arstechnica.com Open in urlscan Pro
18.190.81.75 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
Submission: On March 02 via api (March 2nd 2021, 4:28:09 pm UTC) from US

Summary HTTP 308 Redirects Links 58 Behaviour Indicators

Summary

This website contacted 66 IPs in 8 countries across 44 domains to perform 308 HTTP transactions. The main IP is 18.190.81.75, located in Columbus, United States and belongs to AMAZON-02, US. The main domain is arstechnica.com.
TLS certificate: Issued by Amazon on December 29th 2020. Valid for: a year.

This is the only time arstechnica.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
2	18.190.81.75 18.190.81.75	16509 (AMAZON-02) (AMAZON-02)
19	205.234.175.175 205.234.175.175	23352 (SERVERCEN...) (SERVERCENTRAL)
8	2606:4700::68... 2606:4700::6810:9440	13335 (CLOUDFLAR...) (CLOUDFLARENET)
7 11	142.250.186.66 142.250.186.66	15169 (GOOGLE) (GOOGLE)
3	13.224.192.34 13.224.192.34	16509 (AMAZON-02) (AMAZON-02)
8	23.202.53.51 23.202.53.51	16625 (AKAMAI-AS) (AKAMAI-AS)
14	23.202.53.245 23.202.53.245	16625 (AKAMAI-AS) (AKAMAI-AS)
1	65.9.58.74 65.9.58.74	16509 (AMAZON-02) (AMAZON-02)
5	13.32.24.125 13.32.24.125	16509 (AMAZON-02) (AMAZON-02)
2	2606:4700::68... 2606:4700::6813:d983	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	151.139.128.11 151.139.128.11	20446 (HIGHWINDS3) (HIGHWINDS3)
1	2a00:1450:400... 2a00:1450:4001:80f::2008	15169 (GOOGLE) (GOOGLE)
2	2606:4700:10:... 2606:4700:10::6814:b944	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	34.253.148.162 34.253.148.162	16509 (AMAZON-02) (AMAZON-02)
5	23.202.53.159 23.202.53.159	16625 (AKAMAI-AS) (AKAMAI-AS)
2	18.211.112.77 18.211.112.77	14618 (AMAZON-AES) (AMAZON-AES)
1	3.208.40.114 3.208.40.114	14618 (AMAZON-AES) (AMAZON-AES)
1	3.214.160.249 3.214.160.249	14618 (AMAZON-AES) (AMAZON-AES)
3	151.101.192.239 151.101.192.239	54113 (FASTLY) (FASTLY)
3	142.250.186.34 142.250.186.34	15169 (GOOGLE) (GOOGLE)
1	2606:4700::68... 2606:4700::6811:4032	13335 (CLOUDFLAR...) (CLOUDFLARENET)
8	2a00:1450:400... 2a00:1450:4001:80f::200e	15169 (GOOGLE) (GOOGLE)
1	13.225.82.136 13.225.82.136	16509 (AMAZON-02) (AMAZON-02)
1 2	35.190.59.101 35.190.59.101	15169 (GOOGLE) (GOOGLE)
3	35.201.67.47 35.201.67.47	15169 (GOOGLE) (GOOGLE)
2	35.190.91.160 35.190.91.160	15169 (GOOGLE) (GOOGLE)
1	54.194.105.192 54.194.105.192	16509 (AMAZON-02) (AMAZON-02)
1	2a00:1450:400... 2a00:1450:4001:827::200e	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:829::200e	15169 (GOOGLE) (GOOGLE)
2	52.94.243.89 52.94.243.89	16509 (AMAZON-02) (AMAZON-02)
2	54.145.213.132 54.145.213.132	14618 (AMAZON-AES) (AMAZON-AES)
2	54.209.211.127 54.209.211.127	14618 (AMAZON-AES) (AMAZON-AES)
19	3.223.14.133 3.223.14.133	14618 (AMAZON-AES) (AMAZON-AES)
3	2a00:1450:400... 2a00:1450:400c:c0c::9a	15169 (GOOGLE) (GOOGLE)
3	2a00:1450:400... 2a00:1450:4001:813::2004	15169 (GOOGLE) (GOOGLE)
3	2a00:1450:400... 2a00:1450:4001:80f::2003	15169 (GOOGLE) (GOOGLE)
2	34.120.207.148 34.120.207.148	15169 (GOOGLE) (GOOGLE)
5	99.80.71.186 99.80.71.186	16509 (AMAZON-02) (AMAZON-02)
1	34.231.165.20 34.231.165.20	14618 (AMAZON-AES) (AMAZON-AES)
5	69.173.144.141 69.173.144.141	26667 (RUBICONPR...) (RUBICONPROJECT)
3	184.31.84.150 184.31.84.150	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
3	185.33.221.88 185.33.221.88	29990 (ASN-APPNEX) (ASN-APPNEX)
5	18.156.195.47 18.156.195.47	16509 (AMAZON-02) (AMAZON-02)
3 21	34.98.64.218 34.98.64.218	15169 (GOOGLE) (GOOGLE)
8	104.85.4.23 104.85.4.23	16625 (AKAMAI-AS) (AKAMAI-AS)
41	65.9.67.76 65.9.67.76	16509 (AMAZON-02) (AMAZON-02)
1	13.32.24.41 13.32.24.41	16509 (AMAZON-02) (AMAZON-02)
5	2a00:1450:400... 2a00:1450:4001:827::200a	15169 (GOOGLE) (GOOGLE)
8	13.32.23.187 13.32.23.187	16509 (AMAZON-02) (AMAZON-02)
6	104.85.5.185 104.85.5.185	16625 (AKAMAI-AS) (AKAMAI-AS)
1	70.42.32.63 70.42.32.63	22075 (AS-OUTBRAIN) (AS-OUTBRAIN)
1	2600:9000:215... 2600:9000:2156:1e00:4:14f9:7480:93a1	16509 (AMAZON-02) (AMAZON-02)
1	151.101.14.132 151.101.14.132	54113 (FASTLY) (FASTLY)
2	2a00:1450:400... 2a00:1450:4001:813::2006	15169 (GOOGLE) (GOOGLE)
4	2a03:2880:f01... 2a03:2880:f01c:8012:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK)
24	13.32.24.6 13.32.24.6	16509 (AMAZON-02) (AMAZON-02)
1	64.202.112.31 64.202.112.31	23352 (SERVERCEN...) (SERVERCENTRAL)
4	2a00:1450:400... 2a00:1450:4001:802::2002	15169 (GOOGLE) (GOOGLE)
2 4	104.111.238.139 104.111.238.139	16625 (AKAMAI-AS) (AKAMAI-AS)
2	52.207.120.193 52.207.120.193	14618 (AMAZON-AES) (AMAZON-AES)
2	2a03:2880:f11... 2a03:2880:f11c:8183:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
3	151.101.13.108 151.101.13.108	54113 (FASTLY) (FASTLY)
2	184.30.212.16 184.30.212.16	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
3 3	185.29.135.233 185.29.135.233	30419 (MEDIAMATH...) (MEDIAMATH-INC)
3 3	2620:116:800d... 2620:116:800d:21:8c6e:cf2c:8d6:9fb5	16509 (AMAZON-02) (AMAZON-02)
6 6	37.157.6.247 37.157.6.247	198622 (ADFORM) (ADFORM)
1	69.173.144.139 69.173.144.139	26667 (RUBICONPR...) (RUBICONPROJECT)
2	3.230.55.171 3.230.55.171	14618 (AMAZON-AES) (AMAZON-AES)
308	66

2 18.190.81.75 (Columbus, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-18-190-81-75.us-east-2.compute.amazonaws.com

arstechnica.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

19 205.234.175.175 (United States)

ASN23352 (SERVERCENTRAL, US)
PTR: vip1.G-anycast1.cachefly.net

cdn.arstechnica.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 2606:4700::6810:9440 (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.cookielaw.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 142.250.186.66 (United States) 7 redirects

ASN15169 (GOOGLE, US)
PTR: fra24s05-in-f2.1e100.net

www.googletagservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 13.224.192.34 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-224-192-34.fra2.r.cloudfront.net

c.amazon-adsystem.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 23.202.53.51 (Vienna, Austria)

ASN16625 (AKAMAI-AS, US)
PTR: a23-202-53-51.deploy.static.akamaitechnologies.com

js-sec.indexww.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
as-sec.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
ssum-sec.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

14 23.202.53.245 (Vienna, Austria)

ASN16625 (AKAMAI-AS, US)
PTR: a23-202-53-245.deploy.static.akamaitechnologies.com

z.moatads.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
px.moatads.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 65.9.58.74 (United States)

ASN16509 (AMAZON-02, US)

fpa-cdn.arstechnica.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 13.32.24.125 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-32-24-125.fra56.r.cloudfront.net

player.cnevids.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700::6813:d983 (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.mediavoice.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
plugin.mediavoice.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.139.128.11 (United States)

ASN20446 (HIGHWINDS3, US)

s.skimresources.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:80f::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700:10::6814:b944 (United States)

ASN13335 (CLOUDFLARENET, US)

geolocation.onetrust.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.253.148.162 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-34-253-148-162.eu-west-1.compute.amazonaws.com

segment-data.zqtk.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 23.202.53.159 (Vienna, Austria)

ASN16625 (AKAMAI-AS, US)
PTR: a23-202-53-159.deploy.static.akamaitechnologies.com

widgets.outbrain.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
widget-pixels.outbrain.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 18.211.112.77 (United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-18-211-112-77.compute-1.amazonaws.com

api.cnevids.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 3.208.40.114 (United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-208-40-114.compute-1.amazonaws.com

srv-1970-01-01-00.pixel.parsely.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 3.214.160.249 (United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-214-160-249.compute-1.amazonaws.com

fpa-events.arstechnica.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 151.101.192.239 (United States)

ASN54113 (FASTLY, US)

pixel.condenastdigital.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
api.condenast.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 142.250.186.34 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s04-in-f2.1e100.net

securepubads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
pubads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6811:4032 (United States)

ASN13335 (CLOUDFLARENET, US)

polarcdn-terrax.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 2a00:1450:4001:80f::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.225.82.136 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-225-82-136.fra2.r.cloudfront.net

z-na.associates-amazon.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.190.59.101 (Kansas City, United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: 101.59.190.35.bc.googleusercontent.com

r.skimresources.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 35.201.67.47 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 47.67.201.35.bc.googleusercontent.com

t.skimresources.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.190.91.160 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 160.91.190.35.bc.googleusercontent.com

p.skimresources.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.194.105.192 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-54-194-105-192.eu-west-1.compute.amazonaws.com

mb.moatads.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:827::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

ampcid.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:829::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

ampcid.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.94.243.89 (Ashburn, United States)

ASN16509 (AMAZON-02, US)

assoc-na.associates-amazon.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 54.145.213.132 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)

infinityid.condenastdigital.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 54.209.211.127 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-209-211-127.compute-1.amazonaws.com

4d.condenastdigital.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

19 3.223.14.133 (United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-223-14-133.compute-1.amazonaws.com

capture.condenastdigital.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:400c:c0c::9a (Brussels, Belgium)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:813::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:80f::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.120.207.148 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 148.207.120.34.bc.googleusercontent.com

api.rlcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 99.80.71.186 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-99-80-71-186.eu-west-1.compute.amazonaws.com

match.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.231.165.20 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)

mid.rkdms.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 69.173.144.141 (Frankfurt am Main, Germany)

ASN26667 (RUBICONPROJECT, US)

fastlane.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 184.31.84.150 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)
PTR: a184-31-84-150.deploy.static.akamaitechnologies.com

htlb.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 185.33.221.88 (Amsterdam, Netherlands)

ASN29990 (ASN-APPNEX, US)
PTR: 726.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

ib.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 18.156.195.47 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)

c2shb.ssp.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

21 34.98.64.218 (Kansas City, United States) 3 redirects

ASN15169 (GOOGLE, US)
PTR: 218.64.98.34.bc.googleusercontent.com

condenastus-d.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
eu-u.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
us-u.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 104.85.4.23 (Amsterdam, Netherlands)

ASN16625 (AKAMAI-AS, US)
PTR: a104-85-4-23.deploy.static.akamaitechnologies.com

prebid.media.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
contextual.media.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
hblg.media.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

41 65.9.67.76 (United States)

ASN16509 (AMAZON-02, US)

dwgyu36up6iuz.cloudfront.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.32.24.41 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-32-24-41.fra56.r.cloudfront.net

sync.getpublica.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a00:1450:4001:827::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

imasdk.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 13.32.23.187 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-32-23-187.fra56.r.cloudfront.net

d2c8v52ll5s99u.cloudfront.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 104.85.5.185 (Amsterdam, Netherlands)

ASN16625 (AKAMAI-AS, US)
PTR: a104-85-5-185.deploy.static.akamaitechnologies.com

tcheck.outbrainimg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
images.outbrainimg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 70.42.32.63 (United States)

ASN22075 (AS-OUTBRAIN, US)
PTR: ny.outbrain.com

log.outbrainimg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:2156:1e00:4:14f9:7480:93a1 (United States)

ASN16509 (AMAZON-02, US)

pbs.getpublica.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.14.132 (Frankfurt am Main, Germany)

ASN54113 (FASTLY, US)

odb.outbrain.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:813::2006 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

s0.2mdn.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a03:2880:f01c:8012:face:b00c:0:3 (United States)

ASN32934 (FACEBOOK, US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

24 13.32.24.6 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-32-24-6.fra56.r.cloudfront.net

dp8hsntg6do36.cloudfront.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 64.202.112.31 (United States)

ASN23352 (SERVERCENTRAL, US)
PTR: ny.outbrain.com

mcdp-nydc1.outbrain.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:802::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 104.111.238.139 (Frankfurt am Main, Germany) 2 redirects

ASN16625 (AKAMAI-AS, US)
PTR: a104-111-238-139.deploy.static.akamaitechnologies.com

sb.scorecardresearch.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.207.120.193 (United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-207-120-193.compute-1.amazonaws.com

wren.condenastdigital.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f11c:8183:face:b00c:0:25de (United States)

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 151.101.13.108 (Frankfurt am Main, Germany)

ASN54113 (FASTLY, US)

acdn.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 184.30.212.16 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)
PTR: a184-30-212-16.deploy.static.akamaitechnologies.com

eus.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 185.29.135.233 (United Kingdom) 3 redirects

ASN30419 (MEDIAMATH-INC, US)

sync.mathtag.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2620:116:800d:21:8c6e:cf2c:8d6:9fb5 (United States) 3 redirects

ASN16509 (AMAZON-02, US)

pixel.quantserve.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 37.157.6.247 (Denmark) 6 redirects

ASN198622 (ADFORM, DK)

c1.adform.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 69.173.144.139 (Frankfurt am Main, Germany)

ASN26667 (RUBICONPROJECT, US)

token.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 3.230.55.171 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-230-55-171.compute-1.amazonaws.com

usersync.getpublica.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
73	cloudfront.net dwgyu36up6iuz.cloudfront.net d2c8v52ll5s99u.cloudfront.net dp8hsntg6do36.cloudfront.net	24 MB
27	condenastdigital.com pixel.condenastdigital.com infinityid.condenastdigital.com 4d.condenastdigital.com capture.condenastdigital.com wren.condenastdigital.com	23 KB
21	openx.net 3 redirects condenastus-d.openx.net eu-u.openx.net us-u.openx.net	5 KB
19	arstechnica.net cdn.arstechnica.net	818 KB
16	doubleclick.net 7 redirects securepubads.g.doubleclick.net stats.g.doubleclick.net pubads.g.doubleclick.net cm.g.doubleclick.net	105 KB
15	moatads.com z.moatads.com mb.moatads.com px.moatads.com	277 KB
8	media.net prebid.media.net contextual.media.net hblg.media.net	27 KB
8	rubiconproject.com fastlane.rubiconproject.com eus.rubiconproject.com token.rubiconproject.com	18 KB
8	google-analytics.com www.google-analytics.com	20 KB
8	skimresources.com 1 redirects s.skimresources.com r.skimresources.com t.skimresources.com p.skimresources.com	16 KB
8	cookielaw.org cdn.cookielaw.org	167 KB
7	outbrainimg.com tcheck.outbrainimg.com log.outbrainimg.com images.outbrainimg.com	30 KB
7	casalemedia.com htlb.casalemedia.com as-sec.casalemedia.com ssum-sec.casalemedia.com	2 KB
7	outbrain.com widgets.outbrain.com widget-pixels.outbrain.com odb.outbrain.com mcdp-nydc1.outbrain.com	90 KB
7	cnevids.com player.cnevids.com api.cnevids.com	98 KB
6	adform.net 6 redirects c1.adform.net	2 KB
6	adnxs.com ib.adnxs.com acdn.adnxs.com	54 KB
5	googleapis.com imasdk.googleapis.com	629 KB
5	yahoo.com c2shb.ssp.yahoo.com	2 KB
5	adsrvr.org match.adsrvr.org	2 KB
4	scorecardresearch.com 2 redirects sb.scorecardresearch.com	4 KB
4	googlesyndication.com pagead2.googlesyndication.com	26 KB
4	facebook.net connect.facebook.net	186 KB
4	getpublica.com sync.getpublica.com pbs.getpublica.com usersync.getpublica.com	6 KB
4	google.de ampcid.google.de www.google.de	766 B
4	google.com ampcid.google.com www.google.com	837 B
4	indexww.com js-sec.indexww.com	20 KB
4	arstechnica.com arstechnica.com fpa-cdn.arstechnica.com fpa-events.arstechnica.com	33 KB
3	quantserve.com 3 redirects pixel.quantserve.com	1 KB
3	mathtag.com 3 redirects sync.mathtag.com	2 KB
3	associates-amazon.com z-na.associates-amazon.com assoc-na.associates-amazon.com	4 KB
3	amazon-adsystem.com c.amazon-adsystem.com	34 KB
2	facebook.com www.facebook.com	517 B
2	2mdn.net s0.2mdn.net	33 KB
2	rlcdn.com api.rlcdn.com	242 B
2	onetrust.com geolocation.onetrust.com	747 B
2	mediavoice.com cdn.mediavoice.com plugin.mediavoice.com	135 KB
1	rkdms.com mid.rkdms.com	157 B
1	condenast.io api.condenast.io	4 KB
1	polarcdn-terrax.com polarcdn-terrax.com	649 B
1	parsely.com srv-1970-01-01-00.pixel.parsely.com	229 B
1	zqtk.net segment-data.zqtk.net	545 B
1	googletagmanager.com www.googletagmanager.com	106 KB
1	googletagservices.com www.googletagservices.com	19 KB
308	44

	Domain	Requested by
41	dwgyu36up6iuz.cloudfront.net	arstechnica.com d2c8v52ll5s99u.cloudfront.net
24	dp8hsntg6do36.cloudfront.net	arstechnica.com d2c8v52ll5s99u.cloudfront.net
19	capture.condenastdigital.com	arstechnica.com
19	cdn.arstechnica.net	arstechnica.com cdn.arstechnica.net
12	eu-u.openx.net	3 redirects cdn.arstechnica.net eu-u.openx.net
11	px.moatads.com	arstechnica.com
10	cm.g.doubleclick.net	7 redirects eu-u.openx.net
8	d2c8v52ll5s99u.cloudfront.net	player.cnevids.com d2c8v52ll5s99u.cloudfront.net
8	www.google-analytics.com	www.googletagmanager.com www.google-analytics.com arstechnica.com
8	cdn.cookielaw.org	arstechnica.com cdn.cookielaw.org
6	c1.adform.net	6 redirects
6	us-u.openx.net	eu-u.openx.net
5	images.outbrainimg.com	arstechnica.com
5	imasdk.googleapis.com	player.cnevids.com imasdk.googleapis.com
5	c2shb.ssp.yahoo.com	cdn.arstechnica.net
5	fastlane.rubiconproject.com	cdn.arstechnica.net
5	match.adsrvr.org	js-sec.indexww.com cdn.arstechnica.net eu-u.openx.net
5	player.cnevids.com	arstechnica.com player.cnevids.com cdn.arstechnica.net
4	sb.scorecardresearch.com	2 redirects arstechnica.com
4	pagead2.googlesyndication.com	srcdoc imasdk.googleapis.com
4	connect.facebook.net	d2c8v52ll5s99u.cloudfront.net connect.facebook.net
4	widgets.outbrain.com	cdn.arstechnica.net widgets.outbrain.com
4	js-sec.indexww.com	arstechnica.com cdn.arstechnica.net
3	pixel.quantserve.com	3 redirects
3	sync.mathtag.com	3 redirects
3	ssum-sec.casalemedia.com	js-sec.indexww.com
3	acdn.adnxs.com	cdn.arstechnica.net
3	contextual.media.net	cdn.arstechnica.net
3	prebid.media.net	cdn.arstechnica.net
3	condenastus-d.openx.net	cdn.arstechnica.net
3	ib.adnxs.com	cdn.arstechnica.net
3	htlb.casalemedia.com	cdn.arstechnica.net
3	www.google.de	arstechnica.com
3	www.google.com	arstechnica.com
3	stats.g.doubleclick.net	www.google-analytics.com
3	t.skimresources.com	arstechnica.com s.skimresources.com
3	z.moatads.com	arstechnica.com d2c8v52ll5s99u.cloudfront.net
3	c.amazon-adsystem.com	arstechnica.com c.amazon-adsystem.com
2	usersync.getpublica.com	sync.getpublica.com
2	hblg.media.net	contextual.media.net
2	eus.rubiconproject.com	cdn.arstechnica.net eus.rubiconproject.com
2	www.facebook.com	arstechnica.com
2	wren.condenastdigital.com	cdn.arstechnica.net
2	pubads.g.doubleclick.net	d2c8v52ll5s99u.cloudfront.net
2	s0.2mdn.net	imasdk.googleapis.com
2	api.rlcdn.com	js-sec.indexww.com cdn.arstechnica.net
2	4d.condenastdigital.com	pixel.condenastdigital.com
2	infinityid.condenastdigital.com	pixel.condenastdigital.com d2c8v52ll5s99u.cloudfront.net
2	assoc-na.associates-amazon.com	z-na.associates-amazon.com
2	p.skimresources.com	arstechnica.com
2	r.skimresources.com	1 redirects arstechnica.com
2	pixel.condenastdigital.com	arstechnica.com
2	api.cnevids.com	cdn.arstechnica.net
2	geolocation.onetrust.com	cdn.cookielaw.org
2	arstechnica.com	cdn.arstechnica.net
1	token.rubiconproject.com
1	mcdp-nydc1.outbrain.com	widgets.outbrain.com
1	odb.outbrain.com	widgets.outbrain.com
1	pbs.getpublica.com	player.cnevids.com
1	log.outbrainimg.com	widgets.outbrain.com
1	as-sec.casalemedia.com	js-sec.indexww.com
1	widget-pixels.outbrain.com	arstechnica.com
1	tcheck.outbrainimg.com	widgets.outbrain.com
1	sync.getpublica.com	player.cnevids.com
1	mid.rkdms.com	js-sec.indexww.com
1	ampcid.google.de	www.google-analytics.com
1	ampcid.google.com	www.google-analytics.com
1	api.condenast.io	player.cnevids.com
1	mb.moatads.com	z.moatads.com
1	z-na.associates-amazon.com	www.googletagmanager.com
1	polarcdn-terrax.com	cdn.mediavoice.com
1	plugin.mediavoice.com	cdn.mediavoice.com
1	securepubads.g.doubleclick.net	www.googletagservices.com
1	fpa-events.arstechnica.com	arstechnica.com
1	srv-1970-01-01-00.pixel.parsely.com	arstechnica.com
1	segment-data.zqtk.net	cdn.arstechnica.net
1	www.googletagmanager.com	arstechnica.com
1	s.skimresources.com	arstechnica.com
1	cdn.mediavoice.com	arstechnica.com
1	fpa-cdn.arstechnica.com	arstechnica.com
1	www.googletagservices.com	arstechnica.com
308	81

This site contains links to these domains. Also see Links.

Domain
video.arstechnica.com
cdn.arstechnica.net
www.gettyimages.com
www.facebook.com
twitter.com
www.reddit.com
redcanary.com
en.wikipedia.org
www.arstechnica.com
www.twitter.com
www.outbrain.com
chansouri-halist.com
www.clicktraceclick.com
greencardorganization.com
opentech.page
partners.wsj.com
condenast.com
www.condenast.com

Subject Issuer	Validity	Valid
*.arstechnica.com Amazon	`2020-12-29` - `2022-01-27`	a year	crt.sh
*.cachefly.net GlobalSign RSA OV SSL CA 2018	`2020-10-09` - `2021-10-29`	a year	crt.sh
cookielaw.org Cloudflare Inc ECC CA-3	`2020-07-01` - `2021-07-01`	a year	crt.sh
*.g.doubleclick.net GTS CA 1O1	`2021-01-26` - `2021-04-20`	3 months	crt.sh
c.amazon-adsystem.com Amazon	`2020-08-04` - `2021-08-02`	a year	crt.sh
san.casalemedia.com GeoTrust RSA CA 2018	`2020-03-02` - `2021-04-01`	a year	crt.sh
moatads.com DigiCert SHA2 Secure Server CA	`2021-01-21` - `2022-01-25`	a year	crt.sh
fpa-events.arstechnica.com Amazon	`2020-06-24` - `2021-07-24`	a year	crt.sh
*.cnevids.com Amazon	`2020-10-02` - `2021-11-01`	a year	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2020-08-16` - `2021-08-16`	a year	crt.sh
*.skimresources.com DigiCert SHA2 Secure Server CA	`2020-09-10` - `2021-10-12`	a year	crt.sh
*.google-analytics.com GTS CA 1O1	`2021-02-17` - `2021-05-12`	3 months	crt.sh
onetrust.com Cloudflare Inc ECC CA-3	`2021-02-12` - `2022-02-11`	a year	crt.sh
*.zqtk.net Sectigo RSA Domain Validation Secure Server CA	`2020-08-13` - `2021-08-25`	a year	crt.sh
*.outbrain.com DigiCert SHA2 Secure Server CA	`2020-03-09` - `2021-06-08`	a year	crt.sh
cnevideos.com Amazon	`2020-12-30` - `2022-01-28`	a year	crt.sh
*.pixel.parsely.com R3	`2021-01-26` - `2021-04-26`	3 months	crt.sh
condenast.com GlobalSign CloudSSL CA - SHA256 - G3	`2021-03-01` - `2021-04-21`	2 months	crt.sh
z-na.associates-amazon.com Amazon	`2020-06-19` - `2021-07-19`	a year	crt.sh
*.moatads.com DigiCert SHA2 Secure Server CA	`2019-03-12` - `2021-06-10`	2 years	crt.sh
*.google.com GTS CA 1O1	`2021-02-17` - `2021-05-12`	3 months	crt.sh
*.google.de GTS CA 1O1	`2021-01-26` - `2021-04-20`	3 months	crt.sh
assoc-na.associates-amazon.com Amazon	`2020-12-14` - `2021-12-13`	a year	crt.sh
conde.io Amazon	`2020-06-30` - `2021-07-30`	a year	crt.sh
www.google.com GTS CA 1O1	`2021-01-26` - `2021-04-20`	3 months	crt.sh
www.google.de GTS CA 1O1	`2021-02-17` - `2021-05-12`	3 months	crt.sh
*.rlcdn.com Sectigo RSA Domain Validation Secure Server CA	`2020-04-14` - `2021-04-23`	a year	crt.sh
*.adsrvr.org Trustwave Organization Validation SHA256 CA, Level 1	`2019-03-07` - `2021-04-19`	2 years	crt.sh
*.rkdms.com Entrust Certification Authority - L1K	`2020-10-08` - `2021-10-30`	a year	crt.sh
*.rubiconproject.com DigiCert TLS RSA SHA256 2020 CA1	`2020-12-18` - `2022-01-18`	a year	crt.sh
*.adnxs.com DigiCert ECC Secure Server CA	`2019-01-23` - `2021-03-08`	2 years	crt.sh
web.ssp.yahoo.com DigiCert SHA2 High Assurance Server CA	`2021-02-11` - `2021-08-03`	6 months	crt.sh
*.openx.net GeoTrust RSA CA 2018	`2020-06-18` - `2021-08-17`	a year	crt.sh
*.media.net DigiCert SHA2 Secure Server CA	`2020-02-25` - `2021-05-26`	a year	crt.sh
*.cloudfront.net DigiCert Global CA G2	`2020-05-26` - `2021-04-21`	a year	crt.sh
*.getpublica.com Amazon	`2020-07-29` - `2021-08-29`	a year	crt.sh
upload.video.google.com GTS CA 1O1	`2021-02-17` - `2021-05-12`	3 months	crt.sh
*.outbrainimg.com DigiCert Secure Site ECC CA-1	`2020-03-26` - `2021-06-25`	a year	crt.sh
*.doubleclick.net GTS CA 1O1	`2021-01-26` - `2021-04-20`	3 months	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2021-02-10` - `2021-05-10`	3 months	crt.sh
sb.scorecardresearch.com DigiCert Secure Site ECC CA-1	`2020-07-17` - `2021-06-02`	a year	crt.sh
cdn.adnxs.com GlobalSign CloudSSL CA - SHA256 - G3	`2020-10-29` - `2021-04-14`	5 months	crt.sh

This page contains 28 frames:

Primary Page: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
Frame ID: C7B1B30AEEC1813FEA15A0DAF34AD09B
Requests: 194 HTTP requests in this frame

Frame: https://t.skimresources.com/api/v2/robots.txt?__skimjs_preflight__please_ignore__=true&rnd=0.557321160330501
Frame ID: 5D97DB1A92256AFA065A4EB1C06AA2D0
Requests: 1 HTTP requests in this frame

Frame: https://imasdk.googleapis.com/js/sdkloader/ima3.js
Frame ID: 03720C2DAD397F5BEB7CC6972FA595F4
Requests: 48 HTTP requests in this frame

Frame: https://widgets.outbrain.com/nanoWidget/externals/cookie/test.html
Frame ID: 6DD88CC90D3ED011F1F8677D8D9FFBCE
Requests: 2 HTTP requests in this frame

Frame: https://imasdk.googleapis.com/js/sdkloader/ima3.js
Frame ID: DA1BFBF015AE44167C00BE692D91D54A
Requests: 27 HTTP requests in this frame

Frame: https://imasdk.googleapis.com/js/core/bridge3.444.1_en.html
Frame ID: F22F5E183DD4C6498084D8598B9BBED9
Requests: 2 HTTP requests in this frame

Frame: https://widgets.outbrain.com/widgetOBUserSync/obUserSync.html
Frame ID: 42B32B30617823EA65F8D8EB78321B1F
Requests: 1 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/omsdk/releases/live/omweb-v1.js
Frame ID: A065D633921BDA4D45D4A3A629EEBB06
Requests: 1 HTTP requests in this frame

Frame: https://imasdk.googleapis.com/js/core/bridge3.444.1_en.html
Frame ID: 758409F807952A34C1366936285AC26D
Requests: 2 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/omsdk/releases/live/omweb-v1.js
Frame ID: 471BEE0E748B4F67FEED94C50345685D
Requests: 1 HTTP requests in this frame

Frame: https://contextual.media.net/checksync.php?vsSync=1&cs=8&cv=31&https=1&cid=8CU65UN7R&prvid=2033%2C171%2C251%2C273%2C175%2C132%2C178%2C3018%2C159%2C214%2C3015%2C97%2C77%2C99%2C56%2C182%2C184%2C261%2C188%2C222%2C201%2C246%2C4%2C126%2C203%2C225%2C226%2C10000%2C80%2C229%2C9&gdprconsent=0&purpose1=1&usp_status=0&usp_consent=1&itype=PREBID
Frame ID: 760A332851A7EC4BE880609F0B719056
Requests: 2 HTTP requests in this frame

Frame: https://contextual.media.net/checksync.php?vsSync=1&cs=8&cv=31&https=1&cid=8CU65UN7R&prvid=2033%2C171%2C251%2C273%2C175%2C132%2C178%2C3018%2C159%2C214%2C3015%2C97%2C77%2C99%2C56%2C182%2C184%2C261%2C188%2C222%2C201%2C246%2C4%2C126%2C203%2C225%2C226%2C10000%2C80%2C229%2C9&gdprconsent=0&purpose1=1&usp_status=0&usp_consent=1&itype=PREBID
Frame ID: ADF97E42105B34550319AEED6E7BE30B
Requests: 1 HTTP requests in this frame

Frame: https://acdn.adnxs.com/dmp/async_usersync.html
Frame ID: FEA8546B0735322DAF1C36188B406586
Requests: 1 HTTP requests in this frame

Frame: https://eu-u.openx.net/w/1.0/pd?cc=1&plm=6&ph=92a42b2b-081a-4be8-96bc-8a959e4a3060&gdpr=1&us_privacy=1---
Frame ID: 9887768DBD288372DB5A7B16C3479A25
Requests: 7 HTTP requests in this frame

Frame: https://js-sec.indexww.com/um/ixmatch.html
Frame ID: 047DAD4C8C01D1B1740793E587CCCE52
Requests: 1 HTTP requests in this frame

Frame: https://acdn.adnxs.com/dmp/async_usersync.html
Frame ID: 014427B0C997AAB3A3EE52BAE1AE34ED
Requests: 1 HTTP requests in this frame

Frame: https://js-sec.indexww.com/um/ixmatch.html
Frame ID: FA6E672959C079F149FC4DCE51C59162
Requests: 1 HTTP requests in this frame

Frame: https://acdn.adnxs.com/dmp/async_usersync.html
Frame ID: 387564E75B0E93136BC8190C8549B0E8
Requests: 1 HTTP requests in this frame

Frame: https://contextual.media.net/checksync.php?vsSync=1&cs=8&cv=31&https=1&cid=8CU65UN7R&prvid=2033%2C171%2C251%2C273%2C175%2C132%2C178%2C3018%2C159%2C214%2C3015%2C97%2C77%2C99%2C56%2C182%2C184%2C261%2C188%2C222%2C201%2C246%2C4%2C126%2C203%2C225%2C226%2C10000%2C80%2C229%2C9&gdprconsent=0&purpose1=1&usp_status=0&usp_consent=1&itype=PREBID
Frame ID: 9EF226698F9E4CC48AEFB7CB9AF8DF85
Requests: 2 HTTP requests in this frame

Frame: https://eu-u.openx.net/w/1.0/pd?cc=1&plm=6&ph=92a42b2b-081a-4be8-96bc-8a959e4a3060&gdpr=1&us_privacy=1---
Frame ID: 7B43905BBFFC5A835354FAFDDD9AA9FC
Requests: 7 HTTP requests in this frame

Frame: https://js-sec.indexww.com/um/ixmatch.html
Frame ID: CF46FF127D8F44869E3AEEEAD904C38D
Requests: 1 HTTP requests in this frame

Frame: https://eus.rubiconproject.com/usync.html?us_privacy=1---
Frame ID: 9E2128E53CBA17B5A320AD1B01EF710E
Requests: 3 HTTP requests in this frame

Frame: https://eu-u.openx.net/w/1.0/pd?cc=1&plm=6&ph=92a42b2b-081a-4be8-96bc-8a959e4a3060&gdpr=1&us_privacy=1---
Frame ID: 037126FA339074143957CCB91F7D655E
Requests: 7 HTTP requests in this frame

Frame: https://ssum-sec.casalemedia.com/usermatch?gdpr=1&gdpr_consent=CPCcAsZPCcAsZAcABBENBPCgAAAAAAAAAChQAAAAAAJBAGIAAoAHAAeABcAD4ALQAfABJADEAH8ARQAkQBXADNAG0AOIAcgA5wB1AD_AIGAQcAkQBPwChgGEAOqAh8BHoCQgErAJtAWEAugBdQC7QF5AMQAYsAyEBkYDKAGhANGAaUA1MBtADbgG6AOCCQVgAEAALgAoACoAGQAOAAeABAACIAFQAMIAaABqADyAIYAiABMACfAFUAVgAsABcADeAHMAPQAhABDQCIAIkAR0AlgCXAE0AKUAW4AwwBkADLgGoAaoA2QB3gD2AHxAPsA_QCAQEXARgAjQBHACUgFBAKWAU8Aq4BcwC_AGKANYAbQA3ABvAD0AHyAQ2Ah0BF4CRAExAJlATYAnYBQ4CkQFigLQAWwAuQBd4C8wGBAMGAYSAw0Bh4DIgGSAMnAZcAzkBnwDSAGnQNYA1kMASAAWABcAJIAVQAxADSAGqAOIA2QB1AEhAKHAXQAvoBiwDIwGhAN0DQJgAVABWAC4AIYAZAAywBqADZAHYAPwAgABBQCMAFLAKeAVeAtAC0gGsAN4AdUA-QCGwEOgIqAReAkQBNgCdgFIgLkAYEAwkBh4DGAGTgM5AZ4Az4QASAAWABcAGoASQAqgBiAFcANUAcQBIgDcAG8ASEAocBdADFgGhAN0EQIAAVABWAC4AIYAZAAywBqADZAHYAPwAgABGAClgFPAKuAawA6oB8gENgIdAReAkQBNgCdgFIgLkAYEAwkBh4DJwGcgM-FQHgAKAAqACGAEwALgAjgBlgDUAHYAPwAjABHAClgFXgLQAtIBvAEggJiATYApsBbAC5AF5gMCAYeAyIBnIDPAGfANyFADQAxADVAG0AOIAcgA8ACCgHVAR6AvoBmgDQgGvDIDYAFAAVABDACYAFwARwAywBqADsgH2AfgBGACOAFLAKuAVsA3gCYgE2ALRAWwAvMBgQDDwGRAM5AZ4Az4YANABqAGIAaoA2gBxADkAHgAWIA2QB1QEegLyAaEOAsgACAARAA4ADwALgAfABaADkAH4AQQAugBkADQAH8ARQAkQBOgCzAF8AMsAZoA0gBqgDaAHEAOQAc4A6gB2ADuAIAAQMAgsBBwEIAIiASIAm0BPgE_AKWAVAAtoBeoDAAMCAYQA1gBrwDeAHHAOkAdUA8gB8gEIQIfAiABHoCQoErASuAmIBMoCbQFCgKQAUmApgBUwCqgFbAK5AV2AsoBaQC1AFxQLoAuoBfQDAgGIAMWAZCAygBl4DQoGigaMA0oBpoDUwGvANoAbYA24dBnAAXABQAFQAMgAcABAACIAFQALoAYABjADQANQAeAA-gCGAIgATAAnwBVAFYALAAXAAvgBiADMAG8AOYAegBCACGgEQARIAjoBLAEwAJoAUYApQBYgC3gGEAYYAyABlADRAGoANkAb4A7wB7QD7AP0Af8BFgEYAI5ASkBKgCggFPAKuAWKAtAC0gFzALqAXkAvwBigDaAG4gOmA6gB6AENgIdAREAioBF4CQQEiAJUATYAnYBQ4CmgFWALFAWgAtgBcAC5AF2gLvAXmAwYBhIDDQGHgMSAYwAx4BkgDJwGVAMsAZcAzkBnwDRIGkAaSA0sBpwDWAGxkAF4ACAAfgBBADQAH8ASIAtwBfADLAGqANoAcQA5ABzgDsAHgAQUAnwBSwCxAGAAMIAbIA3gB1QDtgIfAR6AkIBK4CYgE2gKFAUgApMBWwC6AF5AL6AYEAzQBoQDRQGlANTAbYA24hA9AAWABQADIAIgAVAAuABiAEMAJgAVQAuABfADEAGYAN4AegBHACxAGEAMoAagA3wB3wD7APwAf4BGACOAEpAKCAUMAp4BV4C0ALSAXMAvwBigDaAHUAPQAkEBIgCVAE2AKaAWKAtEBbAC4AFyALtAYeAxIBkQDJwGcgM8AZ8A0QBpIDSwHAEgEIAAgAHAAXABCADkAMgAkQBcgC-AGWANQAbQA7gCAAEJAJ8AVAA14BvADqgH2ARUAlYBNoCkwFlALSAX0AxEBiwDQgGlANyJQOQAEAALAAoABkADgAIoAYABiADwAIgATAAqgBcAC-AGIAMwAbQBCACGgEQARIAjgBRgClAFuAMIAZQA1QBsgDvAH4ARgAjgBTwCrwFoAWkAuoBigDcAHUAPkAh0BF4CRAE2ALFAWwAu0BeYDDwGRAMnAZYAzkBngDPgGkANYAcAUAhAACAAuAB8AEIALQAcgA_ACsAGQANoAcgBHACRAE6ALkAXwAywBqADXAG0AOIAc4A6gB3ADwAIAAQcAhIBFQCRAE2gJ8An4BSwCxAF1AMAAYQAxQBrwDeAHVAO2AeQA-QB_wEegJiATKAm0BSACmAFTAK7AWgAugBeQC-gGBAMWAaEA0QBpQDTYGpAamA14BwRSCWAAuACgAKgAZAA4ACAAEQAKoAYABjADQANQAeQBDAEQAJgATwApABVACwAFwAL4AYgAzABzAEIAIaARABEgCjAFKALEAW4AwgBlADRAGqANkAd8A-wD9AIsARgAjgBKQCggFDAKuAVsAuYBeQDaAG4APQAh0BF4CRAE2AJ2AUOApoBWwCxQFsALgAXIAu0BeYDDQGHgMYAZEAyQBk4DLgGcgM8AZ9A0gDSYGsAayA2MAA.YAAAAAAAAAAA&d=https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/&s=184674&cb=https%3A%2F%2Fjs-sec.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Frame ID: 951D7E933CA0D048699971FAD97A4B58
Requests: 1 HTTP requests in this frame

Frame: https://ssum-sec.casalemedia.com/usermatch?gdpr=1&gdpr_consent=CPCcAsZPCcAsZAcABBENBPCgAAAAAAAAAChQAAAAAAJBAGIAAoAHAAeABcAD4ALQAfABJADEAH8ARQAkQBXADNAG0AOIAcgA5wB1AD_AIGAQcAkQBPwChgGEAOqAh8BHoCQgErAJtAWEAugBdQC7QF5AMQAYsAyEBkYDKAGhANGAaUA1MBtADbgG6AOCCQVgAEAALgAoACoAGQAOAAeABAACIAFQAMIAaABqADyAIYAiABMACfAFUAVgAsABcADeAHMAPQAhABDQCIAIkAR0AlgCXAE0AKUAW4AwwBkADLgGoAaoA2QB3gD2AHxAPsA_QCAQEXARgAjQBHACUgFBAKWAU8Aq4BcwC_AGKANYAbQA3ABvAD0AHyAQ2Ah0BF4CRAExAJlATYAnYBQ4CkQFigLQAWwAuQBd4C8wGBAMGAYSAw0Bh4DIgGSAMnAZcAzkBnwDSAGnQNYA1kMASAAWABcAJIAVQAxADSAGqAOIA2QB1AEhAKHAXQAvoBiwDIwGhAN0DQJgAVABWAC4AIYAZAAywBqADZAHYAPwAgABBQCMAFLAKeAVeAtAC0gGsAN4AdUA-QCGwEOgIqAReAkQBNgCdgFIgLkAYEAwkBh4DGAGTgM5AZ4Az4QASAAWABcAGoASQAqgBiAFcANUAcQBIgDcAG8ASEAocBdADFgGhAN0EQIAAVABWAC4AIYAZAAywBqADZAHYAPwAgABGAClgFPAKuAawA6oB8gENgIdAReAkQBNgCdgFIgLkAYEAwkBh4DJwGcgM-FQHgAKAAqACGAEwALgAjgBlgDUAHYAPwAjABHAClgFXgLQAtIBvAEggJiATYApsBbAC5AF5gMCAYeAyIBnIDPAGfANyFADQAxADVAG0AOIAcgA8ACCgHVAR6AvoBmgDQgGvDIDYAFAAVABDACYAFwARwAywBqADsgH2AfgBGACOAFLAKuAVsA3gCYgE2ALRAWwAvMBgQDDwGRAM5AZ4Az4YANABqAGIAaoA2gBxADkAHgAWIA2QB1QEegLyAaEOAsgACAARAA4ADwALgAfABaADkAH4AQQAugBkADQAH8ARQAkQBOgCzAF8AMsAZoA0gBqgDaAHEAOQAc4A6gB2ADuAIAAQMAgsBBwEIAIiASIAm0BPgE_AKWAVAAtoBeoDAAMCAYQA1gBrwDeAHHAOkAdUA8gB8gEIQIfAiABHoCQoErASuAmIBMoCbQFCgKQAUmApgBUwCqgFbAK5AV2AsoBaQC1AFxQLoAuoBfQDAgGIAMWAZCAygBl4DQoGigaMA0oBpoDUwGvANoAbYA24dBnAAXABQAFQAMgAcABAACIAFQALoAYABjADQANQAeAA-gCGAIgATAAnwBVAFYALAAXAAvgBiADMAG8AOYAegBCACGgEQARIAjoBLAEwAJoAUYApQBYgC3gGEAYYAyABlADRAGoANkAb4A7wB7QD7AP0Af8BFgEYAI5ASkBKgCggFPAKuAWKAtAC0gFzALqAXkAvwBigDaAG4gOmA6gB6AENgIdAREAioBF4CQQEiAJUATYAnYBQ4CmgFWALFAWgAtgBcAC5AF2gLvAXmAwYBhIDDQGHgMSAYwAx4BkgDJwGVAMsAZcAzkBnwDRIGkAaSA0sBpwDWAGxkAF4ACAAfgBBADQAH8ASIAtwBfADLAGqANoAcQA5ABzgDsAHgAQUAnwBSwCxAGAAMIAbIA3gB1QDtgIfAR6AkIBK4CYgE2gKFAUgApMBWwC6AF5AL6AYEAzQBoQDRQGlANTAbYA24hA9AAWABQADIAIgAVAAuABiAEMAJgAVQAuABfADEAGYAN4AegBHACxAGEAMoAagA3wB3wD7APwAf4BGACOAEpAKCAUMAp4BV4C0ALSAXMAvwBigDaAHUAPQAkEBIgCVAE2AKaAWKAtEBbAC4AFyALtAYeAxIBkQDJwGcgM8AZ8A0QBpIDSwHAEgEIAAgAHAAXABCADkAMgAkQBcgC-AGWANQAbQA7gCAAEJAJ8AVAA14BvADqgH2ARUAlYBNoCkwFlALSAX0AxEBiwDQgGlANyJQOQAEAALAAoABkADgAIoAYABiADwAIgATAAqgBcAC-AGIAMwAbQBCACGgEQARIAjgBRgClAFuAMIAZQA1QBsgDvAH4ARgAjgBTwCrwFoAWkAuoBigDcAHUAPkAh0BF4CRAE2ALFAWwAu0BeYDDwGRAMnAZYAzkBngDPgGkANYAcAUAhAACAAuAB8AEIALQAcgA_ACsAGQANoAcgBHACRAE6ALkAXwAywBqADXAG0AOIAc4A6gB3ADwAIAAQcAhIBFQCRAE2gJ8An4BSwCxAF1AMAAYQAxQBrwDeAHVAO2AeQA-QB_wEegJiATKAm0BSACmAFTAK7AWgAugBeQC-gGBAMWAaEA0QBpQDTYGpAamA14BwRSCWAAuACgAKgAZAA4ACAAEQAKoAYABjADQANQAeQBDAEQAJgATwApABVACwAFwAL4AYgAzABzAEIAIaARABEgCjAFKALEAW4AwgBlADRAGqANkAd8A-wD9AIsARgAjgBKQCggFDAKuAVsAuYBeQDaAG4APQAh0BF4CRAE2AJ2AUOApoBWwCxQFsALgAXIAu0BeYDDQGHgMYAZEAyQBk4DLgGcgM8AZ9A0gDSYGsAayA2MAA.YAAAAAAAAAAA&d=https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/&s=184674&cb=https%3A%2F%2Fjs-sec.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Frame ID: DFFA57C7A3BBA5D9C7DC7E8FDD816CA5
Requests: 1 HTTP requests in this frame

Frame: https://ssum-sec.casalemedia.com/usermatch?gdpr=1&gdpr_consent=CPCcAsZPCcAsZAcABBENBPCgAAAAAAAAAChQAAAAAAJBAGIAAoAHAAeABcAD4ALQAfABJADEAH8ARQAkQBXADNAG0AOIAcgA5wB1AD_AIGAQcAkQBPwChgGEAOqAh8BHoCQgErAJtAWEAugBdQC7QF5AMQAYsAyEBkYDKAGhANGAaUA1MBtADbgG6AOCCQVgAEAALgAoACoAGQAOAAeABAACIAFQAMIAaABqADyAIYAiABMACfAFUAVgAsABcADeAHMAPQAhABDQCIAIkAR0AlgCXAE0AKUAW4AwwBkADLgGoAaoA2QB3gD2AHxAPsA_QCAQEXARgAjQBHACUgFBAKWAU8Aq4BcwC_AGKANYAbQA3ABvAD0AHyAQ2Ah0BF4CRAExAJlATYAnYBQ4CkQFigLQAWwAuQBd4C8wGBAMGAYSAw0Bh4DIgGSAMnAZcAzkBnwDSAGnQNYA1kMASAAWABcAJIAVQAxADSAGqAOIA2QB1AEhAKHAXQAvoBiwDIwGhAN0DQJgAVABWAC4AIYAZAAywBqADZAHYAPwAgABBQCMAFLAKeAVeAtAC0gGsAN4AdUA-QCGwEOgIqAReAkQBNgCdgFIgLkAYEAwkBh4DGAGTgM5AZ4Az4QASAAWABcAGoASQAqgBiAFcANUAcQBIgDcAG8ASEAocBdADFgGhAN0EQIAAVABWAC4AIYAZAAywBqADZAHYAPwAgABGAClgFPAKuAawA6oB8gENgIdAReAkQBNgCdgFIgLkAYEAwkBh4DJwGcgM-FQHgAKAAqACGAEwALgAjgBlgDUAHYAPwAjABHAClgFXgLQAtIBvAEggJiATYApsBbAC5AF5gMCAYeAyIBnIDPAGfANyFADQAxADVAG0AOIAcgA8ACCgHVAR6AvoBmgDQgGvDIDYAFAAVABDACYAFwARwAywBqADsgH2AfgBGACOAFLAKuAVsA3gCYgE2ALRAWwAvMBgQDDwGRAM5AZ4Az4YANABqAGIAaoA2gBxADkAHgAWIA2QB1QEegLyAaEOAsgACAARAA4ADwALgAfABaADkAH4AQQAugBkADQAH8ARQAkQBOgCzAF8AMsAZoA0gBqgDaAHEAOQAc4A6gB2ADuAIAAQMAgsBBwEIAIiASIAm0BPgE_AKWAVAAtoBeoDAAMCAYQA1gBrwDeAHHAOkAdUA8gB8gEIQIfAiABHoCQoErASuAmIBMoCbQFCgKQAUmApgBUwCqgFbAK5AV2AsoBaQC1AFxQLoAuoBfQDAgGIAMWAZCAygBl4DQoGigaMA0oBpoDUwGvANoAbYA24dBnAAXABQAFQAMgAcABAACIAFQALoAYABjADQANQAeAA-gCGAIgATAAnwBVAFYALAAXAAvgBiADMAG8AOYAegBCACGgEQARIAjoBLAEwAJoAUYApQBYgC3gGEAYYAyABlADRAGoANkAb4A7wB7QD7AP0Af8BFgEYAI5ASkBKgCggFPAKuAWKAtAC0gFzALqAXkAvwBigDaAG4gOmA6gB6AENgIdAREAioBF4CQQEiAJUATYAnYBQ4CmgFWALFAWgAtgBcAC5AF2gLvAXmAwYBhIDDQGHgMSAYwAx4BkgDJwGVAMsAZcAzkBnwDRIGkAaSA0sBpwDWAGxkAF4ACAAfgBBADQAH8ASIAtwBfADLAGqANoAcQA5ABzgDsAHgAQUAnwBSwCxAGAAMIAbIA3gB1QDtgIfAR6AkIBK4CYgE2gKFAUgApMBWwC6AF5AL6AYEAzQBoQDRQGlANTAbYA24hA9AAWABQADIAIgAVAAuABiAEMAJgAVQAuABfADEAGYAN4AegBHACxAGEAMoAagA3wB3wD7APwAf4BGACOAEpAKCAUMAp4BV4C0ALSAXMAvwBigDaAHUAPQAkEBIgCVAE2AKaAWKAtEBbAC4AFyALtAYeAxIBkQDJwGcgM8AZ8A0QBpIDSwHAEgEIAAgAHAAXABCADkAMgAkQBcgC-AGWANQAbQA7gCAAEJAJ8AVAA14BvADqgH2ARUAlYBNoCkwFlALSAX0AxEBiwDQgGlANyJQOQAEAALAAoABkADgAIoAYABiADwAIgATAAqgBcAC-AGIAMwAbQBCACGgEQARIAjgBRgClAFuAMIAZQA1QBsgDvAH4ARgAjgBTwCrwFoAWkAuoBigDcAHUAPkAh0BF4CRAE2ALFAWwAu0BeYDDwGRAMnAZYAzkBngDPgGkANYAcAUAhAACAAuAB8AEIALQAcgA_ACsAGQANoAcgBHACRAE6ALkAXwAywBqADXAG0AOIAc4A6gB3ADwAIAAQcAhIBFQCRAE2gJ8An4BSwCxAF1AMAAYQAxQBrwDeAHVAO2AeQA-QB_wEegJiATKAm0BSACmAFTAK7AWgAugBeQC-gGBAMWAaEA0QBpQDTYGpAamA14BwRSCWAAuACgAKgAZAA4ACAAEQAKoAYABjADQANQAeQBDAEQAJgATwApABVACwAFwAL4AYgAzABzAEIAIaARABEgCjAFKALEAW4AwgBlADRAGqANkAd8A-wD9AIsARgAjgBKQCggFDAKuAVsAuYBeQDaAG4APQAh0BF4CRAE2AJ2AUOApoBWwCxQFsALgAXIAu0BeYDDQGHgMYAZEAyQBk4DLgGcgM8AZ9A0gDSYGsAayA2MAA.YAAAAAAAAAAA&d=https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/&s=184674&cb=https%3A%2F%2Fjs-sec.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Frame ID: D4A795D0FCA2881C6447EFDA9D603E3C
Requests: 1 HTTP requests in this frame

Frame: https://usersync.getpublica.com/usersync?gpdr=0&consent=&us_privacy=
Frame ID: 2FFCEBA0414A811D45252722D05192A0
Requests: 1 HTTP requests in this frame

Frame: https://usersync.getpublica.com/usersync?gpdr=0&consent=&us_privacy=
Frame ID: 63B5641DAB38DB36BD8044F8789A61E5
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

headers link /rel="https:\/\/api\.w\.org\/"/i

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

headers link /rel="https:\/\/api\.w\.org\/"/i

MySQL (Databases) Expand

Overall confidence: 100%
Detected patterns

headers link /rel="https:\/\/api\.w\.org\/"/i

Nginx (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /nginx(?:\/([\d.]+))?/i

Page Statistics

308
Requests

98 %
HTTPS

26 %
IPv6

44
Domains

81
Subdomains

66
IPs

8
Countries

27611 kB
Transfer

35754 kB
Size

0
Cookies

58 Outgoing links

These are links going to different origins than the main page.

URL: http://video.arstechnica.com/
Title: Videos

Search URL Search Domain Scan URL

URL: https://cdn.arstechnica.net/wp-content/uploads/2021/02/mac.jpg
Title: Enlarge

Search URL Search Domain Scan URL

URL: https://www.gettyimages.com/
Title: Jayson Photography / Getty Images

Search URL Search Domain Scan URL

URL: https://www.facebook.com/sharer.php?u=https%3A%2F%2Farstechnica.com%2F%3Fpost_type%3Dpost%26p%3D1744063
Title: Share on Facebook

Search URL Search Domain Scan URL

URL: https://twitter.com/share?text=New+malware+found+on+30%2C000+Macs+has+security+pros+stumped&url=https%3A%2F%2Farstechnica.com%2F%3Fpost_type%3Dpost%26p%3D1744063
Title: Share on Twitter

Search URL Search Domain Scan URL

URL: https://www.reddit.com/submit?url=https%3A%2F%2Farstechnica.com%2F%3Fpost_type%3Dpost%26p%3D1744063&title=New+malware+found+on+30%2C000+Macs+has+security+pros+stumped
Title: Share on Reddit

Search URL Search Domain Scan URL

URL: https://redcanary.com/blog/clipping-silver-sparrows-wings/
Title: blog post

Search URL Search Domain Scan URL

URL: https://en.wikipedia.org/wiki/Mach-O
Title: mach-object

Search URL Search Domain Scan URL

URL: https://cdn.arstechnica.net/wp-content/uploads/2021/02/silver-sparrow-overview.jpg

Search URL Search Domain Scan URL

URL: https://www.arstechnica.com/video/watch/how-the-internet-could-change-under-trump
Title: How the Internet could change under Trump

Search URL Search Domain Scan URL

URL: https://www.twitter.com/dangoodin001
Title: @dangoodin001

Search URL Search Domain Scan URL

URL: https://www.arstechnica.com/video/watch/personal-history-steve-from-gamers-nexus-reacts-to-their-top-1000-comments-on-youtube
Title: Steve Burke of GamersNexus Reacts To Their Top 1000 Comments On YouTube

Search URL Search Domain Scan URL

URL: https://www.arstechnica.com/video/watch/modern-vintage-gamer-reacts-to-his-top-1000-comments-on-youtube
Title: Modern Vintage Gamer Reacts To His Top 1000 Comments On YouTube

Search URL Search Domain Scan URL

URL: https://www.arstechnica.com/video/watch/war-stories-how-the-nes-conquered-a-skeptical-america-in-1985
Title: How The NES Conquered A Skeptical America In 1985

Search URL Search Domain Scan URL

URL: https://www.arstechnica.com/video/watch/scott-manley-reacts-to-his-top-1000-youtube-comments
Title: Scott Manley Reacts To His Top 1000 YouTube Comments

Search URL Search Domain Scan URL

URL: https://www.arstechnica.com/video/watch/how-immersive-stories-deepen-the-horror-of-games-like-soma-and-amnesiac-rebirth
Title: How Horror Works in Amnesia: Rebirth, Soma and Amnesia: The Dark Descent

Search URL Search Domain Scan URL

URL: https://www.arstechnica.com/video/watch/lgrs-clint-basinger-reacts-to-his-top-1000-youtube-comments
Title: LGR's Clint Basinger Reacts To His Top 1000 YouTube Comments

Search URL Search Domain Scan URL

URL: https://www.arstechnica.com/video/watch/the-f-35-s-next-tech-upgrade
Title: The F-35's next tech upgrade

Search URL Search Domain Scan URL

URL: https://www.arstechnica.com/video/watch/war-stories-how-one-gameplay-decision-changed-diablo-forever
Title: How One Gameplay Decision Changed Diablo Forever

Search URL Search Domain Scan URL

URL: https://www.arstechnica.com/video/watch/unsolved-mysteries-unsolved-mysteries-mortal-kombat
Title: Unsolved Mortal Kombat Mysteries With Dominic Cianciolo From NetherRealm Studios

Search URL Search Domain Scan URL

URL: https://www.arstechnica.com/video/watch/us-navy-gets-an-italian-accent
Title: US Navy Gets an Italian Accent

Search URL Search Domain Scan URL

URL: https://www.arstechnica.com/video/watch/war-stories-how-amazons-undone-brought-dreams-to-life-through-rotoscope-and-oil-paints
Title: How Amazon’s “Undone” Animates Dreams With Rotoscoping And Oil Paints

Search URL Search Domain Scan URL

URL: https://www.arstechnica.com/video/watch/fighter-pilot-breaks-down-every-button-in-an-f-15-cockpit
Title: Fighter Pilot Breaks Down Every Button in an F-15 Cockpit

Search URL Search Domain Scan URL

URL: https://www.arstechnica.com/video/watch/war-stories-how-nba-jam-became-a-billion-dollar-slam-dunk
Title: How NBA JAM Became A Billion-Dollar Slam Dunk

Search URL Search Domain Scan URL

URL: https://www.arstechnica.com/video/watch/linus-tech-tips-reacts-to-his-top-1000-youtube-comments
Title: Linus "Tech Tips" Sebastian Reacts to His Top 1000 YouTube Comments

Search URL Search Domain Scan URL

URL: https://www.arstechnica.com/video/watch/war-stories-how-alan-wake-was-rebuilt-3-years-into-development
Title: How Alan Wake Was Rebuilt 3 Years Into Development

Search URL Search Domain Scan URL

URL: https://www.arstechnica.com/video/watch/war-stories-how-prince-of-persia-defeated-apple-ii-s-memory-limitations
Title: How Prince of Persia Defeated Apple II's Memory Limitations

Search URL Search Domain Scan URL

URL: https://www.arstechnica.com/video/watch/war-stories-how-crash-bandicoot-hacked-the-playstation-to-run
Title: How Crash Bandicoot Hacked The Original Playstation

Search URL Search Domain Scan URL

URL: https://www.arstechnica.com/video/watch/war-stories-myst
Title: Myst: The challenges of CD-ROM | War Stories

Search URL Search Domain Scan URL

URL: https://www.arstechnica.com/video/watch/markiplier-reacts-to-his-top-1000-youtube-comments
Title: Markiplier Reacts To His Top 1000 YouTube Comments

Search URL Search Domain Scan URL

URL: https://www.arstechnica.com/video/watch/war-stories-the-evolution-of-oddworld-and-what-comes-next
Title: How Mind Control Saved Oddworld: Abe's Oddysee

Search URL Search Domain Scan URL

URL: https://www.arstechnica.com/video/watch/unsolved-mysteries-bioware-answers-unsolved-mysteries-of-the-mass-effect-universe
Title: Bioware answers unsolved mysteries of the Mass Effect universe

Search URL Search Domain Scan URL

URL: https://www.arstechnica.com/video/watch/war-stories-civilization
Title: Civilization: It's good to take turns | War Stories

Search URL Search Domain Scan URL

URL: https://www.arstechnica.com/video/watch/sitrep-dod-resets-ballistic-missile-interceptor-program
Title: SITREP: DOD Resets Ballistic Missile Interceptor program

Search URL Search Domain Scan URL

URL: https://www.arstechnica.com/video/watch/warframe-s-rebecca-ford-reviews-your-characters
Title: Warframe's Rebecca Ford reviews your characters

Search URL Search Domain Scan URL

URL: https://www.arstechnica.com/video/watch/war-stories-subnautica
Title: Subnautica: A world without guns | War Stories

Search URL Search Domain Scan URL

URL: https://www.arstechnica.com/video/watch/war-stories-slay-the-spire-war-stories
Title: How Slay the Spire’s Original Interface Almost Killed the Game | War Stories

Search URL Search Domain Scan URL

URL: https://www.arstechnica.com/video/watch/war-stories-amnesia-the-dark-descent-the-horror-facade
Title: Amnesia: The Dark Descent - The horror facade | War Stories

Search URL Search Domain Scan URL

URL: https://www.arstechnica.com/video/watch/war-stories-c-and-c-tiberian-sun
Title: Command & Conquer: Tiberian Sun | War Stories

Search URL Search Domain Scan URL

URL: https://www.arstechnica.com/video/watch/war-stories-blade-runner-skinjobs-voxels-and-future-noir
Title: Blade Runner: Skinjobs, voxels, and future noir | War Stories

Search URL Search Domain Scan URL

URL: https://www.arstechnica.com/video/watch/war-stories-dead-space-the-drag-tentacle
Title: Dead Space: The Drag Tentacle | War Stories

Search URL Search Domain Scan URL

URL: https://www.arstechnica.com/video/watch/teach-the-controversy-flat-earthers
Title: Teach the Controversy: Flat Earthers

Search URL Search Domain Scan URL

URL: https://www.arstechnica.com/video/watch/delta-v-the-burgeoning-world-of-small-rockets-paul-allen-s-huge-plane-and-spacex-gets-a-crucial-green-light
Title: Delta V: The Burgeoning World of Small Rockets, Paul Allen's Huge Plane, and SpaceX Gets a Crucial Green-light

Search URL Search Domain Scan URL

URL: https://www.arstechnica.com/video/watch/chris-hadfield-explains-his-space-oddity-video
Title: Chris Hadfield explains his 'Space Oddity' video

Search URL Search Domain Scan URL

URL: https://www.arstechnica.com/video/watch/apollo-the-greatest-leap-episode-1-risk
Title: The Greatest Leap, Episode 1: Risk

Search URL Search Domain Scan URL

URL: https://www.arstechnica.com/video/watch/war-stories-ultima-online-the-virtual-ecology
Title: Ultima Online: The Virtual Ecology | War Stories

Search URL Search Domain Scan URL

URL: https://video.arstechnica.com/
Title: More videos

Search URL Search Domain Scan URL

URL: http://www.outbrain.com/what-is/default/en
Title: Powered by

Search URL Search Domain Scan URL

URL: https://chansouri-halist.com/c8d09a76-8de2-4ec1-9223-d001738e098b?ad=00aa718d6bcfc0dfe93a5260296aea96a0&ad_title=The+Japanese+Way+To+Free+Your+Body+from+Toxins&publisher_id=$publisher_id$&publisher_name=$publisher_name$&section_id=$section_id$&section_name=$section_name$&pub=$source_id$&oci=$ob_click_id$
Title: The Japanese Way To Free Your Body from ToxinsNuubu

Search URL Search Domain Scan URL

URL: https://www.clicktraceclick.com/384fba9c-30c4-4340-b643-28cce2fb4493?sectionid=$section_id$&sectionname=$section_name$&publisherid=$publisher_id$&publishername=$publisher_name$&adtitle=Mac+Antivirus+%282019%29+-+Top+10+Most+Trusted+Antivirus+For+Mac+Users&OutbrainClickId=$ob_click_id$
Title: Mac Antivirus (2019) - Top 10 Most Trusted Antivirus For Mac UsersMy Antivirus Review

Search URL Search Domain Scan URL

URL: https://greencardorganization.com/landing/check-eligibility?utm_source=outbrain&utm_medium=discovery&utm_campaign=bundel_easteur_V10_desk_eng&utm_lp_name=V10-eng&utm_image=0&utm_item_id=0&utm_manager=roy&utm_device=0&utm_publisher=$publisher_name$&utm_section=$section_name$&utm_campaign_id=00d1c116e1e1788b58bae6b705e3883fff&utm_ad_id=0049acfe6941387b49c207779a39dc7fa2&utm_doc_id=00f4c8e90ed4b07cb23d814a6615970985&utm_text=Check+if+you+are+eligible+for+a+U.S+Green+Card.&utm_clkid=$ob_click_id$
Title: Check if you are eligible for a U.S Green Card.U.S Green Card - Free Check

Search URL Search Domain Scan URL

URL: https://opentech.page/view/Er3i2Vspof0O5SBhSalSAAlsHzfgEl3jrhSalSq3dwFubHaKGO4?c=36469&pid=5261&tid=$ob_click_id$&ob_marketer=Quim_Web&ob_publisher_id=$publisher_id$&ob_section_id=$section_id$&ob_ad_id=00b58dcefc859fde88449d832797be8cd0&ob_timestamp=$time_stamp$&ob_platform=WEB&ob_campaign_id=00fcfccd9795af4d7e7748df1315ca1006&ob_doc_title=Indonesian+Diabetes+Reliever&site=BSWeb.Multi.CPC.2_$publisher_name$_$section_name$_00b58dcefc859fde88449d832797be8cd0&mavcid=MANAGERCAMPAIGNID&ob_marketer_id=003b048a3b133562bfffc107c7084cffc0
Title: Start Eating This Everyday To Reduce Blood Sugar (Watch)healths.bar

Search URL Search Domain Scan URL

URL: https://partners.wsj.com/ntt/building-the-future/how-digital-tools-are-improving-global-health/?utm_source=outbrain&utm_medium=syndication&utm_campaign=NTT_111715_Article3_UKAUSGEU_DT&utm_term=$publisher_name$_$section_name$&utm_content=Article3
Title: From dementia to heart disease—how tech is improving healthcareWSJ Custom Studios

Search URL Search Domain Scan URL

URL: http://condenast.com/

Search URL Search Domain Scan URL

URL: https://www.condenast.com/user-agreement/
Title: User Agreement

Search URL Search Domain Scan URL

URL: https://www.condenast.com/privacy-policy/
Title: Privacy Policy and Cookie Statement

Search URL Search Domain Scan URL

URL: https://www.condenast.com/privacy-policy/#california
Title: Your California Privacy Rights

Search URL Search Domain Scan URL

URL: https://www.condenast.com/online-behavioral-advertising-oba-and-how-to-opt-out-of-oba/#clickheretoreadmoreaboutonlinebehavioraladvertising(oba)
Title: Ad Choices

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 56

https://r.skimresources.com/api/ HTTP 307
https://r.skimresources.com/api/?xguid=01EZSW8NA1NDWXEYYZ4ZDCTVWK&persistence=1&checksum=f0ed2b0e08e3c2fb44b30aa39362992ad7c919ff97a03c8a39df4cc7b769262f

Request Chain 218

https://sb.scorecardresearch.com/p?c1=2&c2=6035094&ns_type=hidden&ns_st_sv=4.1505.18&ns_st_it=r&ns_st_id=1614702468331_1&ns_st_ec=1&ns_st_sp=1&ns_st_sq=1&ns_st_cn=1&ns_st_ev=play&ns_st_po=0&ns_st_cl=86000&ns_st_pb=1&ns_st_mp=streamsense&ns_st_mv=4.1505.18&ns_st_pn=1&ns_st_tp=0&ns_st_ci=5952801dfd2e616da6000006&ns_ts=1614702468331&ns_st_bt=0&ns_st_bp=0&ns_st_br=0&ns_st_ub=0&ns_st_pr=*null&ns_st_ep=*null&ns_st_ct=vc&ns_st_ge=*null&ns_st_st=*null&ns_st_pu=*null&c3=ARSTECHNICA&c4=*null&c6=*null&c7=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2021%2F02%2Fnew-malware-found-on-30000-macs-has-security-pros-stumped%2F&c8=How%20the%20Internet%20could%20change%20under%20Trump&c9=&ns_st_sn=*null&ns_st_en=*null&ns_st_ti=*null&ns_st_ia=*null&ns_st_ce=*null&ns_st_ddt=*null&ns_st_tdt=*null HTTP 302
https://sb.scorecardresearch.com/p2?c1=2&c2=6035094&ns_type=hidden&ns_st_sv=4.1505.18&ns_st_it=r&ns_st_id=1614702468331_1&ns_st_ec=1&ns_st_sp=1&ns_st_sq=1&ns_st_cn=1&ns_st_ev=play&ns_st_po=0&ns_st_cl=86000&ns_st_pb=1&ns_st_mp=streamsense&ns_st_mv=4.1505.18&ns_st_pn=1&ns_st_tp=0&ns_st_ci=5952801dfd2e616da6000006&ns_ts=1614702468331&ns_st_bt=0&ns_st_bp=0&ns_st_br=0&ns_st_ub=0&ns_st_pr=*null&ns_st_ep=*null&ns_st_ct=vc&ns_st_ge=*null&ns_st_st=*null&ns_st_pu=*null&c3=ARSTECHNICA&c4=*null&c6=*null&c7=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2021%2F02%2Fnew-malware-found-on-30000-macs-has-security-pros-stumped%2F&c8=How%20the%20Internet%20could%20change%20under%20Trump&c9=&ns_st_sn=*null&ns_st_en=*null&ns_st_ti=*null&ns_st_ia=*null&ns_st_ce=*null&ns_st_ddt=*null&ns_st_tdt=*null&cs_ak_ss=1

Request Chain 256

https://eu-u.openx.net/w/1.0/pd?plm=6&ph=92a42b2b-081a-4be8-96bc-8a959e4a3060&gdpr=1&us_privacy=1--- HTTP 302
https://eu-u.openx.net/w/1.0/pd?cc=1&plm=6&ph=92a42b2b-081a-4be8-96bc-8a959e4a3060&gdpr=1&us_privacy=1---

Request Chain 262

https://eu-u.openx.net/w/1.0/pd?plm=6&ph=92a42b2b-081a-4be8-96bc-8a959e4a3060&gdpr=1&us_privacy=1--- HTTP 302
https://eu-u.openx.net/w/1.0/pd?cc=1&plm=6&ph=92a42b2b-081a-4be8-96bc-8a959e4a3060&gdpr=1&us_privacy=1---

Request Chain 265

https://eu-u.openx.net/w/1.0/pd?plm=6&ph=92a42b2b-081a-4be8-96bc-8a959e4a3060&gdpr=1&us_privacy=1--- HTTP 302
https://eu-u.openx.net/w/1.0/pd?cc=1&plm=6&ph=92a42b2b-081a-4be8-96bc-8a959e4a3060&gdpr=1&us_privacy=1---

Request Chain 270

https://sync.mathtag.com/sync/img?mt_exid=5&redir=https%3A%2F%2Feu-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D536872786%26val%3D%5BMM_UUID%5D HTTP 302
https://eu-u.openx.net/w/1.0/sd?id=536872786&val=7746603e-6786-4e00-8003-7c775eea7ed0

Request Chain 271

https://pixel.quantserve.com/pixel/p-25CIknq_eSg16.gif?idmatch=0&gdpr=1 HTTP 302
https://us-u.openx.net/w/1.0/sd?id=537072956&gdpr=1&val=a7seR2u8FRRwskwWPLgAFD67SRpwuhpAPO66lUKU

Request Chain 272

https://c1.adform.net/serving/cookie/match?party=22 HTTP 302
https://c1.adform.net/serving/cookie/match?CC=1&party=22 HTTP 302
https://eu-u.openx.net/w/1.0/sd?id=537113484&val=2163857443821876275

Request Chain 274

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=MTZjY2QxODItNjEwZi02ODA3LTQ4NWEtOGEwMGE1ZTc5NmJm HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=MTZjY2QxODItNjEwZi02ODA3LTQ4NWEtOGEwMGE1ZTc5NmJm&google_tc=

Request Chain 275

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_sc HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm=&google_sc=&google_tc= HTTP 302
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESECEsVouQXy0JEYOoZB6hR8c&google_cver=1

Request Chain 276

https://sync.mathtag.com/sync/img?mt_exid=5&redir=https%3A%2F%2Feu-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D536872786%26val%3D%5BMM_UUID%5D HTTP 302
https://eu-u.openx.net/w/1.0/sd?id=536872786&val=4ad9603e-6786-4200-9c9c-1848abe9bd13

Request Chain 277

https://pixel.quantserve.com/pixel/p-25CIknq_eSg16.gif?idmatch=0&gdpr=1 HTTP 302
https://us-u.openx.net/w/1.0/sd?id=537072956&gdpr=1&val=bDBWOmw3XWl3OQRqb2JIaGo0AT53ZgFnaGLjWZwu

Request Chain 278

https://c1.adform.net/serving/cookie/match?party=22 HTTP 302
https://c1.adform.net/serving/cookie/match?CC=1&party=22 HTTP 302
https://eu-u.openx.net/w/1.0/sd?id=537113484&val=6946948813889572783

Request Chain 280

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=MGU4NTI4ZjUtM2IwYS02YmRjLTdlMDMtYmFiMDc2NGMwNjBh HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=MGU4NTI4ZjUtM2IwYS02YmRjLTdlMDMtYmFiMDc2NGMwNjBh&google_tc=

Request Chain 281

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_sc HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm=&google_sc=&google_tc= HTTP 302
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESECEsVouQXy0JEYOoZB6hR8c&google_cver=1

Request Chain 282

https://sync.mathtag.com/sync/img?mt_exid=5&redir=https%3A%2F%2Feu-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D536872786%26val%3D%5BMM_UUID%5D HTTP 302
https://eu-u.openx.net/w/1.0/sd?id=536872786&val=2cfe603e-6786-4700-8950-8fd8aef36ba3

Request Chain 283

https://pixel.quantserve.com/pixel/p-25CIknq_eSg16.gif?idmatch=0&gdpr=1 HTTP 302
https://us-u.openx.net/w/1.0/sd?id=537072956&gdpr=1&val=bDBWOmw3XWl3OQRqb2JIaGo0AT53ZgFnaGLjWZwu

Request Chain 284

https://c1.adform.net/serving/cookie/match?party=22 HTTP 302
https://c1.adform.net/serving/cookie/match?CC=1&party=22 HTTP 302
https://eu-u.openx.net/w/1.0/sd?id=537113484&val=1848484361306752349

Request Chain 287

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_sc HTTP 302
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESECEsVouQXy0JEYOoZB6hR8c&google_cver=1

Request Chain 313

https://sb.scorecardresearch.com/p?c1=2&c2=6035094&ns_type=hidden&ns_st_sv=4.1505.18&ns_st_it=r&ns_st_id=1614702468331_1&ns_st_ec=2&ns_st_sp=1&ns_st_cn=1&ns_st_ev=hb&ns_st_po=10032&ns_st_cl=86000&ns_st_hc=1&ns_st_mp=streamsense&ns_st_mv=4.1505.18&ns_st_pn=1&ns_st_tp=0&ns_st_pt=10032&ns_st_pa=10032&ns_st_ci=5952801dfd2e616da6000006&ns_ts=1614702478363&ns_st_bt=0&ns_st_bp=0&ns_st_pc=0&ns_st_pp=0&ns_st_br=0&ns_st_ub=0&ns_st_pr=*null&ns_st_ep=*null&ns_st_ct=vc&ns_st_ge=*null&ns_st_st=*null&ns_st_pu=*null&c3=ARSTECHNICA&c4=*null&c6=*null&c7=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2021%2F02%2Fnew-malware-found-on-30000-macs-has-security-pros-stumped%2F&c8=How%20the%20Internet%20could%20change%20under%20Trump&c9=&ns_st_sn=*null&ns_st_en=*null&ns_st_ti=*null&ns_st_ia=*null&ns_st_ce=*null&ns_st_ddt=*null&ns_st_tdt=*null HTTP 302
https://sb.scorecardresearch.com/p2?c1=2&c2=6035094&ns_type=hidden&ns_st_sv=4.1505.18&ns_st_it=r&ns_st_id=1614702468331_1&ns_st_ec=2&ns_st_sp=1&ns_st_cn=1&ns_st_ev=hb&ns_st_po=10032&ns_st_cl=86000&ns_st_hc=1&ns_st_mp=streamsense&ns_st_mv=4.1505.18&ns_st_pn=1&ns_st_tp=0&ns_st_pt=10032&ns_st_pa=10032&ns_st_ci=5952801dfd2e616da6000006&ns_ts=1614702478363&ns_st_bt=0&ns_st_bp=0&ns_st_pc=0&ns_st_pp=0&ns_st_br=0&ns_st_ub=0&ns_st_pr=*null&ns_st_ep=*null&ns_st_ct=vc&ns_st_ge=*null&ns_st_st=*null&ns_st_pu=*null&c3=ARSTECHNICA&c4=*null&c6=*null&c7=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2021%2F02%2Fnew-malware-found-on-30000-macs-has-security-pros-stumped%2F&c8=How%20the%20Internet%20could%20change%20under%20Trump&c9=&ns_st_sn=*null&ns_st_en=*null&ns_st_ti=*null&ns_st_ia=*null&ns_st_ce=*null&ns_st_ddt=*null&ns_st_tdt=*null&cs_ak_ss=1

308 HTTP transactions
11 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/ 46 KB
15 KB 554ms
261ms Document
text/html 18.190.81.75
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

18.190.81.75 Columbus, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-18-190-81-75.us-east-2.compute.amazonaws.com

Software

nginx/1.17.10 / PHP/7.3.27

Resource Hash

b646001359b46d5e8456dc8e3ac7ca91e57532928e5468577cd8c54e05469095

Security Headers

Name	Value
Content-Security-Policy	default-src https: data: 'unsafe-inline' 'unsafe-eval'; child-src https: data: blob:; connect-src https: data: blob:; font-src https: data:; img-src https: data:; media-src blob: data: https:; object-src https:; script-src https: data: blob: 'unsafe-inline' 'unsafe-eval'; style-src https: 'unsafe-inline'; block-all-mixed-content; upgrade-insecure-requests
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: arstechnica.com
:scheme: https
:path: /information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 02 Mar 2021 16:27:45 GMT
content-type: text/html; charset=UTF-8
server: nginx/1.17.10
x-powered-by: PHP/7.3.27
link: <https://arstechnica.com/wp-json/>; rel="https://api.w.org/"
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
x-frame-options: SAMEORIGIN
content-security-policy: default-src https: data: 'unsafe-inline' 'unsafe-eval'; child-src https: data: blob:; connect-src https: data: blob:; font-src https: data:; img-src https: data:; media-src blob: data: https:; object-src https:; script-src https: data: blob: 'unsafe-inline' 'unsafe-eval'; style-src https: 'unsafe-inline'; block-all-mixed-content; upgrade-insecure-requests
content-encoding: gzip

GET
H2 200 main-d2da6083f3.css
cdn.arstechnica.net/wp-content/themes/ars/assets/css/ 342 KB
71 KB 160ms
52ms Stylesheet
text/css 205.234.175.175
SERVERCENTRAL

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.arstechnica.net/wp-content/themes/ars/assets/css/main-d2da6083f3.css
Requested by: Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 205.234.175.175 , United States, ASN23352 (SERVERCENTRAL, US),
Reverse DNS: vip1.G-anycast1.cachefly.net
Software: CFS 0215 /
Resource Hash: b5ac9be9ddb414f29f9729dbd5295284938848998df6fec71e95919c2831fd89

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 02 Mar 2021 16:27:45 GMT
content-encoding: gzip
x-cf3: H
cf4ttl: 43200.000
x-cf1: 14961:fD.fra2:co:1525808045:cacheN.fra2-01:H
content-length: 72433
x-cf-tsc: 1613070869
x-cf2: H
last-modified: Thu, 11 Feb 2021 18:37:13 GMT
server: CFS 0215
x-cff: B
etag: W/"60257959-559b0"
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=4838400
cf4age: 10
accept-ranges: bytes
expires: Tue, 27 Apr 2021 16:27:45 GMT

GET
H2 200 otSDKStub.js Show response
cdn.cookielaw.org/scripttemplates/ 13 KB
5 KB 33ms
17ms Script
application/javascript 2606:4700::6810:9440
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Requested by

Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:9440 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

dd4b42f7c8ddeeedbc0e556a5da8b647fd08c56a2ac3540b1e5a6d9342ba5c4f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Tue, 02 Mar 2021 16:27:45 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
content-md5: DgCf/JQeR4+J+ZEYMfLA9Q==
age: 171
vary: Accept-Encoding
content-length: 4211
cf-request-id: 08955d6a51000053636a861000000001
x-ms-lease-status: unlocked
last-modified: Wed, 24 Feb 2021 17:18:08 GMT
server: cloudflare
etag: 0x8D8D8E828181ED0
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/javascript
access-control-allow-origin: *
x-ms-request-id: c3880db3-801e-0143-0bda-0ab45a000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=14400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 629bfe8a18c35363-FRA

GET
H2 200 otCCPAiab.js Show response
cdn.cookielaw.org/opt-out/ 22 KB
6 KB 35ms
19ms Script
application/javascript 2606:4700::6810:9440
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/opt-out/otCCPAiab.js

Requested by

Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:9440 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6f25e54ff758a69c92c7260b3647788acb86b4fc6266141893e1a4316b5a0862

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Tue, 02 Mar 2021 16:27:45 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
content-md5: mHlk9fiiqYjvq2V+HtACPg==
age: 79
vary: Accept-Encoding
cf-request-id: 08955d6a5100005363362b7000000001
x-ms-lease-status: unlocked
last-modified: Wed, 08 Jul 2020 15:45:08 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/javascript
access-control-allow-origin: *
x-ms-request-id: 9d8b1554-701e-0052-2b2c-04c514000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=14400
x-ms-version: 2009-09-19
cf-ray: 629bfe8a18c45363-FRA

GET
H2 200 gpt.js Show response
www.googletagservices.com/tag/js/ 57 KB
19 KB 58ms
54ms Script
text/javascript 142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/tag/js/gpt.js

Requested by

Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s05-in-f2.1e100.net

Software

sffe /

Resource Hash

a92675588de87ecbcfe5bdea2fff0f7078d46c1d599a7e62093a1f182e324b91

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 02 Mar 2021 16:27:45 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "799 / 291 of 1000 / last-modified: 1614687026"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 19500
x-xss-protection: 0
expires: Tue, 02 Mar 2021 16:27:45 GMT

GET
H2 200 apstag.js Show response
c.amazon-adsystem.com/aax2/ 115 KB
30 KB 191ms
75ms Script
application/javascript 13.224.192.34
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/aax2/apstag.js
Requested by: Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.224.192.34 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-192-34.fra2.r.cloudfront.net
Software: Server /
Resource Hash: 130eab0b79272570e565d77bb286b5755b9aae8f33efe8af7a2689bf8eabb859

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 02 Mar 2021 16:23:11 GMT
content-encoding: gzip
server: Server
age: 275
etag: d7c8ebbead57940cf77ae4183f7ff01a
x-cache: Hit from cloudfront
content-type: application/javascript
via: 1.1 0f538ee832e1105649039b38ce89e883.cloudfront.net (CloudFront)
cache-control: public, max-age=900
x-amz-cf-pop: FRA2-C1
accept-ranges: bytes
timing-allow-origin: *
x-amz-version-id: pkiOsnrw5ub40d2SPOSAjPBBoA7O4uIM
x-amz-cf-id: LBUTmWW7zlp-XHv44X1aEic0BQqJy1G3nJ1hn83Ro8RdzG0z1ile1Q==

GET
H2 200 prebid.min.js Show response
cdn.arstechnica.net/cns/ 245 KB
76 KB 225ms
117ms Script
application/javascript 205.234.175.175
SERVERCENTRAL

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.arstechnica.net/cns/prebid.min.js?v=1614702432
Requested by: Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 205.234.175.175 , United States, ASN23352 (SERVERCENTRAL, US),
Reverse DNS: vip1.G-anycast1.cachefly.net
Software: CFS 0215 /
Resource Hash: 90daf70d02545637e50825cbb49be93e91b36f3f1f9674b75724743c013cca6b

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 02 Mar 2021 16:27:45 GMT
content-encoding: gzip
x-cf3: M
x-amz-request-id: DEDC5982A115C3AF
x-cf1: 14961:fD.fra2:co:1525808045:cacheN.fra2-01:M
x-cache-hits: 0
content-length: 77337
x-amz-id-2: YN0qJ8uncGHsBD41A3HvbqrABoq18+gaCMJLRh2BsRoE0tG+g5FBNjgHlA7Tt/paZkGa7hPlsfE=
x-served-by: cache-bwi5080-BWI
cf4ttl: 43200.000
x-cf2: H
last-modified: Wed, 10 Feb 2021 19:27:08 GMT
server: CFS 0215
x-timer: S1614702434.765518,VS0,VE64
x-cff: B
etag: "e306c1f64b8f48c93a6ddd9371f462c4"
vary: Accept-Encoding
x-amz-version-id: _hFrXsFCzfO6uVEUTVRdzja9PyLLcHtA
access-control-allow-origin: *
cache-control: max-age=120
cf4age: 0
accept-ranges: bytes
content-type: application/javascript
x-cf-tsc: 1614702434
expires: Tue, 02 Mar 2021 16:29:45 GMT

GET
H/1.1 200
OK 183973-93942139695505.js Show response
js-sec.indexww.com/ht/p/ 46 KB
15 KB 731ms
609ms Script
text/javascript 23.202.53.51
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://js-sec.indexww.com/ht/p/183973-93942139695505.js
Requested by: Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.202.53.51 Vienna, Austria, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-202-53-51.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 968becb1b046753d1c398fa0f40052923873c2423147903a37958b198a64ffe9

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Tue, 02 Mar 2021 16:27:46 GMT
Content-Encoding: gzip
Last-Modified: Tue, 02 Mar 2021 16:25:17 GMT
Server: Apache
ETag: "904674-b75f-5bc902e095a6a"
Vary: Accept-Encoding
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=3571
Connection: keep-alive
Accept-Ranges: bytes
Content-Type: text/javascript
Content-Length: 15370
Expires: Tue, 02 Mar 2021 17:27:17 GMT

GET
H2 200 moatheader.js Show response
z.moatads.com/condenastprebidheader987326845656/ 195 KB
69 KB 178ms
58ms Script
application/x-javascript 23.202.53.245
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://z.moatads.com/condenastprebidheader987326845656/moatheader.js
Requested by: Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.202.53.245 Vienna, Austria, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-202-53-245.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: 159870d28d6a141f4c7da2dcf3970caf103a391dea9149500a8407276a69b070

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 02 Mar 2021 16:27:46 GMT
content-encoding: gzip
last-modified: Mon, 27 Apr 2020 21:09:45 GMT
server: AmazonS3
x-amz-request-id: CA7FA6783AE26CD4
etag: "6de83688cc282085483a4cc5b2af5420"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: max-age=62070
accept-ranges: bytes
content-length: 70131
x-amz-id-2: Jc0SUlBIIiHlTonvMxxnvxbcSdKIOiuxASiDzrtx+TVaudpwLzcjXw+sT8LiISefSfn3/HMb3MQ=

GET
H2 200 ars-technica.min.js Show response
cdn.arstechnica.net/cns/ 151 KB
49 KB 253ms
146ms Script
application/javascript 205.234.175.175
SERVERCENTRAL

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.arstechnica.net/cns/ars-technica.min.js?v=1614702432
Requested by: Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 205.234.175.175 , United States, ASN23352 (SERVERCENTRAL, US),
Reverse DNS: vip1.G-anycast1.cachefly.net
Software: CFS 0215 /
Resource Hash: 8d5126dc968032c4858517a11dfe633130a8c31d577fe6f5c2de404eefb0982f

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 02 Mar 2021 16:27:45 GMT
content-encoding: gzip
x-cf3: M
x-amz-request-id: BV2G8Z7M1X5ZDKFR
x-cf1: 14961:fD.fra2:co:1525808045:cacheN.fra2-01:M
x-cache-hits: 3
content-length: 49420
x-amz-id-2: u2PM3HMalgFLpbUf5VYY57o7cSKWSip/A84izQjhideHiXk09HviJHAPMeuKMlWl4hlGTrdVwF0=
x-served-by: cache-wdc5527-WDC
cf4ttl: 120.500
x-cf2: H
last-modified: Thu, 11 Feb 2021 19:25:30 GMT
server: CFS 0215
x-timer: S1614702434.770277,VS0,VE0
x-cff: B
etag: "7ca666ccc593e21c39e951047259c38b"
vary: Accept-Encoding
x-amz-version-id: yyDi8147uzDbBjqO2kaaQowSYgeuNdI5
access-control-allow-origin: *
cache-control: max-age=120
cf4age: 1
accept-ranges: bytes
content-type: application/javascript
x-cf-tsc: 1614702434
expires: Tue, 02 Mar 2021 16:29:45 GMT

GET
H2 200 ars-84a4ab0802.ads.us.js Show response
cdn.arstechnica.net/wp-content/themes/ars/assets/js/ 3 KB
1 KB 223ms
116ms Script
application/javascript 205.234.175.175
SERVERCENTRAL

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.arstechnica.net/wp-content/themes/ars/assets/js/ars-84a4ab0802.ads.us.js
Requested by: Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 205.234.175.175 , United States, ASN23352 (SERVERCENTRAL, US),
Reverse DNS: vip1.G-anycast1.cachefly.net
Software: CFS 0215 /
Resource Hash: 16708dda2536b4b3782313db4a6ec8456cd84da7ae0f56d7d2455e68fc9bc4f0

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 02 Mar 2021 16:27:45 GMT
content-encoding: gzip
x-cf3: H
cf4ttl: 43200.000
x-cf1: 14961:fD.fra2:co:1525808045:cacheN.fra2-01:H
content-length: 1143
x-cf-tsc: 1611758166
x-cf2: H
last-modified: Wed, 13 Jan 2021 16:00:12 GMT
server: CFS 0215
x-cff: B
etag: "5fff190c-bc0"
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=4838400
cf4age: 29384
accept-ranges: bytes
expires: Tue, 27 Apr 2021 16:27:45 GMT

GET
H2 200 mac-800x534.jpg
cdn.arstechnica.net/wp-content/uploads/2021/02/ 76 KB
76 KB 56ms
53ms Image
image/jpeg 205.234.175.175
SERVERCENTRAL

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.arstechnica.net/wp-content/uploads/2021/02/mac-800x534.jpg
Requested by: Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 205.234.175.175 , United States, ASN23352 (SERVERCENTRAL, US),
Reverse DNS: vip1.G-anycast1.cachefly.net
Software: CFS 0215 /
Resource Hash: 6b57b536ffc354851a6d8595fed472777034c541ada2be4edd321748bad3e3d8

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 02 Mar 2021 16:27:45 GMT
x-cf3: H
x-amz-request-id: XGKS1XRYTRD6R4W6
x-cf1: 14961:fD.fra2:co:1525808045:cacheN.fra2-01:M
x-amz-replication-status: COMPLETED
content-length: 77394
x-amz-id-2: WS/BLzTZrqttDC/4L147q4YnSITd+jHNpbfr3zW+qV20Hu5H5JWa6PNrzaQiwiFwDAf9dT6cdDM=
x-cf-tsc: 1614631595
cf4ttl: 43200.000
x-cf2: H
last-modified: Sat, 20 Feb 2021 01:27:37 GMT
server: CFS 0215
x-cff: B
etag: "2cc81f8922cf9de526113fbd56a64e23"
x-amz-version-id: ZGUo0ZaBLZMvW.AdH8H0ZBEO2DJXRBSf
access-control-allow-origin: *
cache-control: max-age=4838400
cf4age: 34973
accept-ranges: bytes
content-type: image/jpeg
expires: Tue, 27 Apr 2021 16:27:45 GMT

GET
H2 200 silver-sparrow-overview-640x320.jpg
cdn.arstechnica.net/wp-content/uploads/2021/02/ 27 KB
27 KB 64ms
61ms Image
image/jpeg 205.234.175.175
SERVERCENTRAL

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.arstechnica.net/wp-content/uploads/2021/02/silver-sparrow-overview-640x320.jpg
Requested by: Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 205.234.175.175 , United States, ASN23352 (SERVERCENTRAL, US),
Reverse DNS: vip1.G-anycast1.cachefly.net
Software: CFS 0215 /
Resource Hash: 701611e702ac07e223abf07eb261c4de26244b60f99fac346ca19da3b23ce57c

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 02 Mar 2021 16:27:45 GMT
x-cf3: H
x-amz-request-id: FVR9JEF1AXTY8GZ6
x-cf1: 14961:fD.fra2:co:1525808045:cacheN.fra2-01:M
x-amz-replication-status: COMPLETED
content-length: 27577
x-amz-id-2: g5ksVQ5r7V0BRUbl791iqq5psCpb6mhyUL3KhM6n6ci1wqKRD8PpeSh3RdhPJcUA615YTpAiLYg=
x-cf-tsc: 1614613046
cf4ttl: 43200.000
x-cf2: H
last-modified: Sat, 20 Feb 2021 01:31:28 GMT
server: CFS 0215
x-cff: B
etag: "2476b866d3dc37e6ed7be022d70af9a5"
x-amz-version-id: tB5v7uIrXbvbjIY0DGIVSbBVce691s90
access-control-allow-origin: *
cache-control: max-age=4838400
cf4age: 45895
accept-ranges: bytes
content-type: image/jpeg
expires: Tue, 27 Apr 2021 16:27:45 GMT

GET
H2 200 main-e7aebfbfda.js Show response
cdn.arstechnica.net/wp-content/themes/ars/assets/js/ 658 KB
214 KB 53ms
53ms Script
application/javascript 205.234.175.175
SERVERCENTRAL

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.arstechnica.net/wp-content/themes/ars/assets/js/main-e7aebfbfda.js
Requested by: Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 205.234.175.175 , United States, ASN23352 (SERVERCENTRAL, US),
Reverse DNS: vip1.G-anycast1.cachefly.net
Software: CFS 0215 /
Resource Hash: 17f21ab470f0a1cacd46e91124483e9223826b56adb10a874538b4bd9a0f45ed

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 02 Mar 2021 16:27:45 GMT
content-encoding: gzip
x-cf3: H
cf4ttl: 43200.000
x-cf1: 14961:fD.fra2:co:1525808045:cacheN.fra2-01:H
content-length: 218215
x-cf-tsc: 1611779618
x-cf2: H
last-modified: Wed, 13 Jan 2021 16:00:12 GMT
server: CFS 0215
x-cff: B
etag: "5fff190c-a495d"
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=4838400
cf4age: 7931
accept-ranges: bytes
expires: Tue, 27 Apr 2021 16:27:45 GMT

GET
H2 200 p.js Show response
fpa-cdn.arstechnica.com/keys/arstechnica.com/ 49 KB
17 KB 199ms
67ms Script
application/x-javascript 65.9.58.74
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://fpa-cdn.arstechnica.com/keys/arstechnica.com/p.js
Requested by: Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.9.58.74 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 08b8b78504677c4bb61018fbcfe343bf7603d3ea56b3b47d9532569104f9b5c0

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 01 Mar 2021 17:46:31 GMT
content-encoding: gzip
last-modified: Mon, 22 Jun 2020 18:36:23 GMT
server: AmazonS3
age: 81676
etag: W/"9ad5803fbe8f447002010c8ec44dbf00"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/x-javascript
via: 1.1 cae542650fb32c773cc494fc6e7e71e7.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-C1
x-amz-cf-id: vqG1hl5t6N-TbrEozNVpD6xJZcOnTMQLqAyG1VtcjGOqH-pjsCRgHQ==

GET
H/1.1 200
OK arstechnica.js Show response
player.cnevids.com/interlude/ 103 KB
27 KB 204ms
63ms Script
text/javascript 13.32.24.125
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://player.cnevids.com/interlude/arstechnica.js

Requested by

Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

13.32.24.125 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-32-24-125.fra56.r.cloudfront.net

Software

nginx/1.14.1 /

Resource Hash

28fd8292cd179f7501cd6540946091259ada3e6fd363ef40c126528e0ac8b60f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Tue, 02 Mar 2021 16:26:54 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
X-Permitted-Cross-Domain-Policies: none
Age: 52
X-Cache: Hit from cloudfront
Status: 200 OK
Connection: keep-alive
Content-Length: 26963
X-XSS-Protection: 1; mode=block
X-Request-Id: e4f82cc5-693c-4abb-8732-525c7a623af5
X-Runtime: 0.011232
X-Backend-Node: 10.110.127.9
Referrer-Policy: strict-origin-when-cross-origin
Server: nginx/1.14.1
ETag: W/"5d8c3cfc22929797165145bcd274ff4d"
X-Download-Options: noopen
Vary: Origin,Accept-Encoding
Content-Type: text/javascript; charset=utf-8
Via: 1.1 1ee1abe42f3acbda66e5d1252319566a.cloudfront.net (CloudFront)
Cache-Control: max-age=0, private, must-revalidate
X-Amz-Cf-Pop: FRA56-C2
X-Amz-Cf-Id: aInjVWpQVs-63H8L0UzNLyXa1WMXPIMOKwRbS_1KVOhkquBztNmG9A==

GET
H2 200 conde-asa-polar-master.js Show response
cdn.mediavoice.com/nativeads/script/condenastcorporate/ 5 KB
2 KB 42ms
18ms Script
text/javascript 2606:4700::6813:d983
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.mediavoice.com/nativeads/script/condenastcorporate/conde-asa-polar-master.js
Requested by: Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6813:d983 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 030e91b7512dbb40e9b9057f20bcf54c296a7f28c04bbcde0f2d2706dd2a3a06

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 02 Mar 2021 16:27:45 GMT
content-encoding: gzip
cf-cache-status: HIT
age: 4544
via: 1.1 varnish
cf-ray: 629bfe8c1f0f2c56-FRA
cf-ipcountry: DE
content-length: 2018
cf-request-id: 08955d6b8e00002c5663225000000001
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-varnish: 2042173079 2041589696
x-country: DE
cache-control: max-age=21600
accept-ranges: bytes
content-type: text/javascript

GET
H2 200 100098X1555750.skimlinks.js Show response
s.skimresources.com/js/ 35 KB
14 KB 210ms
69ms Script
application/octet-stream 151.139.128.11
HIGHWINDS3

General

Check archive.org

Show headers Download Go to

Full URL: https://s.skimresources.com/js/100098X1555750.skimlinks.js
Requested by: Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.139.128.11 , United States, ASN20446 (HIGHWINDS3, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 3a268d0781eb4eeaffdfd67f4afcc7d3e1e9c28e1a3133ced5d8a6ec8dcec79e

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 02 Mar 2021 16:27:46 GMT
content-encoding: gzip
last-modified: Wed, 24 Feb 2021 10:58:23 GMT
server: AmazonS3
x-amz-request-id: CKETFJ5K3R5J0Z2W
etag: "1d29667eeef4d49bfc72679d78e783aa"
x-hw: 1614702466.cds064.lo4.hn,1614702466.cds278.lo4.c
content-type: application/octet-stream
cache-control: max-age=3600
accept-ranges: bytes
content-length: 13665
x-amz-id-2: I8DahIP6aduYWT8UiBq8MGx3j2oNeLPoubwxNf3rU2GR7itNggXi3amx9nu8UD+xm5HH22HJ4+8=

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 411 KB
106 KB 56ms
53ms Script
application/javascript 2a00:1450:4001:80f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-NLXNPCQ

Requested by

Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

050dd574b27efe92f91dc7ebd38b529a487c5565ffd4af3e8ab56152e32f8298

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 02 Mar 2021 16:27:45 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 108511
x-xss-protection: 0
last-modified: Tue, 02 Mar 2021 15:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Tue, 02 Mar 2021 16:27:45 GMT

GET
H2 200 b10882a1-8446-4e7d-bfb2-ce2c770ad910.json Show response
cdn.cookielaw.org/consent/b10882a1-8446-4e7d-bfb2-ce2c770ad910/ 3 KB
2 KB 24ms
11ms XHR
application/x-javascript 2606:4700::6810:9440
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/consent/b10882a1-8446-4e7d-bfb2-ce2c770ad910/b10882a1-8446-4e7d-bfb2-ce2c770ad910.json

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:9440 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

96824b72aa12ccea1334a545f44967fbc0fd04aaad0a1cb8cac609fab148ca89

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Tue, 02 Mar 2021 16:27:45 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
content-md5: JBB6u0HHMKkR+bLVO/PBYA==
age: 3910
vary: Accept-Encoding
content-length: 1361
cf-request-id: 08955d6b330000535db614b000000001
x-ms-lease-status: unlocked
last-modified: Tue, 09 Feb 2021 23:09:29 GMT
server: cloudflare
etag: 0x8D8CD4FC0CA0B4B
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/x-javascript
access-control-allow-origin: *
x-ms-request-id: f601695e-e01e-0031-3b38-ff8331000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=14400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 629bfe8b8a06535d-FRA

GET
H2 200 dnsfeed Show response
geolocation.onetrust.com/cookieconsentpub/v1/geo/location/ 162 B
520 B 41ms
23ms Script
text/javascript 2606:4700:10::6814:b944
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://geolocation.onetrust.com/cookieconsentpub/v1/geo/location/dnsfeed

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/opt-out/otCCPAiab.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::6814:b944 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

dfeb7783a538aaf85df056bf149c808937dccdb3e3af5714d6fba017054e2f94

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 02 Mar 2021 16:27:45 GMT
content-encoding: gzip
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/javascript
strict-transport-security: max-age=31536000; includeSubDomains; preload
cf-ray: 629bfe8c081cd6d5-FRA
cf-request-id: 08955d6b8a0000d6d525b44000000001

GET
H2 200 location Show response
geolocation.onetrust.com/cookieconsentpub/v1/geo/ 164 B
227 B 18ms
18ms Script
text/javascript 2606:4700:10::6814:b944
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://geolocation.onetrust.com/cookieconsentpub/v1/geo/location

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::6814:b944 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

1b94f9074fc2ef1b63132fc70fe244cc5d5322e5982a80b6273a45a935ae335f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 02 Mar 2021 16:27:45 GMT
content-encoding: gzip
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/javascript
strict-transport-security: max-age=31536000; includeSubDomains; preload
cf-ray: 629bfe8c182ad6d5-FRA
cf-request-id: 08955d6b8f0000d6d504b2a000000001

GET
H/1.1 200
OK condenast-amp Show response
segment-data.zqtk.net/ 285 B
545 B 221ms
72ms XHR
application/javascript 34.253.148.162
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://segment-data.zqtk.net/condenast-amp?url=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2021%2F02%2Fnew-malware-found-on-30000-macs-has-security-pros-stumped%2F
Requested by: Host: cdn.arstechnica.net
URL: https://cdn.arstechnica.net/cns/ars-technica.min.js?v=1614702432
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.253.148.162 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-34-253-148-162.eu-west-1.compute.amazonaws.com
Software: nginx/1.10.3 (Ubuntu) /
Resource Hash: 7304d6dbfd2cebc5fa4d0c8078f3a834486f7a717dc3cf5cdcfa39e0b7299849

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Tue, 02 Mar 2021 16:27:46 GMT
Content-Encoding: gzip
Server: nginx/1.10.3 (Ubuntu)
Transfer-Encoding: chunked
Content-Type: application/javascript; charset=UTF-8
Access-Control-Allow-Origin: https://arstechnica.com
Cache-Control: max-age=39554
Access-Control-Allow-Credentials: true
Connection: keep-alive
Expires: Wed, 03 Mar 2021 03:27:01 GMT

GET
H2 200 ads.js Show response
arstechnica.com/hotzones/src/ 0
494 B 148ms
146ms XHR
application/javascript 18.190.81.75
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://arstechnica.com/hotzones/src/ads.js

Requested by

Host: cdn.arstechnica.net
URL: https://cdn.arstechnica.net/cns/ars-technica.min.js?v=1614702432

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

18.190.81.75 Columbus, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-18-190-81-75.us-east-2.compute.amazonaws.com

Software

nginx/1.17.10 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	default-src https: data: 'unsafe-inline' 'unsafe-eval'; child-src https: data: blob:; connect-src https: data: blob:; font-src https: data:; img-src https: data:; media-src blob: data: https:; object-src https:; script-src https: data: blob: 'unsafe-inline' 'unsafe-eval'; style-src https: 'unsafe-inline'; block-all-mixed-content; upgrade-insecure-requests
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 02 Mar 2021 16:27:45 GMT
x-content-type-options: nosniff
last-modified: Mon, 22 Feb 2021 22:38:42 GMT
server: nginx/1.17.10
etag: "60343272-0"
x-frame-options: SAMEORIGIN
content-type: application/javascript
content-security-policy: default-src https: data: 'unsafe-inline' 'unsafe-eval'; child-src https: data: blob:; connect-src https: data: blob:; font-src https: data:; img-src https: data:; media-src blob: data: https:; object-src https:; script-src https: data: blob: 'unsafe-inline' 'unsafe-eval'; style-src https: 'unsafe-inline'; block-all-mixed-content; upgrade-insecure-requests
accept-ranges: bytes
content-length: 0
x-xss-protection: 1; mode=block

GET
DATA 200
OK truncated
/ 2 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 78c8c364b438f0be81f1c51627902fda95b7aebdd2c04aee28c2f72cd4390207

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/svg+xml;charset=utf-8

GET
DATA 200
OK truncated
/ 357 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: f95836cdd8c1af1d8261e8e198a4c1dd306e2b50ddc389fe820b56212a9cb17d

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/svg+xml;charset=utf-8

GET
H2 200 economica-bold-otf-webfont.woff2
cdn.arstechnica.net/wp-content/themes/ars/assets/fonts/ 25 KB
25 KB 245ms
139ms Font
font/woff2 205.234.175.175
SERVERCENTRAL

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.arstechnica.net/wp-content/themes/ars/assets/fonts/economica-bold-otf-webfont.woff2
Requested by: Host: cdn.arstechnica.net
URL: https://cdn.arstechnica.net/wp-content/themes/ars/assets/css/main-d2da6083f3.css
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 205.234.175.175 , United States, ASN23352 (SERVERCENTRAL, US),
Reverse DNS: vip1.G-anycast1.cachefly.net
Software: CFS 0215 /
Resource Hash: 5315cf641e62ac7de4a82e6003cc1bd1ff09218400d8ff5286c951e25aee966b

Request headers

Origin: https://arstechnica.com
Referer: https://cdn.arstechnica.net/wp-content/themes/ars/assets/css/main-d2da6083f3.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 02 Mar 2021 16:27:46 GMT
x-cf3: H
cf4ttl: 43200.000
x-cf1: 14961:fB.fra2:co:1525808045:cacheN.fra2-01:H
content-length: 25592
x-cf-tsc: 1611784487
x-cf2: H
last-modified: Wed, 13 Jan 2021 16:00:12 GMT
server: CFS 0215
x-cff: B
etag: "5fff190c-63f8"
content-type: font/woff2
access-control-allow-origin: *
cache-control: max-age=4838400
cf4age: 3072
accept-ranges: bytes
expires: Tue, 27 Apr 2021 16:27:46 GMT

GET
H2 200 economica-regular-otf-webfont.woff2
cdn.arstechnica.net/wp-content/themes/ars/assets/fonts/ 24 KB
24 KB 259ms
153ms Font
font/woff2 205.234.175.175
SERVERCENTRAL

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.arstechnica.net/wp-content/themes/ars/assets/fonts/economica-regular-otf-webfont.woff2
Requested by: Host: cdn.arstechnica.net
URL: https://cdn.arstechnica.net/wp-content/themes/ars/assets/css/main-d2da6083f3.css
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 205.234.175.175 , United States, ASN23352 (SERVERCENTRAL, US),
Reverse DNS: vip1.G-anycast1.cachefly.net
Software: CFS 0215 /
Resource Hash: c14a030b0b5ef06f710d9bbff164662d4b43c037e62f254aa6280504013caa34

Request headers

Origin: https://arstechnica.com
Referer: https://cdn.arstechnica.net/wp-content/themes/ars/assets/css/main-d2da6083f3.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 02 Mar 2021 16:27:46 GMT
x-cf3: H
cf4ttl: 43200.000
x-cf1: 14961:fB.fra2:co:1525808045:cacheN.fra2-01:H
content-length: 24264
x-cf-tsc: 1611784487
x-cf2: H
last-modified: Wed, 13 Jan 2021 16:00:12 GMT
server: CFS 0215
x-cff: B
etag: "5fff190c-5ec8"
content-type: font/woff2
access-control-allow-origin: *
cache-control: max-age=4838400
cf4age: 3072
accept-ranges: bytes
expires: Tue, 27 Apr 2021 16:27:46 GMT

GET
DATA 200
OK truncated
/ 279 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 5ecbfb541946a9a9437190a21d98e1c7ab7d863837d7d038a9a1e053c649c8ba

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/svg+xml;charset=utf-8

GET
DATA 200
OK truncated
/ 400 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 6f261533d4b74ae931965cf3609bf47bb55001e39eb7029502d96cec73c4749a

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/svg+xml;charset=utf-8

GET
DATA 200
OK truncated
/ 700 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 5ab499494548829e507e9b6cd57247a6cd565e7f1bc6eb55e3da445af76f1f0c

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/svg+xml;charset=utf-8

GET
DATA 200
OK truncated
/ 715 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 49282a74c6ced31e99f808232188ade8d82652004df4d664dcdb98c32563dd39

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/svg+xml;charset=utf-8

GET
H2 200 virus-3497220_1920-360x200.jpg
cdn.arstechnica.net/wp-content/uploads/2021/02/ 11 KB
12 KB 63ms
62ms Image
image/jpeg 205.234.175.175
SERVERCENTRAL

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.arstechnica.net/wp-content/uploads/2021/02/virus-3497220_1920-360x200.jpg
Requested by: Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 205.234.175.175 , United States, ASN23352 (SERVERCENTRAL, US),
Reverse DNS: vip1.G-anycast1.cachefly.net
Software: CFS 0215 /
Resource Hash: 38c1171626aa245f31b9441b2a7d7545ad80033bf463ed4bc591b6cf9302f588

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 02 Mar 2021 16:27:45 GMT
x-cf3: H
x-amz-request-id: 53N1X5HAE3B479E2
x-cf1: 14961:fD.fra2:co:1525808045:cacheN.fra2-01:M
x-amz-replication-status: COMPLETED
content-length: 11602
x-amz-id-2: QNsr6iXkXfn1R2jcfPsSX1+rgnjGrO75CFAc5IvPHSEAvH3KdiaPhkWEEJygl3/gOtmaeRcCbME=
x-cf-tsc: 1614627925
cf4ttl: 43200.000
x-cf2: H
last-modified: Wed, 17 Feb 2021 18:01:09 GMT
server: CFS 0215
x-cff: B
etag: "26107bec65eda7afcf02bc2a15fbf050"
x-amz-version-id: ELVc3FCkrgI.uqB8bOMZRg3xL3HlNdFl
access-control-allow-origin: *
cache-control: max-age=4838400
cf4age: 43938
accept-ranges: bytes
content-type: image/jpeg
expires: Tue, 27 Apr 2021 16:27:45 GMT

GET
DATA 200
OK truncated
/ 841 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 039f13cdf684666dd973e2385f773385adb074039e8a832ec48e1ae35fb20c15

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/svg+xml;charset=utf-8

GET
H2 200 Dang.jpg
cdn.arstechnica.net/wp-content/uploads/2018/10/ 90 KB
91 KB 53ms
52ms Image
image/jpeg 205.234.175.175
SERVERCENTRAL

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.arstechnica.net/wp-content/uploads/2018/10/Dang.jpg
Requested by: Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 205.234.175.175 , United States, ASN23352 (SERVERCENTRAL, US),
Reverse DNS: vip1.G-anycast1.cachefly.net
Software: CFS 0215 /
Resource Hash: d6f350f62fc19bfd7091e3841649be70e806fb94c00a1f777dbed2ea8ecc9daa

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 02 Mar 2021 16:27:45 GMT
x-cf3: H
x-amz-request-id: VR18T2V4KMX4XS5C
x-cf1: 14961:fD.fra2:co:1525808045:cacheN.fra2-01:H
content-length: 92486
x-amz-id-2: mXu5dvnZ7325N5Zr1YzsFhO9msCtBEgSsDBQ0SOw5YXhzSl5zHRaVcwcBbHfkpsirbk7ITQAd/A=
x-cf-tsc: 1614518319
cf4ttl: 43200.000
x-cf2: H
last-modified: Sat, 21 Dec 2019 01:48:48 GMT
server: CFS 0215
x-cff: B
etag: "03e5fec9e7ca5f8064d945bd791bd4c3"
x-amz-version-id: null
access-control-allow-origin: *
cache-control: max-age=4838400
cf4age: 39050
accept-ranges: bytes
content-type: image/jpeg
x-cf-rand: 53.071
expires: Tue, 27 Apr 2021 16:27:45 GMT

GET
H2 200 channel-ars-be7bb52ba9.png
cdn.arstechnica.net/wp-content/themes/ars/assets/img/ 5 KB
5 KB 61ms
61ms Image
image/png 205.234.175.175
SERVERCENTRAL

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.arstechnica.net/wp-content/themes/ars/assets/img/channel-ars-be7bb52ba9.png
Requested by: Host: cdn.arstechnica.net
URL: https://cdn.arstechnica.net/wp-content/themes/ars/assets/css/main-d2da6083f3.css
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 205.234.175.175 , United States, ASN23352 (SERVERCENTRAL, US),
Reverse DNS: vip1.G-anycast1.cachefly.net
Software: CFS 0215 /
Resource Hash: 08ed3bf6e73a999bafb422b878fb05b87269b00a65230c9457ce75aee10b873e

Request headers

Referer: https://cdn.arstechnica.net/wp-content/themes/ars/assets/css/main-d2da6083f3.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 02 Mar 2021 16:27:45 GMT
x-cf3: H
cf4ttl: 43200.000
x-cf1: 14961:fD.fra2:co:1525808045:cacheN.fra2-01:H
content-length: 4809
x-cf-tsc: 1611749336
x-cf2: H
last-modified: Wed, 13 Jan 2021 16:00:12 GMT
server: CFS 0215
x-cff: B
etag: "5fff190c-12c9"
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=4838400
cf4age: 38215
accept-ranges: bytes
expires: Tue, 27 Apr 2021 16:27:45 GMT

GET
DATA 200
OK truncated
/ 5 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: c7f2558d7005dc61e343b6abb61a63da8ace760a0fdd45cb0cc124b0de5b4c2f

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/svg+xml;charset=utf-8

GET
DATA 200
OK truncated
/ 18 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 62c7d2da9a5942053f17c9756e53b7cda414541619bd35c2b1441cd88c77f235

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/svg+xml;charset=utf-8

GET
DATA 200
OK truncated
/ 2 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 4ec4b6769730ca98db1f40b152c52bd5bec01f61f559fb92709c307750388ac8

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/svg+xml;charset=utf-8

GET
H2 200 opensans-regular-webfont.woff2
cdn.arstechnica.net/wp-content/themes/ars/assets/fonts/ 18 KB
19 KB 205ms
134ms Font
font/woff2 205.234.175.175
SERVERCENTRAL

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.arstechnica.net/wp-content/themes/ars/assets/fonts/opensans-regular-webfont.woff2
Requested by: Host: cdn.arstechnica.net
URL: https://cdn.arstechnica.net/wp-content/themes/ars/assets/css/main-d2da6083f3.css
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 205.234.175.175 , United States, ASN23352 (SERVERCENTRAL, US),
Reverse DNS: vip1.G-anycast1.cachefly.net
Software: CFS 0215 /
Resource Hash: caa3854f28740fa98125ded826446ee4456379e8ad7c4ff46643347d1901506a

Request headers

Origin: https://arstechnica.com
Referer: https://cdn.arstechnica.net/wp-content/themes/ars/assets/css/main-d2da6083f3.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 02 Mar 2021 16:27:46 GMT
x-cf3: H
cf4ttl: 43200.000
x-cf1: 14961:fB.fra2:co:1525808045:cacheN.fra2-01:H
content-length: 18824
x-cf-tsc: 1611784487
x-cf2: H
last-modified: Wed, 13 Jan 2021 16:00:12 GMT
server: CFS 0215
x-cff: B
etag: "5fff190c-4988"
content-type: font/woff2
access-control-allow-origin: *
cache-control: max-age=4838400
cf4age: 3072
accept-ranges: bytes
expires: Tue, 27 Apr 2021 16:27:46 GMT

GET
H2 200 bitter-italic-webfont.woff2
cdn.arstechnica.net/wp-content/themes/ars/assets/fonts/ 24 KB
24 KB 193ms
123ms Font
font/woff2 205.234.175.175
SERVERCENTRAL

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.arstechnica.net/wp-content/themes/ars/assets/fonts/bitter-italic-webfont.woff2
Requested by: Host: cdn.arstechnica.net
URL: https://cdn.arstechnica.net/wp-content/themes/ars/assets/css/main-d2da6083f3.css
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 205.234.175.175 , United States, ASN23352 (SERVERCENTRAL, US),
Reverse DNS: vip1.G-anycast1.cachefly.net
Software: CFS 0215 /
Resource Hash: 1193e934b76ed372f47e23f78f8a13e99d9588e564aff866e8f700e7a0650a83

Request headers

Origin: https://arstechnica.com
Referer: https://cdn.arstechnica.net/wp-content/themes/ars/assets/css/main-d2da6083f3.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 02 Mar 2021 16:27:46 GMT
x-cf3: H
cf4ttl: 43200.000
x-cf1: 14961:fB.fra2:co:1525808045:cacheN.fra2-01:H
content-length: 24212
x-cf-tsc: 1611784487
x-cf2: H
last-modified: Wed, 13 Jan 2021 16:00:12 GMT
server: CFS 0215
x-cff: B
etag: "5fff190c-5e94"
content-type: font/woff2
access-control-allow-origin: *
cache-control: max-age=4838400
cf4age: 3071
accept-ranges: bytes
expires: Tue, 27 Apr 2021 16:27:46 GMT

GET
H2 200 bitter-regular-webfont.woff2
cdn.arstechnica.net/wp-content/themes/ars/assets/fonts/ 22 KB
23 KB 152ms
82ms Font
font/woff2 205.234.175.175
SERVERCENTRAL

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.arstechnica.net/wp-content/themes/ars/assets/fonts/bitter-regular-webfont.woff2
Requested by: Host: cdn.arstechnica.net
URL: https://cdn.arstechnica.net/wp-content/themes/ars/assets/css/main-d2da6083f3.css
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 205.234.175.175 , United States, ASN23352 (SERVERCENTRAL, US),
Reverse DNS: vip1.G-anycast1.cachefly.net
Software: CFS 0215 /
Resource Hash: 0186840386391fa2c0750ff7450a78e066498ba3274546a6fcf0fa9c55cd457c

Request headers

Origin: https://arstechnica.com
Referer: https://cdn.arstechnica.net/wp-content/themes/ars/assets/css/main-d2da6083f3.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 02 Mar 2021 16:27:46 GMT
x-cf3: H
cf4ttl: 43200.000
x-cf1: 14961:fB.fra2:co:1525808045:cacheN.fra2-01:H
content-length: 22872
x-cf-tsc: 1611784488
x-cf2: H
last-modified: Wed, 13 Jan 2021 16:00:12 GMT
server: CFS 0215
x-cff: B
etag: "5fff190c-5958"
content-type: font/woff2
access-control-allow-origin: *
cache-control: max-age=4838400
cf4age: 3072
accept-ranges: bytes
expires: Tue, 27 Apr 2021 16:27:46 GMT

GET
H2 200 opensans-semibold-webfont.woff2
cdn.arstechnica.net/wp-content/themes/ars/assets/fonts/ 19 KB
19 KB 209ms
139ms Font
font/woff2 205.234.175.175
SERVERCENTRAL

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.arstechnica.net/wp-content/themes/ars/assets/fonts/opensans-semibold-webfont.woff2
Requested by: Host: cdn.arstechnica.net
URL: https://cdn.arstechnica.net/wp-content/themes/ars/assets/css/main-d2da6083f3.css
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 205.234.175.175 , United States, ASN23352 (SERVERCENTRAL, US),
Reverse DNS: vip1.G-anycast1.cachefly.net
Software: CFS 0215 /
Resource Hash: 1f9cd4a445ba85172da6090dd7b95edf55fd9e81ddb193e0b78093c1afa84378

Request headers

Origin: https://arstechnica.com
Referer: https://cdn.arstechnica.net/wp-content/themes/ars/assets/css/main-d2da6083f3.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 02 Mar 2021 16:27:46 GMT
x-cf3: H
cf4ttl: 43200.000
x-cf1: 14961:fB.fra2:co:1525808045:cacheN.fra2-01:H
content-length: 18972
x-cf-tsc: 1611773143
x-cf2: H
last-modified: Wed, 13 Jan 2021 16:00:12 GMT
server: CFS 0215
x-cff: B
etag: "5fff190c-4a1c"
content-type: font/woff2
access-control-allow-origin: *
cache-control: max-age=4838400
cf4age: 14416
accept-ranges: bytes
expires: Tue, 27 Apr 2021 16:27:46 GMT

GET
H2 200 opensans-semibolditalic-webfont.woff2
cdn.arstechnica.net/wp-content/themes/ars/assets/fonts/ 20 KB
21 KB 122ms
53ms Font
font/woff2 205.234.175.175
SERVERCENTRAL

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.arstechnica.net/wp-content/themes/ars/assets/fonts/opensans-semibolditalic-webfont.woff2
Requested by: Host: cdn.arstechnica.net
URL: https://cdn.arstechnica.net/wp-content/themes/ars/assets/css/main-d2da6083f3.css
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 205.234.175.175 , United States, ASN23352 (SERVERCENTRAL, US),
Reverse DNS: vip1.G-anycast1.cachefly.net
Software: CFS 0215 /
Resource Hash: 59201950b83489808587827b4050ffe0597992825daa88c227476cdbbf8ca282

Request headers

Origin: https://arstechnica.com
Referer: https://cdn.arstechnica.net/wp-content/themes/ars/assets/css/main-d2da6083f3.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 02 Mar 2021 16:27:46 GMT
x-cf3: H
cf4ttl: 43200.000
x-cf1: 14961:fB.fra2:co:1525808045:cacheN.fra2-01:H
content-length: 20872
x-cf-tsc: 1611773143
x-cf2: H
last-modified: Wed, 13 Jan 2021 16:00:12 GMT
server: CFS 0215
x-cff: B
etag: "5fff190c-5188"
content-type: font/woff2
access-control-allow-origin: *
cache-control: max-age=4838400
cf4age: 14416
accept-ranges: bytes
expires: Tue, 27 Apr 2021 16:27:46 GMT

GET
H2 200 opensans-bold-webfont.woff2
cdn.arstechnica.net/wp-content/themes/ars/assets/fonts/ 19 KB
19 KB 182ms
114ms Font
font/woff2 205.234.175.175
SERVERCENTRAL

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.arstechnica.net/wp-content/themes/ars/assets/fonts/opensans-bold-webfont.woff2
Requested by: Host: cdn.arstechnica.net
URL: https://cdn.arstechnica.net/wp-content/themes/ars/assets/css/main-d2da6083f3.css
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 205.234.175.175 , United States, ASN23352 (SERVERCENTRAL, US),
Reverse DNS: vip1.G-anycast1.cachefly.net
Software: CFS 0215 /
Resource Hash: 86096831a70c72ac0c08f5e65ae92d98330d9fd2b7511dde65ff50b8a16bfd9a

Request headers

Origin: https://arstechnica.com
Referer: https://cdn.arstechnica.net/wp-content/themes/ars/assets/css/main-d2da6083f3.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 02 Mar 2021 16:27:46 GMT
x-cf3: H
cf4ttl: 43200.000
x-cf1: 14961:fB.fra2:co:1525808045:cacheN.fra2-01:H
content-length: 19516
x-cf-tsc: 1611773143
x-cf2: H
last-modified: Wed, 13 Jan 2021 16:00:12 GMT
server: CFS 0215
x-cff: B
etag: "5fff190c-4c3c"
content-type: font/woff2
access-control-allow-origin: *
cache-control: max-age=4838400
cf4age: 14416
accept-ranges: bytes
expires: Tue, 27 Apr 2021 16:27:46 GMT

GET
H2 200 bitter-bold-webfont.woff2
cdn.arstechnica.net/wp-content/themes/ars/assets/fonts/ 22 KB
22 KB 169ms
101ms Font
font/woff2 205.234.175.175
SERVERCENTRAL

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.arstechnica.net/wp-content/themes/ars/assets/fonts/bitter-bold-webfont.woff2
Requested by: Host: cdn.arstechnica.net
URL: https://cdn.arstechnica.net/wp-content/themes/ars/assets/css/main-d2da6083f3.css
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 205.234.175.175 , United States, ASN23352 (SERVERCENTRAL, US),
Reverse DNS: vip1.G-anycast1.cachefly.net
Software: CFS 0215 /
Resource Hash: 807271433f80bb33654a84ec904035be3d2b34e505a051e3469a47fe39ccb752

Request headers

Origin: https://arstechnica.com
Referer: https://cdn.arstechnica.net/wp-content/themes/ars/assets/css/main-d2da6083f3.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 02 Mar 2021 16:27:46 GMT
x-cf3: H
cf4ttl: 43200.000
x-cf1: 14961:fB.fra2:co:1525808045:cacheN.fra2-01:H
content-length: 22104
x-cf-tsc: 1611773143
x-cf2: H
last-modified: Wed, 13 Jan 2021 16:00:12 GMT
server: CFS 0215
x-cff: B
etag: "5fff190c-5658"
content-type: font/woff2
access-control-allow-origin: *
cache-control: max-age=4838400
cf4age: 14415
accept-ranges: bytes
expires: Tue, 27 Apr 2021 16:27:46 GMT

GET
H2 200 outbrain.js Show response
widgets.outbrain.com/ 167 KB
56 KB 867ms
742ms Script
application/x-javascript 23.202.53.159
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://widgets.outbrain.com/outbrain.js?_=1614702466026
Requested by: Host: cdn.arstechnica.net
URL: https://cdn.arstechnica.net/wp-content/themes/ars/assets/js/main-e7aebfbfda.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.202.53.159 Vienna, Austria, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-202-53-159.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 4f27473112250ff771b069a5640dd77e4b4618a8205203aadf9b1ca1fc63079e

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 02 Mar 2021 16:27:46 GMT
content-encoding: gzip
last-modified: Mon, 01 Mar 2021 12:01:13 GMT
etag: W/"29a74-F28YWpw2S8ZsTjeEHDiOaYplWa0"
vary: Accept-Encoding
edge-cache-tag: widget-cheetah
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=14400
access-control-allow-credentials: false
cookie: CheetahStaging=true
access-control-allow-methods: GET,POST
x-traceid: a1f98246a90da978006abe556bb94912
timing-allow-origin: *, *
expires: Tue, 02 Mar 2021 20:27:46 GMT

GET
H/1.1 200
OK video_groups Show response
api.cnevids.com/v1/ 4 KB
1 KB 574ms
141ms XHR
application/json 18.211.112.77
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://api.cnevids.com/v1/video_groups?filters={%22channel_key%22:%22arstechnica%22}&pagesize=20&endpoint=oo.arstechnica

Requested by

Host: cdn.arstechnica.net
URL: https://cdn.arstechnica.net/wp-content/themes/ars/assets/js/main-e7aebfbfda.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

18.211.112.77 , United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-18-211-112-77.compute-1.amazonaws.com

Software

nginx/1.18.0 /

Resource Hash

09129fc345d4d48e4b4fab5c7d0a2d789540768e7b65d92553975f58c28c6594

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept: application/json, text/*
Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Tue, 02 Mar 2021 16:27:46 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
X-Permitted-Cross-Domain-Policies: none
Status: 200 OK
Access-Control-Max-Age: 1728000
Connection: keep-alive
Content-Length: 663
X-XSS-Protection: 1; mode=block
X-Request-Id: cf197034-f4dd-4d38-9ebc-5c9c7b87d176
X-Runtime: 0.002412
X-Backend-Node: 10.110.120.151
Referrer-Policy: strict-origin-when-cross-origin
Server: nginx/1.18.0
X-Frame-Options: SAMEORIGIN
ETag: W/"5d825bcb9a485818efc22956afc423f5"
X-Download-Options: noopen
Vary: Accept-Encoding, Origin
Access-Control-Allow-Methods: GET, PUT, POST, DELETE, OPTIONS
Content-Type: application/json; charset=utf-8
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers
Cache-Control: max-age=0, private, must-revalidate

GET
H2 200 otBannerSdk.js Show response
cdn.cookielaw.org/scripttemplates/6.13.0/ 366 KB
81 KB 16ms
15ms Script
application/javascript 2606:4700::6810:9440
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/6.13.0/otBannerSdk.js

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:9440 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

078981fc821f3cf39ab491128cca5f9e9f9aeda1987a4baf81ce5ddc3bbe860c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Tue, 02 Mar 2021 16:27:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
content-md5: 2hymstrqSFu7c4C3tsoodg==
age: 2963441
vary: Accept-Encoding
content-length: 82575
cf-request-id: 08955d6c370000536378bcf000000001
x-ms-lease-status: unlocked
last-modified: Mon, 25 Jan 2021 02:48:55 GMT
server: cloudflare
etag: 0x8D8C0DBC19F6B64
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/javascript
access-control-allow-origin: *
x-ms-request-id: 46507a2c-101e-000d-228d-f437ea000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=691200
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 629bfe8d2d7a5363-FRA
expires: Wed, 10 Mar 2021 16:27:46 GMT

GET
H/1.1 200
OK /
srv-1970-01-01-00.pixel.parsely.com/plogger/ 43 B
229 B 548ms
134ms Image
image/gif 3.208.40.114
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://srv-1970-01-01-00.pixel.parsely.com/plogger/
Requested by: Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.208.40.114 , United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-208-40-114.compute-1.amazonaws.com
Software: nginx /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Tue, 02 Mar 2021 16:27:46 GMT
Last-Modified: Mon, 28 Sep 1970 06:00:00 GMT
Server: nginx
Connection: keep-alive
Content-Length: 43
Content-Type: image/gif

GET
H/1.1 200
OK /
fpa-events.arstechnica.com/plogger/ 43 B
229 B 562ms
135ms Image
image/gif 3.214.160.249
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://fpa-events.arstechnica.com/plogger/?rand=1614702466132&plid=81925661&idsite=arstechnica.com&url=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2021%2F02%2Fnew-malware-found-on-30000-macs-has-security-pros-stumped%2F&urlref=&screen=1600x1200%7C1600x1200%7C24&data=%7B%7D&sid=1&surl=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2021%2F02%2Fnew-malware-found-on-30000-macs-has-security-pros-stumped%2F&sref=&sts=1614702466116&slts=0&title=New+malware+found+on+30%2C000+Macs+has+security+pros+stumped+%7C+Ars+Technica&date=Tue+Mar+02+2021+17%3A27%3A46+GMT%2B0100+(Central+European+Standard+Time)&action=pageview&pvid=46833363&u=pid%3Dfc4567bfef76bfde02fd0556c50453f2
Requested by: Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.214.160.249 , United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-214-160-249.compute-1.amazonaws.com
Software: nginx /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Tue, 02 Mar 2021 16:27:46 GMT
Last-Modified: Mon, 28 Sep 1970 06:00:00 GMT
Server: nginx
Connection: keep-alive
Content-Length: 43
Content-Type: image/gif

GET
H/1.1 200
OK ars-technica.config.js Show response
pixel.condenastdigital.com/config/v2/production/ 8 KB
2 KB 161ms
49ms Script
application/javascript 151.101.192.239
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://pixel.condenastdigital.com/config/v2/production/ars-technica.config.js
Requested by: Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.192.239 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 281ba70d6e7e5c193cd6b4bbb0c656e15e9479573bc02debaeba7c084c37bb21

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Tue, 02 Mar 2021 16:27:46 GMT
Content-Encoding: gzip
Age: 472478
X-Cache: HIT, HIT
Connection: keep-alive
Content-Length: 1288
x-amz-id-2: +X2HcG3BfQa7+dowxe4Wp3luQ3d0/Hjd606ynvTewD/DkZG2ay+Zmkq2eK2tcjU+esvdLdLhlr4=
X-Served-By: cache-bwi5164-BWI, cache-hhn4022-HHN
Access-Control-Allow-Origin: *
Last-Modified: Fri, 08 Jan 2021 21:37:26 GMT
Server: AmazonS3
X-Timer: S1614702466.277161,VS0,VE0
ETag: "6fc027161d3e51fb7aa83372ee003894"
Vary: Accept-Encoding
x-amz-request-id: 391E05D0767367C9
Via: 1.1 varnish, 1.1 varnish
Expires: Thu, 18 Feb 2021 15:12:44 GMT
Cache-Control: no-cache, public, max-age=604800
Accept-Ranges: bytes
Content-Type: application/javascript
X-Cache-Hits: 1, 2081

GET
H2 200 pubads_impl_2021030101.js Show response
securepubads.g.doubleclick.net/gpt/ 282 KB
100 KB 162ms
57ms Script
text/javascript 142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021030101.js?31060315

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

sffe /

Resource Hash

c183713781265a2abdc03eab5050b102a17a1170eaa908604e61fc9f07c9aad4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 02 Mar 2021 16:27:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Mon, 01 Mar 2021 09:37:48 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, immutable, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 101543
x-xss-protection: 0
expires: Tue, 02 Mar 2021 16:27:46 GMT

GET
H2 200 plugin.js Show response
plugin.mediavoice.com/ 359 KB
133 KB 19ms
11ms Script
application/javascript 2606:4700::6813:d983
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://plugin.mediavoice.com/plugin.js
Requested by: Host: cdn.mediavoice.com
URL: https://cdn.mediavoice.com/nativeads/script/condenastcorporate/conde-asa-polar-master.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6813:d983 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7637a6c8fa6c7c9ce19cebb23b29bf76e3ccec9fdf037483433262df92115388

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 02 Mar 2021 16:27:46 GMT
content-encoding: gzip
cf-cache-status: HIT
age: 41052
content-type: application/javascript
content-length: 135504
cf-request-id: 08955d6c8c00002c56778f2000000001
timing-allow-origin: *
access-control-allow-origin: *
last-modified: Mon, 01 Mar 2021 17:03:27 GMT
server: cloudflare
etag: W/"603d1e5f-59cd5"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, OPTIONS
x-varnish: 2252457633 2252457594
via: 1.1 varnish
cache-control: max-age=43200
access-control-allow-credentials: true
accept-ranges: bytes
cf-ray: 629bfe8da9d22c56-FRA
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
expires: Tue, 02 Mar 2021 17:03:33 GMT

GET
H2 200 condenastcorporate Show response
polarcdn-terrax.com/nativeads/v1.4.0/json/hostname/arstechnica.com/organization/ 208 B
649 B 46ms
23ms XHR
application/json 2606:4700::6811:4032
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://polarcdn-terrax.com/nativeads/v1.4.0/json/hostname/arstechnica.com/organization/condenastcorporate
Requested by: Host: cdn.mediavoice.com
URL: https://cdn.mediavoice.com/nativeads/script/condenastcorporate/conde-asa-polar-master.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:4032 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8dc40a5096530714279199bd98ffbe44f3108bf9dd183ec74d85f69705d86e25

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 02 Mar 2021 16:27:46 GMT
content-encoding: gzip
server: cloudflare
etag: W/"f3cb63b5151ee861d177a2136e7d9989"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/json; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: X-Country, CF-Ray
cache-control: max-age=3600
x-country: DE
cf-ray: 629bfe8dcdc216ee-FRA
cf-request-id: 08955d6c9c000016ee1ea66000000001

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 46 KB
19 KB 6ms
5ms Script
text/javascript 2a00:1450:4001:80f::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-NLXNPCQ

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

0f3be44690ae9914ae3e47b7752e1bdea316f09938e9094f99e0de19ccd8987a

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Fri, 05 Feb 2021 21:33:27 GMT
server: Golfe2
age: 1510
date: Tue, 02 Mar 2021 16:02:36 GMT
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 18980
expires: Tue, 02 Mar 2021 18:02:36 GMT

GET
H2 200 v2 Show response
z-na.associates-amazon.com/onetag/ 11 KB
4 KB 169ms
53ms Script
text/javascript 13.225.82.136
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://z-na.associates-amazon.com/onetag/v2?MarketPlace=US&instanceId=e6160dfa-32a7-4b0e-9675-d18902339f1e
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-NLXNPCQ
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.82.136 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-82-136.fra2.r.cloudfront.net
Software: Server /
Resource Hash: 7475f5c70d3b6020b6f4621b2e69fba3360bea00a913e60b085af165b93842ec

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 02 Mar 2021 05:28:35 GMT
content-encoding: gzip
accept-charset: UTF-8
server: Server
age: 39551
x-amz-rid: 2YVJAABC4P466Y7JS3MQ
vary: accept-encoding,Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/javascript
access-control-allow-origin: *
x-amz-cf-pop: FRA2-C2
x-amz-cf-id: SZtByxvb5rAQZiGQ6QmYWGALoCtIL92ANeBzA-gedpNCCFjMyl4PPQ==
via: 1.1 04ce5a607a98db6d08257633417b84d7.cloudfront.net (CloudFront)

POST
H2

200

/ Show response
r.skimresources.com/api/
Redirect Chain

https://r.skimresources.com/api/
https://r.skimresources.com/api/?xguid=01EZSW8NA1NDWXEYYZ4ZDCTVWK&persistence=1&checksum=f0ed2b0e08e3c2fb44b30aa39362992ad7c919ff97a03c8a39df4cc7b769262f

190 B
502 B

60ms
60ms

XHR
application/json

35.190.59.101
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://r.skimresources.com/api/?xguid=01EZSW8NA1NDWXEYYZ4ZDCTVWK&persistence=1&checksum=f0ed2b0e08e3c2fb44b30aa39362992ad7c919ff97a03c8a39df4cc7b769262f

Requested by

Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

35.190.59.101 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

101.59.190.35.bc.googleusercontent.com

Software

openresty/1.11.2.5 /

Resource Hash

ab42a6882b7ca7c6dd39ff409d4d26cb0f7969b608e077331b3afc1a0a72087b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 02 Mar 2021 16:27:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: openresty/1.11.2.5
strict-transport-security: max-age=31536000
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
access-control-allow-origin: https://arstechnica.com
vary: Accept-Encoding
access-control-allow-credentials: true
content-type: application/json
alt-svc: clear
via: 1.1 google

Redirect headers

date: Tue, 02 Mar 2021 16:27:46 GMT
via: 1.1 google
server: openresty/1.11.2.5
access-control-allow-origin: https://arstechnica.com
strict-transport-security: max-age=31536000
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
location: https://r.skimresources.com/api/?xguid=01EZSW8NA1NDWXEYYZ4ZDCTVWK&persistence=1&checksum=f0ed2b0e08e3c2fb44b30aa39362992ad7c919ff97a03c8a39df4cc7b769262f
access-control-allow-credentials: true
content-type: text/html
alt-svc: clear
content-length: 193

GET
H2 206 robots.txt
t.skimresources.com/api/v2/ Frame 5D97 0
102 B 160ms
60ms Image
text/plain 35.201.67.47
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://t.skimresources.com/api/v2/robots.txt?__skimjs_preflight__please_ignore__=true&rnd=0.557321160330501
Requested by: Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.201.67.47 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 47.67.201.35.bc.googleusercontent.com
Software: Python/3.7 aiohttp/3.5.4 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 02 Mar 2021 16:27:46 GMT
via: 1.1 google
server: Python/3.7 aiohttp/3.5.4
alt-svc: clear
content-length: 0
content-type: text/plain charset=UTF-8

GET
H2 200 px.gif
p.skimresources.com/ 43 B
102 B 149ms
54ms Image
image/gif 35.190.91.160
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://p.skimresources.com/px.gif?ch=1&rn=8.192408148913477
Requested by: Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.190.91.160 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 160.91.190.35.bc.googleusercontent.com
Software: Skimlinks Pixel 1.0 /
Resource Hash: dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 02 Mar 2021 16:27:46 GMT
via: 1.1 google
server: Skimlinks Pixel 1.0
p3p: policyref="http://skimlinks.com/w3c/p3p.xml", CP="NOI DSP COR CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
alt-svc: clear
content-length: 43
content-type: image/gif

GET
H2 200 px.gif
p.skimresources.com/ 43 B
244 B 148ms
53ms Image
image/gif 35.190.91.160
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://p.skimresources.com/px.gif?ch=2&rn=8.192408148913477
Requested by: Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.190.91.160 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 160.91.190.35.bc.googleusercontent.com
Software: Skimlinks Pixel 1.0 /
Resource Hash: dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 02 Mar 2021 16:27:46 GMT
via: 1.1 google
server: Skimlinks Pixel 1.0
p3p: policyref="http://skimlinks.com/w3c/p3p.xml", CP="NOI DSP COR CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
alt-svc: clear
content-length: 43
content-type: image/gif

GET
H2 200 yi.js Show response
mb.moatads.com/ 1 KB
2 KB 226ms
73ms Script
text/html 54.194.105.192
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://mb.moatads.com/yi.js?ud=undefined&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRGt%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%5Elv%3Ch%2CeI8!A2QnbjPSI.%24ki)sV~1HmDkx2KD5pf5%5BG%5BZFZ8R6tbK0pH%23bU%24(9N%2CNJJ)%2CW%2FKo7FY&th=3645823656&tf=Id8O-DxRgoC-xFQTS-CSa7H-XSSptC-j7VIQD-xFQTS-nMzjG-&vi=111111&qp=00000&is=BBBBB2BBEYBvGl2BBCBBtUTBBRmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7OxBb8MxOtJYHCBdm5kBhBBC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBSqj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNBBBBBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbBBC4ehueB57NG9aJeRzBqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=null&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-60&qa=1600&qb=1200&qi=1600&qj=1200&to=00&po=1-0020002000002120&vy=&qr=0&url=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2021%2F02%2Fnew-malware-found-on-30000-macs-has-security-pros-stumped%2F&confidence=2&pcode=condenastprebidheader987326845656&callback=MoatNadoAllJsonpRequest_82608301
Requested by: Host: z.moatads.com
URL: https://z.moatads.com/condenastprebidheader987326845656/moatheader.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.194.105.192 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-194-105-192.eu-west-1.compute.amazonaws.com
Software: TornadoServer/4.5.3 /
Resource Hash: 81469a461efda75b24794f73dadc9ce5606d1bd75b505f5d117d89e9a562813b

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 02 Mar 2021 16:27:46 GMT
cache-control: max-age=900
server: TornadoServer/4.5.3
timing-allow-origin: *
etag: "349a210fcf8552bc3cb53876918c4a081af8262f"
content-length: 1529
content-type: text/html; charset=UTF-8

GET
H2 200 pixel.gif
px.moatads.com/ 43 B
260 B 65ms
63ms Image
image/gif 23.202.53.245
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=17&t=1614702466257&de=573936705493&d=CONDENAST_PREBID_HEADER1%3ADesktop%3A-%3A-&i=YIELD_INTELLIGENCE_INTERNAL1&ar=31f9dba90d-clean&iw=96661e7&zMoatRendered=0&zMoatSlotTargetingLoaded=0&zMoatSlotTargetingSet=0&zMoatPageDataTargetingSet=0&zMoatSafetyTargetingSet=0&zMoatEmptySlot=0&zMoatNadoDataLoadTime=Not%20Loaded&zMoatAllDataLoadTime=Not%20Loaded&bo=arstechnica.com&bd=arstechnica.com%2Finformation-technology%2F2021%2F02%2Fnew-malware-found-on-30000-macs-has-security-pros-stumped&ac=1&bq=11&f=0&na=1764382347&cs=0
Requested by: Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.202.53.245 Vienna, Austria, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-202-53-245.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 02 Mar 2021 16:27:46 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: AkamaiNetStorage
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Tue, 02 Mar 2021 16:27:46 GMT

GET
H2 200 aps_csm.js Show response
c.amazon-adsystem.com/bao-csm/aps-comm/ 6 KB
3 KB 156ms
53ms XHR
application/javascript 13.224.192.34
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/bao-csm/aps-comm/aps_csm.js
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.224.192.34 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-192-34.fra2.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-version-id: 8kbPIzTLk7_TMvnggUSDACBTugDfX2qC
content-encoding: gzip
etag: W/"a4d296427fc806b21335359e398c025c"
age: 69019
x-cache: Hit from cloudfront
access-control-max-age: 3000
access-control-allow-origin: *
last-modified: Fri, 29 Jan 2021 06:42:57 GMT
server: AmazonS3
date: Mon, 01 Mar 2021 21:17:28 GMT
vary: Origin
access-control-allow-methods: GET
content-type: application/javascript
via: 1.1 5a5b94c62ea85e0c0d78b169589b08b5.cloudfront.net (CloudFront)
cache-control: public, max-age=86400
x-amz-cf-pop: FRA2-C1
x-amz-cf-id: uc_zuD_t7vVwfPdAhU68haU2cqnbYE3Ki13PvqCiTtoSU3MlsFyblQ==

GET
H2 200 en.json Show response
cdn.cookielaw.org/consent/b10882a1-8446-4e7d-bfb2-ce2c770ad910/ef17d20e-0b37-40e7-a82c-27f698052aea/ 131 KB
24 KB 28ms
28ms Fetch
application/x-javascript 2606:4700::6810:9440
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/consent/b10882a1-8446-4e7d-bfb2-ce2c770ad910/ef17d20e-0b37-40e7-a82c-27f698052aea/en.json

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/6.13.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:9440 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6778c1cbaff93c029c520c00f0d3463b7f296adea236f22410bbabbebc8a6cea

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Tue, 02 Mar 2021 16:27:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
content-md5: hC6H6XcPLsMx/ml+mSItEQ==
age: 1770
vary: Accept-Encoding
content-length: 24346
cf-request-id: 08955d6d2e0000535dc2915000000001
x-ms-lease-status: unlocked
last-modified: Tue, 09 Feb 2021 23:09:35 GMT
server: cloudflare
etag: 0x8D8CD4FC4AA4424
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/x-javascript
access-control-allow-origin: *
x-ms-request-id: c9f455fe-601e-0020-713b-04b42a000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=14400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 629bfe8eafe9535d-FRA

GET
H2 200 iab2Data.json Show response
cdn.cookielaw.org/vendorlist/ 235 KB
32 KB 19ms
18ms Fetch
application/x-javascript 2606:4700::6810:9440
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/vendorlist/iab2Data.json

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/6.13.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:9440 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3c4c9e412b61eeff2c5e3743ef2a3cb0b6c0e11961bfb033a04be504c58bf081

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Tue, 02 Mar 2021 16:27:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
content-md5: KKfOxwfYUO1ehx4Icz9g7Q==
age: 7472
vary: Accept-Encoding
content-length: 32710
cf-request-id: 08955d6d2c0000535d773aa000000001
x-ms-lease-status: unlocked
last-modified: Tue, 02 Mar 2021 14:19:03 GMT
server: cloudflare
etag: 0x8D8DD8621BDB2BC
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/x-javascript
access-control-allow-origin: *
x-ms-request-id: 46f8b66e-a01e-0097-7e6f-0fbb2f000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=14400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 629bfe8eafeb535d-FRA

GET
H2 200 otTCF.js Show response
cdn.cookielaw.org/scripttemplates/6.13.0/ 67 KB
15 KB 15ms
14ms Script
application/javascript 2606:4700::6810:9440
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/6.13.0/otTCF.js

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/6.13.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:9440 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

13f63ab5fa8d3973eef6d6366052135fb3958b54ca2149cc691864b03ed7d848

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Tue, 02 Mar 2021 16:27:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
content-md5: O4pYvrmqusOrAenZ/pvytA==
age: 2513087
vary: Accept-Encoding
content-length: 14815
cf-request-id: 08955d6d2a0000536381131000000001
x-ms-lease-status: unlocked
last-modified: Thu, 28 Jan 2021 07:38:01 GMT
server: cloudflare
etag: 0x8D8C35FA3CAAE16
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/javascript
access-control-allow-origin: *
x-ms-request-id: 972eb4c8-701e-015d-1ea5-f86eb7000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=691200
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 629bfe8ea89e5363-FRA
expires: Wed, 10 Mar 2021 16:27:46 GMT

GET
H/1.1 200
OK recommendations Show response
api.condenast.io/v1/ 11 KB
4 KB 352ms
241ms Fetch
application/json 151.101.192.239
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://api.condenast.io/v1/recommendations?applicationID=cne-interlude-arstechnica&brand=arstechnica&url=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2021%2F02%2Fnew-malware-found-on-30000-macs-has-security-pros-stumped%2F&filter%5Bstrategy%5D=POPULAR&filter%5BcontentType%5D=CNEVIDEO&filter%5Blanguage%5D=en&page%5Bsize%5D=5
Requested by: Host: player.cnevids.com
URL: https://player.cnevids.com/interlude/arstechnica.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.192.239 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx/1.15.8 /
Resource Hash: e67cf300c813f9b1e1524d9fe95e8ed82aa5d2902cb3d82a9580776d2faf8604

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Tue, 02 Mar 2021 16:27:46 GMT
content-encoding: gzip
X-Backend: 2SrKDXXFWNz87LdtRpzPzK--F_api_eu_central_1_condenast_io
access-control-allow-origin: https://arstechnica.com
transfer-encoding: chunked
X-Cache: MISS
Connection: keep-alive
X-Served-By: cache-hhn4027-HHN
Server: nginx/1.15.8
X-Timer: S1614702466.499849,VS0,VE190
Vary: origin,accept-encoding, Accept-Encoding, Origin
Content-Type: application/json;charset=utf-8
Via: 1.1 varnish
access-control-expose-headers: WWW-Authenticate,Server-Authorization
cache-control: private, max-age=0
access-control-allow-credentials: true
Accept-Ranges: bytes
X-Cache-Hits: 0

GET
H3-Q050 200 linkid.js Show response
www.google-analytics.com/plugins/ua/ 2 KB
1 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:80f::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/plugins/ua/linkid.js

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

92fca55833f48b4289ac8f1cedd48752b580fce4ec4b5d81670b8193d6e51b54

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 02 Mar 2021 16:25:55 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 22 Oct 2019 18:15:00 GMT
server: sffe
age: 111
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=3600
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 859
x-xss-protection: 0
expires: Tue, 02 Mar 2021 17:25:55 GMT

POST
H2 200 publisher:getClientId Show response
ampcid.google.com/v1/ 74 B
535 B 34ms
14ms XHR
application/json 2a00:1450:4001:827::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ampcid.google.com/v1/publisher:getClientId?key=AIzaSyA65lEHUEizIsNtlbNo-l2K18dT680nsaM

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

991bfe84fec788f2b7d432b99a60c1e2aa2e799bc0137da8cf478299d0fc9a10

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

date: Tue, 02 Mar 2021 16:27:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
server: ESF
x-frame-options: SAMEORIGIN
content-type: application/json; charset=UTF-8
access-control-allow-origin: https://arstechnica.com
access-control-expose-headers: vary,vary,vary,content-encoding,date,server,content-length
cache-control: private
access-control-allow-credentials: true
vary: Origin, X-Origin, Referer
content-length: 94
x-xss-protection: 0

GET
H/1.1 200
OK sparrow.min.js Show response
pixel.condenastdigital.com/ 39 KB
14 KB 54ms
53ms Script
application/javascript 151.101.192.239
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://pixel.condenastdigital.com/sparrow.min.js
Requested by: Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.192.239 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 265974f7dd29be4bae22250bd4afd4e57a20eb3c12dc8f623218e1cd8b03fd76

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Tue, 02 Mar 2021 16:27:46 GMT
Content-Encoding: gzip
Age: 483966
X-Cache: HIT, HIT
Connection: keep-alive
Content-Length: 13716
x-amz-id-2: hfLK0pwdDnEjSdruA8fTQrWOgnwI7P5RWa+a6sGEKnUpRT0fmaOcongvYtbKQ3gTGNRmK48zs2c=
X-Served-By: cache-bwi5145-BWI, cache-hhn4022-HHN
Access-Control-Allow-Origin: *
Last-Modified: Mon, 11 Jan 2021 15:41:14 GMT
Server: AmazonS3
X-Timer: S1614702466.436768,VS0,VE0
ETag: "30d7c159549adc8b40ad11e587074634"
Vary: Accept-Encoding
x-amz-request-id: 480E95391513A21E
Via: 1.1 varnish, 1.1 varnish
Expires: Thu, 14 Jan 2021 15:38:28 GMT
Cache-Control: no-cache, public, max-age=604800
Accept-Ranges: bytes
Content-Type: application/javascript
X-Cache-Hits: 1, 38906

GET
H2 200 otCenterRounded.json Show response
cdn.cookielaw.org/scripttemplates/6.13.0/assets/ 9 KB
3 KB 10ms
10ms Fetch
application/json 2606:4700::6810:9440
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/6.13.0/assets/otCenterRounded.json

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/6.13.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:9440 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

19c68177806d520a04ae71ded68085e5eef7f05b209ec4896efafb0f164432d7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Tue, 02 Mar 2021 16:27:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
content-md5: L0sZwKqEvb9GD/IAcZBCVQ==
age: 1239042
vary: Accept-Encoding
content-length: 2421
cf-request-id: 08955d6df80000535dadbb1000000001
x-ms-lease-status: unlocked
last-modified: Thu, 28 Jan 2021 07:37:53 GMT
server: cloudflare
etag: 0x8D8C35F9F60BD54
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/json
access-control-allow-origin: *
x-ms-request-id: 9fb1a7c8-901e-0094-5d3c-04b828000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=691200
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 629bfe8ffa49535d-FRA
expires: Wed, 10 Mar 2021 16:27:46 GMT

POST
H2 200 publisher:getClientId Show response
ampcid.google.de/v1/ 3 B
464 B 35ms
16ms XHR
application/json 2a00:1450:4001:829::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ampcid.google.de/v1/publisher:getClientId?key=AIzaSyA65lEHUEizIsNtlbNo-l2K18dT680nsaM

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

date: Tue, 02 Mar 2021 16:27:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
server: ESF
x-frame-options: SAMEORIGIN
content-type: application/json; charset=UTF-8
access-control-allow-origin: https://arstechnica.com
access-control-expose-headers: vary,vary,vary,content-encoding,date,server,content-length
cache-control: private
access-control-allow-credentials: true
vary: Origin, X-Origin, Referer
content-length: 23
x-xss-protection: 0

GET
H/1.1 200
OK andoncord Show response
assoc-na.associates-amazon.com/onetag/ 16 B
375 B 432ms
148ms XHR
application/json 52.94.243.89
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://assoc-na.associates-amazon.com/onetag/andoncord
Requested by: Host: z-na.associates-amazon.com
URL: https://z-na.associates-amazon.com/onetag/v2?MarketPlace=US&instanceId=e6160dfa-32a7-4b0e-9675-d18902339f1e
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.94.243.89 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: Server /
Resource Hash: c462d460eab61de19f36cc384c99666e5bf65eaeba0c12b8f594c5410c01f220

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Tue, 02 Mar 2021 16:27:46 GMT
Server: Server
x-amz-rid: YDGSQ6Q97KHPZRTBF0EC
Vary: Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Content-Type: application/json
Access-Control-Allow-Origin: https://arstechnica.com
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 16

GET
H/1.1 200
OK / Show response
infinityid.condenastdigital.com/ 36 B
1 KB 576ms
140ms XHR
text/plain 54.145.213.132
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://infinityid.condenastdigital.com/?rand=1614702466603
Requested by: Host: pixel.condenastdigital.com
URL: https://pixel.condenastdigital.com/sparrow.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.145.213.132 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx/1.15.8 /
Resource Hash: 61427e2bab387b8f902367d19f7a7f302c64419d04c302bee5ecc994e9ec5970

Request headers

Accept: text/plain
Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Tue, 02 Mar 2021 16:27:47 GMT
content-encoding: gzip
Server: nginx/1.15.8
vary: origin,accept-encoding
Content-Type: text/plain; charset=utf-8
access-control-allow-origin: https://arstechnica.com
access-control-expose-headers: WWW-Authenticate,Server-Authorization
cache-control: no-cache
access-control-allow-credentials: true
Connection: keep-alive
transfer-encoding: chunked
expires: 0

GET
H/1.1 200
OK content Show response
4d.condenastdigital.com/ 4 KB
2 KB 587ms
159ms XHR
application/json 54.209.211.127
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://4d.condenastdigital.com/content?url=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2021%2F02%2Fnew-malware-found-on-30000-macs-has-security-pros-stumped%2F
Requested by: Host: pixel.condenastdigital.com
URL: https://pixel.condenastdigital.com/sparrow.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.209.211.127 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-209-211-127.compute-1.amazonaws.com
Software: /
Resource Hash: 94ea4c125ce31b5a17e000088c07129c7b73a225ae5f87d58b82490e663413d7

Request headers

Accept: text/plain
Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Tue, 02 Mar 2021 16:27:47 GMT
content-encoding: gzip
transfer-encoding: chunked
Content-Type: application/json; charset=utf-8
access-control-allow-origin: https://arstechnica.com
access-control-expose-headers: WWW-Authenticate,Server-Authorization
cache-control: no-cache
access-control-allow-credentials: true
Connection: keep-alive

GET
H/1.1 200
OK track
capture.condenastdigital.com/ 48 B
48 B 548ms
135ms Image
image/gif 3.223.14.133
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://capture.condenastdigital.com/track?_ts=2021-03-02T16%3A27%3A46.604Z&_t=pubadsReady&cBr=Ars%20Technica&cKe=M1%7CMacOS%7CMacs%7Cmalware&cCh=information%20technology&cTi=New%20malware%20found%20on%2030%2C000%20Macs%20has%20security%20pros%20stumped&cTy=article%7Creport&cCu=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2021%2F02%2Fnew-malware-found-on-30000-macs-has-security-pros-stumped%2F&org_id=4gKgcFGUFUvCGFzHakTPfYp85Yi8&cCl=939&cId=1744063&ccS=web&cPv=all&pHr=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2021%2F02%2Fnew-malware-found-on-30000-macs-has-security-pros-stumped&pRt=referral&pHp=%2Finformation-technology%2F2021%2F02%2Fnew-malware-found-on-30000-macs-has-security-pros-stumped%2F&pRr=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2021%2F02%2Fnew-malware-found-on-30000-macs-has-security-pros-stumped%2F&pWw=1600&pWh=1200&pPw=1600&pPh=5400&pSw=1600&pSh=1200&uID=0ba4f8f3-3dcb-4625-8858-f8cc027e953a&uNw=1&uUq=1&sID=eeca8fd2-2ede-4309-b7f8-017d7fcdf896&pID=4e78db71-a622-4623-8f8c-129b7f97ef02&uDt=desktop&dim1=%7B%22runtimeId%22%3A%22fxezXopc1n4p3%22%2C%22pageContext%22%3A%7B%22contentType%22%3A%22article%22%2C%22templateType%22%3A%22article%22%2C%22channel%22%3A%22information-technology%22%2C%22slug%22%3A%22new-malware-found-on-30000-macs-has-security-pros-stumped%22%2C%22server%22%3A%22production%22%2C%22keywords%22%3A%7B%22tags%22%3A%5B%22m1%22%2C%22macos%22%2C%22macs%22%2C%22malware%22%5D%2C%22cm%22%3A%5B%5D%2C%22platform%22%3A%5B%22wordpress%22%5D%2C%22copilotid%22%3A%22%22%7D%7D%2C%22version%22%3A%226.43.6%22%7D&_o=ars-technica&_c=ad_metrics&environment=prod&origin=ars-technica
Requested by: Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.223.14.133 , United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-223-14-133.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Access-Control-Allow-Origin: *
Date: Tue, 02 Mar 2021 16:27:47 GMT
Connection: keep-alive
Content-Length: 48
Content-Type: image/gif

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 4 B
87 B 16ms
16ms XHR
text/plain 2a00:1450:400c:c0c::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j88&tid=UA-31997-1&cid=1606731204.1614702467&jid=906665086&gjid=1944876124&_gid=1858219647.1614702467&_u=aGBAgUAjAAQCAE~&z=565138120

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c0c::9a Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
date: Tue, 02 Mar 2021 16:27:46 GMT
content-type: text/plain
access-control-allow-origin: https://arstechnica.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 collect
www.google-analytics.com/ 35 B
86 B 6ms
6ms Image
image/gif 2a00:1450:4001:80f::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j88&a=1804182708&t=pageview&_s=1&dl=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2021%2F02%2Fnew-malware-found-on-30000-macs-has-security-pros-stumped%2F&dr=%2F&dp=%2Finformation-technology%2F2021%2F02%2Fnew-malware-found-on-30000-macs-has-security-pros-stumped%2F&ul=en-us&de=UTF-8&dt=New%20malware%20found%20on%2030%2C000%20Macs%20has%20security%20pros%20stumped%20%7C%20Ars%20Technica&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=aGBAgUAjAAQC~&jid=906665086&gjid=1944876124&cid=1606731204.1614702467&tid=UA-31997-1&_gid=1858219647.1614702467&gtm=2wg2h0NLXNPCQ&cg1=article%7Creport&cg2=information-technology&cg3=information%20technology&cd1=GTM-NLXNPCQ&cd2=258&cd4=&cd6=Tue%20Mar%2002%202021%2017%3A27%3A46%20GMT%2B0100%20(Central%20European%20Standard%20Time)&cd7=1614702466193.wfvpqbi&cd8=-1&cd9=Mozilla%2F5.0%20(Macintosh%3B%20Intel%20Mac%20OS%20X%2010_14_5)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F83.0.4103.61%20Safari%2F537.36&cd10=English&cd11=17&cd12=0&cd13=Tag%20Name%3A%20GA%20-%20Pageview%20-%20Core%20Pageview%20-%20All%20Pages&cd20=none&cd25=Dan%20Goodin&cd26=1744063&cd27=939&cd28=New%20malware%20found%20on%2030%2C000%20Macs%20has%20security%20pros%20stumped&cd29=web&cd32=2021-02-20T15%3A10%3A13%2B00%3A00&cd33=11&cd34=2021-02-22T22%3A03%3A20%2B00%3A00&cd35=M1%7CMacOS%7CMacs%7Cmalware&cd36=web&cd43=Ars%20Technica&cd45=Adblock%20Enabled%20-%20false&cd62=https%3A%2F%2Farstechnica.com%2F%3Fp%3D1744063&cd63=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2021%2F02%2Fnew-malware-found-on-30000-macs-has-security-pros-stumped%2F&cd65=&cd72=1.0.0&cd92=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2021%2F02%2Fnew-malware-found-on-30000-macs-has-security-pros-stumped%2F&cd93=information%20technology&cd98=article%7Creport&cd103=&cd113=data-layer-loaded&cd129=&cm21=1&cm23=0&cd3=1606731204.1614702467&z=22522503

Requested by

Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 01 Mar 2021 19:41:25 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 74781
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK 5b27ee7e8c1abc4e7900000f Show response
api.cnevids.com/v1/video_groups/ 92 KB
16 KB 253ms
252ms XHR
application/json 18.211.112.77
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://api.cnevids.com/v1/video_groups/5b27ee7e8c1abc4e7900000f?endpoint=oo.arstechnica

Requested by

Host: cdn.arstechnica.net
URL: https://cdn.arstechnica.net/wp-content/themes/ars/assets/js/main-e7aebfbfda.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

18.211.112.77 , United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-18-211-112-77.compute-1.amazonaws.com

Software

nginx/1.18.0 /

Resource Hash

2bc266428249de342be33433e44908cf53432be4fe1fe7594db37b443ebe6b63

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept: application/json, text/*
Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Tue, 02 Mar 2021 16:27:46 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
X-Permitted-Cross-Domain-Policies: none
Status: 200 OK
Access-Control-Max-Age: 1728000
Connection: keep-alive
Content-Length: 15757
X-XSS-Protection: 1; mode=block
X-Request-Id: eea9cdd9-fd15-4d0d-bd9a-207dfade2f0d
X-Runtime: 0.004650
X-Backend-Node: 10.110.26.143
Referrer-Policy: strict-origin-when-cross-origin
Server: nginx/1.18.0
X-Frame-Options: SAMEORIGIN
ETag: W/"66d8af0e0098dd85d30d086bfd1251c6"
X-Download-Options: noopen
Vary: Accept-Encoding, Origin
Access-Control-Allow-Methods: GET, PUT, POST, DELETE, OPTIONS
Content-Type: application/json; charset=utf-8
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers
Cache-Control: max-age=0, private, must-revalidate

GET
H2 200 ga-audiences
www.google.com/ads/ 42 B
107 B 30ms
29ms Image
image/gif 2a00:1450:4001:813::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j88&tid=UA-31997-1&cid=1606731204.1614702467&jid=906665086&_u=aGBAgUAjAAQCAE~&z=992489682

Requested by

Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 02 Mar 2021 16:27:46 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.de/ads/ 42 B
107 B 30ms
29ms Image
image/gif 2a00:1450:4001:80f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j88&tid=UA-31997-1&cid=1606731204.1614702467&jid=906665086&_u=aGBAgUAjAAQCAE~&z=992489682

Requested by

Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 02 Mar 2021 16:27:46 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 451 identity Show response
api.rlcdn.com/api/ 0
196 B 60ms
58ms XHR
text/plain 34.120.207.148
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://api.rlcdn.com/api/identity?pid=2&rt=envelope&cv=CPCcAsZPCcAsZAcABBENBPCgAAAAAAAAAChQAAAAAAJBAGIAAoAHAAeABcAD4ALQAfABJADEAH8ARQAkQBXADNAG0AOIAcgA5wB1AD_AIGAQcAkQBPwChgGEAOqAh8BHoCQgErAJtAWEAugBdQC7QF5AMQAYsAyEBkYDKAGhANGAaUA1MBtADbgG6AOCCQVgAEAALgAoACoAGQAOAAeABAACIAFQAMIAaABqADyAIYAiABMACfAFUAVgAsABcADeAHMAPQAhABDQCIAIkAR0AlgCXAE0AKUAW4AwwBkADLgGoAaoA2QB3gD2AHxAPsA_QCAQEXARgAjQBHACUgFBAKWAU8Aq4BcwC_AGKANYAbQA3ABvAD0AHyAQ2Ah0BF4CRAExAJlATYAnYBQ4CkQFigLQAWwAuQBd4C8wGBAMGAYSAw0Bh4DIgGSAMnAZcAzkBnwDSAGnQNYA1kMASAAWABcAJIAVQAxADSAGqAOIA2QB1AEhAKHAXQAvoBiwDIwGhAN0DQJgAVABWAC4AIYAZAAywBqADZAHYAPwAgABBQCMAFLAKeAVeAtAC0gGsAN4AdUA-QCGwEOgIqAReAkQBNgCdgFIgLkAYEAwkBh4DGAGTgM5AZ4Az4QASAAWABcAGoASQAqgBiAFcANUAcQBIgDcAG8ASEAocBdADFgGhAN0EQIAAVABWAC4AIYAZAAywBqADZAHYAPwAgABGAClgFPAKuAawA6oB8gENgIdAReAkQBNgCdgFIgLkAYEAwkBh4DJwGcgM-FQHgAKAAqACGAEwALgAjgBlgDUAHYAPwAjABHAClgFXgLQAtIBvAEggJiATYApsBbAC5AF5gMCAYeAyIBnIDPAGfANyFADQAxADVAG0AOIAcgA8ACCgHVAR6AvoBmgDQgGvDIDYAFAAVABDACYAFwARwAywBqADsgH2AfgBGACOAFLAKuAVsA3gCYgE2ALRAWwAvMBgQDDwGRAM5AZ4Az4YANABqAGIAaoA2gBxADkAHgAWIA2QB1QEegLyAaEOAsgACAARAA4ADwALgAfABaADkAH4AQQAugBkADQAH8ARQAkQBOgCzAF8AMsAZoA0gBqgDaAHEAOQAc4A6gB2ADuAIAAQMAgsBBwEIAIiASIAm0BPgE_AKWAVAAtoBeoDAAMCAYQA1gBrwDeAHHAOkAdUA8gB8gEIQIfAiABHoCQoErASuAmIBMoCbQFCgKQAUmApgBUwCqgFbAK5AV2AsoBaQC1AFxQLoAuoBfQDAgGIAMWAZCAygBl4DQoGigaMA0oBpoDUwGvANoAbYA24dBnAAXABQAFQAMgAcABAACIAFQALoAYABjADQANQAeAA-gCGAIgATAAnwBVAFYALAAXAAvgBiADMAG8AOYAegBCACGgEQARIAjoBLAEwAJoAUYApQBYgC3gGEAYYAyABlADRAGoANkAb4A7wB7QD7AP0Af8BFgEYAI5ASkBKgCggFPAKuAWKAtAC0gFzALqAXkAvwBigDaAG4gOmA6gB6AENgIdAREAioBF4CQQEiAJUATYAnYBQ4CmgFWALFAWgAtgBcAC5AF2gLvAXmAwYBhIDDQGHgMSAYwAx4BkgDJwGVAMsAZcAzkBnwDRIGkAaSA0sBpwDWAGxkAF4ACAAfgBBADQAH8ASIAtwBfADLAGqANoAcQA5ABzgDsAHgAQUAnwBSwCxAGAAMIAbIA3gB1QDtgIfAR6AkIBK4CYgE2gKFAUgApMBWwC6AF5AL6AYEAzQBoQDRQGlANTAbYA24hA9AAWABQADIAIgAVAAuABiAEMAJgAVQAuABfADEAGYAN4AegBHACxAGEAMoAagA3wB3wD7APwAf4BGACOAEpAKCAUMAp4BV4C0ALSAXMAvwBigDaAHUAPQAkEBIgCVAE2AKaAWKAtEBbAC4AFyALtAYeAxIBkQDJwGcgM8AZ8A0QBpIDSwHAEgEIAAgAHAAXABCADkAMgAkQBcgC-AGWANQAbQA7gCAAEJAJ8AVAA14BvADqgH2ARUAlYBNoCkwFlALSAX0AxEBiwDQgGlANyJQOQAEAALAAoABkADgAIoAYABiADwAIgATAAqgBcAC-AGIAMwAbQBCACGgEQARIAjgBRgClAFuAMIAZQA1QBsgDvAH4ARgAjgBTwCrwFoAWkAuoBigDcAHUAPkAh0BF4CRAE2ALFAWwAu0BeYDDwGRAMnAZYAzkBngDPgGkANYAcAUAhAACAAuAB8AEIALQAcgA_ACsAGQANoAcgBHACRAE6ALkAXwAywBqADXAG0AOIAc4A6gB3ADwAIAAQcAhIBFQCRAE2gJ8An4BSwCxAF1AMAAYQAxQBrwDeAHVAO2AeQA-QB_wEegJiATKAm0BSACmAFTAK7AWgAugBeQC-gGBAMWAaEA0QBpQDTYGpAamA14BwRSCWAAuACgAKgAZAA4ACAAEQAKoAYABjADQANQAeQBDAEQAJgATwApABVACwAFwAL4AYgAzABzAEIAIaARABEgCjAFKALEAW4AwgBlADRAGqANkAd8A-wD9AIsARgAjgBKQCggFDAKuAVsAuYBeQDaAG4APQAh0BF4CRAE2AJ2AUOApoBWwCxQFsALgAXIAu0BeYDDQGHgMYAZEAyQBk4DLgGcgM8AZ9A0gDSYGsAayA2MAA.YAAAAAAAAAAA&ct=4
Requested by: Host: js-sec.indexww.com
URL: https://js-sec.indexww.com/ht/p/183973-93942139695505.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.120.207.148 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 148.207.120.34.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

date: Tue, 02 Mar 2021 16:27:46 GMT
via: 1.1 google
alt-svc: clear
access-control-allow-methods: GET, OPTIONS
access-control-allow-origin: https://arstechnica.com
access-control-allow-credentials: true
access-control-allow-headers: Accept, Authorization, Content-Type, Cookie, Origin, X-Requested-With
content-length: 0

GET
H2 200 rid Show response
match.adsrvr.org/track/ 109 B
542 B 208ms
68ms XHR
application/json 99.80.71.186
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://match.adsrvr.org/track/rid?ttd_pid=casale&fmt=json&p=183973
Requested by: Host: js-sec.indexww.com
URL: https://js-sec.indexww.com/ht/p/183973-93942139695505.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 99.80.71.186 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-99-80-71-186.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 43e5f72df0718e67f1b947b4910933307c75b55148777f686cc197e3e24dea49

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

date: Tue, 02 Mar 2021 16:27:46 GMT
x-aspnet-version: 4.0.30319
vary: Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://arstechnica.com
cache-control: private
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Content-Length, Content-Encoding, Vary, Cache-Control, Accept
content-length: 109
expires: Thu, 01 Apr 2021 16:27:46 GMT

GET
H2 204 idsv2 Show response
mid.rkdms.com/ 0
157 B 425ms
142ms XHR
text/plain 34.231.165.20
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://mid.rkdms.com/idsv2?ptk=17c1789b-e660-493b-aa74-3c8fb990dc5f&pubid=CONDENAST
Requested by: Host: js-sec.indexww.com
URL: https://js-sec.indexww.com/ht/p/183973-93942139695505.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.231.165.20 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx/1.18.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

access-control-allow-origin: https://arstechnica.com
date: Tue, 02 Mar 2021 16:27:47 GMT
access-control-allow-credentials: true
server: nginx/1.18.0
access-control-allow-methods: GET, HEAD, OPTIONS

POST
H2 200 page Show response
t.skimresources.com/api/v2/ 22 B
339 B 66ms
66ms XHR
application/javascript 35.201.67.47
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://t.skimresources.com/api/v2/page

Requested by

Host: s.skimresources.com
URL: https://s.skimresources.com/js/100098X1555750.skimlinks.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

35.201.67.47 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

47.67.201.35.bc.googleusercontent.com

Software

Python/3.7 aiohttp/3.5.4 /

Resource Hash

fcc83a5b6aef86420c1ad553167106df96bd0ff4192ffe52b1647599948edbcf

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-type: text/plain

Response headers

pragma: no-cache
date: Tue, 02 Mar 2021 16:27:46 GMT
via: 1.1 google
x-content-type-options: nosniff
server: Python/3.7 aiohttp/3.5.4
access-control-allow-headers: Origin, Accept, Content-Type, X-Requested-With, X-CSRF-Token
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/plain; charset=utf-8, application/javascript
access-control-allow-origin: https://arstechnica.com
cache-control: no-store, no-cache, must-revalidate
access-control-allow-credentials: true
alt-svc: clear
content-length: 22

POST
H2 200 link Show response
t.skimresources.com/api/v2/ 22 B
88 B 68ms
68ms XHR
application/javascript 35.201.67.47
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://t.skimresources.com/api/v2/link

Requested by

Host: s.skimresources.com
URL: https://s.skimresources.com/js/100098X1555750.skimlinks.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

35.201.67.47 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

47.67.201.35.bc.googleusercontent.com

Software

Python/3.7 aiohttp/3.5.4 /

Resource Hash

fcc83a5b6aef86420c1ad553167106df96bd0ff4192ffe52b1647599948edbcf

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-type: text/plain

Response headers

pragma: no-cache
date: Tue, 02 Mar 2021 16:27:46 GMT
via: 1.1 google
x-content-type-options: nosniff
server: Python/3.7 aiohttp/3.5.4
access-control-allow-headers: Origin, Accept, Content-Type, X-Requested-With, X-CSRF-Token
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/plain; charset=utf-8, application/javascript
access-control-allow-origin: https://arstechnica.com
cache-control: no-store, no-cache, must-revalidate
access-control-allow-credentials: true
alt-svc: clear
content-length: 22

GET
H2 200 bid Show response
c.amazon-adsystem.com/e/dtb/ 23 B
369 B 101ms
101ms XHR
text/javascript 13.224.192.34
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/e/dtb/bid?src=3035&u=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2021%2F02%2Fnew-malware-found-on-30000-macs-has-security-pros-stumped%2F&pid=QjWsVzAtl2uqm&cb=0&ws=1600x1200&v=7.59.00&t=1000&slots=%5B%7B%22sd%22%3A%220%22%2C%22s%22%3A%5B%22300x50%22%2C%22300x250%22%2C%22320x50%22%2C%22728x90%22%5D%2C%22sn%22%3A%22mid-content%2Fdesktop%22%7D%2C%7B%22sd%22%3A%221%22%2C%22s%22%3A%5B%22728x90%22%2C%22970x250%22%5D%2C%22sn%22%3A%22hero%2Fdesktop%22%7D%2C%7B%22sd%22%3A%222%22%2C%22s%22%3A%5B%22300x250%22%2C%22300x600%22%5D%2C%22sn%22%3A%22rail%2Fdesktop%22%7D%5D&pj=%7B%22si_section%22%3A%22information-technology%22%2C%22us_privacy%22%3A%221---%22%7D&cfgv=0&gdpre=1&gdprc=CPCcAsZPCcAsZAcABBENBPCgAAAAAAAAAChQAAAAAAJBAGIAAoAHAAeABcAD4ALQAfABJADEAH8ARQAkQBXADNAG0AOIAcgA5wB1AD_AIGAQcAkQBPwChgGEAOqAh8BHoCQgErAJtAWEAugBdQC7QF5AMQAYsAyEBkYDKAGhANGAaUA1MBtADbgG6AOCCQVgAEAALgAoACoAGQAOAAeABAACIAFQAMIAaABqADyAIYAiABMACfAFUAVgAsABcADeAHMAPQAhABDQCIAIkAR0AlgCXAE0AKUAW4AwwBkADLgGoAaoA2QB3gD2AHxAPsA_QCAQEXARgAjQBHACUgFBAKWAU8Aq4BcwC_AGKANYAbQA3ABvAD0AHyAQ2Ah0BF4CRAExAJlATYAnYBQ4CkQFigLQAWwAuQBd4C8wGBAMGAYSAw0Bh4DIgGSAMnAZcAzkBnwDSAGnQNYA1kMASAAWABcAJIAVQAxADSAGqAOIA2QB1AEhAKHAXQAvoBiwDIwGhAN0DQJgAVABWAC4AIYAZAAywBqADZAHYAPwAgABBQCMAFLAKeAVeAtAC0gGsAN4AdUA-QCGwEOgIqAReAkQBNgCdgFIgLkAYEAwkBh4DGAGTgM5AZ4Az4QASAAWABcAGoASQAqgBiAFcANUAcQBIgDcAG8ASEAocBdADFgGhAN0EQIAAVABWAC4AIYAZAAywBqADZAHYAPwAgABGAClgFPAKuAawA6oB8gENgIdAReAkQBNgCdgFIgLkAYEAwkBh4DJwGcgM-FQHgAKAAqACGAEwALgAjgBlgDUAHYAPwAjABHAClgFXgLQAtIBvAEggJiATYApsBbAC5AF5gMCAYeAyIBnIDPAGfANyFADQAxADVAG0AOIAcgA8ACCgHVAR6AvoBmgDQgGvDIDYAFAAVABDACYAFwARwAywBqADsgH2AfgBGACOAFLAKuAVsA3gCYgE2ALRAWwAvMBgQDDwGRAM5AZ4Az4YANABqAGIAaoA2gBxADkAHgAWIA2QB1QEegLyAaEOAsgACAARAA4ADwALgAfABaADkAH4AQQAugBkADQAH8ARQAkQBOgCzAF8AMsAZoA0gBqgDaAHEAOQAc4A6gB2ADuAIAAQMAgsBBwEIAIiASIAm0BPgE_AKWAVAAtoBeoDAAMCAYQA1gBrwDeAHHAOkAdUA8gB8gEIQIfAiABHoCQoErASuAmIBMoCbQFCgKQAUmApgBUwCqgFbAK5AV2AsoBaQC1AFxQLoAuoBfQDAgGIAMWAZCAygBl4DQoGigaMA0oBpoDUwGvANoAbYA24dBnAAXABQAFQAMgAcABAACIAFQALoAYABjADQANQAeAA-gCGAIgATAAnwBVAFYALAAXAAvgBiADMAG8AOYAegBCACGgEQARIAjoBLAEwAJoAUYApQBYgC3gGEAYYAyABlADRAGoANkAb4A7wB7QD7AP0Af8BFgEYAI5ASkBKgCggFPAKuAWKAtAC0gFzALqAXkAvwBigDaAG4gOmA6gB6AENgIdAREAioBF4CQQEiAJUATYAnYBQ4CmgFWALFAWgAtgBcAC5AF2gLvAXmAwYBhIDDQGHgMSAYwAx4BkgDJwGVAMsAZcAzkBnwDRIGkAaSA0sBpwDWAGxkAF4ACAAfgBBADQAH8ASIAtwBfADLAGqANoAcQA5ABzgDsAHgAQUAnwBSwCxAGAAMIAbIA3gB1QDtgIfAR6AkIBK4CYgE2gKFAUgApMBWwC6AF5AL6AYEAzQBoQDRQGlANTAbYA24hA9AAWABQADIAIgAVAAuABiAEMAJgAVQAuABfADEAGYAN4AegBHACxAGEAMoAagA3wB3wD7APwAf4BGACOAEpAKCAUMAp4BV4C0ALSAXMAvwBigDaAHUAPQAkEBIgCVAE2AKaAWKAtEBbAC4AFyALtAYeAxIBkQDJwGcgM8AZ8A0QBpIDSwHAEgEIAAgAHAAXABCADkAMgAkQBcgC-AGWANQAbQA7gCAAEJAJ8AVAA14BvADqgH2ARUAlYBNoCkwFlALSAX0AxEBiwDQgGlANyJQOQAEAALAAoABkADgAIoAYABiADwAIgATAAqgBcAC-AGIAMwAbQBCACGgEQARIAjgBRgClAFuAMIAZQA1QBsgDvAH4ARgAjgBTwCrwFoAWkAuoBigDcAHUAPkAh0BF4CRAE2ALFAWwAu0BeYDDwGRAMnAZYAzkBngDPgGkANYAcAUAhAACAAuAB8AEIALQAcgA_ACsAGQANoAcgBHACRAE6ALkAXwAywBqADXAG0AOIAc4A6gB3ADwAIAAQcAhIBFQCRAE2gJ8An4BSwCxAF1AMAAYQAxQBrwDeAHVAO2AeQA-QB_wEegJiATKAm0BSACmAFTAK7AWgAugBeQC-gGBAMWAaEA0QBpQDTYGpAamA14BwRSCWAAuACgAKgAZAA4ACAAEQAKoAYABjADQANQAeQBDAEQAJgATwApABVACwAFwAL4AYgAzABzAEIAIaARABEgCjAFKALEAW4AwgBlADRAGqANkAd8A-wD9AIsARgAjgBKQCggFDAKuAVsAuYBeQDaAG4APQAh0BF4CRAE2AJ2AUOApoBWwCxQFsALgAXIAu0BeYDDQGHgMYAZEAyQBk4DLgGcgM8AZ9A0gDSYGsAayA2MAA.YAAAAAAAAAAA&gdprl=%7B%22status%22%3A%22tcfv2-success%22%7D
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.224.192.34 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-192-34.fra2.r.cloudfront.net
Software: Server /
Resource Hash: 745a085b52b8371ec6705413fca70a28c6d8bff0db480e6b124bd08c54e95ef8

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 02 Mar 2021 16:27:46 GMT
via: 1.1 0f538ee832e1105649039b38ce89e883.cloudfront.net (CloudFront)
server: Server
x-amz-cf-pop: FRA2-C1
vary: User-Agent
x-cache: Miss from cloudfront
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: https://arstechnica.com
access-control-allow-credentials: true
timing-allow-origin: *
content-length: 23
x-amz-cf-id: CVuvPaX-Pd-uRZ7VaIcvQ_ps7iUcLjU42SIEQMtcJIBtZC4l8eqFaA==

GET
H/1.1 200
OK fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 266 B
2 KB 337ms
186ms XHR
application/json 69.173.144.141
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=11850&site_id=307072&zone_id=1552970&size_id=15&alt_size_ids=2%2C43%2C44&us_privacy=1---&rf=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2021%2F02%2Fnew-malware-found-on-30000-macs-has-security-pros-stumped%2F&kw=m1%2C%20macos%2C%20macs%2C%20malware&tk_flint=pbjs_lite_v4.25.0&x_source.tid=75d301ee-fec5-4816-a804-bb836f97f8b8&p_screen_res=1600x1200&rp_floor=0.05&rp_secure=1&slots=1&rand=0.44936589340905364
Requested by: Host: cdn.arstechnica.net
URL: https://cdn.arstechnica.net/cns/prebid.min.js?v=1614702432
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_128_GCM
Server: 69.173.144.141 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.16.0 /
Resource Hash: 88288b8bccc37e461dbe1c53467610729f6aaead1cdec295b096b144a0676a1e

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Tue, 02 Mar 2021 16:27:47 GMT
Server: nginx/1.16.0
Vary: Accept-Encoding
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin: https://arstechnica.com
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json
Keep-Alive: timeout=5
Content-Length: 266
Expires: Wed, 17 Sep 1975 21:32:10 GMT

GET
H2 200 cygnus Show response
htlb.casalemedia.com/ 24 B
370 B 164ms
59ms XHR
application/json 184.31.84.150
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://htlb.casalemedia.com/cygnus?s=375855&v=7.2&ac=j&sd=1&r=%7B%22id%22%3A%223c8f088a2133df%22%2C%22site%22%3A%7B%22page%22%3A%22https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2021%2F02%2Fnew-malware-found-on-30000-macs-has-security-pros-stumped%2F%22%7D%2C%22ext%22%3A%7B%22source%22%3A%22prebid%22%2C%22ixdiag%22%3A%7B%22mfu%22%3A0%2C%22bu%22%3A1%2C%22iu%22%3A0%2C%22nu%22%3A0%2C%22ou%22%3A0%2C%22allU%22%3A1%2C%22ren%22%3Afalse%2C%22msd%22%3A3%2C%22msi%22%3A3%7D%7D%2C%22regs%22%3A%7B%22ext%22%3A%7B%22us_privacy%22%3A%221---%22%7D%7D%2C%22imp%22%3A%5B%7B%22id%22%3A%22458085f33b2f64%22%2C%22ext%22%3A%7B%22siteID%22%3A%22375855%22%2C%22sid%22%3A%22728x90%22%7D%2C%22banner%22%3A%7B%22w%22%3A728%2C%22h%22%3A90%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%22458085f33b2f64%22%2C%22ext%22%3A%7B%22siteID%22%3A%22375855%22%2C%22sid%22%3A%22300x250%22%7D%2C%22banner%22%3A%7B%22w%22%3A300%2C%22h%22%3A250%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%22458085f33b2f64%22%2C%22ext%22%3A%7B%22siteID%22%3A%22375855%22%2C%22sid%22%3A%22300x50%22%7D%2C%22banner%22%3A%7B%22w%22%3A300%2C%22h%22%3A50%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%22458085f33b2f64%22%2C%22ext%22%3A%7B%22siteID%22%3A%22375855%22%2C%22sid%22%3A%22320x50%22%7D%2C%22banner%22%3A%7B%22w%22%3A320%2C%22h%22%3A50%2C%22topframe%22%3A1%7D%7D%5D%7D
Requested by: Host: cdn.arstechnica.net
URL: https://cdn.arstechnica.net/cns/prebid.min.js?v=1614702432
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 184.31.84.150 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a184-31-84-150.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 06aef6ad8a55bd62e43cb59c34dae99579be260c600327bdb0ee737dea694661

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Tue, 02 Mar 2021 16:27:46 GMT
content-encoding: gzip
x-ak-initial-geo: CC:[PL], RC:[], CN:[EU], CIP:[194.99.105.99], XFF:[]
server: Apache
vary: Is-Traffic-Invalid,Accept-Encoding
content-type: application/json
access-control-allow-origin: https://arstechnica.com
x-cs-client-geo: 09
cache-control: max-age=0, no-cache, no-store
access-control-allow-credentials: true
content-length: 44
x-ak-client-geo: 09
expires: Tue, 02 Mar 2021 16:27:46 GMT

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ 19 B
711 B 164ms
54ms XHR
application/json 185.33.221.88
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: cdn.arstechnica.net
URL: https://cdn.arstechnica.net/cns/prebid.min.js?v=1614702432

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.221.88 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

726.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

Software

nginx/1.17.9 /

Resource Hash

0c09c070833c786cb25be38bc30992b30bad578f817dbc9e34beacd8b8ea44c5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Tue, 02 Mar 2021 16:27:46 GMT
X-Proxy-Origin: 194.99.105.99; 194.99.105.99; 726.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.220.108:80
AN-X-Request-Uuid: 923fe402-934d-4ed3-b7f9-ea0e5d040755
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://arstechnica.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json; charset=utf-8
Content-Length: 19
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1 200
OK bidRequest Show response
c2shb.ssp.yahoo.com/ 62 B
475 B 239ms
111ms XHR
application/json 18.156.195.47
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c2shb.ssp.yahoo.com/bidRequest?dcn=8a9691380175757044fd70b6a8ba0010&pos=8a969ce00175757040bb70c50400002c&cmd=bid&secure=1&us_privacy=1---
Requested by: Host: cdn.arstechnica.net
URL: https://cdn.arstechnica.net/cns/prebid.min.js?v=1614702432
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 18.156.195.47 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: ATS/7.1.2.128 /
Resource Hash: e9216d2eb53d1954da6139b158c6b1f25d5df04e78be8daa019e082bfacc68b8

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

Date: Tue, 02 Mar 2021 16:27:46 GMT
Server: ATS/7.1.2.128
Age: 0
Vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
Access-Control-Allow-Methods: POST,GET,HEAD,OPTIONS
Content-Type: application/json;charset=utf-8
Access-Control-Allow-Origin: https://arstechnica.com
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 62

GET
H2 200 arj Show response
condenastus-d.openx.net/w/1.0/ 188 B
371 B 181ms
62ms XHR
application/json 34.98.64.218
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://condenastus-d.openx.net/w/1.0/arj?ju=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2021%2F02%2Fnew-malware-found-on-30000-macs-has-security-pros-stumped%2F&ch=UTF-8&res=1600x1200x24&ifr=false&tz=-60&tws=1600x1200&be=1&bc=hb_pb_3.0.3&dddid=75d301ee-fec5-4816-a804-bb836f97f8b8&nocache=1614702466733&us_privacy=1---&aus=300x250%2C300x50%2C320x50%2C728x90&divIds=mid-content_300x250_300x50_320x50_728x90&auid=541000584&aumfs=50
Requested by: Host: cdn.arstechnica.net
URL: https://cdn.arstechnica.net/cns/prebid.min.js?v=1614702432
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/16.202.0 /
Resource Hash: fd1ae1483beedd5a4d88a891be815d773ac085b8829d7bcbe05a473560b798e0

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Tue, 02 Mar 2021 16:27:46 GMT
content-encoding: gzip
server: OXGW/16.202.0
vary: Accept, Accept-Encoding
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: https://arstechnica.com
cache-control: private, max-age=0, no-cache
access-control-allow-credentials: true
content-type: application/json
alt-svc: clear
content-length: 174
via: 1.1 google
expires: Mon, 26 Jul 1997 05:00:00 GMT

POST
H2 200 prebid Show response
prebid.media.net/rtb/ 1 KB
778 B 200ms
93ms XHR
application/json 104.85.4.23
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.media.net/rtb/prebid?cid=8CU65UN7R
Requested by: Host: cdn.arstechnica.net
URL: https://cdn.arstechnica.net/cns/prebid.min.js?v=1614702432
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 104.85.4.23 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-85-4-23.deploy.static.akamaitechnologies.com
Software: nginx /
Resource Hash: 0be98834a252aa173b24c2de062a0e5623d684baadb1b1d18ee26b93f3c8f6b7

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Tue, 02 Mar 2021 16:27:46 GMT
content-encoding: gzip
server: nginx
vary: Accept-Encoding
content-type: application/json;charset=ISO-8859-1
access-control-allow-origin: https://arstechnica.com
cache-control: max-age=0, no-cache, no-store
access-control-allow-credentials: true
content-length: 550
expires: Tue, 02 Mar 2021 16:27:46 GMT

GET
H/1.1 200
OK fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 260 B
2 KB 299ms
149ms XHR
application/json 69.173.144.141
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=11850&site_id=307072&zone_id=1552960&size_id=2&alt_size_ids=57&us_privacy=1---&rf=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2021%2F02%2Fnew-malware-found-on-30000-macs-has-security-pros-stumped%2F&kw=m1%2C%20macos%2C%20macs%2C%20malware&tk_flint=pbjs_lite_v4.25.0&x_source.tid=eb56ef3c-a771-42b0-a0fa-08e07479f9c7&p_screen_res=1600x1200&rp_floor=0.05&rp_secure=1&slots=1&rand=0.5941867437658637
Requested by: Host: cdn.arstechnica.net
URL: https://cdn.arstechnica.net/cns/prebid.min.js?v=1614702432
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_128_GCM
Server: 69.173.144.141 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.16.0 /
Resource Hash: 49e468dc2f899f16654273e495fadf87ca7a840d2d80f839b2f0b681af187e6d

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Tue, 02 Mar 2021 16:27:47 GMT
Server: nginx/1.16.0
Vary: Accept-Encoding
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin: https://arstechnica.com
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json
Keep-Alive: timeout=5
Content-Length: 260
Expires: Wed, 17 Sep 1975 21:32:10 GMT

GET
H/1.1 200
OK fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 260 B
2 KB 305ms
149ms XHR
application/json 69.173.144.141
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=11850&site_id=307072&zone_id=1552962&size_id=2&alt_size_ids=57&us_privacy=1---&rf=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2021%2F02%2Fnew-malware-found-on-30000-macs-has-security-pros-stumped%2F&kw=m1%2C%20macos%2C%20macs%2C%20malware&tk_flint=pbjs_lite_v4.25.0&x_source.tid=eb56ef3c-a771-42b0-a0fa-08e07479f9c7&p_screen_res=1600x1200&rp_floor=0.05&rp_secure=1&slots=1&rand=0.9687762035665057
Requested by: Host: cdn.arstechnica.net
URL: https://cdn.arstechnica.net/cns/prebid.min.js?v=1614702432
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_128_GCM
Server: 69.173.144.141 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.16.0 /
Resource Hash: bf2142e8062f7d0db34466f799b38a66a9130750ad501dad7455b41b2d059096

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Tue, 02 Mar 2021 16:27:47 GMT
Server: nginx/1.16.0
Vary: Accept-Encoding
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin: https://arstechnica.com
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json
Keep-Alive: timeout=5
Content-Length: 260
Expires: Wed, 17 Sep 1975 21:32:10 GMT

GET
H2 200 cygnus Show response
htlb.casalemedia.com/ 25 B
371 B 151ms
58ms XHR
application/json 184.31.84.150
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://htlb.casalemedia.com/cygnus?s=375849&v=7.2&ac=j&sd=1&r=%7B%22id%22%3A%22162a839d8c10fcd%22%2C%22site%22%3A%7B%22page%22%3A%22https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2021%2F02%2Fnew-malware-found-on-30000-macs-has-security-pros-stumped%2F%22%7D%2C%22ext%22%3A%7B%22source%22%3A%22prebid%22%2C%22ixdiag%22%3A%7B%22mfu%22%3A0%2C%22bu%22%3A1%2C%22iu%22%3A0%2C%22nu%22%3A0%2C%22ou%22%3A0%2C%22allU%22%3A1%2C%22ren%22%3Afalse%2C%22msd%22%3A0%2C%22msi%22%3A0%7D%7D%2C%22regs%22%3A%7B%22ext%22%3A%7B%22us_privacy%22%3A%221---%22%7D%7D%2C%22imp%22%3A%5B%7B%22id%22%3A%2217627ad5fcdd001%22%2C%22ext%22%3A%7B%22siteID%22%3A%22375849%22%2C%22sid%22%3A%22728x90%22%7D%2C%22banner%22%3A%7B%22w%22%3A728%2C%22h%22%3A90%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%2218b3688df723c3c%22%2C%22ext%22%3A%7B%22siteID%22%3A%22375848%22%2C%22sid%22%3A%22970x250%22%7D%2C%22banner%22%3A%7B%22w%22%3A970%2C%22h%22%3A250%2C%22topframe%22%3A1%7D%7D%5D%7D
Requested by: Host: cdn.arstechnica.net
URL: https://cdn.arstechnica.net/cns/prebid.min.js?v=1614702432
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 184.31.84.150 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a184-31-84-150.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 575d85bcb7691a3cf88b885296ecdffb8f9f1857847a1b256f1ad54c5be891ba

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Tue, 02 Mar 2021 16:27:46 GMT
content-encoding: gzip
x-ak-initial-geo: CC:[PL], RC:[], CN:[EU], CIP:[194.99.105.99], XFF:[]
server: Apache
vary: Is-Traffic-Invalid,Accept-Encoding
content-type: application/json
access-control-allow-origin: https://arstechnica.com
x-cs-client-geo: 09
cache-control: max-age=0, no-cache, no-store
access-control-allow-credentials: true
content-length: 45
x-ak-client-geo: 09
expires: Tue, 02 Mar 2021 16:27:46 GMT

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ 19 B
709 B 175ms
72ms XHR
application/json 185.33.221.88
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: cdn.arstechnica.net
URL: https://cdn.arstechnica.net/cns/prebid.min.js?v=1614702432

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.221.88 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

726.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

Software

nginx/1.17.9 /

Resource Hash

0c09c070833c786cb25be38bc30992b30bad578f817dbc9e34beacd8b8ea44c5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Tue, 02 Mar 2021 16:27:46 GMT
X-Proxy-Origin: 194.99.105.99; 194.99.105.99; 726.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.221.9:80
AN-X-Request-Uuid: 07152a99-a730-4e00-9619-96fee735e96a
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://arstechnica.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json; charset=utf-8
Content-Length: 19
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1 200
OK bidRequest Show response
c2shb.ssp.yahoo.com/ 62 B
475 B 254ms
127ms XHR
application/json 18.156.195.47
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c2shb.ssp.yahoo.com/bidRequest?dcn=8a9691380175757044fd70b6a8ba0010&pos=8a969ce00175757040bb70c4ff01002a&cmd=bid&secure=1&us_privacy=1---
Requested by: Host: cdn.arstechnica.net
URL: https://cdn.arstechnica.net/cns/prebid.min.js?v=1614702432
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 18.156.195.47 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: ATS/7.1.2.128 /
Resource Hash: 12b9bdf3807ad4ff800194feeee5ba36cb07be022f3709f99c1f105a4fd5df31

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

Date: Tue, 02 Mar 2021 16:27:46 GMT
Server: ATS/7.1.2.128
Age: 0
Vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
Access-Control-Allow-Methods: POST,GET,HEAD,OPTIONS
Content-Type: application/json;charset=utf-8
Access-Control-Allow-Origin: https://arstechnica.com
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 62

GET
H/1.1 200
OK bidRequest Show response
c2shb.ssp.yahoo.com/ 62 B
475 B 246ms
116ms XHR
application/json 18.156.195.47
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c2shb.ssp.yahoo.com/bidRequest?dcn=8a9691380175757044fd70b6a8ba0010&pos=8a9691380175757044fd70c4fff3002b&cmd=bid&secure=1&us_privacy=1---
Requested by: Host: cdn.arstechnica.net
URL: https://cdn.arstechnica.net/cns/prebid.min.js?v=1614702432
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 18.156.195.47 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: ATS/7.1.2.128 /
Resource Hash: 13c28910868fabba31657c04b0ae5101c420762f1338607b97fff58f9d856274

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

Date: Tue, 02 Mar 2021 16:27:46 GMT
Server: ATS/7.1.2.128
Age: 0
Vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
Access-Control-Allow-Methods: POST,GET,HEAD,OPTIONS
Content-Type: application/json;charset=utf-8
Access-Control-Allow-Origin: https://arstechnica.com
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 62

GET
H2 200 arj Show response
condenastus-d.openx.net/w/1.0/ 188 B
568 B 170ms
61ms XHR
application/json 34.98.64.218
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://condenastus-d.openx.net/w/1.0/arj?ju=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2021%2F02%2Fnew-malware-found-on-30000-macs-has-security-pros-stumped%2F&ch=UTF-8&res=1600x1200x24&ifr=false&tz=-60&tws=1600x1200&be=1&bc=hb_pb_3.0.3&dddid=eb56ef3c-a771-42b0-a0fa-08e07479f9c7%2Ceb56ef3c-a771-42b0-a0fa-08e07479f9c7&nocache=1614702466744&us_privacy=1---&aus=728x90%2C970x250%7C728x90%2C970x250&divIds=hero_728x90_970x250%2Chero_728x90_970x250&auid=541000619%2C541000563&aumfs=50%2C50
Requested by: Host: cdn.arstechnica.net
URL: https://cdn.arstechnica.net/cns/prebid.min.js?v=1614702432
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/16.202.0 /
Resource Hash: 57fa08d15c38c75b5d2501f6845a6f42a380cbccf07c645ee410658ab901c955

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Tue, 02 Mar 2021 16:27:46 GMT
content-encoding: gzip
server: OXGW/16.202.0
vary: Accept, Accept-Encoding
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: https://arstechnica.com
cache-control: private, max-age=0, no-cache
access-control-allow-credentials: true
content-type: application/json
alt-svc: clear
content-length: 173
via: 1.1 google
expires: Mon, 26 Jul 1997 05:00:00 GMT

POST
H2 200 prebid Show response
prebid.media.net/rtb/ 1 KB
779 B 182ms
86ms XHR
application/json 104.85.4.23
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.media.net/rtb/prebid?cid=8CU65UN7R
Requested by: Host: cdn.arstechnica.net
URL: https://cdn.arstechnica.net/cns/prebid.min.js?v=1614702432
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 104.85.4.23 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-85-4-23.deploy.static.akamaitechnologies.com
Software: nginx /
Resource Hash: 0a7188ca97decc5be0cbf72a8faad44c1e62b0e6bc9af245db46870c8dcf8c45

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Tue, 02 Mar 2021 16:27:46 GMT
content-encoding: gzip
server: nginx
vary: Accept-Encoding
content-type: application/json;charset=ISO-8859-1
access-control-allow-origin: https://arstechnica.com
cache-control: max-age=0, no-cache, no-store
access-control-allow-credentials: true
content-length: 551
expires: Tue, 02 Mar 2021 16:27:46 GMT

GET
H/1.1 200
OK 5952801dfd2e616da6000006.js Show response
player.cnevids.com/script/video/ 68 KB
22 KB 168ms
167ms Script
text/javascript 13.32.24.125
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://player.cnevids.com/script/video/5952801dfd2e616da6000006.js?autoplay=1&hasCompanion=false&hideHoverTitle=1&hidePosterTitle=1&muted=1&onReady=setupInterlude1&playerType=interlude&recAlgorithm=recommendations_cne-interlude-arstechnica_4f617df1-eac3-4775-9554-b0e3db036855_similar2-3&recStrategy=similar2_3&showPlaylistBar=false

Requested by

Host: player.cnevids.com
URL: https://player.cnevids.com/interlude/arstechnica.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

13.32.24.125 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-32-24-125.fra56.r.cloudfront.net

Software

nginx/1.14.1 /

Resource Hash

73c3fc6b03919dcf186364edf822f462cc8c2e3d5fd42e14583267ff65165095

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Tue, 02 Mar 2021 16:27:46 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
X-Permitted-Cross-Domain-Policies: none
X-Amz-Cf-Pop: FRA56-C2
X-Cache: Miss from cloudfront
Status: 200 OK
Connection: keep-alive
Content-Length: 22149
X-XSS-Protection: 1; mode=block
X-Request-Id: 881ee0d2-48e9-4ada-865e-be482f2e6600
X-Runtime: 0.005582
X-Backend-Node: 10.110.127.9
Referrer-Policy: strict-origin-when-cross-origin
Server: nginx/1.14.1
ETag: W/"0dd8ee91328d7d6a2718656e5991175d"
X-Download-Options: noopen
Vary: Origin,Accept-Encoding
Content-Type: text/javascript; charset=utf-8
Via: 1.1 1ee1abe42f3acbda66e5d1252319566a.cloudfront.net (CloudFront)
Cache-Control: max-age=0, private, must-revalidate
X-Amz-Cf-Id: dR-7q6xjQM2afUD4FyLLYTR8hCepIB8nOgrRzPu4zCZwADFL-o0wPA==

GET
H/1.1 200
OK 600745e738d069677538c4b8.jsautoplay=0&muted=0&hasCompanion=0&adsDisabled=0&onReady=arsVideoModulePlayerReady8946306 Show response
player.cnevids.com/script/video/ 68 KB
22 KB 173ms
169ms Script
text/javascript 13.32.24.125
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://player.cnevids.com/script/video/600745e738d069677538c4b8.jsautoplay=0&muted=0&hasCompanion=0&adsDisabled=0&onReady=arsVideoModulePlayerReady8946306

Requested by

Host: cdn.arstechnica.net
URL: https://cdn.arstechnica.net/wp-content/themes/ars/assets/js/main-e7aebfbfda.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

13.32.24.125 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-32-24-125.fra56.r.cloudfront.net

Software

nginx/1.14.1 /

Resource Hash

73c3fc6b03919dcf186364edf822f462cc8c2e3d5fd42e14583267ff65165095

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Tue, 02 Mar 2021 16:27:47 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
X-Permitted-Cross-Domain-Policies: none
X-Amz-Cf-Pop: FRA56-C2
X-Cache: Miss from cloudfront
Status: 200 OK
Connection: keep-alive
Content-Length: 22149
X-XSS-Protection: 1; mode=block
X-Request-Id: c1857811-36ad-4712-b56d-157ce5e2d559
X-Runtime: 0.005794
X-Backend-Node: 10.110.127.9
Referrer-Policy: strict-origin-when-cross-origin
Server: nginx/1.14.1
ETag: W/"0ad0f8948bfce8a3c3b6b7e31324c658"
X-Download-Options: noopen
Vary: Origin,Accept-Encoding
Content-Type: text/javascript; charset=utf-8
Via: 1.1 1ee1abe42f3acbda66e5d1252319566a.cloudfront.net (CloudFront)
Cache-Control: max-age=0, private, must-revalidate
X-Amz-Cf-Id: VJQ5C4tspAMCx9MfNionE2MACaJJhmUhsiZy2NNDgzUiMOe-SNUQOQ==

GET
H/1.1 200
OK arstechnica_steve-from-gamers-nexus-reacts-to-their-top-1000-comments-on-youtube.jpg
dwgyu36up6iuz.cloudfront.net/heru80fdn/image/upload/c_fill,d_placeholder_thescene.jpg,fl_progressive,g_center,h_169,q_80,w_300/v1611089409/ 16 KB
17 KB 203ms
69ms Image
image/jpeg 65.9.67.76
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dwgyu36up6iuz.cloudfront.net/heru80fdn/image/upload/c_fill,d_placeholder_thescene.jpg,fl_progressive,g_center,h_169,q_80,w_300/v1611089409/arstechnica_steve-from-gamers-nexus-reacts-to-their-top-1000-comments-on-youtube.jpg

Requested by

Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

65.9.67.76 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Cloudinary /

Resource Hash

06b33c040105224101afcdaacd82b6dfb3ea1bf9ef3d7478cf5fa163a0ad65e0

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800
X-Content-Type-Options	nosniff

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Strict-Transport-Security: max-age=604800
Via: 1.1 106758604a7f1ae0fa6678cd3d828d62.cloudfront.net (CloudFront)
X-Content-Type-Options: nosniff
Age: 95
X-Cache: Hit from cloudfront
Date: Tue, 02 Mar 2021 16:26:20 GMT
Server-Timing: fastly;dur=122;cpu=0;start=2021-02-17T19:51:16.426Z;desc=miss,rtt;dur=6,cloudinary;dur=29;start=2021-02-17T19:51:16.471Z
Content-Length: 16317
Last-Modified: Fri, 22 Jan 2021 06:42:21 GMT
Server: Cloudinary
Cache-Control: public, no-transform, max-age=300
ETag: "4796345150de82db7572da4e13d5fbc1"
Content-Type: image/jpeg
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Content-Length,ETag,Server-Timing,X-Content-Type-Options
Connection: keep-alive
X-Amz-Cf-Pop: FRA56-C1
Accept-Ranges: bytes
Timing-Allow-Origin: *
X-Amz-Cf-Id: umOzeVyhAA_sN0pi0fJhr8Ek1aTHAphVuG_-DgPIt1Lxdl37ZFSxdQ==

GET
H/1.1 200
OK arstechnica_modern-vintage-gamer-reacts-to-his-top-1000-comments-on-youtube.jpg
dwgyu36up6iuz.cloudfront.net/heru80fdn/image/upload/c_fill,d_placeholder_thescene.jpg,fl_progressive,g_center,h_169,q_80,w_300/v1607984287/ 14 KB
15 KB 222ms
79ms Image
image/jpeg 65.9.67.76
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dwgyu36up6iuz.cloudfront.net/heru80fdn/image/upload/c_fill,d_placeholder_thescene.jpg,fl_progressive,g_center,h_169,q_80,w_300/v1607984287/arstechnica_modern-vintage-gamer-reacts-to-his-top-1000-comments-on-youtube.jpg

Requested by

Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

65.9.67.76 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Cloudinary /

Resource Hash

de5e37739b5797e8ba9dba4a2dcb65f37c36a65fe839cb306162e21c74ba166e

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800
X-Content-Type-Options	nosniff

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Strict-Transport-Security: max-age=604800
Via: 1.1 fdd677a35b242f0199586a71e2f6859f.cloudfront.net (CloudFront)
X-Content-Type-Options: nosniff
X-Amz-Cf-Pop: FRA56-C1
X-Cache: RefreshHit from cloudfront
Date: Tue, 02 Mar 2021 16:27:47 GMT
Server-Timing: fastly;dur=1;cpu=0;start=2021-02-14T05:13:07.924Z;desc=hit,rtt;dur=1
Content-Length: 14171
Last-Modified: Tue, 15 Dec 2020 23:57:35 GMT
Server: Cloudinary
Cache-Control: public, no-transform, max-age=300
ETag: "7f2bf661d68cedfcf91542c6e1dab7c6"
Content-Type: image/jpeg
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Content-Length,ETag,Server-Timing,X-Content-Type-Options
Connection: keep-alive
Accept-Ranges: bytes
Timing-Allow-Origin: *
X-Amz-Cf-Id: oZtlNoaNXEzhCKdV0qZKk7g12Z3bLFqvrhMsQopxfD78X1hYyaw5IQ==

GET
H/1.1 200
OK arstechnica_war-stories-gail-tilden.jpg
dwgyu36up6iuz.cloudfront.net/heru80fdn/image/upload/c_fill,d_placeholder_thescene.jpg,fl_progressive,g_center,h_169,q_80,w_300/v1603899385/ 15 KB
16 KB 284ms
78ms Image
image/jpeg 65.9.67.76
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dwgyu36up6iuz.cloudfront.net/heru80fdn/image/upload/c_fill,d_placeholder_thescene.jpg,fl_progressive,g_center,h_169,q_80,w_300/v1603899385/arstechnica_war-stories-gail-tilden.jpg

Requested by

Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

65.9.67.76 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Cloudinary /

Resource Hash

7d91c04c657709af03f6dad61d375c3208d18ab5ff7851c2472007dc05201342

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800
X-Content-Type-Options	nosniff

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Strict-Transport-Security: max-age=604800
Via: 1.1 106758604a7f1ae0fa6678cd3d828d62.cloudfront.net (CloudFront)
X-Content-Type-Options: nosniff
X-Amz-Cf-Pop: FRA56-C1
X-Cache: RefreshHit from cloudfront
Date: Tue, 02 Mar 2021 16:27:47 GMT
Server-Timing: fastly;dur=1;cpu=0;start=2021-02-15T01:30:18.075Z;desc=hit,rtt;dur=6
Content-Length: 15071
Last-Modified: Fri, 30 Oct 2020 04:37:01 GMT
Server: Cloudinary
Cache-Control: public, no-transform, max-age=300
ETag: "1f4aa6187c59e6ed79d0c3a2a0bc19d9"
Content-Type: image/jpeg
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Content-Length,ETag,Server-Timing,X-Content-Type-Options
Connection: keep-alive
Accept-Ranges: bytes
Timing-Allow-Origin: *
X-Amz-Cf-Id: UZ2i33CcHqJxyNBV38s6RqTOoK1y60e17PlEJajRcfEl_jnhoBenaw==

GET
H/1.1 200
OK arstechnica_personal-history-scott-manley.jpg
dwgyu36up6iuz.cloudfront.net/heru80fdn/image/upload/c_fill,d_placeholder_thescene.jpg,fl_progressive,g_center,h_169,q_80,w_300/v1603123470/ 14 KB
15 KB 298ms
75ms Image
image/jpeg 65.9.67.76
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dwgyu36up6iuz.cloudfront.net/heru80fdn/image/upload/c_fill,d_placeholder_thescene.jpg,fl_progressive,g_center,h_169,q_80,w_300/v1603123470/arstechnica_personal-history-scott-manley.jpg

Requested by

Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

65.9.67.76 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Cloudinary /

Resource Hash

1f466b08649eef5ad16c20f6d7207bf8818cb107b6241950dbc568cdffc03d63

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800
X-Content-Type-Options	nosniff

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Strict-Transport-Security: max-age=604800
Via: 1.1 fdd677a35b242f0199586a71e2f6859f.cloudfront.net (CloudFront)
X-Content-Type-Options: nosniff
Age: 209
X-Cache: Hit from cloudfront
Date: Tue, 02 Mar 2021 16:24:59 GMT
Server-Timing: fastly;dur=1;cpu=0;start=2021-02-15T01:48:56.124Z;desc=hit,rtt;dur=0
Content-Length: 14113
Last-Modified: Tue, 20 Oct 2020 20:00:45 GMT
Server: Cloudinary
Cache-Control: public, no-transform, max-age=300
ETag: "963bf0b22c745f95a06f32ee1317b872"
Content-Type: image/jpeg
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Content-Length,ETag,Server-Timing,X-Content-Type-Options
Connection: keep-alive
X-Amz-Cf-Pop: FRA56-C1
Accept-Ranges: bytes
Timing-Allow-Origin: *
X-Amz-Cf-Id: N_jl1ASo4dqJoX--TZM-6MNyUvS9y38Co09Y1_vElLPvpeMnYt32bQ==

GET
H/1.1 200
OK arstechnica_scare-tactics-thomas-grip.jpg
dwgyu36up6iuz.cloudfront.net/heru80fdn/image/upload/c_fill,d_placeholder_thescene.jpg,fl_progressive,g_center,h_169,q_80,w_300/v1602524702/ 15 KB
16 KB 345ms
61ms Image
image/jpeg 65.9.67.76
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dwgyu36up6iuz.cloudfront.net/heru80fdn/image/upload/c_fill,d_placeholder_thescene.jpg,fl_progressive,g_center,h_169,q_80,w_300/v1602524702/arstechnica_scare-tactics-thomas-grip.jpg

Requested by

Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

65.9.67.76 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Cloudinary /

Resource Hash

617e0f9fee7ef0ca891735246b4b5a61caa3622db4a4256685b061c9f43bd053

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800
X-Content-Type-Options	nosniff

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Strict-Transport-Security: max-age=604800
Via: 1.1 106758604a7f1ae0fa6678cd3d828d62.cloudfront.net (CloudFront)
X-Content-Type-Options: nosniff
Age: 193
X-Cache: Hit from cloudfront
Date: Tue, 02 Mar 2021 16:26:20 GMT
Server-Timing: fastly;dur=1;cpu=0;start=2021-02-07T02:08:53.770Z;desc=hit,rtt;dur=5
Content-Length: 15079
Last-Modified: Tue, 13 Oct 2020 18:09:01 GMT
Server: Cloudinary
Cache-Control: public, no-transform, max-age=300
ETag: "d57f99149a48173e30de572cfa48ed93"
Content-Type: image/jpeg
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Content-Length,ETag,Server-Timing,X-Content-Type-Options
Connection: keep-alive
X-Amz-Cf-Pop: FRA56-C1
Accept-Ranges: bytes
Timing-Allow-Origin: *
X-Amz-Cf-Id: S7LmWBBuGCo39wNO0KcrS9t0hZBIu2cJgxlBV5lohWqcLGchvp3slA==

GET
H/1.1 200
OK arstechnica_personal-history-lgr.jpg
dwgyu36up6iuz.cloudfront.net/heru80fdn/image/upload/c_fill,d_placeholder_thescene.jpg,fl_progressive,g_center,h_169,q_80,w_300/v1600711530/ 14 KB
15 KB 372ms
74ms Image
image/jpeg 65.9.67.76
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dwgyu36up6iuz.cloudfront.net/heru80fdn/image/upload/c_fill,d_placeholder_thescene.jpg,fl_progressive,g_center,h_169,q_80,w_300/v1600711530/arstechnica_personal-history-lgr.jpg

Requested by

Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

65.9.67.76 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Cloudinary /

Resource Hash

29637e0647104ccc5d5583e652db29ce99e947c858c3d9502960e7ea7f1aea19

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800
X-Content-Type-Options	nosniff

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Strict-Transport-Security: max-age=604800
Via: 1.1 fdd677a35b242f0199586a71e2f6859f.cloudfront.net (CloudFront)
X-Content-Type-Options: nosniff
Age: 158
X-Cache: Hit from cloudfront
Date: Tue, 02 Mar 2021 16:26:20 GMT
Server-Timing: fastly;dur=1;start=2021-02-15T01:52:33.848Z;desc=hit,rtt;dur=1
Content-Length: 14772
Last-Modified: Mon, 21 Sep 2020 20:59:56 GMT
Server: Cloudinary
Cache-Control: public, no-transform, max-age=300
ETag: "4049b10cd3281951b01beb4f36134234"
Content-Type: image/jpeg
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Content-Length,ETag,Server-Timing,X-Content-Type-Options
Connection: keep-alive
X-Amz-Cf-Pop: FRA56-C1
Accept-Ranges: bytes
Timing-Allow-Origin: *
X-Amz-Cf-Id: fGwyJGZ20zOqc2S8XypCGCC2Bi5-oaFouRzP6YX1x8XVxzIP_aacNw==

GET
H/1.1 200
OK arstechnica_the-f-35-s-next-tech-upgrade.jpg
dwgyu36up6iuz.cloudfront.net/heru80fdn/image/upload/c_fill,d_placeholder_thescene.jpg,fl_progressive,g_center,h_169,q_80,w_300/v1598890591/ 3 KB
4 KB 212ms
62ms Image
image/jpeg 65.9.67.76
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dwgyu36up6iuz.cloudfront.net/heru80fdn/image/upload/c_fill,d_placeholder_thescene.jpg,fl_progressive,g_center,h_169,q_80,w_300/v1598890591/arstechnica_the-f-35-s-next-tech-upgrade.jpg

Requested by

Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

65.9.67.76 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Cloudinary /

Resource Hash

3b0209841325362235c221628e471145726897e4e1c9b210b6e6b2217fdf2ee8

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800
X-Content-Type-Options	nosniff

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Tue, 02 Feb 2021 08:12:01 GMT
Via: 1.1 106758604a7f1ae0fa6678cd3d828d62.cloudfront.net (CloudFront)
X-Content-Type-Options: nosniff
Age: 2448946
X-Cache: Hit from cloudfront
Server-Timing: fastly;dur=1;cpu=0;start=2021-02-02T08:12:01.030Z;desc=hit,rtt;dur=5
Content-Length: 3374
Last-Modified: Mon, 31 Aug 2020 23:24:32 GMT
Server: Cloudinary
Cache-Control: public, no-transform, immutable, max-age=2592000
ETag: "3f16924a1fdff64e971a0491115fc147"
Strict-Transport-Security: max-age=604800
Content-Type: image/jpeg
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Content-Length,ETag,Server-Timing,X-Content-Type-Options
Connection: keep-alive
X-Amz-Cf-Pop: FRA56-C1
Accept-Ranges: bytes
Timing-Allow-Origin: *
X-Amz-Cf-Id: W4CAg04t1eytFart5DTULMmeHQzbSaxIOLWUeLlkXwV9xJl3WClMFw==

GET
H/1.1 200
OK arstechnica_war-stories-diablo.jpg
dwgyu36up6iuz.cloudfront.net/heru80fdn/image/upload/c_fill,d_placeholder_thescene.jpg,fl_progressive,g_center,h_169,q_80,w_300/v1597686086/ 14 KB
15 KB 239ms
89ms Image
image/jpeg 65.9.67.76
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dwgyu36up6iuz.cloudfront.net/heru80fdn/image/upload/c_fill,d_placeholder_thescene.jpg,fl_progressive,g_center,h_169,q_80,w_300/v1597686086/arstechnica_war-stories-diablo.jpg

Requested by

Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

65.9.67.76 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Cloudinary /

Resource Hash

aa3b9513abbbf65a2c8483122648fce1b39b1afa2a69bdf863242f1411baba58

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800
X-Content-Type-Options	nosniff

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Strict-Transport-Security: max-age=604800
Via: 1.1 fdd677a35b242f0199586a71e2f6859f.cloudfront.net (CloudFront)
X-Content-Type-Options: nosniff
X-Amz-Cf-Pop: FRA56-C1
X-Cache: RefreshHit from cloudfront
Date: Tue, 02 Mar 2021 16:27:47 GMT
Server-Timing: fastly;dur=1;cpu=0;start=2021-02-14T03:06:44.605Z;desc=hit,rtt;dur=3
Content-Length: 14667
Last-Modified: Tue, 18 Aug 2020 22:01:18 GMT
Server: Cloudinary
Cache-Control: public, no-transform, max-age=300
ETag: "d4de63ae8b9ef5b77ad58eaae97d7d02"
Content-Type: image/jpeg
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Content-Length,ETag,Server-Timing,X-Content-Type-Options
Connection: keep-alive
Accept-Ranges: bytes
Timing-Allow-Origin: *
X-Amz-Cf-Id: DZ7FZUWSMBkQG5eMPR-24XkDTUYXmGQn0nFWOMcoPReFVdL54sT34g==

GET
H/1.1 200
OK arstechnica_unsolved-mysteries-unsolved-mysteries-mortal-kombat.jpg
dwgyu36up6iuz.cloudfront.net/heru80fdn/image/upload/c_fill,d_placeholder_thescene.jpg,fl_progressive,g_center,h_169,q_80,w_300/v1596476950/ 11 KB
12 KB 202ms
68ms Image
image/jpeg 65.9.67.76
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dwgyu36up6iuz.cloudfront.net/heru80fdn/image/upload/c_fill,d_placeholder_thescene.jpg,fl_progressive,g_center,h_169,q_80,w_300/v1596476950/arstechnica_unsolved-mysteries-unsolved-mysteries-mortal-kombat.jpg

Requested by

Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

65.9.67.76 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Cloudinary /

Resource Hash

0b5c6a8d4a856db56da956eced8af9a5eb6e0a89dc67de5ffc4c83513472a3cc

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800
X-Content-Type-Options	nosniff

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Strict-Transport-Security: max-age=604800
Via: 1.1 106758604a7f1ae0fa6678cd3d828d62.cloudfront.net (CloudFront)
X-Content-Type-Options: nosniff
Age: 197
X-Cache: Hit from cloudfront
Date: Tue, 02 Mar 2021 16:26:20 GMT
Server-Timing: fastly;dur=1;cpu=0;start=2021-02-06T02:07:27.070Z;desc=hit,rtt;dur=2
Content-Length: 11486
Last-Modified: Tue, 04 Aug 2020 15:57:19 GMT
Server: Cloudinary
Cache-Control: public, no-transform, max-age=300
ETag: "7a8a596aae95c9a900261808554523e6"
Content-Type: image/jpeg
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Content-Length,ETag,Server-Timing,X-Content-Type-Options
Connection: keep-alive
X-Amz-Cf-Pop: FRA56-C1
Accept-Ranges: bytes
Timing-Allow-Origin: *
X-Amz-Cf-Id: PlhipD3BT3uLUOy2p2N2vVOWYUejOv0DVu5bu0xliZunN87e5pp7cA==

GET
H/1.1 200
OK arstechnica_us-navy-gets-an-italian-accent.jpg
dwgyu36up6iuz.cloudfront.net/heru80fdn/image/upload/c_fill,d_placeholder_thescene.jpg,fl_progressive,g_center,h_169,q_80,w_300/v1595427354/ 6 KB
7 KB 233ms
68ms Image
image/jpeg 65.9.67.76
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dwgyu36up6iuz.cloudfront.net/heru80fdn/image/upload/c_fill,d_placeholder_thescene.jpg,fl_progressive,g_center,h_169,q_80,w_300/v1595427354/arstechnica_us-navy-gets-an-italian-accent.jpg

Requested by

Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

65.9.67.76 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Cloudinary /

Resource Hash

85db95dbe15c810a710ca6d9094a2a29f2eeea05791cc7aaab7af8939684b978

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800
X-Content-Type-Options	nosniff

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Strict-Transport-Security: max-age=604800
Via: 1.1 fdd677a35b242f0199586a71e2f6859f.cloudfront.net (CloudFront)
X-Content-Type-Options: nosniff
Age: 1783243
X-Cache: Hit from cloudfront
Date: Tue, 23 Feb 2021 19:15:46 GMT
Server-Timing: fastly;dur=1;cpu=0;start=2021-01-24T19:15:28.521Z;desc=hit,rtt;dur=1
Content-Length: 6124
Last-Modified: Wed, 22 Jul 2020 17:29:08 GMT
Server: Cloudinary
Cache-Control: public, no-transform, immutable, max-age=2592000
ETag: "51113bf4443c0cf453d0e8bf60489ac7"
Content-Type: image/jpeg
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Content-Length,ETag,Server-Timing,X-Content-Type-Options
Connection: keep-alive
X-Amz-Cf-Pop: FRA56-C1
Accept-Ranges: bytes
Timing-Allow-Origin: *
X-Amz-Cf-Id: NiRIGXWPLuA1DvPROpxgZu-eXCUYJehRYQMkiVr7WY2vfw0kkApeQA==

GET
H/1.1 200
OK arstechnica_war-stories-war-stories-undone-w-slash-hisko-hulsing.jpg
dwgyu36up6iuz.cloudfront.net/heru80fdn/image/upload/c_fill,d_placeholder_thescene.jpg,fl_progressive,g_center,h_169,q_80,w_300/v1594656439/ 10 KB
11 KB 200ms
68ms Image
image/jpeg 65.9.67.76
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dwgyu36up6iuz.cloudfront.net/heru80fdn/image/upload/c_fill,d_placeholder_thescene.jpg,fl_progressive,g_center,h_169,q_80,w_300/v1594656439/arstechnica_war-stories-war-stories-undone-w-slash-hisko-hulsing.jpg

Requested by

Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

65.9.67.76 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Cloudinary /

Resource Hash

e74b9cb9d8871d300d2a1d36ce2cd00dfbfe0c5d8066d1d415c4ce620a919d47

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800
X-Content-Type-Options	nosniff

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Strict-Transport-Security: max-age=604800
Via: 1.1 106758604a7f1ae0fa6678cd3d828d62.cloudfront.net (CloudFront)
X-Content-Type-Options: nosniff
Age: 93
X-Cache: Hit from cloudfront
Date: Tue, 02 Mar 2021 16:26:20 GMT
Server-Timing: fastly;dur=1;cpu=0;start=2021-02-16T03:25:45.850Z;desc=hit,rtt;dur=0
Content-Length: 10345
Last-Modified: Tue, 14 Jul 2020 16:10:31 GMT
Server: Cloudinary
Cache-Control: public, no-transform, max-age=300
ETag: "60622b64688dbb49917234d4091856fb"
Content-Type: image/jpeg
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Content-Length,ETag,Server-Timing,X-Content-Type-Options
Connection: keep-alive
X-Amz-Cf-Pop: FRA56-C1
Accept-Ranges: bytes
Timing-Allow-Origin: *
X-Amz-Cf-Id: b07OpZQbHm9g7abseb1-_zuxJ8kOWyekORIhjuR5fQYqeKErfNDY6Q==

GET
H/1.1 200
OK arstechnica_fighter-pilot-breaks-down-every-button-in-an-f-15-cockpit.jpg
dwgyu36up6iuz.cloudfront.net/heru80fdn/image/upload/c_fill,d_placeholder_thescene.jpg,fl_progressive,g_center,h_169,q_80,w_300/v1593453234/ 15 KB
16 KB 232ms
74ms Image
image/jpeg 65.9.67.76
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dwgyu36up6iuz.cloudfront.net/heru80fdn/image/upload/c_fill,d_placeholder_thescene.jpg,fl_progressive,g_center,h_169,q_80,w_300/v1593453234/arstechnica_fighter-pilot-breaks-down-every-button-in-an-f-15-cockpit.jpg

Requested by

Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

65.9.67.76 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Cloudinary /

Resource Hash

9431bc6d1a6d036a70c92dfc9000d7965f939671a59705bdd01c3e652048ed9a

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800
X-Content-Type-Options	nosniff

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Strict-Transport-Security: max-age=604800
Via: 1.1 fdd677a35b242f0199586a71e2f6859f.cloudfront.net (CloudFront)
X-Content-Type-Options: nosniff
Age: 306404
X-Cache: Hit from cloudfront
Date: Sat, 27 Feb 2021 03:36:03 GMT
Server-Timing: fastly;dur=167;cpu=0;start=2021-01-25T15:54:53.631Z;desc=miss,rtt;dur=4,cloudinary;dur=68;start=2021-01-25T15:54:53.681Z
Content-Length: 15307
Last-Modified: Tue, 30 Jun 2020 16:17:42 GMT
Server: Cloudinary
Cache-Control: public, no-transform, immutable, max-age=2592000
ETag: "324e15e8b7d3edd23ffbf5df0a1a9e77"
Content-Type: image/jpeg
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Content-Length,ETag,Server-Timing,X-Content-Type-Options
Connection: keep-alive
X-Amz-Cf-Pop: FRA56-C1
Accept-Ranges: bytes
Timing-Allow-Origin: *
X-Amz-Cf-Id: ULD4wSagN2JcAA4yzNVnWyixOeF7lbF_zrjkaj5Nbifw22_NSDhMqw==

GET
H/1.1 200
OK arstechnica_war-stories-war-stories-nba-jam.jpg
dwgyu36up6iuz.cloudfront.net/heru80fdn/image/upload/c_fill,d_placeholder_thescene.jpg,fl_progressive,g_center,h_169,q_80,w_300/v1592315288/ 14 KB
15 KB 201ms
63ms Image
image/jpeg 65.9.67.76
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dwgyu36up6iuz.cloudfront.net/heru80fdn/image/upload/c_fill,d_placeholder_thescene.jpg,fl_progressive,g_center,h_169,q_80,w_300/v1592315288/arstechnica_war-stories-war-stories-nba-jam.jpg

Requested by

Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

65.9.67.76 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Cloudinary /

Resource Hash

5be5b0170ad4bbd2be91182d137933e7de9c7e86b09ec855a4bac015ebfd746f

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800
X-Content-Type-Options	nosniff

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Strict-Transport-Security: max-age=604800
Via: 1.1 106758604a7f1ae0fa6678cd3d828d62.cloudfront.net (CloudFront)
X-Content-Type-Options: nosniff
X-Amz-Cf-Pop: FRA56-C1
X-Cache: Hit from cloudfront
Date: Tue, 02 Mar 2021 16:27:47 GMT
Server-Timing: fastly;dur=1;cpu=0;start=2021-02-14T03:10:27.432Z;desc=hit,rtt;dur=2
Content-Length: 14149
Last-Modified: Tue, 16 Jun 2020 16:24:59 GMT
Server: Cloudinary
Cache-Control: public, no-transform, max-age=300
ETag: "bd63326fa81d10df9e2da1245d3c122c"
Content-Type: image/jpeg
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Content-Length,ETag,Server-Timing,X-Content-Type-Options
Connection: keep-alive
Accept-Ranges: bytes
Timing-Allow-Origin: *
X-Amz-Cf-Id: F5kJEf7qoN9D25VJgZEc8t3zj6VqOvPbph64W7jwXGzdhcKpXKwCiA==

GET
H/1.1 200
OK arstechnica_linus-tech-tips-reacts-to-his-top-1000-youtube-comments.jpg
dwgyu36up6iuz.cloudfront.net/heru80fdn/image/upload/c_fill,d_placeholder_thescene.jpg,fl_progressive,g_center,h_169,q_80,w_300/v1591804041/ 9 KB
10 KB 216ms
72ms Image
image/jpeg 65.9.67.76
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dwgyu36up6iuz.cloudfront.net/heru80fdn/image/upload/c_fill,d_placeholder_thescene.jpg,fl_progressive,g_center,h_169,q_80,w_300/v1591804041/arstechnica_linus-tech-tips-reacts-to-his-top-1000-youtube-comments.jpg

Requested by

Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

65.9.67.76 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Cloudinary /

Resource Hash

e8830a414dfeb4c0e0f519d3419f69849df9226f329357c938333dbf2c956f63

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800
X-Content-Type-Options	nosniff

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Strict-Transport-Security: max-age=604800
Via: 1.1 fdd677a35b242f0199586a71e2f6859f.cloudfront.net (CloudFront)
X-Content-Type-Options: nosniff
Age: 209
X-Cache: Hit from cloudfront
Date: Tue, 02 Mar 2021 16:26:20 GMT
Server-Timing: fastly;dur=1;cpu=0;start=2021-02-14T02:02:42.249Z;desc=hit,rtt;dur=5
Content-Length: 9054
Last-Modified: Fri, 12 Jun 2020 00:52:29 GMT
Server: Cloudinary
Cache-Control: public, no-transform, max-age=300
ETag: "b17d3aab70cb56fbf2df892c8415ab16"
Content-Type: image/jpeg
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Content-Length,ETag,Server-Timing,X-Content-Type-Options
Connection: keep-alive
X-Amz-Cf-Pop: FRA56-C1
Accept-Ranges: bytes
Timing-Allow-Origin: *
X-Amz-Cf-Id: YxgOWjOv-iFf4blUDKSnPGC9K6fVXWgerVBmA-y4OlcFPN1jE5DOTQ==

GET
H/1.1 200
OK arstechnica_war-stories-how-alan-wake-was-rebuilt-3-years-into-development.jpg
dwgyu36up6iuz.cloudfront.net/heru80fdn/image/upload/c_fill,d_placeholder_thescene.jpg,fl_progressive,g_center,h_169,q_80,w_300/v1589408118/ 11 KB
11 KB 212ms
71ms Image
image/jpeg 65.9.67.76
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dwgyu36up6iuz.cloudfront.net/heru80fdn/image/upload/c_fill,d_placeholder_thescene.jpg,fl_progressive,g_center,h_169,q_80,w_300/v1589408118/arstechnica_war-stories-how-alan-wake-was-rebuilt-3-years-into-development.jpg

Requested by

Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

65.9.67.76 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Cloudinary /

Resource Hash

3f2cf5f857c617761a251ceef8f6ed452a7690e21f16eff0a70dddf9beea8633

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800
X-Content-Type-Options	nosniff

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Strict-Transport-Security: max-age=604800
Via: 1.1 106758604a7f1ae0fa6678cd3d828d62.cloudfront.net (CloudFront)
X-Content-Type-Options: nosniff
X-Amz-Cf-Pop: FRA56-C1
X-Cache: Hit from cloudfront
Date: Tue, 02 Mar 2021 16:27:47 GMT
Server-Timing: fastly;dur=1;cpu=0;start=2021-02-14T02:25:21.861Z;desc=hit,rtt;dur=2
Content-Length: 10817
Last-Modified: Fri, 15 May 2020 23:19:35 GMT
Server: Cloudinary
Cache-Control: public, no-transform, max-age=300
ETag: "9417ada34c9b6b07ccd41a463b717969"
Content-Type: image/jpeg
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Content-Length,ETag,Server-Timing,X-Content-Type-Options
Connection: keep-alive
Accept-Ranges: bytes
Timing-Allow-Origin: *
X-Amz-Cf-Id: 49_boS9BUw-92w8i_aTUlXpdx9Fdr9JOSyIfkIB-m5WyG21ckPk07g==

GET
H/1.1 200
OK arstechnica_war-stories-prince-of-persia.jpg
dwgyu36up6iuz.cloudfront.net/heru80fdn/image/upload/c_fill,d_placeholder_thescene.jpg,fl_progressive,g_center,h_169,q_80,w_300/v1584454477/ 15 KB
16 KB 224ms
76ms Image
image/jpeg 65.9.67.76
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dwgyu36up6iuz.cloudfront.net/heru80fdn/image/upload/c_fill,d_placeholder_thescene.jpg,fl_progressive,g_center,h_169,q_80,w_300/v1584454477/arstechnica_war-stories-prince-of-persia.jpg

Requested by

Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

65.9.67.76 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Cloudinary /

Resource Hash

56f8838a24cb0cc47dc34a19d6b84d6ce8bf8086b1682bbb990abc13b1e2da65

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800
X-Content-Type-Options	nosniff

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Strict-Transport-Security: max-age=604800
Via: 1.1 fdd677a35b242f0199586a71e2f6859f.cloudfront.net (CloudFront)
X-Content-Type-Options: nosniff
Age: 207
X-Cache: Hit from cloudfront
Date: Tue, 02 Mar 2021 16:26:20 GMT
Server-Timing: fastly;dur=1;cpu=0;start=2021-02-04T01:56:43.907Z;desc=hit,rtt;dur=5
Content-Length: 15682
Last-Modified: Wed, 18 Mar 2020 01:43:41 GMT
Server: Cloudinary
Cache-Control: public, no-transform, max-age=300
ETag: "e9cccef2a4a4cf217be0ba162f6b4296"
Content-Type: image/jpeg
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Content-Length,ETag,Server-Timing,X-Content-Type-Options
Connection: keep-alive
X-Amz-Cf-Pop: FRA56-C1
Accept-Ranges: bytes
Timing-Allow-Origin: *
X-Amz-Cf-Id: tQihnP7aY98j5kbdDhxLK0-u4QSXpvqV3HxVw3Mj-huEE3N4ATb7WA==

GET
H/1.1 200
OK arstechnica_war-stories-how-crash-bandicoot-hacked-the-playstation-to-run.jpg
dwgyu36up6iuz.cloudfront.net/heru80fdn/image/upload/c_fill,d_placeholder_thescene.jpg,fl_progressive,g_center,h_169,q_80,w_300/v1582755533/ 17 KB
18 KB 219ms
75ms Image
image/jpeg 65.9.67.76
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dwgyu36up6iuz.cloudfront.net/heru80fdn/image/upload/c_fill,d_placeholder_thescene.jpg,fl_progressive,g_center,h_169,q_80,w_300/v1582755533/arstechnica_war-stories-how-crash-bandicoot-hacked-the-playstation-to-run.jpg

Requested by

Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

65.9.67.76 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Cloudinary /

Resource Hash

46a9ddb1f206a46900872e0a832750ae06925528f81883a3d3517fdb42aefb6d

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800
X-Content-Type-Options	nosniff

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Strict-Transport-Security: max-age=604800
Via: 1.1 106758604a7f1ae0fa6678cd3d828d62.cloudfront.net (CloudFront)
X-Content-Type-Options: nosniff
X-Amz-Cf-Pop: FRA56-C1
X-Cache: Hit from cloudfront
Date: Tue, 02 Mar 2021 16:27:47 GMT
Server-Timing: fastly;dur=1;cpu=0;start=2021-02-15T01:54:34.564Z;desc=hit,rtt;dur=2
Content-Length: 17475
Last-Modified: Thu, 27 Feb 2020 18:16:40 GMT
Server: Cloudinary
Cache-Control: public, no-transform, max-age=300
ETag: "7588b83c6eb2a1165344abad7e12e715"
Content-Type: image/jpeg
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Content-Length,ETag,Server-Timing,X-Content-Type-Options
Connection: keep-alive
Accept-Ranges: bytes
Timing-Allow-Origin: *
X-Amz-Cf-Id: f517k3oV_BVIgeczuEA7R_Vbv16_1MRtn77ljGmQp7U30gimOw9MZA==

GET
H/1.1 200
OK arstechnica_war-stories-myst.jpg
dwgyu36up6iuz.cloudfront.net/heru80fdn/image/upload/c_fill,d_placeholder_thescene.jpg,fl_progressive,g_center,h_169,q_80,w_300/v1580223113/ 13 KB
14 KB 228ms
78ms Image
image/jpeg 65.9.67.76
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dwgyu36up6iuz.cloudfront.net/heru80fdn/image/upload/c_fill,d_placeholder_thescene.jpg,fl_progressive,g_center,h_169,q_80,w_300/v1580223113/arstechnica_war-stories-myst.jpg

Requested by

Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

65.9.67.76 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Cloudinary /

Resource Hash

1bf55bc00dbf13180884211c3d301729e67b81f3456225c1fbf97d271d636509

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800
X-Content-Type-Options	nosniff

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Strict-Transport-Security: max-age=604800
Via: 1.1 fdd677a35b242f0199586a71e2f6859f.cloudfront.net (CloudFront)
X-Content-Type-Options: nosniff
X-Amz-Cf-Pop: FRA56-C1
X-Cache: Hit from cloudfront
Date: Tue, 02 Mar 2021 16:27:47 GMT
Server-Timing: fastly;dur=1;cpu=0;start=2021-02-14T05:13:08.044Z;desc=hit,rtt;dur=5
Content-Length: 13522
Last-Modified: Wed, 29 Jan 2020 20:33:36 GMT
Server: Cloudinary
Cache-Control: public, no-transform, max-age=300
ETag: "ed8c6a9aa19e7d5c7aa46a3aead23a87"
Content-Type: image/jpeg
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Content-Length,ETag,Server-Timing,X-Content-Type-Options
Connection: keep-alive
Accept-Ranges: bytes
Timing-Allow-Origin: *
X-Amz-Cf-Id: yOhR6MnPBJ9KZo7-vqqHG_oRzTobx2BDKQU5tomp0KzqTkFxvaoOqA==

GET
H/1.1 200
OK arstechnica_markiplier-reacts-to-his-top-1000-youtube-comments.jpg
dwgyu36up6iuz.cloudfront.net/heru80fdn/image/upload/c_fill,d_placeholder_thescene.jpg,fl_progressive,g_center,h_169,q_80,w_300/v1579194313/ 9 KB
9 KB 214ms
66ms Image
image/jpeg 65.9.67.76
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dwgyu36up6iuz.cloudfront.net/heru80fdn/image/upload/c_fill,d_placeholder_thescene.jpg,fl_progressive,g_center,h_169,q_80,w_300/v1579194313/arstechnica_markiplier-reacts-to-his-top-1000-youtube-comments.jpg

Requested by

Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

65.9.67.76 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Cloudinary /

Resource Hash

e336ff50623cff960c2396944be4392139f63dcc032e5f3428d81489fdfe697a

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800
X-Content-Type-Options	nosniff

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Strict-Transport-Security: max-age=604800
Via: 1.1 106758604a7f1ae0fa6678cd3d828d62.cloudfront.net (CloudFront)
X-Content-Type-Options: nosniff
Age: 158
X-Cache: Hit from cloudfront
Date: Tue, 02 Mar 2021 16:26:20 GMT
Server-Timing: fastly;dur=1;cpu=0;start=2021-02-01T04:48:11.343Z;desc=hit,rtt;dur=4
Content-Length: 8832
Last-Modified: Tue, 21 Jan 2020 16:11:08 GMT
Server: Cloudinary
Cache-Control: public, no-transform, max-age=300
ETag: "2bad386c14ac040d530ceb2ae89c8bbb"
Content-Type: image/jpeg
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Content-Length,ETag,Server-Timing,X-Content-Type-Options
Connection: keep-alive
X-Amz-Cf-Pop: FRA56-C1
Accept-Ranges: bytes
Timing-Allow-Origin: *
X-Amz-Cf-Id: D9Y7LmW-x5wRjtEnM1lToB6Fppe0NvfQJfNBMImm5aWAg3iaKsdpzQ==

GET
H/1.1 200
OK arstechnica_war-stories-war-stories-oddworld.jpg
dwgyu36up6iuz.cloudfront.net/heru80fdn/image/upload/c_fill,d_placeholder_thescene.jpg,fl_progressive,g_center,h_169,q_80,w_300/v1582815531/ 12 KB
13 KB 244ms
87ms Image
image/jpeg 65.9.67.76
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dwgyu36up6iuz.cloudfront.net/heru80fdn/image/upload/c_fill,d_placeholder_thescene.jpg,fl_progressive,g_center,h_169,q_80,w_300/v1582815531/arstechnica_war-stories-war-stories-oddworld.jpg

Requested by

Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

65.9.67.76 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Cloudinary /

Resource Hash

1097abb6f0992cccc79428374463e7f23b99dae5eb85d7317b20bd57c96031bb

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800
X-Content-Type-Options	nosniff

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Strict-Transport-Security: max-age=604800
Via: 1.1 fdd677a35b242f0199586a71e2f6859f.cloudfront.net (CloudFront)
X-Content-Type-Options: nosniff
X-Amz-Cf-Pop: FRA56-C1
X-Cache: Hit from cloudfront
Date: Tue, 02 Mar 2021 16:27:47 GMT
Server-Timing: fastly;dur=1;cpu=0;start=2021-02-07T02:11:41.163Z;desc=hit,rtt;dur=4
Content-Length: 12614
Last-Modified: Thu, 27 Feb 2020 15:06:28 GMT
Server: Cloudinary
Cache-Control: public, no-transform, max-age=300
ETag: "4a7903cbe66890b5688d843661943ccd"
Content-Type: image/jpeg
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Content-Length,ETag,Server-Timing,X-Content-Type-Options
Connection: keep-alive
Accept-Ranges: bytes
Timing-Allow-Origin: *
X-Amz-Cf-Id: 6bY3-_dyA4N9jWcAuh6-rUrkPLuudmMg_YRWleeXBMPGwHm7tNJ2YQ==

GET
H/1.1 200
OK arstechnica_unsolved-mysteries-bioware-answers-unsolved-mysteries-of-the-mass-effect-universe.jpg
dwgyu36up6iuz.cloudfront.net/heru80fdn/image/upload/c_fill,d_placeholder_thescene.jpg,fl_progressive,g_center,h_169,q_80,w_300/v1573140819/ 11 KB
12 KB 387ms
243ms Image
image/jpeg 65.9.67.76
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dwgyu36up6iuz.cloudfront.net/heru80fdn/image/upload/c_fill,d_placeholder_thescene.jpg,fl_progressive,g_center,h_169,q_80,w_300/v1573140819/arstechnica_unsolved-mysteries-bioware-answers-unsolved-mysteries-of-the-mass-effect-universe.jpg

Requested by

Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

65.9.67.76 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Cloudinary /

Resource Hash

de24551bd4396fc8579b2d87ce01944553dd48fb52775d14373725a50efa0c37

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800
X-Content-Type-Options	nosniff

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Strict-Transport-Security: max-age=604800
Via: 1.1 106758604a7f1ae0fa6678cd3d828d62.cloudfront.net (CloudFront)
X-Content-Type-Options: nosniff
Age: 87
X-Cache: Hit from cloudfront
Date: Tue, 02 Mar 2021 16:26:20 GMT
Server-Timing: fastly;dur=1;start=2021-02-16T05:50:50.163Z;desc=hit,rtt;dur=5
Content-Length: 11417
Last-Modified: Fri, 08 Nov 2019 14:35:23 GMT
Server: Cloudinary
Cache-Control: public, no-transform, max-age=300
ETag: "3e8509d06c6610d54babcac0d91e5d93"
Content-Type: image/jpeg
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Content-Length,ETag,Server-Timing,X-Content-Type-Options
Connection: keep-alive
X-Amz-Cf-Pop: FRA56-C1
Accept-Ranges: bytes
Timing-Allow-Origin: *
X-Amz-Cf-Id: cs-Nb2lbC7GjQVHHjRne5eS0_nKsMS37MwqQXA36In-GOe-Bsy4DXw==

GET
H/1.1 200
OK arstechnica_war-stories-civilization.jpg
dwgyu36up6iuz.cloudfront.net/heru80fdn/image/upload/c_fill,d_placeholder_thescene.jpg,fl_progressive,g_center,h_169,q_80,w_300/v1569003425/ 16 KB
17 KB 245ms
76ms Image
image/jpeg 65.9.67.76
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dwgyu36up6iuz.cloudfront.net/heru80fdn/image/upload/c_fill,d_placeholder_thescene.jpg,fl_progressive,g_center,h_169,q_80,w_300/v1569003425/arstechnica_war-stories-civilization.jpg

Requested by

Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

65.9.67.76 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Cloudinary /

Resource Hash

1c7dcc8216c6f82da2998ceeac2523632c7f9bffe510824b6d082621201f2012

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800
X-Content-Type-Options	nosniff

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Strict-Transport-Security: max-age=604800
Via: 1.1 fdd677a35b242f0199586a71e2f6859f.cloudfront.net (CloudFront)
X-Content-Type-Options: nosniff
Age: 157
X-Cache: Hit from cloudfront
Date: Tue, 02 Mar 2021 16:26:20 GMT
Server-Timing: fastly;dur=1;cpu=0;start=2021-02-07T02:11:41.165Z;desc=hit,rtt;dur=4
Content-Length: 16236
Last-Modified: Mon, 23 Sep 2019 11:27:54 GMT
Server: Cloudinary
Cache-Control: public, no-transform, max-age=300
ETag: "72002610618f7bf8bf0e52c760e39897"
Content-Type: image/jpeg
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Content-Length,ETag,Server-Timing,X-Content-Type-Options
Connection: keep-alive
X-Amz-Cf-Pop: FRA56-C1
Accept-Ranges: bytes
Timing-Allow-Origin: *
X-Amz-Cf-Id: 71YcBHi6XIjqsdO_vo7D-7iI4JCtNJYclLWdQ6GmP4_raFrEJfHhow==

GET
H/1.1 200
OK arstechnica_sitrep-dod-resets-ballistic-missile-interceptor-program.jpg
dwgyu36up6iuz.cloudfront.net/heru80fdn/image/upload/c_fill,d_placeholder_thescene.jpg,fl_progressive,g_center,h_169,q_80,w_300/v1568662260/ 11 KB
11 KB 297ms
72ms Image
image/jpeg 65.9.67.76
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dwgyu36up6iuz.cloudfront.net/heru80fdn/image/upload/c_fill,d_placeholder_thescene.jpg,fl_progressive,g_center,h_169,q_80,w_300/v1568662260/arstechnica_sitrep-dod-resets-ballistic-missile-interceptor-program.jpg

Requested by

Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

65.9.67.76 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Cloudinary /

Resource Hash

7fc88c65d46e83b3f3e9f098f05fd639480332fc3718cd714725e2e4633af4e8

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800
X-Content-Type-Options	nosniff

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Sun, 07 Feb 2021 15:43:00 GMT
Via: 1.1 fdd677a35b242f0199586a71e2f6859f.cloudfront.net (CloudFront)
X-Content-Type-Options: nosniff
Age: 1989887
X-Cache: Hit from cloudfront
Server-Timing: fastly;dur=366;cpu=0;start=2021-02-07T15:42:59.824Z;desc=miss,rtt;dur=3,cloudinary;dur=269;start=2021-02-07T15:42:59.872Z
Content-Length: 10793
Last-Modified: Tue, 17 Sep 2019 19:55:15 GMT
Server: Cloudinary
Cache-Control: public, no-transform, immutable, max-age=2592000
ETag: "0e1ff58ccf6d97759de3d774a7ff835a"
Strict-Transport-Security: max-age=604800
Content-Type: image/jpeg
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Content-Length,ETag,Server-Timing,X-Content-Type-Options
Connection: keep-alive
X-Amz-Cf-Pop: FRA56-C1
Accept-Ranges: bytes
Timing-Allow-Origin: *
X-Amz-Cf-Id: jDojEke-EH16Pj9DA4WAOG_iIgMpOVT3aLPdrLnLf2_c3SmtfpAuaQ==

GET
H/1.1 200
OK arstechnica_warframe-reviews.jpg
dwgyu36up6iuz.cloudfront.net/heru80fdn/image/upload/c_fill,d_placeholder_thescene.jpg,fl_progressive,g_center,h_169,q_80,w_300/v1561556730/ 14 KB
15 KB 317ms
78ms Image
image/jpeg 65.9.67.76
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dwgyu36up6iuz.cloudfront.net/heru80fdn/image/upload/c_fill,d_placeholder_thescene.jpg,fl_progressive,g_center,h_169,q_80,w_300/v1561556730/arstechnica_warframe-reviews.jpg

Requested by

Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

65.9.67.76 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Cloudinary /

Resource Hash

83a366075eb2387c6d9f848f42b08df0546027333eccf5813edf95ba45709be2

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800
X-Content-Type-Options	nosniff

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Strict-Transport-Security: max-age=604800
Via: 1.1 fdd677a35b242f0199586a71e2f6859f.cloudfront.net (CloudFront)
X-Content-Type-Options: nosniff
X-Amz-Cf-Pop: FRA56-C1
X-Cache: Hit from cloudfront
Date: Tue, 02 Mar 2021 16:27:48 GMT
Server-Timing: fastly;dur=1;start=2021-02-14T05:13:08.094Z;desc=hit,rtt;dur=9
Content-Length: 14837
Last-Modified: Thu, 27 Jun 2019 19:34:59 GMT
Server: Cloudinary
Cache-Control: public, no-transform, max-age=300
ETag: "1d90d6aef7585f963e1270a1a02a4dd4"
Content-Type: image/jpeg
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Content-Length,ETag,Server-Timing,X-Content-Type-Options
Connection: keep-alive
Accept-Ranges: bytes
Timing-Allow-Origin: *
X-Amz-Cf-Id: OT-_zDCDMdIzOE8a_z46yM1KKibhOsM_bYIF0-a1eEIqZAmVpnlf5g==

GET
H/1.1 200
OK arstechnica_war-stories-subnautica.jpg
dwgyu36up6iuz.cloudfront.net/heru80fdn/image/upload/c_fill,d_placeholder_thescene.jpg,fl_progressive,g_center,h_169,q_80,w_300/v1559747425/ 15 KB
16 KB 307ms
63ms Image
image/jpeg 65.9.67.76
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dwgyu36up6iuz.cloudfront.net/heru80fdn/image/upload/c_fill,d_placeholder_thescene.jpg,fl_progressive,g_center,h_169,q_80,w_300/v1559747425/arstechnica_war-stories-subnautica.jpg

Requested by

Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

65.9.67.76 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Cloudinary /

Resource Hash

20660a9ef7ec454c15b2dc62b3db084e0cc9f74c5bb6de71a96fb1a54aef00f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800
X-Content-Type-Options	nosniff

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Strict-Transport-Security: max-age=604800
Via: 1.1 106758604a7f1ae0fa6678cd3d828d62.cloudfront.net (CloudFront)
X-Content-Type-Options: nosniff
X-Amz-Cf-Pop: FRA56-C1
X-Cache: Hit from cloudfront
Date: Tue, 02 Mar 2021 16:27:48 GMT
Server-Timing: fastly;dur=1;cpu=0;start=2021-02-14T02:46:37.029Z;desc=hit,rtt;dur=0
Content-Length: 15222
Last-Modified: Wed, 05 Jun 2019 17:40:02 GMT
Server: Cloudinary
Cache-Control: public, no-transform, max-age=300
ETag: "8c45b6c645caba59f4b14d3fbdc09062"
Content-Type: image/jpeg
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Content-Length,ETag,Server-Timing,X-Content-Type-Options
Connection: keep-alive
Accept-Ranges: bytes
Timing-Allow-Origin: *
X-Amz-Cf-Id: VFAgNw4UbzLbAD0NTwUs4nKtKhOY5tvjctKg15P05efHfzbR7A8GAA==

GET
H/1.1 200
OK arstechnica_war-stories-slay-the-spire-war-stories.jpg
dwgyu36up6iuz.cloudfront.net/heru80fdn/image/upload/c_fill,d_placeholder_thescene.jpg,fl_progressive,g_center,h_169,q_80,w_300/v1556741487/ 15 KB
16 KB 281ms
61ms Image
image/jpeg 65.9.67.76
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dwgyu36up6iuz.cloudfront.net/heru80fdn/image/upload/c_fill,d_placeholder_thescene.jpg,fl_progressive,g_center,h_169,q_80,w_300/v1556741487/arstechnica_war-stories-slay-the-spire-war-stories.jpg

Requested by

Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

65.9.67.76 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Cloudinary /

Resource Hash

f9d9e96c4439beeca49a1a10f9dffe6f5cd0b604d13aa13af170d0bc62d8ca1b

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800
X-Content-Type-Options	nosniff

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Strict-Transport-Security: max-age=604800
Via: 1.1 a618edcb8ddcdae59a3a61a6c82ff54d.cloudfront.net (CloudFront)
X-Content-Type-Options: nosniff
Age: 158
X-Cache: Hit from cloudfront
Date: Tue, 02 Mar 2021 16:26:20 GMT
Server-Timing: fastly;dur=1;cpu=0;start=2021-02-01T04:43:26.096Z;desc=hit,rtt;dur=1
Content-Length: 15634
Last-Modified: Thu, 02 May 2019 18:45:52 GMT
Server: Cloudinary
Cache-Control: public, no-transform, max-age=300
ETag: "abee90e53f29ba0127fca9442ab50902"
Content-Type: image/jpeg
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Content-Length,ETag,Server-Timing,X-Content-Type-Options
Connection: keep-alive
X-Amz-Cf-Pop: FRA56-C1
Accept-Ranges: bytes
Timing-Allow-Origin: *
X-Amz-Cf-Id: yXkBglbxBR1yk9IzRs7i0zlGBIQ1RWJFhu79wJXmrYVKJkpm-RJ0LQ==

GET
H/1.1 200
OK arstechnica_war-stories-amnesia-the-dark-descent-the-horror-facade.jpg
dwgyu36up6iuz.cloudfront.net/heru80fdn/image/upload/c_fill,d_placeholder_thescene.jpg,fl_progressive,g_center,h_169,q_80,w_300/v1555359865/ 15 KB
16 KB 214ms
71ms Image
image/jpeg 65.9.67.76
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dwgyu36up6iuz.cloudfront.net/heru80fdn/image/upload/c_fill,d_placeholder_thescene.jpg,fl_progressive,g_center,h_169,q_80,w_300/v1555359865/arstechnica_war-stories-amnesia-the-dark-descent-the-horror-facade.jpg

Requested by

Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

65.9.67.76 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Cloudinary /

Resource Hash

1defb6bc54a7ee9c066136908360e8455c23ee9ad0dec9924e7255d7948cd4be

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800
X-Content-Type-Options	nosniff

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Strict-Transport-Security: max-age=604800
Via: 1.1 2a3a093b493a82493f3431437cb166ad.cloudfront.net (CloudFront)
X-Content-Type-Options: nosniff
X-Amz-Cf-Pop: FRA56-C1
X-Cache: Hit from cloudfront
Date: Tue, 02 Mar 2021 16:27:48 GMT
Server-Timing: fastly;dur=1;cpu=0;start=2021-02-14T01:47:16.592Z;desc=hit,rtt;dur=1
Content-Length: 15251
Last-Modified: Tue, 16 Apr 2019 18:59:19 GMT
Server: Cloudinary
Cache-Control: public, no-transform, max-age=300
ETag: "3e7cdc13e718680bf5e1efa64468b560"
Content-Type: image/jpeg
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Content-Length,ETag,Server-Timing,X-Content-Type-Options
Connection: keep-alive
Accept-Ranges: bytes
Timing-Allow-Origin: *
X-Amz-Cf-Id: DzZZKADH0mrCXh3KYS7aBm0emA_U6lDzzUuSSEBpmFoKlWcRYgmPdw==

GET
H/1.1 200
OK arstechnica_war-stories-c-and-c-tiberian-sun.jpg
dwgyu36up6iuz.cloudfront.net/heru80fdn/image/upload/c_fill,d_placeholder_thescene.jpg,fl_progressive,g_center,h_169,q_80,w_300/v1551193450/ 19 KB
19 KB 150ms
79ms Image
image/jpeg 65.9.67.76
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dwgyu36up6iuz.cloudfront.net/heru80fdn/image/upload/c_fill,d_placeholder_thescene.jpg,fl_progressive,g_center,h_169,q_80,w_300/v1551193450/arstechnica_war-stories-c-and-c-tiberian-sun.jpg

Requested by

Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

65.9.67.76 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Cloudinary /

Resource Hash

27348ba4b98bd80f1038496ec5dea6ad865680540058fb085b8ca199b8aaf4c5

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800
X-Content-Type-Options	nosniff

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Strict-Transport-Security: max-age=604800
Via: 1.1 1c5b98f7bd5001d6fe1040daa237afc6.cloudfront.net (CloudFront)
X-Content-Type-Options: nosniff
X-Amz-Cf-Pop: FRA56-C1
X-Cache: Hit from cloudfront
Date: Tue, 02 Mar 2021 16:27:48 GMT
Server-Timing: fastly;dur=1;cpu=0;start=2021-02-15T02:28:41.560Z;desc=hit,rtt;dur=5
Content-Length: 19022
Last-Modified: Wed, 27 Feb 2019 16:48:24 GMT
Server: Cloudinary
Cache-Control: public, no-transform, max-age=300
ETag: "fe52b9acd391d8bee8de15a0f429b377"
Content-Type: image/jpeg
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Content-Length,ETag,Server-Timing,X-Content-Type-Options
Connection: keep-alive
Accept-Ranges: bytes
Timing-Allow-Origin: *
X-Amz-Cf-Id: OfaRxqmr0PI6RLsGFpPtgDOvnN8zPPYzo03lFGjtDeKKvcXz9zFvxQ==

GET
H/1.1 200
OK arstechnica_war-stories-blade-runner-skinjobs-voxels-and-future-noir.jpg
dwgyu36up6iuz.cloudfront.net/heru80fdn/image/upload/c_fill,d_placeholder_thescene.jpg,fl_progressive,g_center,h_169,q_80,w_300/v1550244434/ 18 KB
19 KB 144ms
78ms Image
image/jpeg 65.9.67.76
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dwgyu36up6iuz.cloudfront.net/heru80fdn/image/upload/c_fill,d_placeholder_thescene.jpg,fl_progressive,g_center,h_169,q_80,w_300/v1550244434/arstechnica_war-stories-blade-runner-skinjobs-voxels-and-future-noir.jpg

Requested by

Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

65.9.67.76 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Cloudinary /

Resource Hash

8b72952d3fd656ee6594f0d9735d928113ad1d590705b14f77abf75f1d4d5d69

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800
X-Content-Type-Options	nosniff

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Strict-Transport-Security: max-age=604800
Via: 1.1 6b38a2e1db230db568190464ab7177db.cloudfront.net (CloudFront)
X-Content-Type-Options: nosniff
X-Amz-Cf-Pop: FRA56-C1
X-Cache: Hit from cloudfront
Date: Tue, 02 Mar 2021 16:27:48 GMT
Server-Timing: fastly;dur=1;cpu=0;start=2021-02-15T01:54:34.646Z;desc=hit,rtt;dur=2
Content-Length: 18172
Last-Modified: Fri, 15 Feb 2019 15:34:33 GMT
Server: Cloudinary
Cache-Control: public, no-transform, max-age=300
ETag: "32f1b8954559c8d598e9861f5b8360b9"
Content-Type: image/jpeg
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Content-Length,ETag,Server-Timing,X-Content-Type-Options
Connection: keep-alive
Accept-Ranges: bytes
Timing-Allow-Origin: *
X-Amz-Cf-Id: M8dibk-LyRO5hcY6sqXZxrjmFgKtNOyS-EadHL8bwW9gY-CbNaVMLg==

GET
H/1.1 200
OK arstechnica_war-stories-dead-space-the-drag-tentacle.jpg
dwgyu36up6iuz.cloudfront.net/heru80fdn/image/upload/c_fill,d_placeholder_thescene.jpg,fl_progressive,g_center,h_169,q_80,w_300/v1546889545/ 7 KB
8 KB 70ms
69ms Image
image/jpeg 65.9.67.76
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dwgyu36up6iuz.cloudfront.net/heru80fdn/image/upload/c_fill,d_placeholder_thescene.jpg,fl_progressive,g_center,h_169,q_80,w_300/v1546889545/arstechnica_war-stories-dead-space-the-drag-tentacle.jpg

Requested by

Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

65.9.67.76 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Cloudinary /

Resource Hash

9933997608e86beaf1e7f7188a5c657cdad8ccd9d20eb7b1a46adaa83fa850ab

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800
X-Content-Type-Options	nosniff

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Mon, 01 Feb 2021 19:28:33 GMT
Via: 1.1 fdd677a35b242f0199586a71e2f6859f.cloudfront.net (CloudFront)
X-Content-Type-Options: nosniff
Age: 2494754
X-Cache: Hit from cloudfront
Server-Timing: fastly;dur=1;cpu=0;start=2021-02-01T19:28:33.704Z;desc=hit,rtt;dur=4
Content-Length: 7393
Last-Modified: Tue, 08 Jan 2019 16:38:58 GMT
Server: Cloudinary
Cache-Control: public, no-transform, immutable, max-age=2592000
ETag: "17a6e4b5eb75eb12f5d8c89eb3d0ace8"
Strict-Transport-Security: max-age=604800
Content-Type: image/jpeg
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Content-Length,ETag,Server-Timing,X-Content-Type-Options
Connection: keep-alive
X-Amz-Cf-Pop: FRA56-C1
Accept-Ranges: bytes
Timing-Allow-Origin: *
X-Amz-Cf-Id: FjR7sfXnW2Nt4UPBdDRmgp2D4P86eBjFuCoWnFJDE7onrHv6aFwzJA==

GET
H/1.1 200
OK arstechnica_teach-the-controversy-flat-earthers.jpg
dwgyu36up6iuz.cloudfront.net/heru80fdn/image/upload/c_fill,d_placeholder_thescene.jpg,fl_progressive,g_center,h_169,q_80,w_300/v1541592304/ 10 KB
11 KB 75ms
73ms Image
image/jpeg 65.9.67.76
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dwgyu36up6iuz.cloudfront.net/heru80fdn/image/upload/c_fill,d_placeholder_thescene.jpg,fl_progressive,g_center,h_169,q_80,w_300/v1541592304/arstechnica_teach-the-controversy-flat-earthers.jpg

Requested by

Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

65.9.67.76 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Cloudinary /

Resource Hash

7364fcbb6c5d775f07816712af8a6419db99268f72c337a4977f706dc3423bb3

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800
X-Content-Type-Options	nosniff

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Strict-Transport-Security: max-age=604800
Via: 1.1 106758604a7f1ae0fa6678cd3d828d62.cloudfront.net (CloudFront)
X-Content-Type-Options: nosniff
X-Amz-Cf-Pop: FRA56-C1
X-Cache: Hit from cloudfront
Date: Tue, 02 Mar 2021 16:27:48 GMT
Server-Timing: fastly;dur=1;cpu=0;start=2021-02-14T03:06:43.979Z;desc=hit,rtt;dur=3
Content-Length: 10595
Last-Modified: Fri, 09 Nov 2018 14:44:53 GMT
Server: Cloudinary
Cache-Control: public, no-transform, max-age=300
ETag: "6c0c4f8a9d61ed2b5863a8058c624a37"
Content-Type: image/jpeg
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Content-Length,ETag,Server-Timing,X-Content-Type-Options
Connection: keep-alive
Accept-Ranges: bytes
Timing-Allow-Origin: *
X-Amz-Cf-Id: DmF5e9ACLKo0ur0GqRAQIDQPtsaC4YRrlr_uCZSXITu-ImV3bkboow==

GET
H/1.1 200
OK arstechnica_delta-v-the-burgeoning-world-of-small-rockets-paul-allen-s-huge-plane-and-spacex-get-s-a-crucial-green-light.jpg
dwgyu36up6iuz.cloudfront.net/heru80fdn/image/upload/c_fill,d_placeholder_thescene.jpg,fl_progressive,g_center,h_169,q_80,w_300/v1537406983/ 12 KB
13 KB 73ms
71ms Image
image/jpeg 65.9.67.76
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dwgyu36up6iuz.cloudfront.net/heru80fdn/image/upload/c_fill,d_placeholder_thescene.jpg,fl_progressive,g_center,h_169,q_80,w_300/v1537406983/arstechnica_delta-v-the-burgeoning-world-of-small-rockets-paul-allen-s-huge-plane-and-spacex-get-s-a-crucial-green-light.jpg

Requested by

Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

65.9.67.76 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Cloudinary /

Resource Hash

16f86804dd013db340fee4020a539d3e9d6e5a03d6841e431e50c428e99c26e8

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800
X-Content-Type-Options	nosniff

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Strict-Transport-Security: max-age=604800
Via: 1.1 2a3a093b493a82493f3431437cb166ad.cloudfront.net (CloudFront)
X-Content-Type-Options: nosniff
Age: 151
X-Cache: Hit from cloudfront
Date: Tue, 02 Mar 2021 16:26:20 GMT
Server-Timing: fastly;dur=1;start=2021-02-14T04:57:30.496Z;desc=hit,rtt;dur=3
Content-Length: 12509
Last-Modified: Fri, 21 Sep 2018 16:51:30 GMT
Server: Cloudinary
Cache-Control: public, no-transform, max-age=300
ETag: "b9c502ffc902b60d0eb13698b37a945d"
Content-Type: image/jpeg
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Content-Length,ETag,Server-Timing,X-Content-Type-Options
Connection: keep-alive
X-Amz-Cf-Pop: FRA56-C1
Accept-Ranges: bytes
Timing-Allow-Origin: *
X-Amz-Cf-Id: I6CuJGBuwH8KkdLEmE8gIBhXKCVDZnBRWcD2SKNJoOyLZe4blxl1rQ==

GET
H/1.1 200
OK arstechnica_chris-hadfield-explains-his-space-oddity-video.jpg
dwgyu36up6iuz.cloudfront.net/heru80fdn/image/upload/c_fill,d_placeholder_thescene.jpg,fl_progressive,g_center,h_169,q_80,w_300/v1522031130/ 7 KB
8 KB 62ms
61ms Image
image/jpeg 65.9.67.76
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dwgyu36up6iuz.cloudfront.net/heru80fdn/image/upload/c_fill,d_placeholder_thescene.jpg,fl_progressive,g_center,h_169,q_80,w_300/v1522031130/arstechnica_chris-hadfield-explains-his-space-oddity-video.jpg

Requested by

Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

65.9.67.76 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Cloudinary /

Resource Hash

3ce7e824185893264ab44fbf8370a8f1262831c4c6c367b15f7d4f1e88fadc8c

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800
X-Content-Type-Options	nosniff

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Strict-Transport-Security: max-age=604800
Via: 1.1 a618edcb8ddcdae59a3a61a6c82ff54d.cloudfront.net (CloudFront)
X-Content-Type-Options: nosniff
Age: 1556406
X-Cache: Hit from cloudfront
Date: Thu, 18 Feb 2021 18:19:43 GMT
Server-Timing: fastly;dur=1;cpu=0;start=2021-01-19T18:18:31.349Z;desc=hit,rtt;dur=0
Content-Length: 7181
Last-Modified: Fri, 06 Jul 2018 12:23:22 GMT
Server: Cloudinary
Cache-Control: public, no-transform, immutable, max-age=2592000
ETag: "0549828edcecd339d8d10ebe6119de70"
Content-Type: image/jpeg
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Content-Length,ETag,Server-Timing,X-Content-Type-Options
Connection: keep-alive
X-Amz-Cf-Pop: FRA56-C1
Accept-Ranges: bytes
Timing-Allow-Origin: *
X-Amz-Cf-Id: 8u8cU25sofPokRNIWXEd-iqZu1vHA5DqceGqnHqgxu0QM2NFQ4A55A==

GET
H/1.1 200
OK arstechnica_apollo-mission-episode-1.jpg
dwgyu36up6iuz.cloudfront.net/heru80fdn/image/upload/c_fill,d_placeholder_thescene.jpg,fl_progressive,g_center,h_169,q_80,w_300/v1512424612/ 14 KB
15 KB 75ms
74ms Image
image/jpeg 65.9.67.76
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dwgyu36up6iuz.cloudfront.net/heru80fdn/image/upload/c_fill,d_placeholder_thescene.jpg,fl_progressive,g_center,h_169,q_80,w_300/v1512424612/arstechnica_apollo-mission-episode-1.jpg

Requested by

Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

65.9.67.76 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Cloudinary /

Resource Hash

82cd1a97f81e5b63a621311be2993916eea0907b5eadd53bb6b280f4bb0f8391

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800
X-Content-Type-Options	nosniff

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Strict-Transport-Security: max-age=604800
Via: 1.1 fdd677a35b242f0199586a71e2f6859f.cloudfront.net (CloudFront)
X-Content-Type-Options: nosniff
Age: 108
X-Cache: Hit from cloudfront
Date: Tue, 02 Mar 2021 16:26:20 GMT
Server-Timing: fastly;dur=1;cpu=0;start=2021-02-18T05:01:25.508Z;desc=hit,rtt;dur=6
Content-Length: 14040
Last-Modified: Tue, 05 Dec 2017 01:52:25 GMT
Server: Cloudinary
Cache-Control: public, no-transform, max-age=300
ETag: "ecc047c6eed3dc571a78eab647201220"
Content-Type: image/jpeg
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Content-Length,ETag,Server-Timing,X-Content-Type-Options
Connection: keep-alive
X-Amz-Cf-Pop: FRA56-C1
Accept-Ranges: bytes
Timing-Allow-Origin: *
X-Amz-Cf-Id: 17FNoGrDzLMR0saJJskL0aBvNhg1UGl2_b30THfSpZ3WhsXexX16nA==

GET
H/1.1 200
OK arstechnica_richard-garriot-war-stories.jpg
dwgyu36up6iuz.cloudfront.net/heru80fdn/image/upload/c_fill,d_placeholder_thescene.jpg,fl_progressive,g_center,h_169,q_80,w_300/v1513807048/ 14 KB
14 KB 73ms
72ms Image
image/jpeg 65.9.67.76
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dwgyu36up6iuz.cloudfront.net/heru80fdn/image/upload/c_fill,d_placeholder_thescene.jpg,fl_progressive,g_center,h_169,q_80,w_300/v1513807048/arstechnica_richard-garriot-war-stories.jpg

Requested by

Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

65.9.67.76 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Cloudinary /

Resource Hash

4980853759711c8e9e2779239acd62e9e802fba38371763c65ecdd016a83fdbd

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800
X-Content-Type-Options	nosniff

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Strict-Transport-Security: max-age=604800
Via: 1.1 106758604a7f1ae0fa6678cd3d828d62.cloudfront.net (CloudFront)
X-Content-Type-Options: nosniff
X-Amz-Cf-Pop: FRA56-C1
X-Cache: Hit from cloudfront
Date: Tue, 02 Mar 2021 16:27:48 GMT
Server-Timing: fastly;dur=1;cpu=0;start=2021-02-05T01:47:06.327Z;desc=hit,rtt;dur=7
Content-Length: 13885
Last-Modified: Fri, 06 Jul 2018 19:56:42 GMT
Server: Cloudinary
Cache-Control: public, no-transform, max-age=300
ETag: "13d45a1733ad4d2f3ae707584d6a8a32"
Content-Type: image/jpeg
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Content-Length,ETag,Server-Timing,X-Content-Type-Options
Connection: keep-alive
Accept-Ranges: bytes
Timing-Allow-Origin: *
X-Amz-Cf-Id: z1fw8U7nN0gJAHM3D3ejBL_bt95Vrhkv9RdH1IzyBxEVXyFYBVZCUQ==

GET
DATA 200
OK truncated
/ 408 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: c21029f21dc145723d40362da85504ee5a5bd33f5db6636beae3a01c7aba1fa2

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/svg+xml;charset=utf-8

GET
H2 200 sync.js Show response
sync.getpublica.com/ 12 KB
5 KB 3249ms
91ms Script
application/javascript 13.32.24.41
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://sync.getpublica.com/sync.js
Requested by: Host: player.cnevids.com
URL: https://player.cnevids.com/script/video/5952801dfd2e616da6000006.js?autoplay=1&hasCompanion=false&hideHoverTitle=1&hidePosterTitle=1&muted=1&onReady=setupInterlude1&playerType=interlude&recAlgorithm=recommendations_cne-interlude-arstechnica_4f617df1-eac3-4775-9554-b0e3db036855_similar2-3&recStrategy=similar2_3&showPlaylistBar=false
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.24.41 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-24-41.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: b590c537ff7de705d0d0cf02d11fac9e1103536fa07d4281b5f43e3fd2328897

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 12 Feb 2021 13:08:12 GMT
content-encoding: gzip
last-modified: Fri, 22 Jan 2021 19:08:28 GMT
server: AmazonS3
age: 1567179
etag: W/"7af049a440305ed2ffb9c830dd80d965"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
via: 1.1 2e4a0520ad8fe16707823b20e9441e09.cloudfront.net (CloudFront)
cache-control: max-age=2592000, public
x-amz-cf-pop: FRA56-C2
x-amz-cf-id: rkRurg_PWZGP8WS6RpHTzMze5lucfPOHga4U1KlEGGqSEYWS-OUWeA==

GET
H/1.1 200
OK embed-api.json Show response
player.cnevids.com/ 10 KB
4 KB 291ms
166ms Fetch
application/json 13.32.24.125
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://player.cnevids.com/embed-api.json?videoId=5952801dfd2e616da6000006&playerType=interlude&embedLocation=arstechnica

Requested by

Host: player.cnevids.com
URL: https://player.cnevids.com/script/video/5952801dfd2e616da6000006.js?autoplay=1&hasCompanion=false&hideHoverTitle=1&hidePosterTitle=1&muted=1&onReady=setupInterlude1&playerType=interlude&recAlgorithm=recommendations_cne-interlude-arstechnica_4f617df1-eac3-4775-9554-b0e3db036855_similar2-3&recStrategy=similar2_3&showPlaylistBar=false

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

13.32.24.125 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-32-24-125.fra56.r.cloudfront.net

Software

nginx/1.18.0 /

Resource Hash

7806a4df34b650cf1d585d921415065b0d2fd3875d3c4596123f2426d566be96

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Tue, 02 Mar 2021 16:27:47 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
X-Permitted-Cross-Domain-Policies: none
X-Amz-Cf-Pop: FRA56-C2
X-Cache: Miss from cloudfront
Status: 200 OK
Access-Control-Max-Age: 1728000
Connection: keep-alive
Content-Length: 3395
X-XSS-Protection: 1; mode=block
X-Request-Id: 20b19c17-0b49-450c-9456-a4d928043f48
X-Runtime: 0.008583
X-Backend-Node: 10.110.73.144
Referrer-Policy: strict-origin-when-cross-origin
Server: nginx/1.18.0
ETag: W/"d50ca563cc3aa967a43e5b57b944394f"
X-Download-Options: noopen
Vary: Origin,Accept-Encoding
Access-Control-Allow-Methods: GET, OPTIONS
Content-Type: application/json; charset=utf-8
Via: 1.1 d8670b0c6b76371fb58f730881dfe505.cloudfront.net (CloudFront)
Access-Control-Expose-Headers
Cache-Control: max-age=0, private, must-revalidate
Access-Control-Allow-Origin: *
X-Amz-Cf-Id: qSy4U4NjazY3Zsk-rd-2oW3_1NockhP6aGmqzOzYZs_GfnPegn78Mw==

GET
H2 200 ima3.js Show response
imasdk.googleapis.com/js/sdkloader/ Frame 0372 326 KB
112 KB 34ms
14ms Script
text/javascript 2a00:1450:4001:827::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://imasdk.googleapis.com/js/sdkloader/ima3.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

03449ecbbdb76ecc662e2ad64ea3d61da16722c7f1bb3c0fcc87e52db7eba42f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 02 Mar 2021 16:27:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=900, stale-while-revalidate=3600
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 114726
x-xss-protection: 0
expires: Tue, 02 Mar 2021 16:27:47 GMT

GET
H3-Q050 200 gpt_proxy.js Show response
imasdk.googleapis.com/js/sdkloader/ 74 KB
27 KB 36ms
21ms Script
text/javascript 2a00:1450:4001:827::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://imasdk.googleapis.com/js/sdkloader/gpt_proxy.js

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0a15aa5505b21b62953249515bd4c74ea9bce17b4e5416f74374aa98023a40e5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 02 Mar 2021 16:21:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Fri, 26 Feb 2021 01:07:38 GMT
server: sffe
age: 398
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=900
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 27271
x-xss-protection: 0
expires: Tue, 02 Mar 2021 16:36:09 GMT

GET
H/1.1 200
OK player-style-abb0de6918fca8264be7b7adba283776.css
d2c8v52ll5s99u.cloudfront.net/player/ Frame 0372 74 KB
12 KB 389ms
68ms Stylesheet
text/css 13.32.23.187
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d2c8v52ll5s99u.cloudfront.net/player/player-style-abb0de6918fca8264be7b7adba283776.css
Requested by: Host: player.cnevids.com
URL: https://player.cnevids.com/script/video/5952801dfd2e616da6000006.js?autoplay=1&hasCompanion=false&hideHoverTitle=1&hidePosterTitle=1&muted=1&onReady=setupInterlude1&playerType=interlude&recAlgorithm=recommendations_cne-interlude-arstechnica_4f617df1-eac3-4775-9554-b0e3db036855_similar2-3&recStrategy=similar2_3&showPlaylistBar=false
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.23.187 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-23-187.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 7401eddcf89110f15c8ae1dbc8bb7c246c19ea1d5ddb8316635b8e0863a812f2

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Mon, 08 Feb 2021 02:38:17 GMT
Content-Encoding: gzip
Age: 1950571
X-Cache: Hit from cloudfront
Connection: keep-alive
Content-Length: 11497
Last-Modified: Mon, 14 Dec 2020 21:16:55 GMT
Server: AmazonS3
ETag: "7f12c01248e2e00b16fced6ad0766b0d"
Content-Type: text/css; charset=utf-8
Via: 1.1 bfa7dfbe8ca6d4eb3690c4c82ca6c0fa.cloudfront.net (CloudFront)
Cache-Control: max-age=63072000, public
X-Amz-Cf-Pop: FRA56-C2
Accept-Ranges: bytes
X-Amz-Cf-Id: IamjBND8ue40cYiQ5rLisEo_2K4iELbIrJueL4xy4MjfKPHQmF9roA==
Expires: Tue, 01 Jan 2030 00:00:00 GMT

GET
H/1.1 200
OK main-cddebf909f5183fb417b.js Show response
d2c8v52ll5s99u.cloudfront.net/player/ Frame 0372 922 KB
231 KB 475ms
76ms Script
application/javascript 13.32.23.187
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d2c8v52ll5s99u.cloudfront.net/player/main-cddebf909f5183fb417b.js
Requested by: Host: player.cnevids.com
URL: https://player.cnevids.com/script/video/5952801dfd2e616da6000006.js?autoplay=1&hasCompanion=false&hideHoverTitle=1&hidePosterTitle=1&muted=1&onReady=setupInterlude1&playerType=interlude&recAlgorithm=recommendations_cne-interlude-arstechnica_4f617df1-eac3-4775-9554-b0e3db036855_similar2-3&recStrategy=similar2_3&showPlaylistBar=false
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.23.187 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-23-187.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 18ced2cb193607eafa1f7c88780c693fbf0c88a0e6cbf13c83b78b082ead1836

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 25 Feb 2021 21:47:22 GMT
Content-Encoding: gzip
Age: 412826
X-Cache: Hit from cloudfront
Connection: keep-alive
Content-Length: 236365
Last-Modified: Thu, 25 Feb 2021 21:46:45 GMT
Server: AmazonS3
ETag: "daca3d3b005a384d87a1d6086396e2c4"
Content-Type: application/javascript; charset=utf-8
Via: 1.1 bfa7dfbe8ca6d4eb3690c4c82ca6c0fa.cloudfront.net (CloudFront)
Cache-Control: max-age=63072000, public
X-Amz-Cf-Pop: FRA56-C2
Accept-Ranges: bytes
X-Amz-Cf-Id: gQOKV3wyK9Etk84DfLK14xvs-eKUD6H3ydx3I3-4bSXbql6LDSLMNg==
Expires: Tue, 01 Jan 2030 00:00:00 GMT

GET
H2 200 put.html Show response
widgets.outbrain.com/nanoWidget/externals/cookie/ Frame 6DD8 416 B
815 B 59ms
58ms Document
text/html 23.202.53.159
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://widgets.outbrain.com/nanoWidget/externals/cookie/put.html
Requested by: Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/outbrain.js?_=1614702466026
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.202.53.159 Vienna, Austria, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-202-53-159.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 4f3b933077b738b503f7543ffc82fa0a061f0fe7d0ff1470865fde561a324bcc

Request headers

:method: GET
:authority: widgets.outbrain.com
:scheme: https
:path: /nanoWidget/externals/cookie/put.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/

Response headers

accept-ranges: bytes
content-type: text/html
etag: "c0311cf15c21ddda054005e92fad3f9e:1614600778.368784"
last-modified: Mon, 01 Mar 2021 12:00:39 GMT
server: AkamaiNetStorage
content-length: 416
cache-control: max-age=345600
date: Tue, 02 Mar 2021 16:27:47 GMT
timing-allow-origin: * *
access-control-allow-credentials: false
access-control-allow-methods: GET,POST
access-control-allow-origin: *
cookie: CheetahStaging=true
set-cookie: akacd_widgets_routing=1614702467~rv=1~id=d7e5aab07ab990c0f475fc260b4b2aad; path=/; Expires=Tue, 02 Mar 2021 16:27:47 GMT; Secure; SameSite=None

GET
H/1.1 200
OK YXJzdGVjaG5pY2EuY29t Show response
tcheck.outbrainimg.com/tcheck/check/ 16 B
464 B 171ms
56ms XHR
application/json 104.85.5.185
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://tcheck.outbrainimg.com/tcheck/check/YXJzdGVjaG5pY2EuY29t
Requested by: Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/outbrain.js?_=1614702466026
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 104.85.5.185 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-85-5-185.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 929701ed632814943e3df803ddd9e3f179ccf889c0ad7b7f3392bd8d109b174f

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Tue, 02 Mar 2021 16:27:47 GMT
ETag: W/"10-us8lSJutAxKqLzf8c1+n5XstcwY"
Access-Control-Max-Age: 43200
Access-Control-Allow-Methods: GET,POST
Content-Type: application/json; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: max-age=10322
Access-Control-Allow-Credentials: false
Connection: keep-alive
X-TraceId: b35ce545e7c83ba0797230535094766d
Content-Length: 16
Expires: Tue, 02 Mar 2021 19:19:49 GMT

GET
H2 200 px.gif
widget-pixels.outbrain.com/widget/detect/ 43 B
468 B 62ms
59ms Image
image/gif 23.202.53.159
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://widget-pixels.outbrain.com/widget/detect/px.gif?ch=1&rn=4.536556695343335
Requested by: Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.202.53.159 Vienna, Austria, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-202-53-159.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 02 Mar 2021 16:27:47 GMT
last-modified: Wed, 30 Sep 2020 14:22:29 GMT
server: AkamaiNetStorage
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1601475749.911431"
access-control-allow-methods: GET,POST
content-type: image/gif
access-control-allow-origin: *
cache-control: max-age=2592000
access-control-allow-credentials: false
cookie: CheetahStaging=true
accept-ranges: bytes
timing-allow-origin: *, *
content-length: 43
expires: Thu, 01 Apr 2021 16:27:47 GMT

GET
H/1.1 200
OK onetag Show response
assoc-na.associates-amazon.com/ 64 B
423 B 147ms
146ms XHR
application/json 52.94.243.89
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://assoc-na.associates-amazon.com/onetag?src=330&pj=%7B%22tracking_id%22%3A%22arstech20-20%22%2C%22assocPayloadId%22%3Anull%2C%22refUrl%22%3A%22https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2021%2F02%2Fnew-malware-found-on-30000-macs-has-security-pros-stumped%2F%22%7D&u=https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
Requested by: Host: z-na.associates-amazon.com
URL: https://z-na.associates-amazon.com/onetag/v2?MarketPlace=US&instanceId=e6160dfa-32a7-4b0e-9675-d18902339f1e
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.94.243.89 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: Server /
Resource Hash: 7d19976e2b1dbcfb861853c6571731616fedf63e37bb9631de6bbdf63e19afdf

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Tue, 02 Mar 2021 16:27:47 GMT
Server: Server
x-amz-rid: G4MJX8N10MK24J7WX98W
Vary: Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Content-Type: application/json
Access-Control-Allow-Origin: https://arstechnica.com
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 64

GET
H/1.1 200
OK fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 261 B
1 KB 148ms
146ms XHR
application/json 69.173.144.141
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=11850&site_id=307072&zone_id=1552988&size_id=15&alt_size_ids=10&us_privacy=1---&rf=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2021%2F02%2Fnew-malware-found-on-30000-macs-has-security-pros-stumped%2F&kw=m1%2C%20macos%2C%20macs%2C%20malware&tk_flint=pbjs_lite_v4.25.0&x_source.tid=cf578c98-a062-4fcb-86c2-8b237147c48f&p_screen_res=1600x1200&rp_floor=0.05&rp_secure=1&slots=1&rand=0.9564510944450157
Requested by: Host: cdn.arstechnica.net
URL: https://cdn.arstechnica.net/cns/prebid.min.js?v=1614702432
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_128_GCM
Server: 69.173.144.141 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.16.0 /
Resource Hash: 47816b9ab41f9e6b513817cd19ff0e3fd5f646c733942ce1f8153030cf8e4223

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Tue, 02 Mar 2021 16:27:47 GMT
Server: nginx/1.16.0
Vary: Accept-Encoding
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin: https://arstechnica.com
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json
Keep-Alive: timeout=5
Content-Length: 261
Expires: Wed, 17 Sep 1975 21:32:10 GMT

GET
H/1.1 200
OK fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 261 B
1 KB 142ms
137ms XHR
application/json 69.173.144.141
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=11850&site_id=307072&zone_id=1552990&size_id=15&alt_size_ids=10&us_privacy=1---&rf=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2021%2F02%2Fnew-malware-found-on-30000-macs-has-security-pros-stumped%2F&kw=m1%2C%20macos%2C%20macs%2C%20malware&tk_flint=pbjs_lite_v4.25.0&x_source.tid=cf578c98-a062-4fcb-86c2-8b237147c48f&p_screen_res=1600x1200&rp_floor=0.05&rp_secure=1&slots=1&rand=0.7952479699588191
Requested by: Host: cdn.arstechnica.net
URL: https://cdn.arstechnica.net/cns/prebid.min.js?v=1614702432
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_128_GCM
Server: 69.173.144.141 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.16.0 /
Resource Hash: 3b49902701ca966d959b465a55168153d535ca2cf9241e6abd740cab6dfe614a

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Tue, 02 Mar 2021 16:27:47 GMT
Server: nginx/1.16.0
Vary: Accept-Encoding
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin: https://arstechnica.com
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json
Keep-Alive: timeout=5
Content-Length: 261
Expires: Wed, 17 Sep 1975 21:32:10 GMT

GET
H2 200 cygnus Show response
htlb.casalemedia.com/ 25 B
371 B 74ms
73ms XHR
application/json 184.31.84.150
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://htlb.casalemedia.com/cygnus?s=375865&v=7.2&ac=j&sd=1&r=%7B%22id%22%3A%22349a2d150243143%22%2C%22site%22%3A%7B%22page%22%3A%22https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2021%2F02%2Fnew-malware-found-on-30000-macs-has-security-pros-stumped%2F%22%7D%2C%22ext%22%3A%7B%22source%22%3A%22prebid%22%2C%22ixdiag%22%3A%7B%22mfu%22%3A0%2C%22bu%22%3A1%2C%22iu%22%3A0%2C%22nu%22%3A0%2C%22ou%22%3A0%2C%22allU%22%3A1%2C%22ren%22%3Afalse%2C%22msd%22%3A0%2C%22msi%22%3A0%7D%7D%2C%22user%22%3A%7B%22eids%22%3A%5B%7B%22source%22%3A%22adserver.org%22%2C%22uids%22%3A%5B%7B%22id%22%3A%2202316e12-b56b-4ea9-b260-12c1bb62c8dd%22%2C%22ext%22%3A%7B%22rtiPartner%22%3A%22TDID%22%7D%7D%2C%7B%22id%22%3A%22FALSE%22%2C%22ext%22%3A%7B%22rtiPartner%22%3A%22TDID_LOOKUP%22%7D%7D%2C%7B%22id%22%3A%222021-03-02T16%3A27%3A46%22%2C%22ext%22%3A%7B%22rtiPartner%22%3A%22TDID_CREATED_AT%22%7D%7D%5D%7D%5D%7D%2C%22regs%22%3A%7B%22ext%22%3A%7B%22us_privacy%22%3A%221---%22%7D%7D%2C%22imp%22%3A%5B%7B%22id%22%3A%22359d46774ee8869%22%2C%22ext%22%3A%7B%22siteID%22%3A%22375865%22%2C%22sid%22%3A%22300x250%22%7D%2C%22banner%22%3A%7B%22w%22%3A300%2C%22h%22%3A250%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%2236fdf591f53de05%22%2C%22ext%22%3A%7B%22siteID%22%3A%22375864%22%2C%22sid%22%3A%22300x600%22%7D%2C%22banner%22%3A%7B%22w%22%3A300%2C%22h%22%3A600%2C%22topframe%22%3A1%7D%7D%5D%7D
Requested by: Host: cdn.arstechnica.net
URL: https://cdn.arstechnica.net/cns/prebid.min.js?v=1614702432
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 184.31.84.150 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a184-31-84-150.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 5e47ba3677210affb7d14f8c3147b57c2503df00f455809a79a7ee5c0fd640a5

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Tue, 02 Mar 2021 16:27:47 GMT
content-encoding: gzip
x-ak-initial-geo: CC:[PL], RC:[], CN:[EU], CIP:[194.99.105.99], XFF:[]
server: Apache
vary: Is-Traffic-Invalid,Accept-Encoding
content-type: application/json
access-control-allow-origin: https://arstechnica.com
x-cs-client-geo: 09
cache-control: max-age=0, no-cache, no-store
access-control-allow-credentials: true
content-length: 45
x-ak-client-geo: 09
expires: Tue, 02 Mar 2021 16:27:47 GMT

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ 19 B
710 B 59ms
59ms XHR
application/json 185.33.221.88
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: cdn.arstechnica.net
URL: https://cdn.arstechnica.net/cns/prebid.min.js?v=1614702432

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.221.88 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

726.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

Software

nginx/1.17.9 /

Resource Hash

0c09c070833c786cb25be38bc30992b30bad578f817dbc9e34beacd8b8ea44c5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Tue, 02 Mar 2021 16:27:47 GMT
X-Proxy-Origin: 194.99.105.99; 194.99.105.99; 726.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.221.78:80
AN-X-Request-Uuid: e46292c4-5586-4b41-92d4-c7b26f655e65
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://arstechnica.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json; charset=utf-8
Content-Length: 19
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1 200
OK bidRequest Show response
c2shb.ssp.yahoo.com/ 62 B
475 B 171ms
169ms XHR
application/json 18.156.195.47
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c2shb.ssp.yahoo.com/bidRequest?dcn=8a9691380175757044fd70b6a8ba0010&pos=8a969ce00175757040bb70c50db8002f&cmd=bid&secure=1&us_privacy=1---
Requested by: Host: cdn.arstechnica.net
URL: https://cdn.arstechnica.net/cns/prebid.min.js?v=1614702432
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 18.156.195.47 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: ATS/7.1.2.128 /
Resource Hash: 8a5f30ebe17876cba2fcd044b340e9b232a981bb2f1601856d4c1f713e231a29

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

Date: Tue, 02 Mar 2021 16:27:47 GMT
Server: ATS/7.1.2.128
Age: 0
Vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
Access-Control-Allow-Methods: POST,GET,HEAD,OPTIONS
Content-Type: application/json;charset=utf-8
Access-Control-Allow-Origin: https://arstechnica.com
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 62

GET
H/1.1 200
OK bidRequest Show response
c2shb.ssp.yahoo.com/ 62 B
475 B 155ms
153ms XHR
application/json 18.156.195.47
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c2shb.ssp.yahoo.com/bidRequest?dcn=8a9691380175757044fd70b6a8ba0010&pos=8a9691380175757044fd70c50ec60030&cmd=bid&secure=1&us_privacy=1---
Requested by: Host: cdn.arstechnica.net
URL: https://cdn.arstechnica.net/cns/prebid.min.js?v=1614702432
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 18.156.195.47 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: ATS/7.1.2.128 /
Resource Hash: 1e026b1ec6226d83238026e75d5b1b9e575cc563f350eeceeb90f1db91d66138

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

Date: Tue, 02 Mar 2021 16:27:47 GMT
Server: ATS/7.1.2.128
Age: 0
Vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
Access-Control-Allow-Methods: POST,GET,HEAD,OPTIONS
Content-Type: application/json;charset=utf-8
Access-Control-Allow-Origin: https://arstechnica.com
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 62

GET
H2 200 arj Show response
condenastus-d.openx.net/w/1.0/ 190 B
367 B 269ms
268ms XHR
application/json 34.98.64.218
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://condenastus-d.openx.net/w/1.0/arj?ju=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2021%2F02%2Fnew-malware-found-on-30000-macs-has-security-pros-stumped%2F&ch=UTF-8&res=1600x1200x24&ifr=false&tz=-60&tws=1600x1200&be=1&bc=hb_pb_3.0.3&dddid=cf578c98-a062-4fcb-86c2-8b237147c48f%2Ccf578c98-a062-4fcb-86c2-8b237147c48f&nocache=1614702467044&us_privacy=1---&aus=300x250%2C300x600%7C300x250%2C300x600&divIds=rail_300x250_300x600%2Crail_300x250_300x600&auid=541000589%2C541000592&aumfs=50%2C50
Requested by: Host: cdn.arstechnica.net
URL: https://cdn.arstechnica.net/cns/prebid.min.js?v=1614702432
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/16.202.0 /
Resource Hash: 845ceb7470fa8137610b4f7e0d862f5d1186e060b8914addca7e6f8a1414bfd1

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Tue, 02 Mar 2021 16:27:47 GMT
content-encoding: gzip
server: OXGW/16.202.0
vary: Accept, Accept-Encoding
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: https://arstechnica.com
cache-control: private, max-age=0, no-cache
access-control-allow-credentials: true
content-type: application/json
alt-svc: clear
content-length: 174
via: 1.1 google
expires: Mon, 26 Jul 1997 05:00:00 GMT

POST
H2 200 prebid Show response
prebid.media.net/rtb/ 1 KB
779 B 113ms
112ms XHR
application/json 104.85.4.23
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.media.net/rtb/prebid?cid=8CU65UN7R
Requested by: Host: cdn.arstechnica.net
URL: https://cdn.arstechnica.net/cns/prebid.min.js?v=1614702432
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 104.85.4.23 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-85-4-23.deploy.static.akamaitechnologies.com
Software: nginx /
Resource Hash: 6b9787f057bf70e98ef534ee4e6916b294ee043dd398fcbfbd06ad7e742c1d23

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Tue, 02 Mar 2021 16:27:47 GMT
content-encoding: gzip
server: nginx
vary: Accept-Encoding
content-type: application/json;charset=ISO-8859-1
access-control-allow-origin: https://arstechnica.com
cache-control: max-age=0, no-cache, no-store
access-control-allow-credentials: true
content-length: 551
expires: Tue, 02 Mar 2021 16:27:47 GMT

GET
H2 200 test.html Show response
widgets.outbrain.com/nanoWidget/externals/cookie/ Frame 6DD8 610 B
1009 B 58ms
58ms Document
text/html 23.202.53.159
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://widgets.outbrain.com/nanoWidget/externals/cookie/test.html
Requested by: Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/nanoWidget/externals/cookie/put.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.202.53.159 Vienna, Austria, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-202-53-159.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 6139e1fc0d3709eebbe2b18510cf24361b9f8a538c3529a73c282bafe6c78474

Request headers

:method: GET
:authority: widgets.outbrain.com
:scheme: https
:path: /nanoWidget/externals/cookie/test.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-origin
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://widgets.outbrain.com/nanoWidget/externals/cookie/put.html
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: thirdparty=yes
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://widgets.outbrain.com/nanoWidget/externals/cookie/put.html

Response headers

accept-ranges: bytes
content-type: text/html
etag: "48053d50141031b1511dbd30f9a31288:1614600779.226048"
last-modified: Mon, 01 Mar 2021 12:00:39 GMT
server: AkamaiNetStorage
content-length: 610
cache-control: max-age=345600
date: Tue, 02 Mar 2021 16:27:47 GMT
timing-allow-origin: * *
access-control-allow-credentials: false
access-control-allow-methods: GET,POST
access-control-allow-origin: *
cookie: CheetahStaging=true
set-cookie: akacd_widgets_routing=1614702467~rv=63~id=6046f5e86ad9ff870ee4a7fd52d17eee; path=/; Expires=Tue, 02 Mar 2021 16:27:47 GMT; Secure; SameSite=None

GET
H/1.1 200
OK embed-api.json Show response
player.cnevids.com/ 11 KB
4 KB 302ms
172ms Fetch
application/json 13.32.24.125
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://player.cnevids.com/embed-api.json?videoId=600745e738d069677538c4b8&embedLocation=arstechnica

Requested by

Host: player.cnevids.com
URL: https://player.cnevids.com/script/video/600745e738d069677538c4b8.jsautoplay=0&muted=0&hasCompanion=0&adsDisabled=0&onReady=arsVideoModulePlayerReady8946306

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

13.32.24.125 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-32-24-125.fra56.r.cloudfront.net

Software

nginx/1.16.1 /

Resource Hash

cbc5a8c8a917bb8cd2082195272016b6ff5f9cd403ce464bacf5bb8a17b5615a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Tue, 02 Mar 2021 16:27:47 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
X-Permitted-Cross-Domain-Policies: none
X-Amz-Cf-Pop: FRA56-C2
X-Cache: Miss from cloudfront
Status: 200 OK
Access-Control-Max-Age: 1728000
Connection: keep-alive
Content-Length: 3518
X-XSS-Protection: 1; mode=block
X-Request-Id: a4467494-d5d5-41f5-910d-7e1e9e4fb6f2
X-Runtime: 0.011692
X-Backend-Node: 10.110.9.87
Referrer-Policy: strict-origin-when-cross-origin
Server: nginx/1.16.1
ETag: W/"b3af4d94b230866e240087a606d5b067"
X-Download-Options: noopen
Vary: Origin,Accept-Encoding
Access-Control-Allow-Methods: GET, OPTIONS
Content-Type: application/json; charset=utf-8
Via: 1.1 22b9ddafebf39d72780d68dad970d218.cloudfront.net (CloudFront)
Access-Control-Expose-Headers
Cache-Control: max-age=0, private, must-revalidate
Access-Control-Allow-Origin: *
X-Amz-Cf-Id: lpHFqjjxsccGdfgER6EcfIVr_N2C-Az2UR3DoyDETH7Z47jTifBopg==

GET
H3-Q050 200 ima3.js Show response
imasdk.googleapis.com/js/sdkloader/ Frame DA1B 326 KB
112 KB 14ms
13ms Script
text/javascript 2a00:1450:4001:827::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://imasdk.googleapis.com/js/sdkloader/ima3.js

Requested by

Host: player.cnevids.com
URL: https://player.cnevids.com/script/video/600745e738d069677538c4b8.jsautoplay=0&muted=0&hasCompanion=0&adsDisabled=0&onReady=arsVideoModulePlayerReady8946306

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

03449ecbbdb76ecc662e2ad64ea3d61da16722c7f1bb3c0fcc87e52db7eba42f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 02 Mar 2021 16:27:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=900, stale-while-revalidate=3600
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 114726
x-xss-protection: 0
expires: Tue, 02 Mar 2021 16:27:47 GMT

GET
H/1.1 200
OK player-style-abb0de6918fca8264be7b7adba283776.css
d2c8v52ll5s99u.cloudfront.net/player/ Frame DA1B 74 KB
12 KB 320ms
72ms Stylesheet
text/css 13.32.23.187
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d2c8v52ll5s99u.cloudfront.net/player/player-style-abb0de6918fca8264be7b7adba283776.css
Requested by: Host: player.cnevids.com
URL: https://player.cnevids.com/script/video/600745e738d069677538c4b8.jsautoplay=0&muted=0&hasCompanion=0&adsDisabled=0&onReady=arsVideoModulePlayerReady8946306
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.23.187 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-23-187.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 7401eddcf89110f15c8ae1dbc8bb7c246c19ea1d5ddb8316635b8e0863a812f2

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Mon, 08 Feb 2021 02:38:17 GMT
Content-Encoding: gzip
Age: 1950571
X-Cache: Hit from cloudfront
Connection: keep-alive
Content-Length: 11497
Last-Modified: Mon, 14 Dec 2020 21:16:55 GMT
Server: AmazonS3
ETag: "7f12c01248e2e00b16fced6ad0766b0d"
Content-Type: text/css; charset=utf-8
Via: 1.1 bfa7dfbe8ca6d4eb3690c4c82ca6c0fa.cloudfront.net (CloudFront)
Cache-Control: max-age=63072000, public
X-Amz-Cf-Pop: FRA56-C2
Accept-Ranges: bytes
X-Amz-Cf-Id: zGwwOz4JMKtiv2WiCB42bjttESAbRsIsOcOB2hxu7poC2SoPWCP8MA==
Expires: Tue, 01 Jan 2030 00:00:00 GMT

GET
H/1.1 200
OK main-cddebf909f5183fb417b.js Show response
d2c8v52ll5s99u.cloudfront.net/player/ Frame DA1B 922 KB
231 KB 505ms
64ms Script
application/javascript 13.32.23.187
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d2c8v52ll5s99u.cloudfront.net/player/main-cddebf909f5183fb417b.js
Requested by: Host: player.cnevids.com
URL: https://player.cnevids.com/script/video/600745e738d069677538c4b8.jsautoplay=0&muted=0&hasCompanion=0&adsDisabled=0&onReady=arsVideoModulePlayerReady8946306
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.23.187 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-23-187.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 18ced2cb193607eafa1f7c88780c693fbf0c88a0e6cbf13c83b78b082ead1836

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 25 Feb 2021 21:47:22 GMT
Content-Encoding: gzip
Age: 412826
X-Cache: Hit from cloudfront
Connection: keep-alive
Content-Length: 236365
Last-Modified: Thu, 25 Feb 2021 21:46:45 GMT
Server: AmazonS3
ETag: "daca3d3b005a384d87a1d6086396e2c4"
Content-Type: application/javascript; charset=utf-8
Via: 1.1 bfa7dfbe8ca6d4eb3690c4c82ca6c0fa.cloudfront.net (CloudFront)
Cache-Control: max-age=63072000, public
X-Amz-Cf-Pop: FRA56-C2
Accept-Ranges: bytes
X-Amz-Cf-Id: p6QQsdhLudu-lJEvs7ngNexO-nu9_hCu9I7laf4mYrPKA9aZaC3ftA==
Expires: Tue, 01 Jan 2030 00:00:00 GMT

POST
H/1.1 200
OK headerstats Show response
as-sec.casalemedia.com/ 0
313 B 470ms
103ms XHR
text/plain 23.202.53.51
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://as-sec.casalemedia.com/headerstats?s=383250&u=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2021%2F02%2Fnew-malware-found-on-30000-macs-has-security-pros-stumped%2F&v=3
Requested by: Host: js-sec.indexww.com
URL: https://js-sec.indexww.com/ht/p/183973-93942139695505.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.202.53.51 Vienna, Austria, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-202-53-51.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

Pragma: no-cache
Date: Tue, 02 Mar 2021 16:27:47 GMT
Server: Apache
Access-Control-Allow-Origin: https://arstechnica.com
Cache-Control: max-age=0, no-cache, no-store
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 0
Expires: Tue, 02 Mar 2021 16:27:47 GMT

GET
H/1.1 200
OK dwce_cheq_events Show response
log.outbrainimg.com/loggerServices/ 4 B
325 B 1040ms
136ms XHR
application/json 70.42.32.63
AS-OUTBRAIN

General

Check archive.org

Show headers Download Go to

Full URL: https://log.outbrainimg.com/loggerServices/dwce_cheq_events?timestamp=1614702467192&sessionId=9057799a-2e75-992a-7fe4-553dfd6c44db&url=arstechnica.com&cheqSource=1&cheqEvent=0&exitReason=2
Requested by: Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/outbrain.js?_=1614702466026
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 70.42.32.63 , United States, ASN22075 (AS-OUTBRAIN, US),
Reverse DNS: ny.outbrain.com
Software: /
Resource Hash: b5bea41b6c623f7c09f1bf24dcae58ebab3c0cdd90ad966bc43a45b44867e12b

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 02 Mar 2021 16:27:48 GMT
Access-Control-Allow-Methods: GET,POST
Content-Type: application/json; charset=UTF-8
Access-Control-Allow-Origin: *
Cache-Control: no-cache, no-store, must-revalidate
X-TraceId: 1f31c866b4ffbf50f0555d3e2de8c9b0
Content-Length: 4
Expires: 0

GET
H/1.1 200
OK user Show response
4d.condenastdigital.com/ 67 B
468 B 168ms
160ms XHR
application/json 54.209.211.127
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://4d.condenastdigital.com/user?xid=50b8ab59-83f4-4626-9718-6b8bf7dc3673
Requested by: Host: pixel.condenastdigital.com
URL: https://pixel.condenastdigital.com/sparrow.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.209.211.127 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-209-211-127.compute-1.amazonaws.com
Software: /
Resource Hash: 8672345ec715b43b89a4de8e3f54b8cb7de995c33db14a1665356b6beb1aecea

Request headers

Accept: text/plain
Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Tue, 02 Mar 2021 16:27:47 GMT
content-encoding: gzip
transfer-encoding: chunked
Content-Type: application/json; charset=utf-8
access-control-allow-origin: https://arstechnica.com
access-control-expose-headers: WWW-Authenticate,Server-Authorization
cache-control: no-cache
access-control-allow-credentials: true
Connection: keep-alive

GET
H2 200 s2s-hb Show response
pbs.getpublica.com/v1/ 2 B
393 B 177ms
125ms XHR
application/json 2600:9000:2156:1e00:4:14f9:7480:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://pbs.getpublica.com/v1/s2s-hb?site_id=2564&format=json&app_name=CNEVIDEO&adserver=gam&slot_count=1&site_name=arstechnica&content_episode=null&content_length=86&content_season=&content_id=5952801dfd2e616da6000006&content_title=How%20the%20Internet%20could%20change%20under%20Trump&content_series=&content_language=en&content_category=technology%2CScience%20%26%20Tech&content_keywords=internet%2Cinternet%20privacy%2Cnet%20neutrality%2Cobama%2Cobama%20administration%2Cprivacy%2Ctrump&site_page=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2021%2F02%2Fnew-malware-found-on-30000-macs-has-security-pros-stumped%2F&cb=5119985
Requested by: Host: player.cnevids.com
URL: https://player.cnevids.com/script/video/5952801dfd2e616da6000006.js?autoplay=1&hasCompanion=false&hideHoverTitle=1&hidePosterTitle=1&muted=1&onReady=setupInterlude1&playerType=interlude&recAlgorithm=recommendations_cne-interlude-arstechnica_4f617df1-eac3-4775-9554-b0e3db036855_similar2-3&recStrategy=similar2_3&showPlaylistBar=false
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2156:1e00:4:14f9:7480:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 02 Mar 2021 16:27:47 GMT
via: 1.1 009e5e3e32afcd1d135a7234c9da5521.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA50-C1
vary: Origin
x-cache: Miss from cloudfront
content-type: application/json; charset=UTF-8
access-control-allow-origin: https://arstechnica.com
cache-control: private, no-cache, no-store, must-revalidate, proxy-revalidate
access-control-allow-credentials: true
content-length: 2
x-amz-cf-id: 3S0W6NuRBbcx61Qftbi7s-D6R1x0W6qEwB-sk0Tixh5e2dQnxGcoSg==
expires: 0

GET
H2 200 get Show response
odb.outbrain.com/utils/ 37 KB
25 KB 323ms
226ms Script
text/x-json 151.101.14.132
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://odb.outbrain.com/utils/get?url=http%3A%2F%2Farstechnica.com%2Finformation-technology%2F2021%2F02%2Fnew-malware-found-on-30000-macs-has-security-pros-stumped%2F&srcUrl=http%3A%2F%2Ffeeds.arstechnica.com%2Farstechnica%2Findex%2F&idx=0&rand=64844&key=NANOWDGT01&widgetJSId=JS_1&va=true&format=vjapi&pdobuid=-1&adblck=false&abwl=false&settings=true&recs=true&version=2000235&sig=xi9tiI9G&apv=false&osLang=en-US&winW=1600&winH=1200&scrW=1600&scrH=1200&dpr=1&secured=true&cnsntv2=CPCcAsZPCcAsZAcABBENBPCgAAAAAAAAAChQAAAAAAJBAGIAAoAHAAeABcAD4ALQAfABJADEAH8ARQAkQBXADNAG0AOIAcgA5wB1AD_AIGAQcAkQBPwChgGEAOqAh8BHoCQgErAJtAWEAugBdQC7QF5AMQAYsAyEBkYDKAGhANGAaUA1MBtADbgG6AOCCQVgAEAALgAoACoAGQAOAAeABAACIAFQAMIAaABqADyAIYAiABMACfAFUAVgAsABcADeAHMAPQAhABDQCIAIkAR0AlgCXAE0AKUAW4AwwBkADLgGoAaoA2QB3gD2AHxAPsA_QCAQEXARgAjQBHACUgFBAKWAU8Aq4BcwC_AGKANYAbQA3ABvAD0AHyAQ2Ah0BF4CRAExAJlATYAnYBQ4CkQFigLQAWwAuQBd4C8wGBAMGAYSAw0Bh4DIgGSAMnAZcAzkBnwDSAGnQNYA1kMASAAWABcAJIAVQAxADSAGqAOIA2QB1AEhAKHAXQAvoBiwDIwGhAN0DQJgAVABWAC4AIYAZAAywBqADZAHYAPwAgABBQCMAFLAKeAVeAtAC0gGsAN4AdUA-QCGwEOgIqAReAkQBNgCdgFIgLkAYEAwkBh4DGAGTgM5AZ4Az4QASAAWABcAGoASQAqgBiAFcANUAcQBIgDcAG8ASEAocBdADFgGhAN0EQIAAVABWAC4AIYAZAAywBqADZAHYAPwAgABGAClgFPAKuAawA6oB8gENgIdAReAkQBNgCdgFIgLkAYEAwkBh4DJwGcgM-FQHgAKAAqACGAEwALgAjgBlgDUAHYAPwAjABHAClgFXgLQAtIBvAEggJiATYApsBbAC5AF5gMCAYeAyIBnIDPAGfANyFADQAxADVAG0AOIAcgA8ACCgHVAR6AvoBmgDQgGvDIDYAFAAVABDACYAFwARwAywBqADsgH2AfgBGACOAFLAKuAVsA3gCYgE2ALRAWwAvMBgQDDwGRAM5AZ4Az4YANABqAGIAaoA2gBxADkAHgAWIA2QB1QEegLyAaEOAsgACAARAA4ADwALgAfABaADkAH4AQQAugBkADQAH8ARQAkQBOgCzAF8AMsAZoA0gBqgDaAHEAOQAc4A6gB2ADuAIAAQMAgsBBwEIAIiASIAm0BPgE_AKWAVAAtoBeoDAAMCAYQA1gBrwDeAHHAOkAdUA8gB8gEIQIfAiABHoCQoErASuAmIBMoCbQFCgKQAUmApgBUwCqgFbAK5AV2AsoBaQC1AFxQLoAuoBfQDAgGIAMWAZCAygBl4DQoGigaMA0oBpoDUwGvANoAbYA24dBnAAXABQAFQAMgAcABAACIAFQALoAYABjADQANQAeAA-gCGAIgATAAnwBVAFYALAAXAAvgBiADMAG8AOYAegBCACGgEQARIAjoBLAEwAJoAUYApQBYgC3gGEAYYAyABlADRAGoANkAb4A7wB7QD7AP0Af8BFgEYAI5ASkBKgCggFPAKuAWKAtAC0gFzALqAXkAvwBigDaAG4gOmA6gB6AENgIdAREAioBF4CQQEiAJUATYAnYBQ4CmgFWALFAWgAtgBcAC5AF2gLvAXmAwYBhIDDQGHgMSAYwAx4BkgDJwGVAMsAZcAzkBnwDRIGkAaSA0sBpwDWAGxkAF4ACAAfgBBADQAH8ASIAtwBfADLAGqANoAcQA5ABzgDsAHgAQUAnwBSwCxAGAAMIAbIA3gB1QDtgIfAR6AkIBK4CYgE2gKFAUgApMBWwC6AF5AL6AYEAzQBoQDRQGlANTAbYA24hA9AAWABQADIAIgAVAAuABiAEMAJgAVQAuABfADEAGYAN4AegBHACxAGEAMoAagA3wB3wD7APwAf4BGACOAEpAKCAUMAp4BV4C0ALSAXMAvwBigDaAHUAPQAkEBIgCVAE2AKaAWKAtEBbAC4AFyALtAYeAxIBkQDJwGcgM8AZ8A0QBpIDSwHAEgEIAAgAHAAXABCADkAMgAkQBcgC-AGWANQAbQA7gCAAEJAJ8AVAA14BvADqgH2ARUAlYBNoCkwFlALSAX0AxEBiwDQgGlANyJQOQAEAALAAoABkADgAIoAYABiADwAIgATAAqgBcAC-AGIAMwAbQBCACGgEQARIAjgBRgClAFuAMIAZQA1QBsgDvAH4ARgAjgBTwCrwFoAWkAuoBigDcAHUAPkAh0BF4CRAE2ALFAWwAu0BeYDDwGRAMnAZYAzkBngDPgGkANYAcAUAhAACAAuAB8AEIALQAcgA_ACsAGQANoAcgBHACRAE6ALkAXwAywBqADXAG0AOIAc4A6gB3ADwAIAAQcAhIBFQCRAE2gJ8An4BSwCxAF1AMAAYQAxQBrwDeAHVAO2AeQA-QB_wEegJiATKAm0BSACmAFTAK7AWgAugBeQC-gGBAMWAaEA0QBpQDTYGpAamA14BwRSCWAAuACgAKgAZAA4ACAAEQAKoAYABjADQANQAeQBDAEQAJgATwApABVACwAFwAL4AYgAzABzAEIAIaARABEgCjAFKALEAW4AwgBlADRAGqANkAd8A-wD9AIsARgAjgBKQCggFDAKuAVsAuYBeQDaAG4APQAh0BF4CRAE2AJ2AUOApoBWwCxQFsALgAXIAu0BeYDDQGHgMYAZEAyQBk4DLgGcgM8AZ9A0gDSYGsAayA2MAA.YAAAAAAAAAAA&cmpStat=1&ccpa=1---&ccpaStat=1&wdr-natlaz=true
Requested by: Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/outbrain.js?_=1614702466026
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.14.132 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 7c9c9c29b3dba83c4fcb627a7d9e746c8edac1ca8e8d21a6d20e816e9ceaf03e

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 02 Mar 2021 16:27:47 GMT
via: 1.1 varnish, 1.1 varnish
traffic-path: NYDC1, LGA, FRA, Europe1
x-cache: MISS, MISS
p3p: policyref="http://www.outbrain.com/w3c/p3p.xml",CP="NOI NID CURa DEVa TAIa PSAa PSDa OUR IND UNI"
backend-ip: 157.52.117.81
x-cache-hits: 0, 0
x-traceid: b7a3b616283aa485495f4d0544aa3641
content-encoding: gzip
content-length: 25473
x-served-by: cache-lga21981-LGA, cache-fra19160-FRA
x-timer: S1614702467.437018,VS0,VE177
vary: Accept-Encoding, User-Agent
content-type: text/x-json; charset=UTF-8
accept-ranges: bytes
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1 200
OK track
capture.condenastdigital.com/ 48 B
48 B 139ms
138ms Image
image/gif 3.223.14.133
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://capture.condenastdigital.com/track?_ts=2021-03-02T16%3A27%3A47.392Z&_t=pageview&cBr=Ars%20Technica&cKe=M1%7CMacOS%7CMacs%7Cmalware&cCh=information%20technology&cTi=New%20malware%20found%20on%2030%2C000%20Macs%20has%20security%20pros%20stumped&cTy=article%7Creport&cTp=ALLBRANDS_70%2C%20ALLBRANDS_7%2C%20ALLBRANDS_63%2C%20ALLBRANDS_38%2C%20ALLBRANDS_31%2C%20ALLBRANDS_283%2C%20ALLBRANDS_274%2C%20ALLBRANDS_258%2C%20ALLBRANDS_167%2C%20ALLBRANDS_134%2C%20ALLBRANDS_64%2C%20ALLBRANDS_57%2C%20ALLBRANDS_28%2C%20ALLBRANDS_244%2C%20ALLBRANDS_21%2C%20ALLBRANDS_192&cTpw=0.4428023467608065%2C%200.4428023467608065%2C%200.4428023467608065%2C%200.4428023467608065%2C%200.4428023467608065%2C%200.4428023467608065%2C%200.4428023467608065%2C%200.4428023467608065%2C%200.4428023467608065%2C%200.4428023467608065%2C%200.23651113530694187%2C%200.23651113530694187%2C%200.23651113530694187%2C%200.23651113530694187%2C%200.23651113530694187%2C%200.23651113530694187&cEnt=malware%2C%20silver%20sparrow%2C%20page%20layout%2C%20javascript%2C%20content%20delivery%20network%2C%20installer%2C%20red%20canary%2C%20malwarebytes%2C%20dan%20goodin%2C%20apple%2C%20utc%2C%20amazon%20web%20services%2C%20silver%20sparrow.%2C%20akamai%2C%20cond%C3%A9%20nast%2C%20ars%20orbital%20transmission%2C%20internet%2C%20us%2C%20uk%2C%20canada&cEnw=1%2C%200.8108515340695781%2C%200.5893825025693292%2C%200.5234062396520748%2C%200.43266986241070404%2C%200.396383436053935%2C%200.3898142923956203%2C%200.3872030879274411%2C%200.3671837196954457%2C%200.3629702313547694%2C%200.3405881861694213%2C%200.33698642251846816%2C%200.31814344541785544%2C%200.3093789231264289%2C%200.295673457733113%2C%200.26469478813217723%2C%200.2506862805752175%2C%200.23981631622050187%2C%200.2397308210939932%2C%200.2396455567199375&cCu=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2021%2F02%2Fnew-malware-found-on-30000-macs-has-security-pros-stumped%2F&org_id=4gKgcFGUFUvCGFzHakTPfYp85Yi8&cCl=939&cId=1744063&cPd=2021-02-20T15%3A10%3A13.000%2B00%3A00&ccS=web&cPv=all&pHr=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2021%2F02%2Fnew-malware-found-on-30000-macs-has-security-pros-stumped&pRt=referral&pHp=%2Finformation-technology%2F2021%2F02%2Fnew-malware-found-on-30000-macs-has-security-pros-stumped%2F&pRr=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2021%2F02%2Fnew-malware-found-on-30000-macs-has-security-pros-stumped%2F&pWw=1600&pWh=1200&pPw=1600&pPh=5900&pSw=1600&pSh=1200&uID=0ba4f8f3-3dcb-4625-8858-f8cc027e953a&sID=eeca8fd2-2ede-4309-b7f8-017d7fcdf896&pID=4e78db71-a622-4623-8f8c-129b7f97ef02&uDt=desktop&_o=ars-technica&_c=general&xID=50b8ab59-83f4-4626-9718-6b8bf7dc3673&environment=prod&origin=ars-technica&cKh=malware%2Csilver%20sparrow%2Cpayload%2Cresearcher
Requested by: Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.223.14.133 , United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-223-14-133.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Access-Control-Allow-Origin: *
Date: Tue, 02 Mar 2021 16:27:47 GMT
Connection: keep-alive
Content-Length: 48
Content-Type: image/gif

GET
H/1.1 200
OK track
capture.condenastdigital.com/ 48 B
48 B 207ms
135ms Image
image/gif 3.223.14.133
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://capture.condenastdigital.com/track?_o=cne&app=playerservice&cCh=videos%2Fshow&pHr=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2021%2F02%2Fnew-malware-found-on-30000-macs-has-security-pros-stumped%2F&pID=4e78db71-a622-4623-8f8c-129b7f97ef02&sID=eeca8fd2-2ede-4309-b7f8-017d7fcdf896&uId=0ba4f8f3-3dcb-4625-8858-f8cc027e953a&xid=&_ts=2021-03-02T16%3A27%3A47.449Z&_c=error&_t=PrebidError&dim1=%7B%22errorData%22%3A%7B%22body%22%3A%5B%5D%2C%22timeout%22%3Afalse%7D%7D&dim3=Empty
Requested by: Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.223.14.133 , United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-223-14-133.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Access-Control-Allow-Origin: *
Date: Tue, 02 Mar 2021 16:27:47 GMT
Connection: keep-alive
Content-Length: 48
Content-Type: image/gif

GET
H/1.1 200
OK sf-ui-display-medium-webfont.woff2
d2c8v52ll5s99u.cloudfront.net/assets/fonts/ Frame 0372 29 KB
30 KB 591ms
456ms Font
application/font-woff2 13.32.23.187
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d2c8v52ll5s99u.cloudfront.net/assets/fonts/sf-ui-display-medium-webfont.woff2
Requested by: Host: d2c8v52ll5s99u.cloudfront.net
URL: https://d2c8v52ll5s99u.cloudfront.net/player/player-style-abb0de6918fca8264be7b7adba283776.css
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.23.187 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-23-187.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: d281c9d6bae645f3da6d2f0769a2cf0668709fd28e2021ce74821cdd8c7117b3

Request headers

Origin: https://arstechnica.com
Referer: https://d2c8v52ll5s99u.cloudfront.net/player/player-style-abb0de6918fca8264be7b7adba283776.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Tue, 02 Mar 2021 16:27:49 GMT
Content-Encoding: gzip
Vary: Origin,Access-Control-Request-Headers,Access-Control-Request-Method
X-Amz-Cf-Pop: FRA56-C2
X-Cache: RefreshHit from cloudfront
Connection: keep-alive
Content-Length: 29632
Access-Control-Allow-Origin: *
Last-Modified: Mon, 26 Jun 2017 15:24:42 GMT
Server: AmazonS3
ETag: "7d18db04f980971f2a9c5026bbc34bed"
Access-Control-Max-Age: 3000
Access-Control-Allow-Methods: GET
Content-Type: application/font-woff2
Via: 1.1 103eb504d36d97c9f30550032223d996.cloudfront.net (CloudFront)
Cache-Control: max-age=63072000, public
Accept-Ranges: bytes
X-Amz-Cf-Id: hXLB17RTAJsYgFWYhQ_V-e0h-O9jLFUGiySFWLRSbMNpP2r6cR7TWA==
Expires: Tue, 01 Jan 2030 00:00:00 GMT

GET
H3-Q050 200 bridge3.444.1_en.html Show response
imasdk.googleapis.com/js/core/ Frame F22F 577 KB
188 KB 6ms
6ms Document
text/html 2a00:1450:4001:827::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://imasdk.googleapis.com/js/core/bridge3.444.1_en.html

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3a478cc89688c6d5bc04418bbfd3da092d2df5c78ad9b6663975cceb83832e61

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: imasdk.googleapis.com
:scheme: https
:path: /js/core/bridge3.444.1_en.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
content-length: 192862
date: Fri, 26 Feb 2021 12:33:48 GMT
expires: Sat, 26 Feb 2022 12:33:48 GMT
last-modified: Fri, 26 Feb 2021 01:03:43 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 359639
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 client.js Show response
s0.2mdn.net/instream/video/ Frame 0372 44 KB
17 KB 36ms
16ms Script
text/javascript 2a00:1450:4001:813::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/instream/video/client.js

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d0bffc7261df1454c5e05475cda7d9e6647318dc6c3936767e1252bfe8849c54

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 02 Mar 2021 16:27:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 16746
x-xss-protection: 0
expires: Tue, 02 Mar 2021 16:27:47 GMT

GET
H2 200 fbevents.js Show response
connect.facebook.net/en_US/ Frame 0372 91 KB
23 KB 6ms
6ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: d2c8v52ll5s99u.cloudfront.net
URL: https://d2c8v52ll5s99u.cloudfront.net/player/main-cddebf909f5183fb417b.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 , United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

9e7ea2b4ba8e2bcc4a964d6192e4671dc5f6863a1c7e35b52b229a3c1e67a68d

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com data: blob: 'self';script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c;
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 0
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 23762
x-fb-rlafr: 0
pragma: public
x-fb-debug: 5BZqRjXYlMGoefFNX+GnX/xxRj9Ol2xrfE1PkkGlVn5AoUOAndVpqST+gVIdnJzWT5PMs0xcKxSjIbxIRIagCA==
x-fb-trip-id: 686109401
x-frame-options: DENY
date: Tue, 02 Mar 2021 16:27:47 GMT
strict-transport-security: max-age=31536000; preload; includeSubDomains
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H/1.1 200
OK comscore-min.js Show response
d2c8v52ll5s99u.cloudfront.net/player/ Frame 0372 38 KB
11 KB 177ms
65ms Script
text/javascript 13.32.23.187
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d2c8v52ll5s99u.cloudfront.net/player/comscore-min.js
Requested by: Host: d2c8v52ll5s99u.cloudfront.net
URL: https://d2c8v52ll5s99u.cloudfront.net/player/main-cddebf909f5183fb417b.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.23.187 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-23-187.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 833a86642252016b29f08dd45ffd27f9e00ca237f28d8c5f0147a6e15d009377

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Tue, 02 Mar 2021 16:26:47 GMT
Content-Encoding: gzip
Last-Modified: Wed, 24 May 2017 18:19:15 GMT
Server: AmazonS3
Age: 347
ETag: W/"054acb6fbd2b2a6c1ac561705bffb0cc"
Vary: Accept-Encoding
X-Cache: Hit from cloudfront
Content-Type: text/javascript
Via: 1.1 bfa7dfbe8ca6d4eb3690c4c82ca6c0fa.cloudfront.net (CloudFront)
Connection: keep-alive
Transfer-Encoding: chunked
X-Amz-Cf-Pop: FRA56-C2
X-Amz-Cf-Id: iGTObv9j6Shva_c0hkzf8Wy7pmazzAvBRLkdUe71eaJT-M4MaTclQQ==

POST
H3-Q050 200 collect Show response
www.google-analytics.com/j/ 2 B
67 B 15ms
14ms XHR
text/plain 2a00:1450:4001:80f::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j88&a=1804182708&t=event&ni=1&_s=1&dl=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2021%2F02%2Fnew-malware-found-on-30000-macs-has-security-pros-stumped%2F&dr=%2F&dp=%2Finformation-technology%2F2021%2F02%2Fnew-malware-found-on-30000-macs-has-security-pros-stumped%2F&ul=en-us&de=UTF-8&dt=New%20malware%20found%20on%2030%2C000%20Macs%20has%20security%20pros%20stumped%20%7C%20Ars%20Technica&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=video&ea=loaded&el=5952801dfd2e616da6000006%7Cnull_null%7C86%7CHow%20the%20Internet%20could%20change%20under%20Trump&_u=aGDAAUAjAAQCAG~&jid=1602163719&gjid=174454453&cid=1606731204.1614702467&tid=UA-31997-1&_gid=1858219647.1614702467&_r=1&gtm=2wg2h0NLXNPCQ&cg1=article%7Creport&cg2=information-technology&cg3=information%20technology&cd1=GTM-NLXNPCQ&cd2=258&cd4=&cd6=Tue%20Mar%2002%202021%2017%3A27%3A47%20GMT%2B0100%20(Central%20European%20Standard%20Time)&cd7=1614702467814.luifvadr&cd8=-1&cd9=Mozilla%2F5.0%20(Macintosh%3B%20Intel%20Mac%20OS%20X%2010_14_5)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F83.0.4103.61%20Safari%2F537.36&cd10=English&cd11=17&cd12=0&cd13=GA%20Event%20-%20Video%20Engagement&cd20=none&cd21=50b8ab59-83f4-4626-9718-6b8bf7dc3673&cd25=Dan%20Goodin&cd26=1744063&cd27=939&cd28=New%20malware%20found%20on%2030%2C000%20Macs%20has%20security%20pros%20stumped&cd29=web&cd32=2021-02-20T15%3A10%3A13%2B00%3A00&cd33=11&cd34=2021-02-22T22%3A03%3A20%2B00%3A00&cd35=M1%7CMacOS%7CMacs%7Cmalware&cd36=web&cd43=Ars%20Technica&cd45=Adblock%20Enabled%20-%20false&cd62=https%3A%2F%2Farstechnica.com%2F%3Fp%3D1744063&cd63=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2021%2F02%2Fnew-malware-found-on-30000-macs-has-security-pros-stumped%2F&cd65=&cd72=1.0.0&cd92=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2021%2F02%2Fnew-malware-found-on-30000-macs-has-security-pros-stumped%2F&cd93=information%20technology&cd95=%2CC0001%2C&cd98=article%7Creport&cd103=&cd113=video-loaded&cd129=&cd3=1606731204.1614702467&cd76=5952801dfd2e616da6000006%7Cnull_null%7C86%7CHow%20the%20Internet%20could%20change%20under%20Trump&cd77=arstechnica_interlude&cd80=1&cd82=5952801dfd2e616da6000006&cd83=null_null&cd84=How%20the%20Internet%20could%20change%20under%20Trump&cd85=86&cd90=arstechnica&cd91=1&z=1851958890

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Tue, 02 Mar 2021 16:27:47 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://arstechnica.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK track
capture.condenastdigital.com/ Frame 0372 48 B
48 B 135ms
134ms Image
image/gif 3.223.14.133
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://capture.condenastdigital.com/track?_o=cne&_ts=2021-03-02T16%3A27%3A47.668Z&_c=&_t=Player%20Requested&sID=eeca8fd2-2ede-4309-b7f8-017d7fcdf896&pID=4e78db71-a622-4623-8f8c-129b7f97ef02&pHr=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2021%2F02%2Fnew-malware-found-on-30000-macs-has-security-pros-stumped%2F
Requested by: Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.223.14.133 , United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-223-14-133.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Access-Control-Allow-Origin: *
Date: Tue, 02 Mar 2021 16:27:47 GMT
Connection: keep-alive
Content-Length: 48
Content-Type: image/gif

GET
H/1.1 200
OK track
capture.condenastdigital.com/ Frame 0372 48 B
48 B 135ms
135ms Image
image/gif 3.223.14.133
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://capture.condenastdigital.com/track?_o=cne&_ts=2021-03-02T16%3A27%3A47.780Z&_c=initial&_t=gptData&sID=eeca8fd2-2ede-4309-b7f8-017d7fcdf896&pID=4e78db71-a622-4623-8f8c-129b7f97ef02&pHr=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2021%2F02%2Fnew-malware-found-on-30000-macs-has-security-pros-stumped%2F&dim1=%7B%22adBlocked%22%3Afalse%2C%22adUnits%22%3A%5B%223379%2Fconde.ars%2Finterstitial%2Finformation-technology%2Farticle%2F1%22%2C%223379%2Fconde.ars%2Fhero%2Finformation-technology%2Farticle%2F1%22%2C%223379%2Fconde.ars%2Frail%2Finformation-technology%2Farticle%2F1%22%2C%223379%2Fconde.ars%2Frail%2Finformation-technology%2Farticle%2F2%22%2C%223379%2Fconde.ars%2Frail%2Finformation-technology%2Farticle%2F3%22%2C%223379%2Fconde.ars%2Fmid-content%2Finformation-technology%2Farticle%2F1%22%2C%223379%2Fconde.ars%2Fmid-content%2Finformation-technology%2Farticle%2F2%22%2C%223379%2Fconde.ars%2Fmid-content%2Finformation-technology%2Farticle%2F3%22%5D%2C%22embedLocation%22%3A%22arstechnica%22%2C%22error%22%3A%22%22%2C%22lineItems%22%3A%5B%5D%2C%22publicaEnabled%22%3Afalse%2C%22videoId%22%3A%225952801dfd2e616da6000006%22%7D
Requested by: Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.223.14.133 , United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-223-14-133.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Access-Control-Allow-Origin: *
Date: Tue, 02 Mar 2021 16:27:48 GMT
Connection: keep-alive
Content-Length: 48
Content-Type: image/gif

GET
H/1.1 200
OK arstechnica_how-the-internet-could-change-under-trump.jpg
dwgyu36up6iuz.cloudfront.net/heru80fdn/image/upload/c_fill,d_placeholder_arstechnica.png,fl_progressive,g_face,h_450,q_80,w_800/v1498579695/ Frame 0372 71 KB
72 KB 62ms
61ms Image
image/jpeg 65.9.67.76
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dwgyu36up6iuz.cloudfront.net/heru80fdn/image/upload/c_fill,d_placeholder_arstechnica.png,fl_progressive,g_face,h_450,q_80,w_800/v1498579695/arstechnica_how-the-internet-could-change-under-trump.jpg

Requested by

Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

65.9.67.76 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Cloudinary /

Resource Hash

1370c96be1c754ed05c9d7fa4107cd6f1c7e25b1eee343b06d4b0b0271febb7f

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800
X-Content-Type-Options	nosniff

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Tue, 09 Feb 2021 06:27:41 GMT
Via: 1.1 1c5b98f7bd5001d6fe1040daa237afc6.cloudfront.net (CloudFront)
X-Content-Type-Options: nosniff
Age: 1850407
X-Cache: Hit from cloudfront
Server-Timing: fastly;dur=194;cpu=0;start=2021-02-09T06:27:41.085Z;desc=miss,rtt;dur=1,cloudinary;dur=103;start=2021-02-09T06:27:41.131Z
Content-Length: 72703
Last-Modified: Wed, 28 Jun 2017 17:33:57 GMT
Server: Cloudinary
Cache-Control: public, no-transform, immutable, max-age=2592000
ETag: "3442cb54fcc284e19af078ba2c3c2e9e"
Strict-Transport-Security: max-age=604800
Content-Type: image/jpeg
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Content-Length,ETag,Server-Timing,X-Content-Type-Options
Connection: keep-alive
X-Amz-Cf-Pop: FRA56-C1
Accept-Ranges: bytes
Timing-Allow-Origin: *
X-Amz-Cf-Id: 0xdBqGXXDrM919vjnIQcNmgXXHY2NG_R4Cy47jjI4N6lBww7BmdgIw==

GET
BLOB 200
OK f9f77647-c945-4869-b10c-4be47e3b1476
https://arstechnica.com/ Frame 0372 31 B
0 Other
application/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://arstechnica.com/f9f77647-c945-4869-b10c-4be47e3b1476
Requested by: Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 7725538fe2f71147bffeba7452b434c826aef9009666cb4360c605d0b2a91d1d

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Length: 31
Content-Type: application/javascript

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 4 B
70 B 16ms
15ms XHR
text/plain 2a00:1450:400c:c0c::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j88&tid=UA-31997-1&cid=1606731204.1614702467&jid=1602163719&gjid=174454453&_gid=1858219647.1614702467&_u=aGDAAUAjAAQCAG~&z=1549197586

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c0c::9a Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
date: Tue, 02 Mar 2021 16:27:47 GMT
content-type: text/plain
access-control-allow-origin: https://arstechnica.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 206
Partial Content c1057a6f-76fc-470d-9cbc-87c086864674thumbs.mp4
dp8hsntg6do36.cloudfront.net/5952801dfd2e616da6000006/ Frame 0372 127 KB
0 229ms
64ms Media
video/mp4 13.32.24.6
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://dp8hsntg6do36.cloudfront.net/5952801dfd2e616da6000006/c1057a6f-76fc-470d-9cbc-87c086864674thumbs.mp4
Requested by: Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.24.6 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-24-6.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
Accept-Encoding: identity;q=1, *;q=0
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Range: bytes=0-

Response headers

Date: Mon, 01 Mar 2021 19:22:32 GMT
Via: 1.1 daa2f44af77ac5ed09ff4b0024dfcd5d.cloudfront.net (CloudFront)
Last-Modified: Tue, 27 Jun 2017 15:57:09 GMT
Server: AmazonS3
Age: 122453
ETag: "6a2371a26e616416bee589a75f4d2fd9"
X-Cache: Hit from cloudfront
Content-Type: video/mp4
Content-Range: bytes 0-271936/271937
Connection: keep-alive
X-Amz-Cf-Pop: FRA56-C2
Accept-Ranges: bytes
Content-Length: 271937
X-Amz-Cf-Id: 3Mw_hJM2VKaQPyS5gqdVYvEzAvmV6nOYx4woqr3m5hhtXigFhqqnzg==

GET
H/1.1 206
Partial Content c1057a6f-76fc-470d-9cbc-87c086864674thumbs.mp4
dp8hsntg6do36.cloudfront.net/5952801dfd2e616da6000006/ Frame 0372 64 KB
0 388ms
67ms Media
video/mp4 13.32.24.6
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://dp8hsntg6do36.cloudfront.net/5952801dfd2e616da6000006/c1057a6f-76fc-470d-9cbc-87c086864674thumbs.mp4
Requested by: Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.24.6 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-24-6.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
Accept-Encoding: identity;q=1, *;q=0
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Range: bytes=0-

Response headers

Date: Mon, 01 Mar 2021 19:22:32 GMT
Via: 1.1 daa2f44af77ac5ed09ff4b0024dfcd5d.cloudfront.net (CloudFront)
Last-Modified: Tue, 27 Jun 2017 15:57:09 GMT
Server: AmazonS3
Age: 122453
ETag: "6a2371a26e616416bee589a75f4d2fd9"
X-Cache: Hit from cloudfront
Content-Type: video/mp4
Content-Range: bytes 0-271936/271937
Connection: keep-alive
X-Amz-Cf-Pop: FRA56-C2
Accept-Ranges: bytes
Content-Length: 271937
X-Amz-Cf-Id: 6NJahjNZtCHB0KiGQFaZbB9iBDEgvWYxk2SbN3XR8EQqq54u9TqbiA==

GET
H/1.1 200
OK track
capture.condenastdigital.com/ Frame 0372 48 B
48 B 138ms
136ms Image
image/gif 3.223.14.133
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://capture.condenastdigital.com/track?_o=cne&_ts=2021-03-02T16%3A27%3A47.958Z&_c=Player%20Event&_t=Player%20In%20Viewport&app=playerservice&cBr=arstechnica&cCh=videos%2Fshow&cCu=https%3A%2F%2Fwww.arstechnica.com%2Fvideo%2Fwatch%2Fhow-the-internet-could-change-under-trump&cId=5952801dfd2e616da6000006&cKe=internet%2Cinternet%20privacy%2Cnet%20neutrality%2Cobama%2Cobama%20administration%2Cprivacy%2Ctrump&cPd=2017-06-28T10%3A00%3A00%2B00%3A00&cTi=How%20the%20Internet%20could%20change%20under%20Trump&mDu=86&pHr=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2021%2F02%2Fnew-malware-found-on-30000-macs-has-security-pros-stumped%2F&pID=4e78db71-a622-4623-8f8c-129b7f97ef02&pWw=276&pWh=155.25&sID=eeca8fd2-2ede-4309-b7f8-017d7fcdf896&uId=0ba4f8f3-3dcb-4625-8858-f8cc027e953a&xid=50b8ab59-83f4-4626-9718-6b8bf7dc3673&dim1=%7B%22contentStartType%22%3A%22autoplay%22%2C%22doNotTrackSetting%22%3Anull%2C%22environment%22%3A%22oo%22%2C%22gitBranch%22%3A%22master%22%2C%22gitSha%22%3A%2251ae250%22%2C%22guid%22%3A%22fa0034af-4523-c7d2-6bc7-6f82408a5d7f%22%2C%22isMobile%22%3Afalse%2C%22isVerso%22%3Afalse%2C%22initialPlayerStartType%22%3A%22autoplay%22%2C%22persistent%22%3Afalse%2C%22playerDepth%22%3A481%2C%22playerType%22%3A%22interlude%22%2C%22playsOnPage%22%3A0%2C%22prerollPlayed%22%3Afalse%2C%22recAlgorithm%22%3A%22recommendations_cne-interlude-arstechnica_4f617df1-eac3-4775-9554-b0e3db036855_similar2-3%22%2C%22recStrategy%22%3A%22similar2_3%22%2C%22isRightRail%22%3Afalse%2C%22tabStatus%22%3A%22active%22%2C%22videoViews%22%3A1%2C%22viewportStatus%22%3A%22FULLY_IN_VIEWPORT%22%7D&dim2=%7B%22adBlocked%22%3Afalse%2C%22adId%22%3A%22%22%2C%22adType%22%3A%22%22%2C%22creativeId%22%3A%22%22%2C%22wrapperAdIds%22%3A%22%22%2C%22wrapperAdSystems%22%3A%22%22%2C%22dfpLineItem%22%3A%22%22%2C%22publicaEnabled%22%3Afalse%2C%22podIndex%22%3A%22%22%7D&adId=
Requested by: Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.223.14.133 , United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-223-14-133.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Access-Control-Allow-Origin: *
Date: Tue, 02 Mar 2021 16:27:48 GMT
Connection: keep-alive
Content-Length: 48
Content-Type: image/gif

GET
H/1.1 200
OK track
capture.condenastdigital.com/ Frame 0372 48 B
48 B 146ms
142ms Image
image/gif 3.223.14.133
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://capture.condenastdigital.com/track?_o=cne&_ts=2021-03-02T16%3A27%3A47.964Z&_c=Player%20Event&_t=Player%20Loaded&app=playerservice&cBr=arstechnica&cCh=videos%2Fshow&cCu=https%3A%2F%2Fwww.arstechnica.com%2Fvideo%2Fwatch%2Fhow-the-internet-could-change-under-trump&cId=5952801dfd2e616da6000006&cKe=internet%2Cinternet%20privacy%2Cnet%20neutrality%2Cobama%2Cobama%20administration%2Cprivacy%2Ctrump&cPd=2017-06-28T10%3A00%3A00%2B00%3A00&cTi=How%20the%20Internet%20could%20change%20under%20Trump&mDu=86&pHr=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2021%2F02%2Fnew-malware-found-on-30000-macs-has-security-pros-stumped%2F&pID=4e78db71-a622-4623-8f8c-129b7f97ef02&pWw=276&pWh=155.25&sID=eeca8fd2-2ede-4309-b7f8-017d7fcdf896&uId=0ba4f8f3-3dcb-4625-8858-f8cc027e953a&xid=50b8ab59-83f4-4626-9718-6b8bf7dc3673&dim1=%7B%22contentStartType%22%3A%22autoplay%22%2C%22doNotTrackSetting%22%3Anull%2C%22environment%22%3A%22oo%22%2C%22gitBranch%22%3A%22master%22%2C%22gitSha%22%3A%2251ae250%22%2C%22guid%22%3A%22fa0034af-4523-c7d2-6bc7-6f82408a5d7f%22%2C%22isMobile%22%3Afalse%2C%22isVerso%22%3Afalse%2C%22initialPlayerStartType%22%3A%22autoplay%22%2C%22persistent%22%3Afalse%2C%22playerDepth%22%3A481%2C%22playerType%22%3A%22interlude%22%2C%22playsOnPage%22%3A0%2C%22prerollPlayed%22%3Afalse%2C%22recAlgorithm%22%3A%22recommendations_cne-interlude-arstechnica_4f617df1-eac3-4775-9554-b0e3db036855_similar2-3%22%2C%22recStrategy%22%3A%22similar2_3%22%2C%22isRightRail%22%3Afalse%2C%22tabStatus%22%3A%22active%22%2C%22videoViews%22%3A1%2C%22viewportStatus%22%3A%22FULLY_IN_VIEWPORT%22%7D&dim2=%7B%22adBlocked%22%3Afalse%2C%22adId%22%3A%22%22%2C%22adType%22%3A%22%22%2C%22creativeId%22%3A%22%22%2C%22wrapperAdIds%22%3A%22%22%2C%22wrapperAdSystems%22%3A%22%22%2C%22dfpLineItem%22%3A%22%22%2C%22publicaEnabled%22%3Afalse%2C%22podIndex%22%3A%22%22%7D&adId=
Requested by: Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.223.14.133 , United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-223-14-133.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Access-Control-Allow-Origin: *
Date: Tue, 02 Mar 2021 16:27:48 GMT
Connection: keep-alive
Content-Length: 48
Content-Type: image/gif

GET
H/1.1 200
OK c1057a6f-76fc-470d-9cbc-87c086864674manifest-ios.m3u8 Show response
dp8hsntg6do36.cloudfront.net/5952801dfd2e616da6000006/ Frame 0372 918 B
1 KB 191ms
58ms XHR
application/x-mpegurl 13.32.24.6
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://dp8hsntg6do36.cloudfront.net/5952801dfd2e616da6000006/c1057a6f-76fc-470d-9cbc-87c086864674manifest-ios.m3u8?videoIndex=0&requester=oo
Requested by: Host: d2c8v52ll5s99u.cloudfront.net
URL: https://d2c8v52ll5s99u.cloudfront.net/player/main-cddebf909f5183fb417b.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.24.6 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-24-6.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: f387907dcb88532c842b6c98ad655d18fc4ac65316981d430245d3cd03f7e803

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Tue, 02 Mar 2021 08:44:19 GMT
Via: 1.1 1c12254585d1d316d9380549d59e3c80.cloudfront.net (CloudFront)
Vary: Origin
Age: 71833
X-Cache: Hit from cloudfront
Connection: keep-alive
Content-Length: 918
Last-Modified: Tue, 27 Jun 2017 15:56:51 GMT
Server: AmazonS3
ETag: "3ce187de835c8066c79fd5180c80c7f3"
Access-Control-Max-Age: 3000
Access-Control-Allow-Methods: GET, HEAD
Content-Type: application/x-mpegURL
Access-Control-Allow-Origin: *
X-Amz-Cf-Pop: FRA56-C2
Accept-Ranges: bytes
X-Amz-Cf-Id: qv_Ls8YsulG6voFTqHwWeoAr198XtygAt3UzzXYVwsRXbeg3cCp6cQ==

GET
H2 200 ga-audiences
www.google.com/ads/ 42 B
107 B 30ms
29ms Image
image/gif 2a00:1450:4001:813::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j88&tid=UA-31997-1&cid=1606731204.1614702467&jid=1602163719&_u=aGDAAUAjAAQCAG~&z=1356327693

Requested by

Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 02 Mar 2021 16:27:48 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.de/ads/ 42 B
107 B 30ms
30ms Image
image/gif 2a00:1450:4001:80f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j88&tid=UA-31997-1&cid=1606731204.1614702467&jid=1602163719&_u=aGDAAUAjAAQCAG~&z=1356327693

Requested by

Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 02 Mar 2021 16:27:48 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
BLOB 200
OK 344f0c2b-74ff-43a6-b33f-86af36a91000
https://arstechnica.com/ Frame 0372 5 KB
0 Other
application/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://arstechnica.com/344f0c2b-74ff-43a6-b33f-86af36a91000
Requested by: Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: d5f3418a3fa657175d5341b5e032be036cb4d5818de5d1497f2175be5a7e3701

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Length: 5463
Content-Type: application/javascript

GET
H2 200 obUserSync.html Show response
widgets.outbrain.com/widgetOBUserSync/ Frame 42B3 16 KB
6 KB 61ms
61ms Document
text/html 23.202.53.159
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://widgets.outbrain.com/widgetOBUserSync/obUserSync.html
Requested by: Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/outbrain.js?_=1614702466026
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.202.53.159 Vienna, Austria, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-202-53-159.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: afb145bd40df8dffa617b6e9e404d0284c792dd7a3e40884b49df9c9279c625b

Request headers

:method: GET
:authority: widgets.outbrain.com
:scheme: https
:path: /widgetOBUserSync/obUserSync.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/

Response headers

accept-ranges: bytes
content-type: text/html
etag: "2759986ecbb4d0550a78c4abeda19fad:1614673403.295396"
last-modified: Tue, 02 Mar 2021 08:23:11 GMT
server: AkamaiNetStorage
vary: Accept-Encoding
content-encoding: gzip
cache-control: max-age=86400
expires: Wed, 03 Mar 2021 16:27:48 GMT
date: Tue, 02 Mar 2021 16:27:48 GMT
content-length: 5390
timing-allow-origin: * *
access-control-allow-credentials: false
access-control-allow-methods: GET,POST
access-control-allow-origin: *
cookie: CheetahStaging=true
set-cookie: akacd_widgets_routing=1614702468~rv=56~id=e5069b0daa11786e41b6958e0ad2de93; path=/; Expires=Tue, 02 Mar 2021 16:27:48 GMT; Secure; SameSite=None

GET
H/1.1 200
OK l Show response
mcdp-nydc1.outbrain.com/ 2 B
292 B 1535ms
130ms Fetch
text/plain 64.202.112.31
SERVERCENTRAL

General

Check archive.org

Show headers Download Go to

Full URL: https://mcdp-nydc1.outbrain.com/l?token=ceb16e2e885a49bf4582836de262d712_6817_1614702467566&tm=970&eT=0&tpcs=0&wRV=2000235&pVis=0&lsd=-1&eIdx=&ccpa=1---&cnsntV2=CPCcAsZPCcAsZAcABBENBPCgAAAAAAAAAChQAAAAAAJBAGIAAoAHAAeABcAD4ALQAfABJADEAH8ARQAkQBXADNAG0AOIAcgA5wB1AD_AIGAQcAkQBPwChgGEAOqAh8BHoCQgErAJtAWEAugBdQC7QF5AMQAYsAyEBkYDKAGhANGAaUA1MBtADbgG6AOCCQVgAEAALgAoACoAGQAOAAeABAACIAFQAMIAaABqADyAIYAiABMACfAFUAVgAsABcADeAHMAPQAhABDQCIAIkAR0AlgCXAE0AKUAW4AwwBkADLgGoAaoA2QB3gD2AHxAPsA_QCAQEXARgAjQBHACUgFBAKWAU8Aq4BcwC_AGKANYAbQA3ABvAD0AHyAQ2Ah0BF4CRAExAJlATYAnYBQ4CkQFigLQAWwAuQBd4C8wGBAMGAYSAw0Bh4DIgGSAMnAZcAzkBnwDSAGnQNYA1kMASAAWABcAJIAVQAxADSAGqAOIA2QB1AEhAKHAXQAvoBiwDIwGhAN0DQJgAVABWAC4AIYAZAAywBqADZAHYAPwAgABBQCMAFLAKeAVeAtAC0gGsAN4AdUA-QCGwEOgIqAReAkQBNgCdgFIgLkAYEAwkBh4DGAGTgM5AZ4Az4QASAAWABcAGoASQAqgBiAFcANUAcQBIgDcAG8ASEAocBdADFgGhAN0EQIAAVABWAC4AIYAZAAywBqADZAHYAPwAgABGAClgFPAKuAawA6oB8gENgIdAReAkQBNgCdgFIgLkAYEAwkBh4DJwGcgM-FQHgAKAAqACGAEwALgAjgBlgDUAHYAPwAjABHAClgFXgLQAtIBvAEggJiATYApsBbAC5AF5gMCAYeAyIBnIDPAGfANyFADQAxADVAG0AOIAcgA8ACCgHVAR6AvoBmgDQgGvDIDYAFAAVABDACYAFwARwAywBqADsgH2AfgBGACOAFLAKuAVsA3gCYgE2ALRAWwAvMBgQDDwGRAM5AZ4Az4YANABqAGIAaoA2gBxADkAHgAWIA2QB1QEegLyAaEOAsgACAARAA4ADwALgAfABaADkAH4AQQAugBkADQAH8ARQAkQBOgCzAF8AMsAZoA0gBqgDaAHEAOQAc4A6gB2ADuAIAAQMAgsBBwEIAIiASIAm0BPgE_AKWAVAAtoBeoDAAMCAYQA1gBrwDeAHHAOkAdUA8gB8gEIQIfAiABHoCQoErASuAmIBMoCbQFCgKQAUmApgBUwCqgFbAK5AV2AsoBaQC1AFxQLoAuoBfQDAgGIAMWAZCAygBl4DQoGigaMA0oBpoDUwGvANoAbYA24dBnAAXABQAFQAMgAcABAACIAFQALoAYABjADQANQAeAA-gCGAIgATAAnwBVAFYALAAXAAvgBiADMAG8AOYAegBCACGgEQARIAjoBLAEwAJoAUYApQBYgC3gGEAYYAyABlADRAGoANkAb4A7wB7QD7AP0Af8BFgEYAI5ASkBKgCggFPAKuAWKAtAC0gFzALqAXkAvwBigDaAG4gOmA6gB6AENgIdAREAioBF4CQQEiAJUATYAnYBQ4CmgFWALFAWgAtgBcAC5AF2gLvAXmAwYBhIDDQGHgMSAYwAx4BkgDJwGVAMsAZcAzkBnwDRIGkAaSA0sBpwDWAGxkAF4ACAAfgBBADQAH8ASIAtwBfADLAGqANoAcQA5ABzgDsAHgAQUAnwBSwCxAGAAMIAbIA3gB1QDtgIfAR6AkIBK4CYgE2gKFAUgApMBWwC6AF5AL6AYEAzQBoQDRQGlANTAbYA24hA9AAWABQADIAIgAVAAuABiAEMAJgAVQAuABfADEAGYAN4AegBHACxAGEAMoAagA3wB3wD7APwAf4BGACOAEpAKCAUMAp4BV4C0ALSAXMAvwBigDaAHUAPQAkEBIgCVAE2AKaAWKAtEBbAC4AFyALtAYeAxIBkQDJwGcgM8AZ8A0QBpIDSwHAEgEIAAgAHAAXABCADkAMgAkQBcgC-AGWANQAbQA7gCAAEJAJ8AVAA14BvADqgH2ARUAlYBNoCkwFlALSAX0AxEBiwDQgGlANyJQOQAEAALAAoABkADgAIoAYABiADwAIgATAAqgBcAC-AGIAMwAbQBCACGgEQARIAjgBRgClAFuAMIAZQA1QBsgDvAH4ARgAjgBTwCrwFoAWkAuoBigDcAHUAPkAh0BF4CRAE2ALFAWwAu0BeYDDwGRAMnAZYAzkBngDPgGkANYAcAUAhAACAAuAB8AEIALQAcgA_ACsAGQANoAcgBHACRAE6ALkAXwAywBqADXAG0AOIAc4A6gB3ADwAIAAQcAhIBFQCRAE2gJ8An4BSwCxAF1AMAAYQAxQBrwDeAHVAO2AeQA-QB_wEegJiATKAm0BSACmAFTAK7AWgAugBeQC-gGBAMWAaEA0QBpQDTYGpAamA14BwRSCWAAuACgAKgAZAA4ACAAEQAKoAYABjADQANQAeQBDAEQAJgATwApABVACwAFwAL4AYgAzABzAEIAIaARABEgCjAFKALEAW4AwgBlADRAGqANkAd8A-wD9AIsARgAjgBKQCggFDAKuAVsAuYBeQDaAG4APQAh0BF4CRAE2AJ2AUOApoBWwCxQFsALgAXIAu0BeYDDQGHgMYAZEAyQBk4DLgGcgM8AZ9A0gDSYGsAayA2MAA.YAAAAAAAAAAA&cheq=0&ab=0&wl=0
Requested by: Host: widgets.outbrain.com
URL: https://widgets.outbrain.com/outbrain.js?_=1614702466026
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 64.202.112.31 , United States, ASN23352 (SERVERCENTRAL, US),
Reverse DNS: ny.outbrain.com
Software: /
Resource Hash: 2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

access-control-allow-origin: *
Date: Tue, 02 Mar 2021 16:27:49 GMT
content-encoding: gzip
X-TraceId: 5f19ef7b0e62d89998aecd0dcbee483b
Content-Type: text/plain; charset=UTF-8
Content-Length: 28
access-control-expose-headers: content-range

GET
H2 200 eyJpdSI6IjE0MWEyODRkMGI1ZDMyNTgyMzNkNmYwMTM3MTk1NGZhZDRjYmI5YjNiMzIzMzEyNmMxYTZhYzYxODE1MDVmYTIiLCJ3IjoxNDAsImgiOjEwMCwiZCI6MS41LCJjcyI6MCwiZiI6NH0.webp
images.outbrainimg.com/transform/v3/ 3 KB
4 KB 177ms
55ms Image
image/webp 104.85.5.185
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.outbrainimg.com/transform/v3/eyJpdSI6IjE0MWEyODRkMGI1ZDMyNTgyMzNkNmYwMTM3MTk1NGZhZDRjYmI5YjNiMzIzMzEyNmMxYTZhYzYxODE1MDVmYTIiLCJ3IjoxNDAsImgiOjEwMCwiZCI6MS41LCJjcyI6MCwiZiI6NH0.webp
Requested by: Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 104.85.5.185 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-85-5-185.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 0cb247be3e04fe36794b875373c19153f34f03eb05aae37ff743e68708cc5a51

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 02 Mar 2021 16:27:48 GMT
cache-control: max-age=2436687
last-modified: Sat, 13 Feb 2021 23:21:21 GMT
x-traceid: a1f542daabb568214648a2a02106de48
timing-allow-origin: *
content-length: 3520
content-type: image/webp

GET
H2 200 eyJpdSI6ImUxMzU3NTk5MDg5NWJkMzU4MGVjZjU4ZTkyZDBkZjU4YWM3YTA2YWU2MWI5ODZhOTYwYTM3YmRlNzc3ZDhjODciLCJ3IjoxNDAsImgiOjEwMCwiZCI6MS41LCJjcyI6MCwiZiI6NH0.webp
images.outbrainimg.com/transform/v3/ 2 KB
2 KB 198ms
88ms Image
image/webp 104.85.5.185
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.outbrainimg.com/transform/v3/eyJpdSI6ImUxMzU3NTk5MDg5NWJkMzU4MGVjZjU4ZTkyZDBkZjU4YWM3YTA2YWU2MWI5ODZhOTYwYTM3YmRlNzc3ZDhjODciLCJ3IjoxNDAsImgiOjEwMCwiZCI6MS41LCJjcyI6MCwiZiI6NH0.webp
Requested by: Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 104.85.5.185 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-85-5-185.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 7fa08d7f9994608e0beaffa2eddc86eb4d187be7560e968702f14293dc506fac

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 02 Mar 2021 16:27:48 GMT
cache-control: max-age=1515702
last-modified: Wed, 10 Feb 2021 16:09:13 GMT
x-traceid: f0b616e9cfdb0fd7ef4fa96026271571
timing-allow-origin: *
content-length: 1641
content-type: image/webp

GET
H2 200 eyJpdSI6IjhkOWFjM2Y5MWJkYTBkMTczMmFiYjc2ZGNlNDg0NGE2YTk0ZjVmYzk5MmQ2MzRhN2VjNjhmZmJjODY5MjczMGUiLCJ3IjoxNDAsImgiOjEwMCwiZCI6MS41LCJjcyI6MCwiZiI6NH0.webp
images.outbrainimg.com/transform/v3/ 7 KB
7 KB 189ms
89ms Image
image/webp 104.85.5.185
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.outbrainimg.com/transform/v3/eyJpdSI6IjhkOWFjM2Y5MWJkYTBkMTczMmFiYjc2ZGNlNDg0NGE2YTk0ZjVmYzk5MmQ2MzRhN2VjNjhmZmJjODY5MjczMGUiLCJ3IjoxNDAsImgiOjEwMCwiZCI6MS41LCJjcyI6MCwiZiI6NH0.webp
Requested by: Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 104.85.5.185 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-85-5-185.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 948226984e93a8a49e2fbc6ae7d4f3c17d68e606f703d76ec956f771fbc670cb

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 02 Mar 2021 16:27:48 GMT
cache-control: max-age=1217118
last-modified: Tue, 15 Dec 2020 16:03:11 GMT
x-traceid: 9068a2188ab44cf92b0e7f584745764d
timing-allow-origin: *
content-length: 6864
content-type: image/webp

GET
H2 200 eyJpdSI6ImE1MzIyYTRiODRkN2IxNTBkMTg0OTNlMjY1ZjkxZDlhZjUwOGUzMjFkZDIyODM4NWYzODBhMGZjYTYyYmRlODYiLCJ3IjoxNDAsImgiOjEwMCwiZCI6MS41LCJjcyI6MCwiZiI6NH0.webp
images.outbrainimg.com/transform/v3/ 8 KB
8 KB 182ms
84ms Image
image/webp 104.85.5.185
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.outbrainimg.com/transform/v3/eyJpdSI6ImE1MzIyYTRiODRkN2IxNTBkMTg0OTNlMjY1ZjkxZDlhZjUwOGUzMjFkZDIyODM4NWYzODBhMGZjYTYyYmRlODYiLCJ3IjoxNDAsImgiOjEwMCwiZCI6MS41LCJjcyI6MCwiZiI6NH0.webp
Requested by: Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 104.85.5.185 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-85-5-185.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: e9848fb823bccc9d79f591be7bd57f02a80c6d570f257ef554b787336b538ca5

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 02 Mar 2021 16:27:48 GMT
cache-control: max-age=2252559
last-modified: Fri, 15 Jan 2021 06:03:33 GMT
x-traceid: 3dcd85915dcabd42a15653674458ef5b
timing-allow-origin: *
content-length: 7724
content-type: image/webp

GET
H2 200 eyJpdSI6Ijg0MmNkNTUzZmI4Y2JmMjVmZGMzZDA2ODVjZjU2YjQzZDdjODk5ODZjZmYzODJlY2YzNWRlZmI3YjZmMjFjNmQiLCJ3IjoxNDAsImgiOjEwMCwiZCI6MS41LCJjcyI6MCwiZiI6NH0.webp
images.outbrainimg.com/transform/v3/ 9 KB
9 KB 155ms
58ms Image
image/webp 104.85.5.185
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://images.outbrainimg.com/transform/v3/eyJpdSI6Ijg0MmNkNTUzZmI4Y2JmMjVmZGMzZDA2ODVjZjU2YjQzZDdjODk5ODZjZmYzODJlY2YzNWRlZmI3YjZmMjFjNmQiLCJ3IjoxNDAsImgiOjEwMCwiZCI6MS41LCJjcyI6MCwiZiI6NH0.webp
Requested by: Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 104.85.5.185 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-85-5-185.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: d20116f3604125cd796346ed202f0ae2f7529f5af03bba27548ba36e7c92402d

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 02 Mar 2021 16:27:48 GMT
cache-control: max-age=1843409
last-modified: Tue, 23 Feb 2021 08:45:38 GMT
x-traceid: 148f5e641e9b62e6dc5bbbfec2955343
timing-allow-origin: *
content-length: 9458
content-type: image/webp

GET
H2 200 omweb-v1.js Show response
pagead2.googlesyndication.com/omsdk/releases/live/ Frame A065 36 KB
13 KB 27ms
6ms Script
text/javascript 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/omsdk/releases/live/omweb-v1.js

Requested by

Host: srcdoc
URL: about:srcdoc

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a11f37584d425c821f06a42bb6a20546c9ceaf34bbf5d4d776afbaef40148e6e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 02 Mar 2021 15:33:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Mon, 14 Dec 2020 16:45:56 GMT
server: sffe
age: 3239
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=3600
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 12603
x-xss-protection: 0
expires: Tue, 02 Mar 2021 16:33:49 GMT

GET
H2 200 1663130473914833 Show response
connect.facebook.net/signals/config/ Frame 0372 242 KB
70 KB 10ms
6ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/1663130473914833?v=2.9.33&r=stable

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 , United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

c6a9af0e8366289a295ada98808d055eac76782b34e953da164e5626c18b7d3d

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com data: blob: 'self';script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net attachment.fbsbx.com blob: 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c;
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 0
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 71111
x-fb-rlafr: 0
pragma: public
x-fb-debug: RnQJzema3IorB+Yq+X5x4C/9/4S69uyLNWxQt22zLhGIrOQiED29ZdTABx7+AeR25rKeTMUo6qEwhNzvxzpcag==
x-fb-trip-id: 686109401
x-frame-options: DENY
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
date: Tue, 02 Mar 2021 16:27:48 GMT
strict-transport-security: max-age=31536000; preload; includeSubDomains
report-to: {"group":"coop_report","max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/"}]}, {"group":"coep_report","max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/"}]}
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
origin-trial: AqUfQvNe9Mod+kZ3Qx78GGg2ul4TtHv3l126BaOQCbywgYxRUP0y9rs8/el96V62SmT7ue9StD9aXvYmT3UAAQcAAAB5eyJvcmlnaW4iOiJodHRwczovL2ZhY2Vib29rLmNvbTo0NDMiLCJmZWF0dXJlIjoiQ3Jvc3NPcmlnaW5PcGVuZXJQb2xpY3lSZXBvcnRpbmciLCJleHBpcnkiOjE2MTM0MTE1NzMsImlzU3ViZG9tYWluIjp0cnVlfQ==
cross-origin-opener-policy-report-only: same-origin-allow-popups;report-to="coop_report"
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H/1.1 200
OK sf-ui-display-medium-webfont.woff2
d2c8v52ll5s99u.cloudfront.net/assets/fonts/ Frame DA1B 29 KB
30 KB 731ms
443ms Font
application/font-woff2 13.32.23.187
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d2c8v52ll5s99u.cloudfront.net/assets/fonts/sf-ui-display-medium-webfont.woff2
Requested by: Host: d2c8v52ll5s99u.cloudfront.net
URL: https://d2c8v52ll5s99u.cloudfront.net/player/player-style-abb0de6918fca8264be7b7adba283776.css
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.23.187 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-23-187.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: d281c9d6bae645f3da6d2f0769a2cf0668709fd28e2021ce74821cdd8c7117b3

Request headers

Origin: https://arstechnica.com
Referer: https://d2c8v52ll5s99u.cloudfront.net/player/player-style-abb0de6918fca8264be7b7adba283776.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Tue, 02 Mar 2021 16:27:49 GMT
Content-Encoding: gzip
Vary: Origin,Access-Control-Request-Headers,Access-Control-Request-Method
X-Amz-Cf-Pop: FRA56-C2
X-Cache: RefreshHit from cloudfront
Connection: keep-alive
Content-Length: 29632
Access-Control-Allow-Origin: *
Last-Modified: Mon, 26 Jun 2017 15:24:42 GMT
Server: AmazonS3
ETag: "7d18db04f980971f2a9c5026bbc34bed"
Access-Control-Max-Age: 3000
Access-Control-Allow-Methods: GET
Content-Type: application/font-woff2
Via: 1.1 103eb504d36d97c9f30550032223d996.cloudfront.net (CloudFront)
Cache-Control: max-age=63072000, public
Accept-Ranges: bytes
X-Amz-Cf-Id: 5cChimGgoacNwiGjMpa_GRP5UvOJglvjH1kbKG3SKrEWVa_TIjPPdA==
Expires: Tue, 01 Jan 2030 00:00:00 GMT

GET
H2 200 bridge3.444.1_en.html Show response
imasdk.googleapis.com/js/core/ Frame 7584 577 KB
189 KB 9ms
8ms Document
text/html 2a00:1450:4001:827::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://imasdk.googleapis.com/js/core/bridge3.444.1_en.html

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3a478cc89688c6d5bc04418bbfd3da092d2df5c78ad9b6663975cceb83832e61

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: imasdk.googleapis.com
:scheme: https
:path: /js/core/bridge3.444.1_en.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
content-length: 192862
date: Fri, 26 Feb 2021 12:33:48 GMT
expires: Sat, 26 Feb 2022 12:33:48 GMT
last-modified: Fri, 26 Feb 2021 01:03:43 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 359640
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 client.js Show response
s0.2mdn.net/instream/video/ Frame DA1B 44 KB
16 KB 14ms
14ms Script
text/javascript 2a00:1450:4001:813::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/instream/video/client.js

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d0bffc7261df1454c5e05475cda7d9e6647318dc6c3936767e1252bfe8849c54

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 02 Mar 2021 16:27:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 16746
x-xss-protection: 0
expires: Tue, 02 Mar 2021 16:27:48 GMT

GET
H2 200 fbevents.js Show response
connect.facebook.net/en_US/ Frame DA1B 91 KB
23 KB 6ms
6ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: d2c8v52ll5s99u.cloudfront.net
URL: https://d2c8v52ll5s99u.cloudfront.net/player/main-cddebf909f5183fb417b.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 , United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

9e7ea2b4ba8e2bcc4a964d6192e4671dc5f6863a1c7e35b52b229a3c1e67a68d

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com data: blob: 'self';script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c;
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 0
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 23762
x-fb-rlafr: 0
pragma: public
x-fb-debug: 5BZqRjXYlMGoefFNX+GnX/xxRj9Ol2xrfE1PkkGlVn5AoUOAndVpqST+gVIdnJzWT5PMs0xcKxSjIbxIRIagCA==
x-fb-trip-id: 686109401
x-frame-options: DENY
date: Tue, 02 Mar 2021 16:27:48 GMT
strict-transport-security: max-age=31536000; preload; includeSubDomains
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H/1.1 200
OK comscore-min.js Show response
d2c8v52ll5s99u.cloudfront.net/player/ Frame DA1B 38 KB
11 KB 75ms
66ms Script
text/javascript 13.32.23.187
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d2c8v52ll5s99u.cloudfront.net/player/comscore-min.js
Requested by: Host: d2c8v52ll5s99u.cloudfront.net
URL: https://d2c8v52ll5s99u.cloudfront.net/player/main-cddebf909f5183fb417b.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.23.187 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-23-187.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 833a86642252016b29f08dd45ffd27f9e00ca237f28d8c5f0147a6e15d009377

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Tue, 02 Mar 2021 16:26:47 GMT
Content-Encoding: gzip
Last-Modified: Wed, 24 May 2017 18:19:15 GMT
Server: AmazonS3
Age: 348
ETag: W/"054acb6fbd2b2a6c1ac561705bffb0cc"
Vary: Accept-Encoding
X-Cache: Hit from cloudfront
Content-Type: text/javascript
Via: 1.1 bfa7dfbe8ca6d4eb3690c4c82ca6c0fa.cloudfront.net (CloudFront)
Connection: keep-alive
Transfer-Encoding: chunked
X-Amz-Cf-Pop: FRA56-C2
X-Amz-Cf-Id: rTFE0EBqFiYqDW39my96u5IyR7tJQxm5tT_yitzZ2hKnizcppGecGw==

POST
H2 200 collect Show response
www.google-analytics.com/j/ 2 B
206 B 14ms
13ms XHR
text/plain 2a00:1450:4001:80f::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j88&a=1804182708&t=event&ni=1&_s=1&dl=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2021%2F02%2Fnew-malware-found-on-30000-macs-has-security-pros-stumped%2F&dr=%2F&dp=%2Finformation-technology%2F2021%2F02%2Fnew-malware-found-on-30000-macs-has-security-pros-stumped%2F&ul=en-us&de=UTF-8&dt=New%20malware%20found%20on%2030%2C000%20Macs%20has%20security%20pros%20stumped%20%7C%20Ars%20Technica&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=video&ea=loaded&el=600745e738d069677538c4b8%7CPersonal%20History_Season%201%7C1512%7CSteve%20Burke%20of%20GamersNexus%20Reacts%20To%20Their%20Top%201000%20Comments%20On%20YouTube&_u=aGjAAUAjAAQCAG~&jid=817798858&gjid=43521936&cid=1606731204.1614702467&tid=UA-31997-1&_gid=2078831671.1614702468&_r=1&gtm=2wg2h0NLXNPCQ&cg1=article%7Creport&cg2=information-technology&cg3=information%20technology&cd1=GTM-NLXNPCQ&cd2=258&cd4=&cd6=Tue%20Mar%2002%202021%2017%3A27%3A48%20GMT%2B0100%20(Central%20European%20Standard%20Time)&cd7=1614702468117.iu9oau&cd8=-1&cd9=Mozilla%2F5.0%20(Macintosh%3B%20Intel%20Mac%20OS%20X%2010_14_5)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F83.0.4103.61%20Safari%2F537.36&cd10=English&cd11=17&cd12=0&cd13=GA%20Event%20-%20Video%20Engagement&cd20=none&cd25=Dan%20Goodin&cd26=1744063&cd27=939&cd28=New%20malware%20found%20on%2030%2C000%20Macs%20has%20security%20pros%20stumped&cd29=web&cd32=2021-02-20T15%3A10%3A13%2B00%3A00&cd33=11&cd34=2021-02-22T22%3A03%3A20%2B00%3A00&cd35=M1%7CMacOS%7CMacs%7Cmalware&cd36=web&cd43=Ars%20Technica&cd45=Adblock%20Enabled%20-%20false&cd62=https%3A%2F%2Farstechnica.com%2F%3Fp%3D1744063&cd63=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2021%2F02%2Fnew-malware-found-on-30000-macs-has-security-pros-stumped%2F&cd65=&cd72=1.0.0&cd92=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2021%2F02%2Fnew-malware-found-on-30000-macs-has-security-pros-stumped%2F&cd93=information%20technology&cd95=%2CC0001%2C&cd98=article%7Creport&cd103=&cd113=video-loaded&cd129=&cd3=1606731204.1614702467&cd76=600745e738d069677538c4b8%7CPersonal%20History_Season%201%7C1512%7CSteve%20Burke%20of%20GamersNexus%20Reacts%20To%20Their%20Top%201000%20Comments%20On%20YouTube&cd77=arstechnica&cd80=1&cd82=600745e738d069677538c4b8&cd83=Personal%20History_Season%201&cd84=Steve%20Burke%20of%20GamersNexus%20Reacts%20To%20Their%20Top%201000%20Comments%20On%20YouTube&cd85=1512&cd90=arstechnica&cd91=1&z=1678655648

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Tue, 02 Mar 2021 16:27:48 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://arstechnica.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK infinityid Show response
infinityid.condenastdigital.com/ Frame DA1B 36 B
1 KB 142ms
142ms XHR
text/plain 54.145.213.132
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://infinityid.condenastdigital.com/infinityid
Requested by: Host: d2c8v52ll5s99u.cloudfront.net
URL: https://d2c8v52ll5s99u.cloudfront.net/player/main-cddebf909f5183fb417b.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.145.213.132 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx/1.15.8 /
Resource Hash: bfd2d2d2a2c611d8f7376cfd3e734b434ef888043df725ce84a8b2d7e39492e0

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Tue, 02 Mar 2021 16:27:48 GMT
content-encoding: gzip
Server: nginx/1.15.8
vary: origin,accept-encoding
Content-Type: text/plain; charset=utf-8
access-control-allow-origin: https://arstechnica.com
access-control-expose-headers: WWW-Authenticate,Server-Authorization
cache-control: no-cache
access-control-allow-credentials: true
Connection: keep-alive
transfer-encoding: chunked
expires: 0

GET
H/1.1 200
OK track
capture.condenastdigital.com/ Frame DA1B 48 B
48 B 140ms
134ms Image
image/gif 3.223.14.133
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://capture.condenastdigital.com/track?_o=cne&_ts=2021-03-02T16%3A27%3A48.033Z&_c=&_t=Player%20Requested&pHr=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2021%2F02%2Fnew-malware-found-on-30000-macs-has-security-pros-stumped%2F
Requested by: Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.223.14.133 , United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-223-14-133.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Access-Control-Allow-Origin: *
Date: Tue, 02 Mar 2021 16:27:48 GMT
Connection: keep-alive
Content-Length: 48
Content-Type: image/gif

GET
H/1.1 200
OK track
capture.condenastdigital.com/ Frame DA1B 48 B
48 B 135ms
134ms Image
image/gif 3.223.14.133
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://capture.condenastdigital.com/track?_o=cne&_ts=2021-03-02T16%3A27%3A48.092Z&_c=initial&_t=gptData&pHr=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2021%2F02%2Fnew-malware-found-on-30000-macs-has-security-pros-stumped%2F&dim1=%7B%22adBlocked%22%3Afalse%2C%22adUnits%22%3A%5B%223379%2Fconde.ars%2Finterstitial%2Finformation-technology%2Farticle%2F1%22%2C%223379%2Fconde.ars%2Fhero%2Finformation-technology%2Farticle%2F1%22%2C%223379%2Fconde.ars%2Frail%2Finformation-technology%2Farticle%2F1%22%2C%223379%2Fconde.ars%2Frail%2Finformation-technology%2Farticle%2F2%22%2C%223379%2Fconde.ars%2Frail%2Finformation-technology%2Farticle%2F3%22%2C%223379%2Fconde.ars%2Fmid-content%2Finformation-technology%2Farticle%2F1%22%2C%223379%2Fconde.ars%2Fmid-content%2Finformation-technology%2Farticle%2F2%22%2C%223379%2Fconde.ars%2Fmid-content%2Finformation-technology%2Farticle%2F3%22%5D%2C%22embedLocation%22%3A%22arstechnica%22%2C%22error%22%3A%22%22%2C%22lineItems%22%3A%5B%5D%2C%22publicaEnabled%22%3Afalse%2C%22videoId%22%3A%22600745e738d069677538c4b8%22%7D
Requested by: Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.223.14.133 , United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-223-14-133.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Access-Control-Allow-Origin: *
Date: Tue, 02 Mar 2021 16:27:48 GMT
Connection: keep-alive
Content-Length: 48
Content-Type: image/gif

GET
H/1.1 200
OK arstechnica_steve-from-gamers-nexus-reacts-to-their-top-1000-comments-on-youtube.jpg
dwgyu36up6iuz.cloudfront.net/heru80fdn/image/upload/c_fill,d_placeholder_arstechnica.png,fl_progressive,g_face,h_450,q_80,w_800/v1611089409/ Frame DA1B 74 KB
75 KB 71ms
71ms Image
image/jpeg 65.9.67.76
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dwgyu36up6iuz.cloudfront.net/heru80fdn/image/upload/c_fill,d_placeholder_arstechnica.png,fl_progressive,g_face,h_450,q_80,w_800/v1611089409/arstechnica_steve-from-gamers-nexus-reacts-to-their-top-1000-comments-on-youtube.jpg

Requested by

Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

65.9.67.76 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Cloudinary /

Resource Hash

451c12f71b589bb0f76d663003c2090670e94f3f104baf6a4377c150d82964ae

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800
X-Content-Type-Options	nosniff

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Strict-Transport-Security: max-age=604800
Via: 1.1 106758604a7f1ae0fa6678cd3d828d62.cloudfront.net (CloudFront)
X-Content-Type-Options: nosniff
Age: 165
X-Cache: Hit from cloudfront
Date: Tue, 02 Mar 2021 16:26:22 GMT
Server-Timing: fastly;dur=1;cpu=0;start=2021-02-15T03:42:28.013Z;desc=hit,rtt;dur=4
Content-Length: 75851
Last-Modified: Thu, 21 Jan 2021 16:08:22 GMT
Server: Cloudinary
Cache-Control: public, no-transform, max-age=300
ETag: "ed7d9270e128461711c5e9572de84a6a"
Content-Type: image/jpeg
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Content-Length,ETag,Server-Timing,X-Content-Type-Options
Connection: keep-alive
X-Amz-Cf-Pop: FRA56-C1
Accept-Ranges: bytes
Timing-Allow-Origin: *
X-Amz-Cf-Id: 8r0uiqQrC9A2tngREWcfK8cMSRMap3Q2e86_F8aNf5n209Z83K71Zw==

GET
H2 200 ads Show response
pubads.g.doubleclick.net/gampad/ Frame 0372 2 KB
1 KB 1189ms
78ms XHR
text/xml 142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pubads.g.doubleclick.net/gampad/ads?sz=640x360|480x70&iu=/3379/conde.ars/inline-player/information-technology/article&ciu_szs=300x60&gdfp_req=1&env=vp&output=vmap&unviewed_position_start=1&cust_params=m_data%3D1%26m_safety%3Dsafe%26m_categories%3Dmoat_safe%26m_mv%3DnoHistData%26m_gv%3DnoHistData%26env_device_type%3Ddesktop%26ctx_template%3Darticle%26content_type%3Darticle%26ctx_page_channel%3Dinformation-technology%26env_server%3Dproduction%26ctx_cns_version%3D6.43.6%26ctx_page_slug%3Dnew-malware-found-on-30000-macs-has-security-pros-stumped%26cnt_tags%3Dm1%252Cmacos%252Cmacs%252Cmalware%26cnt_copilotid%3D%26vnd_prx_segments%3D120000%252C121100%252C131100%252C131123%252C230004%252C300003%252C210001%252C240000%252C240002%252C240003%252C240001%252C240005%252C240006%252C240007%252C240008%252C240009%252C240011%252C240012%252C240013%252C240014%252C240017%252C240015%252C240016%252C240018%252C240019%252Ceuwba9%252Cv8lc56%26vnd_4d_cached%3D0%26vnd_4d_ctx_sg%3D%26vnd_4d_ctx_topics%3D%26vnd_4d_ctx_entities%3D%26vnd_4d_ctx_keywords%3D%26vnd_4d_sid%3Deeca8fd2-2ede-4309-b7f8-017d7fcdf896%26vnd_4d_pid%3D4e78db71-a622-4623-8f8c-129b7f97ef02%26vnd_4d_usr_topics%3D%26ctx_line_items%3D%26skipTimeout%3Dfalse%26height%3D155%26muted%3D1%26right_rail%3D0%26sensitive%3D0%26width%3D276&correlator=4284257813267620&description_url=https%3A%2F%2Fwww.arstechnica.com%2Fvideo%2Fwatch%2Fhow-the-internet-could-change-under-trump&vid=5952801dfd2e616da6000006&cmsid=1495&ppid=50b8ab5983f4462697186b8bf7dc3673

Requested by

Host: d2c8v52ll5s99u.cloudfront.net
URL: https://d2c8v52ll5s99u.cloudfront.net/player/main-cddebf909f5183fb417b.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

cafe /

Resource Hash

1a3030de2b854c090bd24bef92c316193cdb65d9483e593b66f9acbb26d58f0b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 02 Mar 2021 16:27:49 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1018
x-xss-protection: 0
google-lineitem-id: 0
pragma: no-cache
server: cafe
google-creative-id: 0
content-type: text/xml; charset=UTF-8
access-control-allow-origin: https://arstechnica.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
BLOB 200
OK f363968b-3e6e-43ac-884a-e86fe921c0a5
https://arstechnica.com/ Frame DA1B 31 B
0 Other
application/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://arstechnica.com/f363968b-3e6e-43ac-884a-e86fe921c0a5
Requested by: Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 7725538fe2f71147bffeba7452b434c826aef9009666cb4360c605d0b2a91d1d

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Length: 31
Content-Type: application/javascript

POST
H3-Q050 200 collect Show response
stats.g.doubleclick.net/j/ 4 B
68 B 13ms
13ms XHR
text/plain 2a00:1450:400c:c0c::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j88&tid=UA-31997-1&cid=1606731204.1614702467&jid=817798858&gjid=43521936&_gid=2078831671.1614702468&_u=aGjAAUAjAAQCAG~&z=1982727559

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400c:c0c::9a Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
date: Tue, 02 Mar 2021 16:27:48 GMT
content-type: text/plain
access-control-allow-origin: https://arstechnica.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK c1057a6f-76fc-470d-9cbc-87c086864674file-1422k-128-48000-768.m3u8 Show response
dp8hsntg6do36.cloudfront.net/5952801dfd2e616da6000006/ Frame 0372 1 KB
861 B 58ms
57ms XHR
application/x-mpegurl 13.32.24.6
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://dp8hsntg6do36.cloudfront.net/5952801dfd2e616da6000006/c1057a6f-76fc-470d-9cbc-87c086864674file-1422k-128-48000-768.m3u8?requester=oo
Requested by: Host: d2c8v52ll5s99u.cloudfront.net
URL: https://d2c8v52ll5s99u.cloudfront.net/player/main-cddebf909f5183fb417b.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.24.6 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-24-6.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 119469f02e1dfeb4757bb7d609dcf00b2237a78212bb6b05977c4b0af0dd3363

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Mon, 01 Mar 2021 23:22:34 GMT
Content-Encoding: gzip
Vary: Origin
Age: 136447
Transfer-Encoding: chunked
X-Cache: Hit from cloudfront
Connection: keep-alive
Access-Control-Allow-Origin: *
Last-Modified: Tue, 27 Jun 2017 15:57:28 GMT
Server: AmazonS3
ETag: W/"54b53c227b79965444fc3a518672ba2d"
Access-Control-Max-Age: 3000
Access-Control-Allow-Methods: GET, HEAD
Content-Type: application/x-mpegURL
Via: 1.1 1c12254585d1d316d9380549d59e3c80.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: FRA56-C2
X-Amz-Cf-Id: gBVMEDYanetiA14shj0Jf6bmAj7kVYGkhTYnc_5qzYGbPHf8HHN5-w==

GET
H/1.1 206
Partial Content 099796a2-82ab-463a-bda7-8bf55d67ecd1thumbs.mp4
dp8hsntg6do36.cloudfront.net/600745e738d069677538c4b8/ Frame DA1B 128 KB
0 113ms
64ms Media
video/mp4 13.32.24.6
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://dp8hsntg6do36.cloudfront.net/600745e738d069677538c4b8/099796a2-82ab-463a-bda7-8bf55d67ecd1thumbs.mp4
Requested by: Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.24.6 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-24-6.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
Accept-Encoding: identity;q=1, *;q=0
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Range: bytes=0-

Response headers

Date: Tue, 02 Mar 2021 04:51:40 GMT
Via: 1.1 daa2f44af77ac5ed09ff4b0024dfcd5d.cloudfront.net (CloudFront)
Last-Modified: Tue, 19 Jan 2021 21:24:59 GMT
Server: AmazonS3
Age: 46054
ETag: "0723c9864ae2eb075f537343282c1ab3"
X-Cache: Hit from cloudfront
Content-Type: video/mp4
Content-Range: bytes 0-3771102/3771103
Connection: keep-alive
X-Amz-Cf-Pop: FRA56-C2
Accept-Ranges: bytes
Content-Length: 3771103
X-Amz-Cf-Id: y45tkQfwL2f2qGu2frZ83pNDrmg7lXWckMAro2qoHMtCUAjaPmhawg==

GET
H/1.1 206
Partial Content 099796a2-82ab-463a-bda7-8bf55d67ecd1thumbs.mp4
dp8hsntg6do36.cloudfront.net/600745e738d069677538c4b8/ Frame DA1B 64 KB
0 165ms
61ms Media
video/mp4 13.32.24.6
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://dp8hsntg6do36.cloudfront.net/600745e738d069677538c4b8/099796a2-82ab-463a-bda7-8bf55d67ecd1thumbs.mp4
Requested by: Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.24.6 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-24-6.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
Accept-Encoding: identity;q=1, *;q=0
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Range: bytes=0-

Response headers

Date: Tue, 02 Mar 2021 08:38:54 GMT
Via: 1.1 99399b4523bd3370d7a592870d630ec9.cloudfront.net (CloudFront)
Last-Modified: Tue, 19 Jan 2021 21:24:59 GMT
Server: AmazonS3
Age: 46054
ETag: "0723c9864ae2eb075f537343282c1ab3"
X-Cache: Hit from cloudfront
Content-Type: video/mp4
Content-Range: bytes 0-3771102/3771103
Connection: keep-alive
X-Amz-Cf-Pop: FRA56-C2
Accept-Ranges: bytes
Content-Length: 3771103
X-Amz-Cf-Id: Bna2QeyuEi0KvVfPojvfGWaRLHsjBzgD6jLnyy5kogWobeRvvS6u9Q==

GET
H/1.1 200
OK track
capture.condenastdigital.com/ Frame DA1B 48 B
48 B 179ms
137ms Image
image/gif 3.223.14.133
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://capture.condenastdigital.com/track?_o=cne&_ts=2021-03-02T16%3A27%3A48.289Z&_c=Player%20Event&_t=Player%20Loaded&app=playerservice&cBr=arstechnica&cCh=videos%2Fshow&cCu=https%3A%2F%2Fwww.arstechnica.com%2Fvideo%2Fwatch%2Fpersonal-history-steve-from-gamers-nexus-reacts-to-their-top-1000-comments-on-youtube&cId=600745e738d069677538c4b8&cKe=personal%20history%2Cars%20personal%20history%2Cars%20technica%20personal%20history%2Cgamers%20nexus%2Csteve%20gamers%20nexus%2Cstevegn%2Cgamersnexus%2Csteve%20burke%20gamersnexus%2Cstephen%20burke%2Csteve%20burke&cPd=2021-01-21T16%3A00%3A00%2B00%3A00&cTi=Steve%20Burke%20of%20GamersNexus%20Reacts%20To%20Their%20Top%201000%20Comments%20On%20YouTube&mDu=1512&pHr=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2021%2F02%2Fnew-malware-found-on-30000-macs-has-security-pros-stumped%2F&pWw=540&pWh=303.75&dim1=%7B%22contentStartType%22%3A%22manual%22%2C%22doNotTrackSetting%22%3Anull%2C%22environment%22%3A%22oo%22%2C%22gitBranch%22%3A%22master%22%2C%22gitSha%22%3A%2251ae250%22%2C%22guid%22%3A%22d78af99-fc57-53e0-fa41-ad6e2247f4e%22%2C%22isMobile%22%3Afalse%2C%22isVerso%22%3Afalse%2C%22initialPlayerStartType%22%3A%22manual%22%2C%22persistent%22%3Afalse%2C%22playerDepth%22%3A4649.09375%2C%22playerType%22%3A%22video-continuous%22%2C%22playsOnPage%22%3A0%2C%22prerollPlayed%22%3Afalse%2C%22recAlgorithm%22%3Anull%2C%22recStrategy%22%3Anull%2C%22isRightRail%22%3Afalse%2C%22tabStatus%22%3A%22active%22%2C%22videoViews%22%3A1%2C%22viewportStatus%22%3Anull%7D&dim2=%7B%22adBlocked%22%3Afalse%2C%22adId%22%3A%22%22%2C%22adType%22%3A%22%22%2C%22creativeId%22%3A%22%22%2C%22wrapperAdIds%22%3A%22%22%2C%22wrapperAdSystems%22%3A%22%22%2C%22dfpLineItem%22%3A%22%22%2C%22publicaEnabled%22%3Afalse%2C%22podIndex%22%3A%22%22%7D&adId=
Requested by: Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.223.14.133 , United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-223-14-133.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Access-Control-Allow-Origin: *
Date: Tue, 02 Mar 2021 16:27:48 GMT
Connection: keep-alive
Content-Length: 48
Content-Type: image/gif

GET
H/1.1 200
OK 099796a2-82ab-463a-bda7-8bf55d67ecd1manifest-ios.m3u8 Show response
dp8hsntg6do36.cloudfront.net/600745e738d069677538c4b8/ Frame DA1B 918 B
1 KB 106ms
56ms XHR
application/x-mpegurl 13.32.24.6
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://dp8hsntg6do36.cloudfront.net/600745e738d069677538c4b8/099796a2-82ab-463a-bda7-8bf55d67ecd1manifest-ios.m3u8?videoIndex=0&requester=oo
Requested by: Host: d2c8v52ll5s99u.cloudfront.net
URL: https://d2c8v52ll5s99u.cloudfront.net/player/main-cddebf909f5183fb417b.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.24.6 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-24-6.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 8fd3b78ce066771a0b6aa2c4ad501e8d1305ce43eb2b4dde84d5f88b1a299fd7

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Tue, 02 Mar 2021 05:38:47 GMT
Via: 1.1 1c12254585d1d316d9380549d59e3c80.cloudfront.net (CloudFront)
Vary: Origin
Age: 86209
X-Cache: Hit from cloudfront
Connection: keep-alive
Content-Length: 918
Last-Modified: Tue, 19 Jan 2021 21:20:33 GMT
Server: AmazonS3
ETag: "fb5ad80d6d6158e4578edc99b99511f2"
Access-Control-Max-Age: 3000
Access-Control-Allow-Methods: GET, HEAD
Content-Type: application/x-mpegURL
Access-Control-Allow-Origin: *
X-Amz-Cf-Pop: FRA56-C2
Accept-Ranges: bytes
X-Amz-Cf-Id: zbkiuXLJa_SXAreGg_17XBnQjxbzaEHA1k4okJnacl3kPC7D235IQA==

GET
H3-Q050 200 ga-audiences
www.google.com/ads/ 42 B
88 B 30ms
30ms Image
image/gif 2a00:1450:4001:813::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j88&tid=UA-31997-1&cid=1606731204.1614702467&jid=817798858&_u=aGjAAUAjAAQCAG~&z=901940098

Requested by

Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 02 Mar 2021 16:27:48 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 ga-audiences
www.google.de/ads/ 42 B
88 B 31ms
30ms Image
image/gif 2a00:1450:4001:80f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j88&tid=UA-31997-1&cid=1606731204.1614702467&jid=817798858&_u=aGjAAUAjAAQCAG~&z=901940098

Requested by

Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 02 Mar 2021 16:27:48 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
BLOB 200
OK 50b2824c-8b37-4692-9798-1eed77874d27
https://arstechnica.com/ Frame DA1B 5 KB
0 Other
application/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://arstechnica.com/50b2824c-8b37-4692-9798-1eed77874d27
Requested by: Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: d5f3418a3fa657175d5341b5e032be036cb4d5818de5d1497f2175be5a7e3701

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Length: 5463
Content-Type: application/javascript

GET
H/1.1

200
OK

p2
sb.scorecardresearch.com/ Frame 0372
Redirect Chain

https://sb.scorecardresearch.com/p?c1=2&c2=6035094&ns_type=hidden&ns_st_sv=4.1505.18&ns_st_it=r&ns_st_id=1614702468331_1&ns_st_ec=1&ns_st_sp=1&ns_st_sq=1&ns_st_cn=1&ns_st_ev=play&ns_st_po=0&ns_st_c...
https://sb.scorecardresearch.com/p2?c1=2&c2=6035094&ns_type=hidden&ns_st_sv=4.1505.18&ns_st_it=r&ns_st_id=1614702468331_1&ns_st_ec=1&ns_st_sp=1&ns_st_sq=1&ns_st_cn=1&ns_st_ev=play&ns_st_po=0&ns_st_...

43 B
589 B

73ms
66ms

Image
image/gif

104.111.238.139
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sb.scorecardresearch.com/p2?c1=2&c2=6035094&ns_type=hidden&ns_st_sv=4.1505.18&ns_st_it=r&ns_st_id=1614702468331_1&ns_st_ec=1&ns_st_sp=1&ns_st_sq=1&ns_st_cn=1&ns_st_ev=play&ns_st_po=0&ns_st_cl=86000&ns_st_pb=1&ns_st_mp=streamsense&ns_st_mv=4.1505.18&ns_st_pn=1&ns_st_tp=0&ns_st_ci=5952801dfd2e616da6000006&ns_ts=1614702468331&ns_st_bt=0&ns_st_bp=0&ns_st_br=0&ns_st_ub=0&ns_st_pr=*null&ns_st_ep=*null&ns_st_ct=vc&ns_st_ge=*null&ns_st_st=*null&ns_st_pu=*null&c3=ARSTECHNICA&c4=*null&c6=*null&c7=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2021%2F02%2Fnew-malware-found-on-30000-macs-has-security-pros-stumped%2F&c8=How%20the%20Internet%20could%20change%20under%20Trump&c9=&ns_st_sn=*null&ns_st_en=*null&ns_st_ti=*null&ns_st_ia=*null&ns_st_ce=*null&ns_st_ddt=*null&ns_st_tdt=*null&cs_ak_ss=1
Requested by: Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 104.111.238.139 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-238-139.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 24e480e4659fbae818853a38f8a3036f529f539024dc3e772c0b594ce02ea9db

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 02 Mar 2021 16:27:48 GMT
Cache-Control: private, no-cache, no-cache=Set-Cookie, no-store, proxy-revalidate
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Mon, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://sb.scorecardresearch.com/p2?c1=2&c2=6035094&ns_type=hidden&ns_st_sv=4.1505.18&ns_st_it=r&ns_st_id=1614702468331_1&ns_st_ec=1&ns_st_sp=1&ns_st_sq=1&ns_st_cn=1&ns_st_ev=play&ns_st_po=0&ns_st_cl=86000&ns_st_pb=1&ns_st_mp=streamsense&ns_st_mv=4.1505.18&ns_st_pn=1&ns_st_tp=0&ns_st_ci=5952801dfd2e616da6000006&ns_ts=1614702468331&ns_st_bt=0&ns_st_bp=0&ns_st_br=0&ns_st_ub=0&ns_st_pr=*null&ns_st_ep=*null&ns_st_ct=vc&ns_st_ge=*null&ns_st_st=*null&ns_st_pu=*null&c3=ARSTECHNICA&c4=*null&c6=*null&c7=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2021%2F02%2Fnew-malware-found-on-30000-macs-has-security-pros-stumped%2F&c8=How%20the%20Internet%20could%20change%20under%20Trump&c9=&ns_st_sn=*null&ns_st_en=*null&ns_st_ti=*null&ns_st_ia=*null&ns_st_ce=*null&ns_st_ddt=*null&ns_st_tdt=*null&cs_ak_ss=1
Pragma: no-cache
Date: Tue, 02 Mar 2021 16:27:48 GMT
Cache-Control: private, no-cache, no-cache=Set-Cookie, no-store, proxy-revalidate
Connection: keep-alive
Content-Length: 0
Expires: Mon, 01 Jan 1990 00:00:00 GMT

POST
H/1.1 204
No Content events
wren.condenastdigital.com/1.0/conde/ 0
732 B 623ms
173ms Other
image/gif 52.207.120.193
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://wren.condenastdigital.com/1.0/conde/events?topic=wren.events.ads&api_key=d3Jlbg

Requested by

Host: cdn.arstechnica.net
URL: https://cdn.arstechnica.net/cns/ars-technica.min.js?v=1614702432

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.207.120.193 , United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-52-207-120-193.compute-1.amazonaws.com

Software

nginx/1.15.8 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

Date: Tue, 02 Mar 2021 16:27:49 GMT
x-content-type-options: nosniff
Server: nginx/1.15.8
x-frame-options: DENY
x-download-options: noopen
vary: origin
Connection: keep-alive
Content-Type: image/gif
access-control-allow-origin: https://arstechnica.com
access-control-expose-headers: WWW-Authenticate,Server-Authorization
cache-control: no-cache
access-control-allow-credentials: true
strict-transport-security: max-age=15768000; preload
x-xss-protection: 1; mode=block

GET
H3-Q050 200 omweb-v1.js Show response
pagead2.googlesyndication.com/omsdk/releases/live/ Frame 471B 36 KB
13 KB 40ms
20ms Script
text/javascript 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/omsdk/releases/live/omweb-v1.js

Requested by

Host: srcdoc
URL: about:srcdoc

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a11f37584d425c821f06a42bb6a20546c9ceaf34bbf5d4d776afbaef40148e6e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 02 Mar 2021 15:33:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Mon, 14 Dec 2020 16:45:56 GMT
server: sffe
age: 3239
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=3600
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 12603
x-xss-protection: 0
expires: Tue, 02 Mar 2021 16:33:49 GMT

GET
H2 200 ads Show response
pubads.g.doubleclick.net/gampad/ Frame DA1B 8 KB
2 KB 1075ms
78ms XHR
text/xml 142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pubads.g.doubleclick.net/gampad/ads?sz=640x480|480x70&iu=/3379/conde.ars/player/information-technology/article&ciu_szs=300x60&gdfp_req=1&env=vp&output=vmap&unviewed_position_start=1&cust_params=m_data%3D1%26m_safety%3Dsafe%26m_categories%3Dmoat_safe%26m_mv%3DnoHistData%26m_gv%3DnoHistData%26env_device_type%3Ddesktop%26ctx_template%3Darticle%26content_type%3Darticle%26ctx_page_channel%3Dinformation-technology%26env_server%3Dproduction%26ctx_cns_version%3D6.43.6%26ctx_page_slug%3Dnew-malware-found-on-30000-macs-has-security-pros-stumped%26cnt_tags%3Dm1%252Cmacos%252Cmacs%252Cmalware%26cnt_copilotid%3D%26vnd_prx_segments%3D120000%252C121100%252C131100%252C131123%252C230004%252C300003%252C210001%252C240000%252C240002%252C240003%252C240001%252C240005%252C240006%252C240007%252C240008%252C240009%252C240011%252C240012%252C240013%252C240014%252C240017%252C240015%252C240016%252C240018%252C240019%252Ceuwba9%252Cv8lc56%26vnd_4d_cached%3D0%26vnd_4d_ctx_sg%3D%26vnd_4d_ctx_topics%3D%26vnd_4d_ctx_entities%3D%26vnd_4d_ctx_keywords%3D%26vnd_4d_sid%3Deeca8fd2-2ede-4309-b7f8-017d7fcdf896%26vnd_4d_pid%3D4e78db71-a622-4623-8f8c-129b7f97ef02%26vnd_4d_usr_topics%3D%26ctx_line_items%3D%26height%3D304%26muted%3D0%26right_rail%3D0%26sensitive%3D0%26series%3D6007503ecc196a7a65d35ac1%26width%3D540&correlator=4284257813267620&description_url=https%3A%2F%2Fwww.arstechnica.com%2Fvideo%2Fwatch%2Fpersonal-history-steve-from-gamers-nexus-reacts-to-their-top-1000-comments-on-youtube&vid=600745e738d069677538c4b8&cmsid=1495&ppid=6b1b5527c3734631bd6d45f1577d915a

Requested by

Host: d2c8v52ll5s99u.cloudfront.net
URL: https://d2c8v52ll5s99u.cloudfront.net/player/main-cddebf909f5183fb417b.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

cafe /

Resource Hash

97b0d993c6c0d74e3288226c3a688e8383d23ddd7abbfedad9752893db9307f2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 02 Mar 2021 16:27:49 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1195
x-xss-protection: 0
google-lineitem-id: 0
pragma: no-cache
server: cafe
google-creative-id: 0
content-type: text/xml; charset=UTF-8
access-control-allow-origin: https://arstechnica.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

General

Check archive.org

Show headers Download Go to Show image

Full URL

Requested by

Host: d2c8v52ll5s99u.cloudfront.net
URL: https://d2c8v52ll5s99u.cloudfront.net/player/main-cddebf909f5183fb417b.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

65.9.67.76 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Cloudinary /

Resource Hash

1370c96be1c754ed05c9d7fa4107cd6f1c7e25b1eee343b06d4b0b0271febb7f

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800
X-Content-Type-Options	nosniff

Request headers

Origin: https://arstechnica.com
Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Tue, 09 Feb 2021 06:27:41 GMT
Via: 1.1 43c19aee1cbb38bf37ea4d5265ba1f54.cloudfront.net (CloudFront)
X-Content-Type-Options: nosniff
Age: 1850407
X-Cache: Hit from cloudfront
Server-Timing: fastly;dur=194;cpu=0;start=2021-02-09T06:27:41.085Z;desc=miss,rtt;dur=1,cloudinary;dur=103;start=2021-02-09T06:27:41.131Z
Content-Length: 72703
Last-Modified: Wed, 28 Jun 2017 17:33:57 GMT
Server: Cloudinary
Cache-Control: public, no-transform, immutable, max-age=2592000
ETag: "3442cb54fcc284e19af078ba2c3c2e9e"
Strict-Transport-Security: max-age=604800
Content-Type: image/jpeg
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Content-Length,ETag,Server-Timing,X-Content-Type-Options
Connection: keep-alive
X-Amz-Cf-Pop: FRA56-C1
Accept-Ranges: bytes
Timing-Allow-Origin: *
X-Amz-Cf-Id: 8HeKB70sqMvnZGvd6O1as9bW7VKJNLDZA7gb3j0hkU-S2R3LMzTA5Q==

General

Check archive.org

Show headers Download Go to Show image

Full URL

Requested by

Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

65.9.67.76 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Cloudinary /

Resource Hash

1370c96be1c754ed05c9d7fa4107cd6f1c7e25b1eee343b06d4b0b0271febb7f

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800
X-Content-Type-Options	nosniff

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Tue, 09 Feb 2021 06:27:41 GMT
Via: 1.1 1c5b98f7bd5001d6fe1040daa237afc6.cloudfront.net (CloudFront)
X-Content-Type-Options: nosniff
Age: 1850407
X-Cache: Hit from cloudfront
Server-Timing: fastly;dur=194;cpu=0;start=2021-02-09T06:27:41.085Z;desc=miss,rtt;dur=1,cloudinary;dur=103;start=2021-02-09T06:27:41.131Z
Content-Length: 72703
Last-Modified: Wed, 28 Jun 2017 17:33:57 GMT
Server: Cloudinary
Cache-Control: public, no-transform, immutable, max-age=2592000
ETag: "3442cb54fcc284e19af078ba2c3c2e9e"
Strict-Transport-Security: max-age=604800
Content-Type: image/jpeg
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Content-Length,ETag,Server-Timing,X-Content-Type-Options
Connection: keep-alive
X-Amz-Cf-Pop: FRA56-C1
Accept-Ranges: bytes
Timing-Allow-Origin: *
X-Amz-Cf-Id: Kpk7vSdjfe5ZDzH5Bj2XEa8bLXMJN6tvcPVVM43zjPfojAYLVs3TVg==

GET
BLOB 200
OK cd60fe33-4f89-4d3b-ae6f-14f427db8597
https://arstechnica.com/ Frame 0372 64 KB
0 Other
application/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://arstechnica.com/cd60fe33-4f89-4d3b-ae6f-14f427db8597
Requested by: Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 2db2f16f2ca017e865150e9b6edbbc4c4349ad8448db72e8bb21bbfb40cc4092

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Length: 65790
Content-Type: application/javascript

GET
H/1.1 200
OK c1057a6f-76fc-470d-9cbc-87c086864674file-1422k-128-48000-768-00001.ts Show response
dp8hsntg6do36.cloudfront.net/5952801dfd2e616da6000006/ Frame 0372 556 KB
543 KB 58ms
57ms XHR
application/x-mpegurl 13.32.24.6
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://dp8hsntg6do36.cloudfront.net/5952801dfd2e616da6000006/c1057a6f-76fc-470d-9cbc-87c086864674file-1422k-128-48000-768-00001.ts?requester=oo
Requested by: Host: d2c8v52ll5s99u.cloudfront.net
URL: https://d2c8v52ll5s99u.cloudfront.net/player/main-cddebf909f5183fb417b.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.24.6 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-24-6.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 774450873519c5e57ff4563f98c016010952d04b7cf3c75f851bfd0c185bed31

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Mon, 01 Mar 2021 23:55:51 GMT
Content-Encoding: gzip
Vary: Accept-Encoding,Origin
Age: 128983
Transfer-Encoding: chunked
X-Cache: Hit from cloudfront
Connection: keep-alive
Access-Control-Allow-Origin: *
Last-Modified: Tue, 27 Jun 2017 15:57:28 GMT
Server: AmazonS3
ETag: W/"81a9161a93e3f6816501373decbb2b86"
Access-Control-Max-Age: 3000
Access-Control-Allow-Methods: GET, HEAD
Content-Type: application/x-mpegURL
Via: 1.1 1c12254585d1d316d9380549d59e3c80.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: FRA56-C2
X-Amz-Cf-Id: NeM0aNrMrpnbbSXQquOzEMNn-hM23EJycje2PSiI3qjjyICAk9qQiQ==

GET
H2 200 1663130473914833 Show response
connect.facebook.net/signals/config/ Frame DA1B 242 KB
70 KB 6ms
6ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/1663130473914833?v=2.9.33&r=stable

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 , United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

c6a9af0e8366289a295ada98808d055eac76782b34e953da164e5626c18b7d3d

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com data: blob: 'self';script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net attachment.fbsbx.com blob: 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c;
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 0
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 71111
x-fb-rlafr: 0
pragma: public
x-fb-debug: RnQJzema3IorB+Yq+X5x4C/9/4S69uyLNWxQt22zLhGIrOQiED29ZdTABx7+AeR25rKeTMUo6qEwhNzvxzpcag==
x-fb-trip-id: 686109401
x-frame-options: DENY
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
date: Tue, 02 Mar 2021 16:27:48 GMT
strict-transport-security: max-age=31536000; preload; includeSubDomains
report-to: {"group":"coop_report","max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/"}]}, {"group":"coep_report","max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/"}]}
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
origin-trial: AqUfQvNe9Mod+kZ3Qx78GGg2ul4TtHv3l126BaOQCbywgYxRUP0y9rs8/el96V62SmT7ue9StD9aXvYmT3UAAQcAAAB5eyJvcmlnaW4iOiJodHRwczovL2ZhY2Vib29rLmNvbTo0NDMiLCJmZWF0dXJlIjoiQ3Jvc3NPcmlnaW5PcGVuZXJQb2xpY3lSZXBvcnRpbmciLCJleHBpcnkiOjE2MTM0MTE1NzMsImlzU3ViZG9tYWluIjp0cnVlfQ==
cross-origin-opener-policy-report-only: same-origin-allow-popups;report-to="coop_report"
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H/1.1 200
OK 099796a2-82ab-463a-bda7-8bf55d67ecd1file-1422k-128-48000-768.m3u8 Show response
dp8hsntg6do36.cloudfront.net/600745e738d069677538c4b8/ Frame DA1B 20 KB
1 KB 74ms
61ms XHR
application/x-mpegurl 13.32.24.6
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://dp8hsntg6do36.cloudfront.net/600745e738d069677538c4b8/099796a2-82ab-463a-bda7-8bf55d67ecd1file-1422k-128-48000-768.m3u8?requester=oo
Requested by: Host: d2c8v52ll5s99u.cloudfront.net
URL: https://d2c8v52ll5s99u.cloudfront.net/player/main-cddebf909f5183fb417b.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.24.6 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-24-6.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: b1c52447e6a8c00f86e06e19b3bdc943378a2f915fd14c69eee5a7fb3df92196

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Mon, 01 Mar 2021 19:13:28 GMT
Content-Encoding: gzip
Vary: Origin
Age: 129021
Transfer-Encoding: chunked
X-Cache: Hit from cloudfront
Connection: keep-alive
Access-Control-Allow-Origin: *
Last-Modified: Tue, 19 Jan 2021 21:29:12 GMT
Server: AmazonS3
ETag: W/"40d7274191a497cf41a0f5efddbf59b4"
Access-Control-Max-Age: 3000
Access-Control-Allow-Methods: GET, HEAD
Content-Type: application/x-mpegURL
Via: 1.1 fd3cce3e0bafd8b312277d0ad9f4762f.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: FRA56-C2
X-Amz-Cf-Id: qOVcSCDi8V4AS6UjDfvmsIsqupqY_hxQurdKhIA1JJleh4nvKVhqbg==

GET
BLOB 200
OK 562a6535-8165-49b4-a02c-fbecf92f7839
https://arstechnica.com/ Frame DA1B 64 KB
0 Other
application/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://arstechnica.com/562a6535-8165-49b4-a02c-fbecf92f7839
Requested by: Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 2db2f16f2ca017e865150e9b6edbbc4c4349ad8448db72e8bb21bbfb40cc4092

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Length: 65790
Content-Type: application/javascript

GET
H/1.1 200
OK 099796a2-82ab-463a-bda7-8bf55d67ecd1file-1422k-128-48000-768-00001.ts Show response
dp8hsntg6do36.cloudfront.net/600745e738d069677538c4b8/ Frame DA1B 725 KB
716 KB 59ms
58ms XHR
application/x-mpegurl 13.32.24.6
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://dp8hsntg6do36.cloudfront.net/600745e738d069677538c4b8/099796a2-82ab-463a-bda7-8bf55d67ecd1file-1422k-128-48000-768-00001.ts?requester=oo
Requested by: Host: d2c8v52ll5s99u.cloudfront.net
URL: https://d2c8v52ll5s99u.cloudfront.net/player/main-cddebf909f5183fb417b.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.24.6 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-24-6.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: e46d360d76c0447642cba9580a52bda77c7b852817fb980f9f8351f6701903b1

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Tue, 02 Mar 2021 06:24:44 GMT
Content-Encoding: gzip
Vary: Accept-Encoding,Origin
Age: 41267
Transfer-Encoding: chunked
X-Cache: Hit from cloudfront
Connection: keep-alive
Access-Control-Allow-Origin: *
Last-Modified: Tue, 19 Jan 2021 21:28:53 GMT
Server: AmazonS3
ETag: W/"ec954b703402c6d8c22a43f91bd5b791"
Access-Control-Max-Age: 3000
Access-Control-Allow-Methods: GET, HEAD
Content-Type: application/x-mpegURL
Via: 1.1 1c12254585d1d316d9380549d59e3c80.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: FRA56-C2
X-Amz-Cf-Id: ZiOfuaZ82iDCoHj7wqO7IHwEMOgPJYu_b_PRa0lYcolGRa0YgiYLJg==

GET
H/1.1 200
OK arstechnica_steve-from-gamers-nexus-reacts-to-their-top-1000-comments-on-youtube.jpg
dwgyu36up6iuz.cloudfront.net/heru80fdn/image/upload/c_fill,d_placeholder_arstechnica.png,fl_progressive,g_face,h_450,q_80,w_800/v1611089409/ Frame DA1B 74 KB
75 KB 182ms
64ms Image
image/jpeg 65.9.67.76
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

Requested by

Host: d2c8v52ll5s99u.cloudfront.net
URL: https://d2c8v52ll5s99u.cloudfront.net/player/main-cddebf909f5183fb417b.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

65.9.67.76 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Cloudinary /

Resource Hash

451c12f71b589bb0f76d663003c2090670e94f3f104baf6a4377c150d82964ae

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800
X-Content-Type-Options	nosniff

Request headers

Origin: https://arstechnica.com
Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Strict-Transport-Security: max-age=604800
Via: 1.1 43c19aee1cbb38bf37ea4d5265ba1f54.cloudfront.net (CloudFront)
X-Content-Type-Options: nosniff
Age: 165
X-Cache: Hit from cloudfront
Date: Tue, 02 Mar 2021 16:26:22 GMT
Server-Timing: fastly;dur=1;cpu=0;start=2021-02-15T03:42:28.013Z;desc=hit,rtt;dur=4
Content-Length: 75851
Last-Modified: Thu, 21 Jan 2021 16:08:22 GMT
Server: Cloudinary
Cache-Control: public, no-transform, max-age=300
ETag: "ed7d9270e128461711c5e9572de84a6a"
Content-Type: image/jpeg
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Content-Length,ETag,Server-Timing,X-Content-Type-Options
Connection: keep-alive
X-Amz-Cf-Pop: FRA56-C1
Accept-Ranges: bytes
Timing-Allow-Origin: *
X-Amz-Cf-Id: wPeFg8d3z6xSA18UAUvd7LN3caiw6OsjkmNeMlyZZ3dUCJIPd0I2EA==

GET
H/1.1 200
OK arstechnica_steve-from-gamers-nexus-reacts-to-their-top-1000-comments-on-youtube.jpg
dwgyu36up6iuz.cloudfront.net/heru80fdn/image/upload/c_fill,d_placeholder_arstechnica.png,fl_progressive,g_face,h_450,q_80,w_800/v1611089409/ Frame DA1B 74 KB
75 KB 64ms
63ms Image
image/jpeg 65.9.67.76
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

Requested by

Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

65.9.67.76 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Cloudinary /

Resource Hash

451c12f71b589bb0f76d663003c2090670e94f3f104baf6a4377c150d82964ae

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800
X-Content-Type-Options	nosniff

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Strict-Transport-Security: max-age=604800
Via: 1.1 106758604a7f1ae0fa6678cd3d828d62.cloudfront.net (CloudFront)
X-Content-Type-Options: nosniff
Age: 165
X-Cache: Hit from cloudfront
Date: Tue, 02 Mar 2021 16:26:22 GMT
Server-Timing: fastly;dur=1;cpu=0;start=2021-02-15T03:42:28.013Z;desc=hit,rtt;dur=4
Content-Length: 75851
Last-Modified: Thu, 21 Jan 2021 16:08:22 GMT
Server: Cloudinary
Cache-Control: public, no-transform, max-age=300
ETag: "ed7d9270e128461711c5e9572de84a6a"
Content-Type: image/jpeg
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Content-Length,ETag,Server-Timing,X-Content-Type-Options
Connection: keep-alive
X-Amz-Cf-Pop: FRA56-C1
Accept-Ranges: bytes
Timing-Allow-Origin: *
X-Amz-Cf-Id: ujBmolq15y9WTOTDMRzlppIA0fY9Kd05nVXTHrULwLWsX2UN7Nb10Q==

POST
H3-Q050 200 collect
www.google-analytics.com/ 35 B
81 B 13ms
13ms Other
image/gif 2a00:1450:4001:80f::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/collect

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Tue, 02 Mar 2021 16:27:49 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: https://arstechnica.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 moatvideo.js Show response
z.moatads.com/condenastjsvideocontent160527792519/ Frame DA1B 303 KB
102 KB 60ms
60ms Script
application/x-javascript 23.202.53.245
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://z.moatads.com/condenastjsvideocontent160527792519/moatvideo.js
Requested by: Host: d2c8v52ll5s99u.cloudfront.net
URL: https://d2c8v52ll5s99u.cloudfront.net/player/main-cddebf909f5183fb417b.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.202.53.245 Vienna, Austria, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-202-53-245.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: d2af09dd1f0e5ea8911299520de4e42718847787e7666f7240efde750093c8e6

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 02 Mar 2021 16:27:49 GMT
content-encoding: gzip
last-modified: Wed, 24 Feb 2021 22:24:56 GMT
server: AmazonS3
x-amz-request-id: 7B57815F5D76D82D
etag: "35ffb0198b1a294fb8fdebc134a1f173"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: max-age=55158
accept-ranges: bytes
content-length: 103920
x-amz-id-2: TQMqsW+w3tDRDfRFYxcbSIXT6gPf4k0I0b7Y2MAGKOZnTFGhtSF7P+RJTz5nRIw4+E/P3iOqMNg=

GET
H/1.1 200
OK track
capture.condenastdigital.com/ Frame DA1B 48 B
48 B 148ms
148ms Image
image/gif 3.223.14.133
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://capture.condenastdigital.com/track?_o=cne&_ts=2021-03-02T16%3A27%3A49.455Z&_c=Video%20Ad&_t=Ad%20Call%20Made&app=playerservice&cBr=arstechnica&cCh=videos%2Fshow&cCu=https%3A%2F%2Fwww.arstechnica.com%2Fvideo%2Fwatch%2Fpersonal-history-steve-from-gamers-nexus-reacts-to-their-top-1000-comments-on-youtube&cId=600745e738d069677538c4b8&cKe=personal%20history%2Cars%20personal%20history%2Cars%20technica%20personal%20history%2Cgamers%20nexus%2Csteve%20gamers%20nexus%2Cstevegn%2Cgamersnexus%2Csteve%20burke%20gamersnexus%2Cstephen%20burke%2Csteve%20burke&cPd=2021-01-21T16%3A00%3A00%2B00%3A00&cTi=Steve%20Burke%20of%20GamersNexus%20Reacts%20To%20Their%20Top%201000%20Comments%20On%20YouTube&cTy=%2F3379%2Fconde.ars%2Fplayer%2Finformation-technology%2Farticle&mDu=1512&pHr=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2021%2F02%2Fnew-malware-found-on-30000-macs-has-security-pros-stumped%2F&pWw=540&pWh=303.75&xid=6b1b5527-c373-4631-bd6d-45f1577d915a&dim1=%7B%22contentStartType%22%3A%22manual%22%2C%22doNotTrackSetting%22%3Anull%2C%22environment%22%3A%22oo%22%2C%22gitBranch%22%3A%22master%22%2C%22gitSha%22%3A%2251ae250%22%2C%22guid%22%3A%22d78af99-fc57-53e0-fa41-ad6e2247f4e%22%2C%22isMobile%22%3Afalse%2C%22isVerso%22%3Afalse%2C%22initialPlayerStartType%22%3A%22manual%22%2C%22persistent%22%3Afalse%2C%22playerDepth%22%3A4649.09375%2C%22playerType%22%3A%22video-continuous%22%2C%22playsOnPage%22%3A0%2C%22prerollPlayed%22%3Afalse%2C%22recAlgorithm%22%3Anull%2C%22recStrategy%22%3Anull%2C%22isRightRail%22%3Afalse%2C%22tabStatus%22%3A%22active%22%2C%22videoViews%22%3A1%2C%22viewportStatus%22%3A%22OUT_OF_VIEWPORT%22%7D&dim2=%7B%22adBlocked%22%3Afalse%2C%22adId%22%3A%22%22%2C%22adType%22%3A%22%22%2C%22creativeId%22%3A%22%22%2C%22wrapperAdIds%22%3A%22%22%2C%22wrapperAdSystems%22%3A%22%22%2C%22dfpLineItem%22%3A%22%22%2C%22publicaEnabled%22%3Afalse%2C%22podIndex%22%3A%22%22%7D&videoViews=1&adId=
Requested by: Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.223.14.133 , United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-223-14-133.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Access-Control-Allow-Origin: *
Date: Tue, 02 Mar 2021 16:27:49 GMT
Connection: keep-alive
Content-Length: 48
Content-Type: image/gif

POST
H3-Q050 200 collect
www.google-analytics.com/ 35 B
58 B 14ms
14ms Other
image/gif 2a00:1450:4001:80f::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/collect

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Tue, 02 Mar 2021 16:27:49 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: https://arstechnica.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 moatvideo.js Show response
z.moatads.com/condenastjsvideocontent160527792519/ Frame 0372 303 KB
102 KB 67ms
67ms Script
application/x-javascript 23.202.53.245
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://z.moatads.com/condenastjsvideocontent160527792519/moatvideo.js
Requested by: Host: d2c8v52ll5s99u.cloudfront.net
URL: https://d2c8v52ll5s99u.cloudfront.net/player/main-cddebf909f5183fb417b.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.202.53.245 Vienna, Austria, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-202-53-245.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: d2af09dd1f0e5ea8911299520de4e42718847787e7666f7240efde750093c8e6

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 02 Mar 2021 16:27:49 GMT
content-encoding: gzip
last-modified: Wed, 24 Feb 2021 22:24:56 GMT
server: AmazonS3
x-amz-request-id: 7B57815F5D76D82D
etag: "35ffb0198b1a294fb8fdebc134a1f173"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: max-age=55158
accept-ranges: bytes
content-length: 103920
x-amz-id-2: TQMqsW+w3tDRDfRFYxcbSIXT6gPf4k0I0b7Y2MAGKOZnTFGhtSF7P+RJTz5nRIw4+E/P3iOqMNg=

GET
H/1.1 200
OK track
capture.condenastdigital.com/ Frame 0372 48 B
48 B 135ms
134ms Image
image/gif 3.223.14.133
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://capture.condenastdigital.com/track?_o=cne&_ts=2021-03-02T16%3A27%3A49.481Z&_c=Video%20Ad&_t=Ad%20Call%20Made&app=playerservice&cBr=arstechnica&cCh=videos%2Fshow&cCu=https%3A%2F%2Fwww.arstechnica.com%2Fvideo%2Fwatch%2Fhow-the-internet-could-change-under-trump&cId=5952801dfd2e616da6000006&cKe=internet%2Cinternet%20privacy%2Cnet%20neutrality%2Cobama%2Cobama%20administration%2Cprivacy%2Ctrump&cPd=2017-06-28T10%3A00%3A00%2B00%3A00&cTi=How%20the%20Internet%20could%20change%20under%20Trump&cTy=%2F3379%2Fconde.ars%2Finline-player%2Finformation-technology%2Farticle&mDu=86&pHr=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2021%2F02%2Fnew-malware-found-on-30000-macs-has-security-pros-stumped%2F&pID=4e78db71-a622-4623-8f8c-129b7f97ef02&pWw=276&pWh=155.25&sID=eeca8fd2-2ede-4309-b7f8-017d7fcdf896&uId=0ba4f8f3-3dcb-4625-8858-f8cc027e953a&xid=50b8ab59-83f4-4626-9718-6b8bf7dc3673&dim1=%7B%22contentStartType%22%3A%22autoplay%22%2C%22doNotTrackSetting%22%3Anull%2C%22environment%22%3A%22oo%22%2C%22gitBranch%22%3A%22master%22%2C%22gitSha%22%3A%2251ae250%22%2C%22guid%22%3A%22fa0034af-4523-c7d2-6bc7-6f82408a5d7f%22%2C%22isMobile%22%3Afalse%2C%22isVerso%22%3Afalse%2C%22initialPlayerStartType%22%3A%22autoplay%22%2C%22persistent%22%3Afalse%2C%22playerDepth%22%3A481%2C%22playerType%22%3A%22interlude%22%2C%22playsOnPage%22%3A0%2C%22prerollPlayed%22%3Afalse%2C%22recAlgorithm%22%3A%22recommendations_cne-interlude-arstechnica_4f617df1-eac3-4775-9554-b0e3db036855_similar2-3%22%2C%22recStrategy%22%3A%22similar2_3%22%2C%22isRightRail%22%3Afalse%2C%22tabStatus%22%3A%22active%22%2C%22videoViews%22%3A1%2C%22viewportStatus%22%3A%22FULLY_IN_VIEWPORT%22%7D&dim2=%7B%22adBlocked%22%3Afalse%2C%22adId%22%3A%22%22%2C%22adType%22%3A%22%22%2C%22creativeId%22%3A%22%22%2C%22wrapperAdIds%22%3A%22%22%2C%22wrapperAdSystems%22%3A%22%22%2C%22dfpLineItem%22%3A%22%22%2C%22publicaEnabled%22%3Afalse%2C%22podIndex%22%3A%22%22%7D&videoViews=1&adId=
Requested by: Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.223.14.133 , United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-223-14-133.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Access-Control-Allow-Origin: *
Date: Tue, 02 Mar 2021 16:27:49 GMT
Connection: keep-alive
Content-Length: 48
Content-Type: image/gif

GET
H2 200 pixel.gif
px.moatads.com/ 43 B
260 B 69ms
68ms Image
image/gif 23.202.53.245
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=17&i=CONDEVIDEOCONTENT1&hp=1&wf=1&vz=-&zp=0&vb=8&kq=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&bq=8&f=0&j=&t=1614702469584&de=102899765677&m=0&ar=b6cd16e-clean&iw=fab7aad&q=3&cb=0&ym=0&cu=1614702469584&ll=2&lm=0&ln=1&r=0&em=0&en=0&d=Steve%20Burke%20of%20GamersNexus%20Reacts%20To%20Their%20Top%201000%20Comments%20On%20YouTube%3A%2F3379%2Fconde.ars%2Fplayer%2Finformation-technology%2Farticle%3Aundefined%3Aundefined&zMoatVideoId=600745e738d069677538c4b8&zMoatAP=-&zGSRC=1&gu=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2021%2F02%2Fnew-malware-found-on-30000-macs-has-security-pros-stumped%2F&id=1&ii=4&zMoatDomain=arstechnica.com&zMoatSubdomain=arstechnica.com&gw=condenastjsvideocontent160527792519&fd=1&ac=1&it=500&ti=0&ih=1&pe=1%3A911%3A911%3A0%3A1201&fs=188403&na=997934761&cs=0
Requested by: Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.202.53.245 Vienna, Austria, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-202-53-245.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 02 Mar 2021 16:27:49 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: AkamaiNetStorage
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Tue, 02 Mar 2021 16:27:49 GMT

GET
H2 200 pixel.gif
px.moatads.com/ 43 B
260 B 61ms
60ms Image
image/gif 23.202.53.245
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=17&i=CONDEVIDEOCONTENT1&hp=1&wf=1&vz=-&zp=0&vb=8&kq=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&bq=8&f=0&j=&t=1614702469722&de=407007513103&m=0&ar=b6cd16e-clean&iw=fab7aad&q=6&cb=0&ym=0&cu=1614702469722&ll=2&lm=0&ln=1&r=0&em=0&en=0&d=How%20the%20Internet%20could%20change%20under%20Trump%3A%2F3379%2Fconde.ars%2Finline-player%2Finformation-technology%2Farticle%3Aundefined%3Aundefined&zMoatVideoId=5952801dfd2e616da6000006&zMoatAP=true&zGSRC=1&gu=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2021%2F02%2Fnew-malware-found-on-30000-macs-has-security-pros-stumped%2F&id=1&ii=4&zMoatDomain=arstechnica.com&zMoatSubdomain=arstechnica.com&gw=condenastjsvideocontent160527792519&fd=1&ac=1&it=500&ti=0&ih=1&pe=1%3A911%3A911%3A0%3A1201&fs=188403&na=354119641&cs=0
Requested by: Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.202.53.245 Vienna, Austria, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-202-53-245.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 02 Mar 2021 16:27:49 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: AkamaiNetStorage
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Tue, 02 Mar 2021 16:27:49 GMT

GET
H3-Q050 200 ads Show response
pagead2.googlesyndication.com/gampad/ Frame 7584 0
531 B 46ms
32ms XHR
text/html 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/gampad/ads?sz=640x480%7C480x70&iu=%2F3379%2Fconde.ars%2Fplayer%2Finformation-technology%2Farticle&ciu_szs=300x60&gdfp_req=1&env=vp&output=xml_vmap1&unviewed_position_start=1&cust_params=m_data%3D1%26m_safety%3Dsafe%26m_categories%3Dmoat_safe%26m_mv%3DnoHistData%26m_gv%3DnoHistData%26env_device_type%3Ddesktop%26ctx_template%3Darticle%26content_type%3Darticle%26ctx_page_channel%3Dinformation-technology%26env_server%3Dproduction%26ctx_cns_version%3D6.43.6%26ctx_page_slug%3Dnew-malware-found-on-30000-macs-has-security-pros-stumped%26cnt_tags%3Dm1%252Cmacos%252Cmacs%252Cmalware%26cnt_copilotid%3D%26vnd_prx_segments%3D120000%252C121100%252C131100%252C131123%252C230004%252C300003%252C210001%252C240000%252C240002%252C240003%252C240001%252C240005%252C240006%252C240007%252C240008%252C240009%252C240011%252C240012%252C240013%252C240014%252C240017%252C240015%252C240016%252C240018%252C240019%252Ceuwba9%252Cv8lc56%26vnd_4d_cached%3D0%26vnd_4d_ctx_sg%3D%26vnd_4d_ctx_topics%3D%26vnd_4d_ctx_entities%3D%26vnd_4d_ctx_keywords%3D%26vnd_4d_sid%3Deeca8fd2-2ede-4309-b7f8-017d7fcdf896%26vnd_4d_pid%3D4e78db71-a622-4623-8f8c-129b7f97ef02%26vnd_4d_usr_topics%3D%26ctx_line_items%3D%26height%3D304%26muted%3D0%26right_rail%3D0%26sensitive%3D0%26series%3D6007503ecc196a7a65d35ac1%26width%3D540&correlator=581689097331748&description_url=https%3A%2F%2Fwww.arstechnica.com%2Fvideo%2Fwatch%2Fpersonal-history-steve-from-gamers-nexus-reacts-to-their-top-1000-comments-on-youtube&vid=600745e738d069677538c4b8&cmsid=1495&ppid=6b1b5527c3734631bd6d45f1577d915a&sdkv=h.3.444.1&osd=2&frm=0&vis=1&sdr=1&hl=en&is_amp=0&u_so=l&ctv=0&gdpr=1&gdpr_consent=tcunavailable&sdki=44d&adk=3408565466&sdk_apis=2%2C8&sid=3928D9A2-EA91-4A0A-B191-4625460325D6&eid=44736270&url=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2021%2F02%2Fnew-malware-found-on-30000-macs-has-security-pros-stumped%2F&dlt=1614702467116&idt=1797&dt=1614702469949&scor=1679220902440784&ged=ve4_td3_tt2_pd3_la3000_er4953.350.5106.650_vi0.0.1200.1600_vp0_eb16619

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/core/bridge3.444.1_en.html

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://imasdk.googleapis.com/js/core/bridge3.444.1_en.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 02 Mar 2021 16:27:49 GMT
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-creative-id: -2
content-type: text/html; charset=UTF-8
access-control-allow-origin: https://imasdk.googleapis.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 ads Show response
pagead2.googlesyndication.com/gampad/ Frame F22F 0
27 B 30ms
28ms XHR
text/html 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/gampad/ads?slotname=%2F3379%2Fconde.ars%2Finline-player%2Finformation-technology%2Farticle&sz=640x360%7C480x70&ciu_szs=300x60&cust_params=m_data%3D1%26m_safety%3Dsafe%26m_categories%3Dmoat_safe%26m_mv%3DnoHistData%26m_gv%3DnoHistData%26env_device_type%3Ddesktop%26ctx_template%3Darticle%26content_type%3Darticle%26ctx_page_channel%3Dinformation-technology%26env_server%3Dproduction%26ctx_cns_version%3D6.43.6%26ctx_page_slug%3Dnew-malware-found-on-30000-macs-has-security-pros-stumped%26cnt_tags%3Dm1%252Cmacos%252Cmacs%252Cmalware%26cnt_copilotid%3D%26vnd_prx_segments%3D120000%252C121100%252C131100%252C131123%252C230004%252C300003%252C210001%252C240000%252C240002%252C240003%252C240001%252C240005%252C240006%252C240007%252C240008%252C240009%252C240011%252C240012%252C240013%252C240014%252C240017%252C240015%252C240016%252C240018%252C240019%252Ceuwba9%252Cv8lc56%26vnd_4d_cached%3D0%26vnd_4d_ctx_sg%3D%26vnd_4d_ctx_topics%3D%26vnd_4d_ctx_entities%3D%26vnd_4d_ctx_keywords%3D%26vnd_4d_sid%3Deeca8fd2-2ede-4309-b7f8-017d7fcdf896%26vnd_4d_pid%3D4e78db71-a622-4623-8f8c-129b7f97ef02%26vnd_4d_usr_topics%3D%26ctx_line_items%3D%26skipTimeout%3Dfalse%26height%3D155%26muted%3D1%26right_rail%3D0%26sensitive%3D0%26width%3D276&url=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2021%2F02%2Fnew-malware-found-on-30000-macs-has-security-pros-stumped%2F&unviewed_position_start=1&output=xml_vast4&env=vp&gdfp_req=1&ad_rule=0&video_url_to_fetch=https%3A%2F%2Fwww.arstechnica.com%2Fvideo%2Fwatch%2Fhow-the-internet-could-change-under-trump&vad_type=linear&vpos=preroll&pod=1&pmnd=0&pmxd=30000&pmad=2&vrid=1187211&ppid=50b8ab5983f4462697186b8bf7dc3673&correlator=2057237745580587&cmsid=1495&video_doc_id=5952801dfd2e616da6000006&kfa=0&tfcd=0&sdkv=h.3.444.1&osd=2&frm=0&vis=1&sdr=1&hl=en&is_amp=0&u_so=l&ctv=0&gdpr=1&gdpr_consent=tcunavailable&sdki=44d&adk=3211474126&sdk_apis=2%2C8&sid=F028C906-EC6D-48A4-A444-6D54BF15E211&eid=44712632&dlt=1614702466973&idt=1557&dt=1614702469968&scor=4275625961327483&ged=ve4_td3_tt2_pd3_la3000_er636.1082.789.1382_vi0.0.1200.1600_vp0_eb16619

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/core/bridge3.444.1_en.html

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://imasdk.googleapis.com/js/core/bridge3.444.1_en.html
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 02 Mar 2021 16:27:49 GMT
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-creative-id: -2
content-type: text/html; charset=UTF-8
access-control-allow-origin: https://imasdk.googleapis.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK track
capture.condenastdigital.com/ Frame DA1B 48 B
48 B 140ms
139ms Image
image/gif 3.223.14.133
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://capture.condenastdigital.com/track?_o=cne&_ts=2021-03-02T16%3A27%3A50.017Z&_c=Video%20Ad&_t=DFP%20Ad%20Error%20adLoadError%2C%20UNKNOWN_AD_RESPONSE%2C%20The%20ad%20response%20was%20not%20understood%20and%20cannot%20be%20parsed.%2C%20null&app=playerservice&cBr=arstechnica&cCh=videos%2Fshow&cCu=https%3A%2F%2Fwww.arstechnica.com%2Fvideo%2Fwatch%2Fpersonal-history-steve-from-gamers-nexus-reacts-to-their-top-1000-comments-on-youtube&cId=600745e738d069677538c4b8&cKe=personal%20history%2Cars%20personal%20history%2Cars%20technica%20personal%20history%2Cgamers%20nexus%2Csteve%20gamers%20nexus%2Cstevegn%2Cgamersnexus%2Csteve%20burke%20gamersnexus%2Cstephen%20burke%2Csteve%20burke&cPd=2021-01-21T16%3A00%3A00%2B00%3A00&cTi=Steve%20Burke%20of%20GamersNexus%20Reacts%20To%20Their%20Top%201000%20Comments%20On%20YouTube&cTy=%2F3379%2Fconde.ars%2Fplayer%2Finformation-technology%2Farticle&mDu=1512&pHr=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2021%2F02%2Fnew-malware-found-on-30000-macs-has-security-pros-stumped%2F&pWw=540&pWh=303.75&xid=6b1b5527-c373-4631-bd6d-45f1577d915a&dim1=%7B%22contentStartType%22%3A%22manual%22%2C%22doNotTrackSetting%22%3Anull%2C%22environment%22%3A%22oo%22%2C%22gitBranch%22%3A%22master%22%2C%22gitSha%22%3A%2251ae250%22%2C%22guid%22%3A%22d78af99-fc57-53e0-fa41-ad6e2247f4e%22%2C%22isMobile%22%3Afalse%2C%22isVerso%22%3Afalse%2C%22initialPlayerStartType%22%3A%22manual%22%2C%22persistent%22%3Afalse%2C%22playerDepth%22%3A4649.09375%2C%22playerType%22%3A%22video-continuous%22%2C%22playsOnPage%22%3A0%2C%22prerollPlayed%22%3Afalse%2C%22recAlgorithm%22%3Anull%2C%22recStrategy%22%3Anull%2C%22isRightRail%22%3Afalse%2C%22tabStatus%22%3A%22active%22%2C%22videoViews%22%3A1%2C%22viewportStatus%22%3A%22OUT_OF_VIEWPORT%22%7D&dim2=%7B%22adBlocked%22%3Afalse%2C%22adId%22%3A%22%22%2C%22adType%22%3A%22%22%2C%22creativeId%22%3A%22%22%2C%22wrapperAdIds%22%3A%22%22%2C%22wrapperAdSystems%22%3A%22%22%2C%22dfpLineItem%22%3A%22%22%2C%22publicaEnabled%22%3Afalse%2C%22podIndex%22%3A%22%22%7D&videoViews=1&adId=
Requested by: Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.223.14.133 , United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-223-14-133.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Access-Control-Allow-Origin: *
Date: Tue, 02 Mar 2021 16:27:50 GMT
Connection: keep-alive
Content-Length: 48
Content-Type: image/gif

GET
H/1.1 200
OK track
capture.condenastdigital.com/ Frame 0372 48 B
48 B 142ms
140ms Image
image/gif 3.223.14.133
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://capture.condenastdigital.com/track?_o=cne&_ts=2021-03-02T16%3A27%3A50.023Z&_c=Video%20Ad&_t=DFP%20Ad%20Error%20adLoadError%2C%20UNKNOWN_AD_RESPONSE%2C%20The%20ad%20response%20was%20not%20understood%20and%20cannot%20be%20parsed.%2C%20null&app=playerservice&cBr=arstechnica&cCh=videos%2Fshow&cCu=https%3A%2F%2Fwww.arstechnica.com%2Fvideo%2Fwatch%2Fhow-the-internet-could-change-under-trump&cId=5952801dfd2e616da6000006&cKe=internet%2Cinternet%20privacy%2Cnet%20neutrality%2Cobama%2Cobama%20administration%2Cprivacy%2Ctrump&cPd=2017-06-28T10%3A00%3A00%2B00%3A00&cTi=How%20the%20Internet%20could%20change%20under%20Trump&cTy=%2F3379%2Fconde.ars%2Finline-player%2Finformation-technology%2Farticle&mDu=86&pHr=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2021%2F02%2Fnew-malware-found-on-30000-macs-has-security-pros-stumped%2F&pID=4e78db71-a622-4623-8f8c-129b7f97ef02&pWw=276&pWh=155.25&sID=eeca8fd2-2ede-4309-b7f8-017d7fcdf896&uId=0ba4f8f3-3dcb-4625-8858-f8cc027e953a&xid=50b8ab59-83f4-4626-9718-6b8bf7dc3673&dim1=%7B%22contentStartType%22%3A%22autoplay%22%2C%22doNotTrackSetting%22%3Anull%2C%22environment%22%3A%22oo%22%2C%22gitBranch%22%3A%22master%22%2C%22gitSha%22%3A%2251ae250%22%2C%22guid%22%3A%22fa0034af-4523-c7d2-6bc7-6f82408a5d7f%22%2C%22isMobile%22%3Afalse%2C%22isVerso%22%3Afalse%2C%22initialPlayerStartType%22%3A%22autoplay%22%2C%22persistent%22%3Afalse%2C%22playerDepth%22%3A481%2C%22playerType%22%3A%22interlude%22%2C%22playsOnPage%22%3A0%2C%22prerollPlayed%22%3Afalse%2C%22recAlgorithm%22%3A%22recommendations_cne-interlude-arstechnica_4f617df1-eac3-4775-9554-b0e3db036855_similar2-3%22%2C%22recStrategy%22%3A%22similar2_3%22%2C%22isRightRail%22%3Afalse%2C%22tabStatus%22%3A%22active%22%2C%22videoViews%22%3A1%2C%22viewportStatus%22%3A%22FULLY_IN_VIEWPORT%22%7D&dim2=%7B%22adBlocked%22%3Afalse%2C%22adId%22%3A%22%22%2C%22adType%22%3A%22%22%2C%22creativeId%22%3A%22%22%2C%22wrapperAdIds%22%3A%22%22%2C%22wrapperAdSystems%22%3A%22%22%2C%22dfpLineItem%22%3A%22%22%2C%22publicaEnabled%22%3Afalse%2C%22podIndex%22%3A%22%22%7D&videoViews=1&adId=
Requested by: Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.223.14.133 , United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-223-14-133.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Access-Control-Allow-Origin: *
Date: Tue, 02 Mar 2021 16:27:50 GMT
Connection: keep-alive
Content-Length: 48
Content-Type: image/gif

POST
H3-Q050 200 collect
www.google-analytics.com/ 35 B
81 B 13ms
12ms Other
image/gif 2a00:1450:4001:80f::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/collect

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Tue, 02 Mar 2021 16:27:50 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: https://arstechnica.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK c1057a6f-76fc-470d-9cbc-87c086864674cc.vtt Show response
dp8hsntg6do36.cloudfront.net/5952801dfd2e616da6000006/ Frame 0372 88 B
675 B 162ms
161ms XHR
text/vtt 13.32.24.6
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://dp8hsntg6do36.cloudfront.net/5952801dfd2e616da6000006/c1057a6f-76fc-470d-9cbc-87c086864674cc.vtt
Requested by: Host: d2c8v52ll5s99u.cloudfront.net
URL: https://d2c8v52ll5s99u.cloudfront.net/player/main-cddebf909f5183fb417b.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.24.6 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-24-6.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 8b3b177ff5d680541fb0dfe91141757ae86d3dfb4ecb3508cf601a02261fb8ba

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Tue, 02 Mar 2021 16:27:51 GMT
Via: 1.1 1c12254585d1d316d9380549d59e3c80.cloudfront.net (CloudFront)
Vary: Origin
X-Amz-Cf-Pop: FRA56-C2
X-Cache: RefreshHit from cloudfront
Connection: keep-alive
Content-Length: 88
Last-Modified: Tue, 27 Jun 2017 16:16:25 GMT
Server: AmazonS3
ETag: "b40724dba2f1869fce874c05153d7759"
Access-Control-Max-Age: 3000
Access-Control-Allow-Methods: GET, HEAD
Content-Type: text/vtt; charset=utf-8
Access-Control-Allow-Origin: *
Accept-Ranges: bytes
X-Amz-Cf-Id: CwqirIgvRPGPtKkpA4-p_ROwiuhQ2h5leJTucmF1rFutUr7809pOAQ==

GET
H2 200 /
www.facebook.com/tr/ Frame 0372 44 B
259 B 16ms
5ms Image
image/gif 2a03:2880:f11c:8183:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=1663130473914833&ev=Start&dl=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2021%2F02%2Fnew-malware-found-on-30000-macs-has-security-pros-stumped%2F&rl=&if=true&ts=1614702470038&cd[brand]=arstechnica&cd[url]=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2021%2F02%2Fnew-malware-found-on-30000-macs-has-security-pros-stumped%2F&cd[category]=Video%20View&sw=1600&sh=1200&v=2.9.33&r=stable&ec=0&o=30&fbp=fb.1.1614702470034.96881803&it=1614702468009&coo=false&rqm=GET

Requested by

Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f11c:8183:face:b00c:0:25de , United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 02 Mar 2021 16:27:50 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
cache-control: no-cache, must-revalidate, max-age=0
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 44
expires: Tue, 02 Mar 2021 16:27:50 GMT

GET
H2 200 pixel.gif
px.moatads.com/ 43 B
260 B 81ms
71ms Image
image/gif 23.202.53.245
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=0&q=0&hp=1&wf=1&vz=-&zp=0&vb=8&kq=1&lo=0&uk=null&pk=1&wk=1&rk=1&tk=1&ak=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2021%2F02%2Fnew-malware-found-on-30000-macs-has-security-pros-stumped%2F&i=CONDEVIDEOCONTENT1&ud=undefined&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRGt%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%5Elv%3Ch%2CeI8!A2QnbjPSI.%24ki)sV~1HmDkx2KD5pf5%5BG%5BZFZ8R6tbK0pH%23bU%24(9N%2CNJJ)%2CW%2FKo7FY&th=3645823656&tf=Id8O-DxRgoC-xFQTS-CSa7H-XSSptC-j7VIQD-xFQTS-nMzjG-&vi=111111&qp=00000&is=BBBBB2BBEYBvGl2BBCBBtUTBBRmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7OxBb8MxOtJYHCBdm5kBhBBC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBSqj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNBBBBBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbBBC4ehueB57NG9aJeRzBqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=null&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-60&qa=1600&qb=1200&qi=1600&qj=1200&to=00&po=1-0020002000002120&vy=&qr=0&url=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2021%2F02%2Fnew-malware-found-on-30000-macs-has-security-pros-stumped%2F&confidence=2&pcode=condenastprebidheader987326845656&ql=&qo=0&bq=8&g=0&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=155&w=276&fy=0&gp=0&zGSRC=1&gu=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2021%2F02%2Fnew-malware-found-on-30000-macs-has-security-pros-stumped%2F&id=1&ii=4&f=0&j=&t=1614702469722&de=407007513103&cu=1614702469722&m=381&ar=b6cd16e-clean&iw=fab7aad&cb=0&ym=0&ll=2&lm=0&ln=1&r=0&dl=0&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=6149&le=1&gm=1&io=1&ch=0&vv=1&vw=1%3A3%3A0&vp=100&vx=100%3A-%3A-&pe=1%3A911%3A911%3A0%3A1201&as=0&ag=73&an=0&gf=73&gg=0&ez=1&aj=1&pg=100&pf=0&ib=0&cc=0&bw=73&bx=0&dj=1&aa=0&ad=0&cn=0&gk=0&gl=0&hj=0&pv=0&em=0&en=0&st=1&su=1&of=1&oz=1&oe=1%3A1%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=357&cd=0&ah=357&am=0&dq=146&dr=0&ds=146&dt=0&zx=0&tb=0&vm=0&vl=0&vt=0&vd=0&zMoatSRE=0&zMoatVSD=0&hc=0&er=0&es=0&gs=0&gt=0&eu=0&ev=0&et=1&dz=1&eb=1&rf=0&re=0&cl=0&at=0&d=How%20the%20Internet%20could%20change%20under%20Trump%3A%2F3379%2Fconde.ars%2Finline-player%2Finformation-technology%2Farticle%3Aundefined%3Aundefined&gw=condenastjsvideocontent160527792519&zMoatDomain=arstechnica.com&zMoatSubdomain=arstechnica.com&zMoatVideoId=5952801dfd2e616da6000006&zMoatAP=true&ab=3&ac=1&fd=1&kt=strict&it=500&fz=1&or=0&oq=1&ot=ff&zMoatJS=3%3A-&ti=0&ih=1&tc=0&fs=188403&na=1997741114&cs=0
Requested by: Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.202.53.245 Vienna, Austria, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-202-53-245.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 02 Mar 2021 16:27:50 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: AkamaiNetStorage
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Tue, 02 Mar 2021 16:27:50 GMT

GET
H/1.1 200
OK track
capture.condenastdigital.com/ Frame 0372 48 B
48 B 148ms
139ms Image
image/gif 3.223.14.133
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://capture.condenastdigital.com/track?_o=cne&_ts=2021-03-02T16%3A27%3A50.111Z&_c=Video%20View&_t=Content%20Start&app=playerservice&cBr=arstechnica&cCh=videos%2Fshow&cCu=https%3A%2F%2Fwww.arstechnica.com%2Fvideo%2Fwatch%2Fhow-the-internet-could-change-under-trump&cId=5952801dfd2e616da6000006&cKe=internet%2Cinternet%20privacy%2Cnet%20neutrality%2Cobama%2Cobama%20administration%2Cprivacy%2Ctrump&cPd=2017-06-28T10%3A00%3A00%2B00%3A00&cTi=How%20the%20Internet%20could%20change%20under%20Trump&cTy=%2F3379%2Fconde.ars%2Finline-player%2Finformation-technology%2Farticle&mDu=86&pHr=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2021%2F02%2Fnew-malware-found-on-30000-macs-has-security-pros-stumped%2F&pID=4e78db71-a622-4623-8f8c-129b7f97ef02&pWw=276&pWh=155.25&sID=eeca8fd2-2ede-4309-b7f8-017d7fcdf896&uId=0ba4f8f3-3dcb-4625-8858-f8cc027e953a&xid=50b8ab59-83f4-4626-9718-6b8bf7dc3673&dim1=%7B%22contentStartType%22%3A%22autoplay%22%2C%22doNotTrackSetting%22%3Anull%2C%22environment%22%3A%22oo%22%2C%22gitBranch%22%3A%22master%22%2C%22gitSha%22%3A%2251ae250%22%2C%22guid%22%3A%22fa0034af-4523-c7d2-6bc7-6f82408a5d7f%22%2C%22isMobile%22%3Afalse%2C%22isVerso%22%3Afalse%2C%22initialPlayerStartType%22%3A%22autoplay%22%2C%22persistent%22%3Afalse%2C%22playerDepth%22%3A481%2C%22playerType%22%3A%22interlude%22%2C%22playsOnPage%22%3A0%2C%22prerollPlayed%22%3Afalse%2C%22recAlgorithm%22%3A%22recommendations_cne-interlude-arstechnica_4f617df1-eac3-4775-9554-b0e3db036855_similar2-3%22%2C%22recStrategy%22%3A%22similar2_3%22%2C%22isRightRail%22%3Afalse%2C%22tabStatus%22%3A%22active%22%2C%22videoViews%22%3A1%2C%22viewportStatus%22%3A%22FULLY_IN_VIEWPORT%22%7D&dim2=%7B%22adBlocked%22%3Afalse%2C%22adId%22%3A%22%22%2C%22adType%22%3A%22%22%2C%22creativeId%22%3A%22%22%2C%22wrapperAdIds%22%3A%22%22%2C%22wrapperAdSystems%22%3A%22%22%2C%22dfpLineItem%22%3A%22%22%2C%22publicaEnabled%22%3Afalse%2C%22podIndex%22%3A%22%22%7D&videoViews=1&adId=
Requested by: Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.223.14.133 , United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-223-14-133.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Access-Control-Allow-Origin: *
Date: Tue, 02 Mar 2021 16:27:50 GMT
Connection: keep-alive
Content-Length: 48
Content-Type: image/gif

GET
H/1.1 200
OK track
capture.condenastdigital.com/ Frame 0372 48 B
48 B 169ms
136ms Image
image/gif 3.223.14.133
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://capture.condenastdigital.com/track?_o=cne&_ts=2021-03-02T16%3A27%3A50.113Z&_c=Video%20View&_t=Any%20Start&app=playerservice&cBr=arstechnica&cCh=videos%2Fshow&cCu=https%3A%2F%2Fwww.arstechnica.com%2Fvideo%2Fwatch%2Fhow-the-internet-could-change-under-trump&cId=5952801dfd2e616da6000006&cKe=internet%2Cinternet%20privacy%2Cnet%20neutrality%2Cobama%2Cobama%20administration%2Cprivacy%2Ctrump&cPd=2017-06-28T10%3A00%3A00%2B00%3A00&cTi=How%20the%20Internet%20could%20change%20under%20Trump&cTy=%2F3379%2Fconde.ars%2Finline-player%2Finformation-technology%2Farticle&mDu=86&pHr=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2021%2F02%2Fnew-malware-found-on-30000-macs-has-security-pros-stumped%2F&pID=4e78db71-a622-4623-8f8c-129b7f97ef02&pWw=276&pWh=155.25&sID=eeca8fd2-2ede-4309-b7f8-017d7fcdf896&uId=0ba4f8f3-3dcb-4625-8858-f8cc027e953a&xid=50b8ab59-83f4-4626-9718-6b8bf7dc3673&dim1=%7B%22contentStartType%22%3A%22autoplay%22%2C%22doNotTrackSetting%22%3Anull%2C%22environment%22%3A%22oo%22%2C%22gitBranch%22%3A%22master%22%2C%22gitSha%22%3A%2251ae250%22%2C%22guid%22%3A%22fa0034af-4523-c7d2-6bc7-6f82408a5d7f%22%2C%22isMobile%22%3Afalse%2C%22isVerso%22%3Afalse%2C%22initialPlayerStartType%22%3A%22autoplay%22%2C%22persistent%22%3Afalse%2C%22playerDepth%22%3A481%2C%22playerType%22%3A%22interlude%22%2C%22playsOnPage%22%3A0%2C%22prerollPlayed%22%3Afalse%2C%22recAlgorithm%22%3A%22recommendations_cne-interlude-arstechnica_4f617df1-eac3-4775-9554-b0e3db036855_similar2-3%22%2C%22recStrategy%22%3A%22similar2_3%22%2C%22isRightRail%22%3Afalse%2C%22tabStatus%22%3A%22active%22%2C%22videoViews%22%3A1%2C%22viewportStatus%22%3A%22FULLY_IN_VIEWPORT%22%7D&dim2=%7B%22adBlocked%22%3Afalse%2C%22adId%22%3A%22%22%2C%22adType%22%3A%22%22%2C%22creativeId%22%3A%22%22%2C%22wrapperAdIds%22%3A%22%22%2C%22wrapperAdSystems%22%3A%22%22%2C%22dfpLineItem%22%3A%22%22%2C%22publicaEnabled%22%3Afalse%2C%22podIndex%22%3A%22%22%7D&videoViews=1&adId=
Requested by: Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.223.14.133 , United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-223-14-133.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Access-Control-Allow-Origin: *
Date: Tue, 02 Mar 2021 16:27:50 GMT
Connection: keep-alive
Content-Length: 48
Content-Type: image/gif

GET
H/1.1 200
OK c1057a6f-76fc-470d-9cbc-87c086864674file-1422k-128-48000-768-00002.ts Show response
dp8hsntg6do36.cloudfront.net/5952801dfd2e616da6000006/ Frame 0372 649 KB
639 KB 71ms
67ms XHR
application/x-mpegurl 13.32.24.6
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://dp8hsntg6do36.cloudfront.net/5952801dfd2e616da6000006/c1057a6f-76fc-470d-9cbc-87c086864674file-1422k-128-48000-768-00002.ts?requester=oo
Requested by: Host: d2c8v52ll5s99u.cloudfront.net
URL: https://d2c8v52ll5s99u.cloudfront.net/player/main-cddebf909f5183fb417b.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.24.6 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-24-6.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: d77f13ec3935533f066143f9de66f3a6d2ef5166cea8f4cc275430ca175739d1

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Tue, 02 Mar 2021 05:06:29 GMT
Content-Encoding: gzip
Vary: Origin
Age: 40882
Transfer-Encoding: chunked
X-Cache: Hit from cloudfront
Connection: keep-alive
Access-Control-Allow-Origin: *
Last-Modified: Tue, 27 Jun 2017 15:57:28 GMT
Server: AmazonS3
ETag: W/"00e2970bcba243ad99ee8488aeed6d6a"
Access-Control-Max-Age: 3000
Access-Control-Allow-Methods: GET, HEAD
Content-Type: application/x-mpegURL
Via: 1.1 fd3cce3e0bafd8b312277d0ad9f4762f.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: FRA56-C2
X-Amz-Cf-Id: qi-PJB33qjKANF-WAUQ7RPpXMF9WQeC-ItyqCdZ8LnI-F6Heb0aJLw==

GET
H2 451 envelope Show response
api.rlcdn.com/api/identity/ 0
46 B 65ms
64ms XHR
text/plain 34.120.207.148
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://api.rlcdn.com/api/identity/envelope?pid=1409
Requested by: Host: cdn.arstechnica.net
URL: https://cdn.arstechnica.net/cns/prebid.min.js?v=1614702432
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.120.207.148 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 148.207.120.34.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

date: Tue, 02 Mar 2021 16:27:50 GMT
via: 1.1 google
alt-svc: clear
access-control-allow-methods: GET, OPTIONS
access-control-allow-origin: https://arstechnica.com
access-control-allow-credentials: true
access-control-allow-headers: Accept, Authorization, Content-Type, Cookie, Origin, X-Requested-With
content-length: 0

GET
H2 200 rid Show response
match.adsrvr.org/track/ 0
406 B 69ms
69ms XHR
application/javascript 99.80.71.186
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://match.adsrvr.org/track/rid?ttd_pid=3egfyfq&fmt=json
Requested by: Host: cdn.arstechnica.net
URL: https://cdn.arstechnica.net/cns/prebid.min.js?v=1614702432
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 99.80.71.186 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-99-80-71-186.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

date: Tue, 02 Mar 2021 16:27:50 GMT
x-aspnet-version: 4.0.30319
vary: Origin
content-type: application/javascript
access-control-allow-origin: https://arstechnica.com
cache-control: private
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Content-Length, Content-Encoding, Vary, Cache-Control, Accept
content-length: 0
expires: Wed, 02 Mar 2022 16:27:50 GMT

GET
H2 200 checksync.php Show response
contextual.media.net/ Frame 760A 22 KB
8 KB 81ms
75ms Document
text/html 104.85.4.23
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://contextual.media.net/checksync.php?vsSync=1&cs=8&cv=31&https=1&cid=8CU65UN7R&prvid=2033%2C171%2C251%2C273%2C175%2C132%2C178%2C3018%2C159%2C214%2C3015%2C97%2C77%2C99%2C56%2C182%2C184%2C261%2C188%2C222%2C201%2C246%2C4%2C126%2C203%2C225%2C226%2C10000%2C80%2C229%2C9&gdprconsent=0&purpose1=1&usp_status=0&usp_consent=1&itype=PREBID

Requested by

Host: cdn.arstechnica.net
URL: https://cdn.arstechnica.net/cns/prebid.min.js?v=1614702432

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.85.4.23 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-85-4-23.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

cf4b6263061854368fa177690445fcccfefa9dc7349e4981343109586c0a5e0d

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

:method: GET
:authority: contextual.media.net
:scheme: https
:path: /checksync.php?vsSync=1&cs=8&cv=31&https=1&cid=8CU65UN7R&prvid=2033%2C171%2C251%2C273%2C175%2C132%2C178%2C3018%2C159%2C214%2C3015%2C97%2C77%2C99%2C56%2C182%2C184%2C261%2C188%2C222%2C201%2C246%2C4%2C126%2C203%2C225%2C226%2C10000%2C80%2C229%2C9&gdprconsent=0&purpose1=1&usp_status=0&usp_consent=1&itype=PREBID
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/

Response headers

server: Apache
content-type: text/html; charset=UTF-8
set-cookie: gdpr_status=1; Expires=Fri, 03 Sep 2021 16:27:50 GMT; domain=.media.net; Path=/; sameSite=none; secure=true
x-mnet-hl2: E
strict-transport-security: max-age=604800
vary: Accept-Encoding
content-encoding: gzip
cache-control: max-age=172800
expires: Thu, 04 Mar 2021 16:27:50 GMT
date: Tue, 02 Mar 2021 16:27:50 GMT
content-length: 7971

GET
H2 200 checksync.php Show response
contextual.media.net/ Frame ADF9 22 KB
8 KB 76ms
72ms Document
text/html 104.85.4.23
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: cdn.arstechnica.net
URL: https://cdn.arstechnica.net/cns/prebid.min.js?v=1614702432

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.85.4.23 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-85-4-23.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

cf4b6263061854368fa177690445fcccfefa9dc7349e4981343109586c0a5e0d

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

:method: GET
:authority: contextual.media.net
:scheme: https
:path: /checksync.php?vsSync=1&cs=8&cv=31&https=1&cid=8CU65UN7R&prvid=2033%2C171%2C251%2C273%2C175%2C132%2C178%2C3018%2C159%2C214%2C3015%2C97%2C77%2C99%2C56%2C182%2C184%2C261%2C188%2C222%2C201%2C246%2C4%2C126%2C203%2C225%2C226%2C10000%2C80%2C229%2C9&gdprconsent=0&purpose1=1&usp_status=0&usp_consent=1&itype=PREBID
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/

Response headers

server: Apache
content-type: text/html; charset=UTF-8
set-cookie: gdpr_status=1; Expires=Fri, 03 Sep 2021 16:27:50 GMT; domain=.media.net; Path=/; sameSite=none; secure=true
x-mnet-hl2: E
strict-transport-security: max-age=604800
vary: Accept-Encoding
content-encoding: gzip
cache-control: max-age=172800
expires: Thu, 04 Mar 2021 16:27:50 GMT
date: Tue, 02 Mar 2021 16:27:50 GMT
content-length: 7971

GET
H/1.1 200
OK async_usersync.html Show response
acdn.adnxs.com/dmp/ Frame FEA8 52 KB
17 KB 166ms
47ms Document
text/html 151.101.13.108
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://acdn.adnxs.com/dmp/async_usersync.html
Requested by: Host: cdn.arstechnica.net
URL: https://cdn.arstechnica.net/cns/prebid.min.js?v=1614702432
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.13.108 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx/1.13.10 /
Resource Hash: 3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd

Request headers

Host: acdn.adnxs.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/

Response headers

Connection: keep-alive
Content-Length: 17053
Server: nginx/1.13.10
Content-Type: text/html
Last-Modified: Wed, 02 Dec 2020 20:56:47 GMT
ETag: W/"5fc7ff8f-cf34"
Expires: Wed, 24 Feb 2021 05:50:24 GMT
Cache-Control: max-age=86402
Access-Control-Allow-Origin: *
Content-Encoding: gzip
Via: 1.1 varnish, 1.1 varnish
Accept-Ranges: bytes
Date: Tue, 02 Mar 2021 16:27:50 GMT
Age: 38233
X-Served-By: cache-lga21946-LGA, cache-fra19154-FRA
X-Cache: HIT, HIT
X-Cache-Hits: 4, 301837
X-Timer: S1614702470.311477,VS0,VE0
Vary: Accept-Encoding

GET
H2

200

pd Show response
eu-u.openx.net/w/1.0/ Frame 9887
Redirect Chain

https://eu-u.openx.net/w/1.0/pd?plm=6&ph=92a42b2b-081a-4be8-96bc-8a959e4a3060&gdpr=1&us_privacy=1---
https://eu-u.openx.net/w/1.0/pd?cc=1&plm=6&ph=92a42b2b-081a-4be8-96bc-8a959e4a3060&gdpr=1&us_privacy=1---

668 B
729 B

59ms
59ms

Document
text/html

34.98.64.218
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://eu-u.openx.net/w/1.0/pd?cc=1&plm=6&ph=92a42b2b-081a-4be8-96bc-8a959e4a3060&gdpr=1&us_privacy=1---
Requested by: Host: cdn.arstechnica.net
URL: https://cdn.arstechnica.net/cns/prebid.min.js?v=1614702432
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/16.202.0 /
Resource Hash: 114337975e73acb5a340f406cd8b20163496ed66e1a543f2d0719f4c4e06586a

Request headers

:method: GET
:authority: eu-u.openx.net
:scheme: https
:path: /w/1.0/pd?cc=1&plm=6&ph=92a42b2b-081a-4be8-96bc-8a959e4a3060&gdpr=1&us_privacy=1---
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: i=e90f3d11-01ff-0954-076c-18510b226b22|1614702470
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/

Response headers

vary: Accept, Accept-Encoding
set-cookie: i=e90f3d11-01ff-0954-076c-18510b226b22|1614702470; Version=1; Expires=Wed, 02-Mar-2022 16:27:50 GMT; Max-Age=31536000; Secure; Domain=.openx.net; Path=/; SameSite=None pd=v2|1614702470|gekin0vNiygu; Version=1; Expires=Wed, 17-Mar-2021 16:27:50 GMT; Max-Age=1296000; Secure; Domain=.openx.net; Path=/; SameSite=None
server: OXGW/16.202.0
p3p: CP="CUR ADM OUR NOR STA NID"
date: Tue, 02 Mar 2021 16:27:50 GMT
content-type: text/html
content-length: 419
content-encoding: gzip
via: 1.1 google
alt-svc: clear

Redirect headers

set-cookie: i=e90f3d11-01ff-0954-076c-18510b226b22|1614702470; Version=1; Expires=Wed, 02-Mar-2022 16:27:50 GMT; Max-Age=31536000; Secure; Domain=.openx.net; Path=/; SameSite=None
server: OXGW/16.202.0
p3p: CP="CUR ADM OUR NOR STA NID"
location: https://eu-u.openx.net/w/1.0/pd?cc=1&plm=6&ph=92a42b2b-081a-4be8-96bc-8a959e4a3060&gdpr=1&us_privacy=1---
date: Tue, 02 Mar 2021 16:27:50 GMT
content-length: 0
via: 1.1 google
alt-svc: clear

GET
H/1.1 200
OK ixmatch.html Show response
js-sec.indexww.com/um/ Frame 047D 2 KB
1 KB 59ms
57ms Document
text/html 23.202.53.51
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://js-sec.indexww.com/um/ixmatch.html
Requested by: Host: cdn.arstechnica.net
URL: https://cdn.arstechnica.net/cns/prebid.min.js?v=1614702432
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.202.53.51 Vienna, Austria, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-202-53-51.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 7eca7977c6ade416c20775a7fd7cfa2291c5752cd1225d5c4342b057c37a000c

Request headers

Host: js-sec.indexww.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/

Response headers

Server: Apache
Last-Modified: Thu, 11 Feb 2021 16:12:45 GMT
ETag: "e20015-90b-5bb11ca420f07"
Accept-Ranges: bytes
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: text/html; charset=UTF-8
Vary: Accept-Encoding
Content-Encoding: gzip
Date: Tue, 02 Mar 2021 16:27:50 GMT
Content-Length: 1151
Connection: keep-alive

GET
H/1.1 200
OK async_usersync.html Show response
acdn.adnxs.com/dmp/ Frame 0144 52 KB
17 KB 156ms
48ms Document
text/html 151.101.13.108
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://acdn.adnxs.com/dmp/async_usersync.html
Requested by: Host: cdn.arstechnica.net
URL: https://cdn.arstechnica.net/cns/prebid.min.js?v=1614702432
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.13.108 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx/1.13.10 /
Resource Hash: 3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd

Request headers

Host: acdn.adnxs.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/

Response headers

Connection: keep-alive
Content-Length: 17053
Server: nginx/1.13.10
Content-Type: text/html
Last-Modified: Wed, 02 Dec 2020 20:56:47 GMT
ETag: W/"5fc7ff8f-cf34"
Expires: Wed, 24 Feb 2021 05:50:24 GMT
Cache-Control: max-age=86402
Access-Control-Allow-Origin: *
Content-Encoding: gzip
Via: 1.1 varnish, 1.1 varnish
Accept-Ranges: bytes
Date: Tue, 02 Mar 2021 16:27:50 GMT
Age: 38233
X-Served-By: cache-lga21946-LGA, cache-fra19163-FRA
X-Cache: HIT, HIT
X-Cache-Hits: 4, 291886
X-Timer: S1614702470.312147,VS0,VE0
Vary: Accept-Encoding

GET
H/1.1 200
OK ixmatch.html Show response
js-sec.indexww.com/um/ Frame FA6E 2 KB
1 KB 122ms
60ms Document
text/html 23.202.53.51
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://js-sec.indexww.com/um/ixmatch.html
Requested by: Host: cdn.arstechnica.net
URL: https://cdn.arstechnica.net/cns/prebid.min.js?v=1614702432
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.202.53.51 Vienna, Austria, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-202-53-51.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 7eca7977c6ade416c20775a7fd7cfa2291c5752cd1225d5c4342b057c37a000c

Request headers

Host: js-sec.indexww.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/

Response headers

Server: Apache
Last-Modified: Thu, 11 Feb 2021 16:12:45 GMT
ETag: "e20015-90b-5bb11ca420f07"
Accept-Ranges: bytes
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: text/html; charset=UTF-8
Vary: Accept-Encoding
Content-Encoding: gzip
Date: Tue, 02 Mar 2021 16:27:50 GMT
Content-Length: 1151
Connection: keep-alive

GET
H/1.1 200
OK async_usersync.html Show response
acdn.adnxs.com/dmp/ Frame 3875 52 KB
17 KB 152ms
49ms Document
text/html 151.101.13.108
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://acdn.adnxs.com/dmp/async_usersync.html
Requested by: Host: cdn.arstechnica.net
URL: https://cdn.arstechnica.net/cns/prebid.min.js?v=1614702432
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.13.108 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx/1.13.10 /
Resource Hash: 3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd

Request headers

Host: acdn.adnxs.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/

Response headers

Connection: keep-alive
Content-Length: 17053
Server: nginx/1.13.10
Content-Type: text/html
Last-Modified: Wed, 02 Dec 2020 20:56:47 GMT
ETag: W/"5fc7ff8f-cf34"
Expires: Wed, 24 Feb 2021 05:50:24 GMT
Cache-Control: max-age=86402
Access-Control-Allow-Origin: *
Content-Encoding: gzip
Via: 1.1 varnish, 1.1 varnish
Accept-Ranges: bytes
Date: Tue, 02 Mar 2021 16:27:50 GMT
Age: 38233
X-Served-By: cache-lga21946-LGA, cache-fra19135-FRA
X-Cache: HIT, HIT
X-Cache-Hits: 4, 291763
X-Timer: S1614702470.318665,VS0,VE0
Vary: Accept-Encoding

GET
H2 200 checksync.php Show response
contextual.media.net/ Frame 9EF2 22 KB
8 KB 85ms
62ms Document
text/html 104.85.4.23
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: cdn.arstechnica.net
URL: https://cdn.arstechnica.net/cns/prebid.min.js?v=1614702432

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.85.4.23 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-85-4-23.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

cf4b6263061854368fa177690445fcccfefa9dc7349e4981343109586c0a5e0d

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

:method: GET
:authority: contextual.media.net
:scheme: https
:path: /checksync.php?vsSync=1&cs=8&cv=31&https=1&cid=8CU65UN7R&prvid=2033%2C171%2C251%2C273%2C175%2C132%2C178%2C3018%2C159%2C214%2C3015%2C97%2C77%2C99%2C56%2C182%2C184%2C261%2C188%2C222%2C201%2C246%2C4%2C126%2C203%2C225%2C226%2C10000%2C80%2C229%2C9&gdprconsent=0&purpose1=1&usp_status=0&usp_consent=1&itype=PREBID
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/

Response headers

server: Apache
content-type: text/html; charset=UTF-8
set-cookie: gdpr_status=1; Expires=Fri, 03 Sep 2021 16:27:50 GMT; domain=.media.net; Path=/; sameSite=none; secure=true
x-mnet-hl2: E
strict-transport-security: max-age=604800
vary: Accept-Encoding
content-encoding: gzip
cache-control: max-age=172800
expires: Thu, 04 Mar 2021 16:27:50 GMT
date: Tue, 02 Mar 2021 16:27:50 GMT
content-length: 7971

GET
H2

200

pd Show response
eu-u.openx.net/w/1.0/ Frame 7B43
Redirect Chain

https://eu-u.openx.net/w/1.0/pd?plm=6&ph=92a42b2b-081a-4be8-96bc-8a959e4a3060&gdpr=1&us_privacy=1---
https://eu-u.openx.net/w/1.0/pd?cc=1&plm=6&ph=92a42b2b-081a-4be8-96bc-8a959e4a3060&gdpr=1&us_privacy=1---

668 B
719 B

58ms
57ms

Document
text/html

34.98.64.218
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://eu-u.openx.net/w/1.0/pd?cc=1&plm=6&ph=92a42b2b-081a-4be8-96bc-8a959e4a3060&gdpr=1&us_privacy=1---
Requested by: Host: cdn.arstechnica.net
URL: https://cdn.arstechnica.net/cns/prebid.min.js?v=1614702432
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/16.202.0 /
Resource Hash: 2f72c08bf85b4f043471e7d56c29dc5d084b6744ff5345a57582ec24eb1de919

Request headers

:method: GET
:authority: eu-u.openx.net
:scheme: https
:path: /w/1.0/pd?cc=1&plm=6&ph=92a42b2b-081a-4be8-96bc-8a959e4a3060&gdpr=1&us_privacy=1---
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: i=f146c466-5bfa-0a8f-3135-28e1d889fb97|1614702470
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/

Response headers

vary: Accept, Accept-Encoding
set-cookie: i=f146c466-5bfa-0a8f-3135-28e1d889fb97|1614702470; Version=1; Expires=Wed, 02-Mar-2022 16:27:50 GMT; Max-Age=31536000; Secure; Domain=.openx.net; Path=/; SameSite=None pd=v2|1614702470|gekin0vNiygu; Version=1; Expires=Wed, 17-Mar-2021 16:27:50 GMT; Max-Age=1296000; Secure; Domain=.openx.net; Path=/; SameSite=None
server: OXGW/16.202.0
p3p: CP="CUR ADM OUR NOR STA NID"
date: Tue, 02 Mar 2021 16:27:50 GMT
content-type: text/html
content-length: 416
content-encoding: gzip
via: 1.1 google
alt-svc: clear

Redirect headers

set-cookie: i=f146c466-5bfa-0a8f-3135-28e1d889fb97|1614702470; Version=1; Expires=Wed, 02-Mar-2022 16:27:50 GMT; Max-Age=31536000; Secure; Domain=.openx.net; Path=/; SameSite=None
server: OXGW/16.202.0
p3p: CP="CUR ADM OUR NOR STA NID"
location: https://eu-u.openx.net/w/1.0/pd?cc=1&plm=6&ph=92a42b2b-081a-4be8-96bc-8a959e4a3060&gdpr=1&us_privacy=1---
date: Tue, 02 Mar 2021 16:27:50 GMT
content-length: 0
via: 1.1 google
alt-svc: clear

GET
H/1.1 200
OK ixmatch.html Show response
js-sec.indexww.com/um/ Frame CF46 2 KB
1 KB 156ms
59ms Document
text/html 23.202.53.51
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://js-sec.indexww.com/um/ixmatch.html
Requested by: Host: cdn.arstechnica.net
URL: https://cdn.arstechnica.net/cns/prebid.min.js?v=1614702432
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.202.53.51 Vienna, Austria, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-202-53-51.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 7eca7977c6ade416c20775a7fd7cfa2291c5752cd1225d5c4342b057c37a000c

Request headers

Host: js-sec.indexww.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/

Response headers

Server: Apache
Last-Modified: Thu, 11 Feb 2021 16:12:45 GMT
ETag: "e20015-90b-5bb11ca420f07"
Accept-Ranges: bytes
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: text/html; charset=UTF-8
Vary: Accept-Encoding
Content-Encoding: gzip
Date: Tue, 02 Mar 2021 16:27:50 GMT
Content-Length: 1151
Connection: keep-alive

GET
H/1.1 200
OK usync.html Show response
eus.rubiconproject.com/ Frame 9E21 291 B
559 B 178ms
56ms Document
text/html 184.30.212.16
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?us_privacy=1---
Requested by: Host: cdn.arstechnica.net
URL: https://cdn.arstechnica.net/cns/prebid.min.js?v=1614702432
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 184.30.212.16 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a184-30-212-16.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 4ddc003bfd0366a9c5e059509b3bac51972a8e803904b2a90b6b5c5ee7b26720

Request headers

Host: eus.rubiconproject.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/

Response headers

Server: Apache/2.2.15 (CentOS)
Last-Modified: Mon, 28 Sep 2020 17:02:39 GMT
ETag: "4000c-123-5b062a240e9c0"
Accept-Ranges: bytes
Content-Encoding: gzip
Content-Length: 238
Content-Type: text/html; charset=UTF-8
Date: Tue, 02 Mar 2021 16:27:50 GMT
Connection: keep-alive
Vary: Accept-Encoding

GET
H2

200

pd Show response
eu-u.openx.net/w/1.0/ Frame 0371
Redirect Chain

https://eu-u.openx.net/w/1.0/pd?plm=6&ph=92a42b2b-081a-4be8-96bc-8a959e4a3060&gdpr=1&us_privacy=1---
https://eu-u.openx.net/w/1.0/pd?cc=1&plm=6&ph=92a42b2b-081a-4be8-96bc-8a959e4a3060&gdpr=1&us_privacy=1---

668 B
721 B

60ms
57ms

Document
text/html

34.98.64.218
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://eu-u.openx.net/w/1.0/pd?cc=1&plm=6&ph=92a42b2b-081a-4be8-96bc-8a959e4a3060&gdpr=1&us_privacy=1---
Requested by: Host: cdn.arstechnica.net
URL: https://cdn.arstechnica.net/cns/prebid.min.js?v=1614702432
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/16.202.0 /
Resource Hash: e8f2720b4935f9b2bb8805db58f1db4bb9e86cce89af21dd2a373c7a2603dec7

Request headers

:method: GET
:authority: eu-u.openx.net
:scheme: https
:path: /w/1.0/pd?cc=1&plm=6&ph=92a42b2b-081a-4be8-96bc-8a959e4a3060&gdpr=1&us_privacy=1---
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: i=59a9bc20-0fc0-0e55-1df2-2e9396c28886|1614702470
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/

Response headers

vary: Accept, Accept-Encoding
set-cookie: i=59a9bc20-0fc0-0e55-1df2-2e9396c28886|1614702470; Version=1; Expires=Wed, 02-Mar-2022 16:27:50 GMT; Max-Age=31536000; Secure; Domain=.openx.net; Path=/; SameSite=None pd=v2|1614702470|gekin0vNiygu; Version=1; Expires=Wed, 17-Mar-2021 16:27:50 GMT; Max-Age=1296000; Secure; Domain=.openx.net; Path=/; SameSite=None
server: OXGW/16.202.0
p3p: CP="CUR ADM OUR NOR STA NID"
date: Tue, 02 Mar 2021 16:27:50 GMT
content-type: text/html
content-length: 418
content-encoding: gzip
via: 1.1 google
alt-svc: clear

Redirect headers

set-cookie: i=59a9bc20-0fc0-0e55-1df2-2e9396c28886|1614702470; Version=1; Expires=Wed, 02-Mar-2022 16:27:50 GMT; Max-Age=31536000; Secure; Domain=.openx.net; Path=/; SameSite=None
server: OXGW/16.202.0
p3p: CP="CUR ADM OUR NOR STA NID"
location: https://eu-u.openx.net/w/1.0/pd?cc=1&plm=6&ph=92a42b2b-081a-4be8-96bc-8a959e4a3060&gdpr=1&us_privacy=1---
date: Tue, 02 Mar 2021 16:27:50 GMT
content-length: 0
via: 1.1 google
alt-svc: clear

GET
H2 200 pixel.gif
px.moatads.com/ 43 B
260 B 61ms
60ms Image
image/gif 23.202.53.245
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=29&q=0&hp=1&wf=1&vz=-&zp=0&vb=8&kq=1&lo=0&tr=1&uk=null&pk=1&wk=1&rk=1&tk=1&ak=-&i=CONDEVIDEOCONTENT1&ud=undefined&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRGt%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%5Elv%3Ch%2CeI8!A2QnbjPSI.%24ki)sV~1HmDkx2KD5pf5%5BG%5BZFZ8R6tbK0pH%23bU%24(9N%2CNJJ)%2CW%2FKo7FY&th=3645823656&tf=Id8O-DxRgoC-xFQTS-CSa7H-XSSptC-j7VIQD-xFQTS-nMzjG-&vi=111111&qp=00000&is=BBBBB2BBEYBvGl2BBCBBtUTBBRmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7OxBb8MxOtJYHCBdm5kBhBBC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBSqj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNBBBBBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbBBC4ehueB57NG9aJeRzBqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=null&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-60&qa=1600&qb=1200&qi=1600&qj=1200&to=00&po=1-0020002000002120&vy=&qr=0&url=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2021%2F02%2Fnew-malware-found-on-30000-macs-has-security-pros-stumped%2F&confidence=2&pcode=condenastprebidheader987326845656&ql=&qo=0&bq=8&g=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=155&w=276&fy=0&gp=0&zGSRC=1&gu=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2021%2F02%2Fnew-malware-found-on-30000-macs-has-security-pros-stumped%2F&id=1&ii=4&f=0&j=&t=1614702469722&de=407007513103&cu=1614702469722&m=385&ar=b6cd16e-clean&iw=fab7aad&cb=0&ym=0&ll=2&lm=0&ln=1&r=0&dl=0&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=6149&le=1&gm=1&io=1&ch=0&vv=1&vw=1%3A3%3A0&vp=100&vx=100%3A-%3A-&pe=1%3A911%3A911%3A0%3A1201&as=0&ag=73&an=73&gf=73&gg=73&ez=1&aj=1&pg=100&pf=100&ib=0&cc=0&bw=73&bx=73&dj=1&aa=0&ad=0&cn=0&gk=0&gl=0&hj=0&pv=0&em=0&en=0&st=1&su=1&of=1&oz=1&oe=1%3A1%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=357&cd=357&ah=357&am=357&dq=146&dr=146&ds=146&dt=146&zx=0&tb=0&vm=0&vl=0&vt=0&vd=0&zMoatSRE=0&zMoatVSD=0&hc=0&er=0&es=0&gs=0&gt=0&eu=0&ev=0&et=1&dz=1&eb=1&ef=1&rf=0&re=0&cl=0&at=0&d=How%20the%20Internet%20could%20change%20under%20Trump%3A%2F3379%2Fconde.ars%2Finline-player%2Finformation-technology%2Farticle%3Aundefined%3Aundefined&gw=condenastjsvideocontent160527792519&zMoatDomain=arstechnica.com&zMoatSubdomain=arstechnica.com&zMoatVideoId=5952801dfd2e616da6000006&zMoatAP=true&ab=3&ac=1&fd=1&kt=strict&it=500&fz=1&or=0&oq=1&ot=ff&zMoatJS=3%3A-&ti=0&ih=1&tc=0&fs=188403&na=1747714418&cs=0
Requested by: Host: arstechnica.com
URL: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.202.53.245 Vienna, Austria, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-202-53-245.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 02 Mar 2021 16:27:50 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: AkamaiNetStorage
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Tue, 02 Mar 2021 16:27:50 GMT

GET
H2 200 log
hblg.media.net/ Frame 760A 35 B
194 B 62ms
53ms Image
image/gif 104.85.4.23
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hblg.media.net/log?logid=kfk&evtid=chlog&reqId=125145447255957501614702470313&fs=2&pid=8PRL4E7N3&cid=8CU65UN7R&itype=PREBID&bs=2&bi=30000&ccs=8&svr=2021030114_94&gdpr=1&csex=0&usp_status=0&usc=1&lper=10&tr=572.5387447232846
Requested by: Host: contextual.media.net
URL: https://contextual.media.net/checksync.php?vsSync=1&cs=8&cv=31&https=1&cid=8CU65UN7R&prvid=2033%2C171%2C251%2C273%2C175%2C132%2C178%2C3018%2C159%2C214%2C3015%2C97%2C77%2C99%2C56%2C182%2C184%2C261%2C188%2C222%2C201%2C246%2C4%2C126%2C203%2C225%2C226%2C10000%2C80%2C229%2C9&gdprconsent=0&purpose1=1&usp_status=0&usp_consent=1&itype=PREBID
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 104.85.4.23 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-85-4-23.deploy.static.akamaitechnologies.com
Software: Jetty(9.4.35.v20201120) /
Resource Hash: 796c46ec10bc9105545f6f90d51593921b69956bd9087eb72bee83f40ad86f90

Request headers

Referer: https://contextual.media.net/checksync.php?vsSync=1&cs=8&cv=31&https=1&cid=8CU65UN7R&prvid=2033%2C171%2C251%2C273%2C175%2C132%2C178%2C3018%2C159%2C214%2C3015%2C97%2C77%2C99%2C56%2C182%2C184%2C261%2C188%2C222%2C201%2C246%2C4%2C126%2C203%2C225%2C226%2C10000%2C80%2C229%2C9&gdprconsent=0&purpose1=1&usp_status=0&usp_consent=1&itype=PREBID
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 02 Mar 2021 16:27:50 GMT
server: Jetty(9.4.35.v20201120)
content-type: image/gif
access-control-allow-origin: *
cache-control: max-age=0, no-cache, no-store
content-length: 35
expires: Tue, 02 Mar 2021 16:27:50 GMT

GET
H/1.1 200
OK usermatch Show response
ssum-sec.casalemedia.com/ Frame 951D 54 B
326 B 230ms
102ms Document
text/html 23.202.53.51
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ssum-sec.casalemedia.com/usermatch?gdpr=1&gdpr_consent=CPCcAsZPCcAsZAcABBENBPCgAAAAAAAAAChQAAAAAAJBAGIAAoAHAAeABcAD4ALQAfABJADEAH8ARQAkQBXADNAG0AOIAcgA5wB1AD_AIGAQcAkQBPwChgGEAOqAh8BHoCQgErAJtAWEAugBdQC7QF5AMQAYsAyEBkYDKAGhANGAaUA1MBtADbgG6AOCCQVgAEAALgAoACoAGQAOAAeABAACIAFQAMIAaABqADyAIYAiABMACfAFUAVgAsABcADeAHMAPQAhABDQCIAIkAR0AlgCXAE0AKUAW4AwwBkADLgGoAaoA2QB3gD2AHxAPsA_QCAQEXARgAjQBHACUgFBAKWAU8Aq4BcwC_AGKANYAbQA3ABvAD0AHyAQ2Ah0BF4CRAExAJlATYAnYBQ4CkQFigLQAWwAuQBd4C8wGBAMGAYSAw0Bh4DIgGSAMnAZcAzkBnwDSAGnQNYA1kMASAAWABcAJIAVQAxADSAGqAOIA2QB1AEhAKHAXQAvoBiwDIwGhAN0DQJgAVABWAC4AIYAZAAywBqADZAHYAPwAgABBQCMAFLAKeAVeAtAC0gGsAN4AdUA-QCGwEOgIqAReAkQBNgCdgFIgLkAYEAwkBh4DGAGTgM5AZ4Az4QASAAWABcAGoASQAqgBiAFcANUAcQBIgDcAG8ASEAocBdADFgGhAN0EQIAAVABWAC4AIYAZAAywBqADZAHYAPwAgABGAClgFPAKuAawA6oB8gENgIdAReAkQBNgCdgFIgLkAYEAwkBh4DJwGcgM-FQHgAKAAqACGAEwALgAjgBlgDUAHYAPwAjABHAClgFXgLQAtIBvAEggJiATYApsBbAC5AF5gMCAYeAyIBnIDPAGfANyFADQAxADVAG0AOIAcgA8ACCgHVAR6AvoBmgDQgGvDIDYAFAAVABDACYAFwARwAywBqADsgH2AfgBGACOAFLAKuAVsA3gCYgE2ALRAWwAvMBgQDDwGRAM5AZ4Az4YANABqAGIAaoA2gBxADkAHgAWIA2QB1QEegLyAaEOAsgACAARAA4ADwALgAfABaADkAH4AQQAugBkADQAH8ARQAkQBOgCzAF8AMsAZoA0gBqgDaAHEAOQAc4A6gB2ADuAIAAQMAgsBBwEIAIiASIAm0BPgE_AKWAVAAtoBeoDAAMCAYQA1gBrwDeAHHAOkAdUA8gB8gEIQIfAiABHoCQoErASuAmIBMoCbQFCgKQAUmApgBUwCqgFbAK5AV2AsoBaQC1AFxQLoAuoBfQDAgGIAMWAZCAygBl4DQoGigaMA0oBpoDUwGvANoAbYA24dBnAAXABQAFQAMgAcABAACIAFQALoAYABjADQANQAeAA-gCGAIgATAAnwBVAFYALAAXAAvgBiADMAG8AOYAegBCACGgEQARIAjoBLAEwAJoAUYApQBYgC3gGEAYYAyABlADRAGoANkAb4A7wB7QD7AP0Af8BFgEYAI5ASkBKgCggFPAKuAWKAtAC0gFzALqAXkAvwBigDaAG4gOmA6gB6AENgIdAREAioBF4CQQEiAJUATYAnYBQ4CmgFWALFAWgAtgBcAC5AF2gLvAXmAwYBhIDDQGHgMSAYwAx4BkgDJwGVAMsAZcAzkBnwDRIGkAaSA0sBpwDWAGxkAF4ACAAfgBBADQAH8ASIAtwBfADLAGqANoAcQA5ABzgDsAHgAQUAnwBSwCxAGAAMIAbIA3gB1QDtgIfAR6AkIBK4CYgE2gKFAUgApMBWwC6AF5AL6AYEAzQBoQDRQGlANTAbYA24hA9AAWABQADIAIgAVAAuABiAEMAJgAVQAuABfADEAGYAN4AegBHACxAGEAMoAagA3wB3wD7APwAf4BGACOAEpAKCAUMAp4BV4C0ALSAXMAvwBigDaAHUAPQAkEBIgCVAE2AKaAWKAtEBbAC4AFyALtAYeAxIBkQDJwGcgM8AZ8A0QBpIDSwHAEgEIAAgAHAAXABCADkAMgAkQBcgC-AGWANQAbQA7gCAAEJAJ8AVAA14BvADqgH2ARUAlYBNoCkwFlALSAX0AxEBiwDQgGlANyJQOQAEAALAAoABkADgAIoAYABiADwAIgATAAqgBcAC-AGIAMwAbQBCACGgEQARIAjgBRgClAFuAMIAZQA1QBsgDvAH4ARgAjgBTwCrwFoAWkAuoBigDcAHUAPkAh0BF4CRAE2ALFAWwAu0BeYDDwGRAMnAZYAzkBngDPgGkANYAcAUAhAACAAuAB8AEIALQAcgA_ACsAGQANoAcgBHACRAE6ALkAXwAywBqADXAG0AOIAc4A6gB3ADwAIAAQcAhIBFQCRAE2gJ8An4BSwCxAF1AMAAYQAxQBrwDeAHVAO2AeQA-QB_wEegJiATKAm0BSACmAFTAK7AWgAugBeQC-gGBAMWAaEA0QBpQDTYGpAamA14BwRSCWAAuACgAKgAZAA4ACAAEQAKoAYABjADQANQAeQBDAEQAJgATwApABVACwAFwAL4AYgAzABzAEIAIaARABEgCjAFKALEAW4AwgBlADRAGqANkAd8A-wD9AIsARgAjgBKQCggFDAKuAVsAuYBeQDaAG4APQAh0BF4CRAE2AJ2AUOApoBWwCxQFsALgAXIAu0BeYDDQGHgMYAZEAyQBk4DLgGcgM8AZ9A0gDSYGsAayA2MAA.YAAAAAAAAAAA&d=https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/&s=184674&cb=https%3A%2F%2Fjs-sec.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Requested by: Host: js-sec.indexww.com
URL: https://js-sec.indexww.com/um/ixmatch.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.202.53.51 Vienna, Austria, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-202-53-51.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 863b0e04b9e8af02d763cb98563ca8d9f80c6b99a3ec2eb6395db229bc3f8ba9

Request headers

Host: ssum-sec.casalemedia.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://js-sec.indexww.com/um/ixmatch.html
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://js-sec.indexww.com/um/ixmatch.html

Response headers

Server: Apache
Content-Type: text/html
Vary: Is-Traffic-Usersync
Content-Length: 54
Expires: Tue, 02 Mar 2021 16:27:50 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Tue, 02 Mar 2021 16:27:50 GMT
Connection: keep-alive

GET
H2 200 log
hblg.media.net/ Frame 9EF2 35 B
194 B 56ms
55ms Image
image/gif 104.85.4.23
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hblg.media.net/log?logid=kfk&evtid=chlog&reqId=380892686850845661614702470576&fs=2&pid=8PRL4E7N3&cid=8CU65UN7R&itype=PREBID&bs=2&bi=30000&ccs=8&svr=2021030114_94&gdpr=1&csex=0&usp_status=0&usc=1&lper=10&tr=671.2725513497173
Requested by: Host: contextual.media.net
URL: https://contextual.media.net/checksync.php?vsSync=1&cs=8&cv=31&https=1&cid=8CU65UN7R&prvid=2033%2C171%2C251%2C273%2C175%2C132%2C178%2C3018%2C159%2C214%2C3015%2C97%2C77%2C99%2C56%2C182%2C184%2C261%2C188%2C222%2C201%2C246%2C4%2C126%2C203%2C225%2C226%2C10000%2C80%2C229%2C9&gdprconsent=0&purpose1=1&usp_status=0&usp_consent=1&itype=PREBID
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 104.85.4.23 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-85-4-23.deploy.static.akamaitechnologies.com
Software: Jetty(9.4.35.v20201120) /
Resource Hash: 796c46ec10bc9105545f6f90d51593921b69956bd9087eb72bee83f40ad86f90

Request headers

Referer: https://contextual.media.net/checksync.php?vsSync=1&cs=8&cv=31&https=1&cid=8CU65UN7R&prvid=2033%2C171%2C251%2C273%2C175%2C132%2C178%2C3018%2C159%2C214%2C3015%2C97%2C77%2C99%2C56%2C182%2C184%2C261%2C188%2C222%2C201%2C246%2C4%2C126%2C203%2C225%2C226%2C10000%2C80%2C229%2C9&gdprconsent=0&purpose1=1&usp_status=0&usp_consent=1&itype=PREBID
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 02 Mar 2021 16:27:50 GMT
server: Jetty(9.4.35.v20201120)
content-type: image/gif
access-control-allow-origin: *
cache-control: max-age=0, no-cache, no-store
content-length: 35
expires: Tue, 02 Mar 2021 16:27:50 GMT

GET
H2

200

sd
eu-u.openx.net/w/1.0/ Frame 9887
Redirect Chain

https://sync.mathtag.com/sync/img?mt_exid=5&redir=https%3A%2F%2Feu-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D536872786%26val%3D%5BMM_UUID%5D
https://eu-u.openx.net/w/1.0/sd?id=536872786&val=7746603e-6786-4e00-8003-7c775eea7ed0

43 B
106 B

59ms
57ms

Image
image/gif

34.98.64.218
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://eu-u.openx.net/w/1.0/sd?id=536872786&val=7746603e-6786-4e00-8003-7c775eea7ed0
Requested by: Host: eu-u.openx.net
URL: https://eu-u.openx.net/w/1.0/pd?cc=1&plm=6&ph=92a42b2b-081a-4be8-96bc-8a959e4a3060&gdpr=1&us_privacy=1---
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/16.202.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Referer: https://eu-u.openx.net/w/1.0/pd?cc=1&plm=6&ph=92a42b2b-081a-4be8-96bc-8a959e4a3060&gdpr=1&us_privacy=1---
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 02 Mar 2021 16:27:50 GMT
via: 1.1 google
server: OXGW/16.202.0
vary: Accept
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
content-type: image/gif
alt-svc: clear
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

Date: Tue, 02 Mar 2021 16:28:38 GMT
Server: MT3 3518 2f03077 master cdg-pixel-x29
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location: https://eu-u.openx.net/w/1.0/sd?id=536872786&val=7746603e-6786-4e00-8003-7c775eea7ed0
Cache-Control: no-cache
Connection: keep-alive
Content-Type: image/gif
Keep-Alive: timeout=360
Content-Length: 0
Expires: Tue, 02 Mar 2021 16:28:37 GMT

GET
H2

200

sd
us-u.openx.net/w/1.0/ Frame 9887
Redirect Chain

https://pixel.quantserve.com/pixel/p-25CIknq_eSg16.gif?idmatch=0&gdpr=1
https://us-u.openx.net/w/1.0/sd?id=537072956&gdpr=1&val=a7seR2u8FRRwskwWPLgAFD67SRpwuhpAPO66lUKU

43 B
106 B

74ms
62ms

Image
image/gif

34.98.64.218
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072956&gdpr=1&val=a7seR2u8FRRwskwWPLgAFD67SRpwuhpAPO66lUKU
Requested by: Host: eu-u.openx.net
URL: https://eu-u.openx.net/w/1.0/pd?cc=1&plm=6&ph=92a42b2b-081a-4be8-96bc-8a959e4a3060&gdpr=1&us_privacy=1---
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/16.202.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Referer: https://eu-u.openx.net/w/1.0/pd?cc=1&plm=6&ph=92a42b2b-081a-4be8-96bc-8a959e4a3060&gdpr=1&us_privacy=1---
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 02 Mar 2021 16:27:50 GMT
via: 1.1 google
server: OXGW/16.202.0
vary: Accept
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
content-type: image/gif
alt-svc: clear
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 02 Mar 2021 16:27:50 GMT
strict-transport-security: max-age=86400
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
location: https://us-u.openx.net/w/1.0/sd?id=537072956&gdpr=1&val=a7seR2u8FRRwskwWPLgAFD67SRpwuhpAPO66lUKU
cache-control: private, no-cache, no-store, proxy-revalidate
content-length: 0
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H2

200

sd
eu-u.openx.net/w/1.0/ Frame 9887
Redirect Chain

https://c1.adform.net/serving/cookie/match?party=22
https://c1.adform.net/serving/cookie/match?CC=1&party=22
https://eu-u.openx.net/w/1.0/sd?id=537113484&val=2163857443821876275

43 B
106 B

57ms
57ms

Image
image/gif

34.98.64.218
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://eu-u.openx.net/w/1.0/sd?id=537113484&val=2163857443821876275
Requested by: Host: eu-u.openx.net
URL: https://eu-u.openx.net/w/1.0/pd?cc=1&plm=6&ph=92a42b2b-081a-4be8-96bc-8a959e4a3060&gdpr=1&us_privacy=1---
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/16.202.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Referer: https://eu-u.openx.net/w/1.0/pd?cc=1&plm=6&ph=92a42b2b-081a-4be8-96bc-8a959e4a3060&gdpr=1&us_privacy=1---
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 02 Mar 2021 16:27:50 GMT
via: 1.1 google
server: OXGW/16.202.0
vary: Accept
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
content-type: image/gif
alt-svc: clear
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 02 Mar 2021 16:27:50 GMT
server: nginx
location: https://eu-u.openx.net/w/1.0/sd?id=537113484&val=2163857443821876275
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
content-length: 0
expires: -1

GET
H2 200 openx
match.adsrvr.org/track/cmf/ Frame 9887 70 B
264 B 74ms
72ms Image
image/gif 99.80.71.186
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.adsrvr.org/track/cmf/openx?oxid=3aa30248-a878-36a3-5dba-d0b96f0558df&gdpr=1
Requested by: Host: eu-u.openx.net
URL: https://eu-u.openx.net/w/1.0/pd?cc=1&plm=6&ph=92a42b2b-081a-4be8-96bc-8a959e4a3060&gdpr=1&us_privacy=1---
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 99.80.71.186 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-99-80-71-186.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

Referer: https://eu-u.openx.net/w/1.0/pd?cc=1&plm=6&ph=92a42b2b-081a-4be8-96bc-8a959e4a3060&gdpr=1&us_privacy=1---
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 02 Mar 2021 16:27:50 GMT
cache-control: private,no-cache, must-revalidate
x-aspnet-version: 4.0.30319
content-type: image/gif
content-length: 70
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"

GET
H3-Q050

200

pixel
cm.g.doubleclick.net/ Frame 9887
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=MTZjY2QxODItNjEwZi02ODA3LTQ4NWEtOGEwMGE1ZTc5NmJm
https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=MTZjY2QxODItNjEwZi02ODA3LTQ4NWEtOGEwMGE1ZTc5NmJm&google_tc=

170 B
190 B

83ms
66ms

Image
image/png

142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=MTZjY2QxODItNjEwZi02ODA3LTQ4NWEtOGEwMGE1ZTc5NmJm&google_tc=

Requested by

Host: eu-u.openx.net
URL: https://eu-u.openx.net/w/1.0/pd?cc=1&plm=6&ph=92a42b2b-081a-4be8-96bc-8a959e4a3060&gdpr=1&us_privacy=1---

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s05-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://eu-u.openx.net/w/1.0/pd?cc=1&plm=6&ph=92a42b2b-081a-4be8-96bc-8a959e4a3060&gdpr=1&us_privacy=1---
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 02 Mar 2021 16:27:50 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 02 Mar 2021 16:27:50 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=MTZjY2QxODItNjEwZi02ODA3LTQ4NWEtOGEwMGE1ZTc5NmJm&google_tc=
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 326
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

sd
us-u.openx.net/w/1.0/ Frame 9887
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_sc
https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm=&google_sc=&google_tc=
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESECEsVouQXy0JEYOoZB6hR8c&google_cver=1

43 B
106 B

60ms
58ms

Image
image/gif

34.98.64.218
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESECEsVouQXy0JEYOoZB6hR8c&google_cver=1
Requested by: Host: eu-u.openx.net
URL: https://eu-u.openx.net/w/1.0/pd?cc=1&plm=6&ph=92a42b2b-081a-4be8-96bc-8a959e4a3060&gdpr=1&us_privacy=1---
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/16.202.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Referer: https://eu-u.openx.net/w/1.0/pd?cc=1&plm=6&ph=92a42b2b-081a-4be8-96bc-8a959e4a3060&gdpr=1&us_privacy=1---
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 02 Mar 2021 16:27:50 GMT
via: 1.1 google
server: OXGW/16.202.0
vary: Accept
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
content-type: image/gif
alt-svc: clear
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 02 Mar 2021 16:27:50 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESECEsVouQXy0JEYOoZB6hR8c&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 295
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

sd
eu-u.openx.net/w/1.0/ Frame 7B43
Redirect Chain

https://sync.mathtag.com/sync/img?mt_exid=5&redir=https%3A%2F%2Feu-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D536872786%26val%3D%5BMM_UUID%5D
https://eu-u.openx.net/w/1.0/sd?id=536872786&val=4ad9603e-6786-4200-9c9c-1848abe9bd13

43 B
106 B

62ms
61ms

Image
image/gif

34.98.64.218
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://eu-u.openx.net/w/1.0/sd?id=536872786&val=4ad9603e-6786-4200-9c9c-1848abe9bd13
Requested by: Host: eu-u.openx.net
URL: https://eu-u.openx.net/w/1.0/pd?cc=1&plm=6&ph=92a42b2b-081a-4be8-96bc-8a959e4a3060&gdpr=1&us_privacy=1---
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/16.202.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Referer: https://eu-u.openx.net/w/1.0/pd?cc=1&plm=6&ph=92a42b2b-081a-4be8-96bc-8a959e4a3060&gdpr=1&us_privacy=1---
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 02 Mar 2021 16:27:50 GMT
via: 1.1 google
server: OXGW/16.202.0
vary: Accept
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
content-type: image/gif
alt-svc: clear
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

Date: Tue, 02 Mar 2021 16:28:38 GMT
Server: MT3 3518 2f03077 master cdg-pixel-x28
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location: https://eu-u.openx.net/w/1.0/sd?id=536872786&val=4ad9603e-6786-4200-9c9c-1848abe9bd13
Cache-Control: no-cache
Connection: keep-alive
Content-Type: image/gif
Keep-Alive: timeout=360
Content-Length: 0
Expires: Tue, 02 Mar 2021 16:28:37 GMT

GET
H2

200

sd
us-u.openx.net/w/1.0/ Frame 7B43
Redirect Chain

https://pixel.quantserve.com/pixel/p-25CIknq_eSg16.gif?idmatch=0&gdpr=1
https://us-u.openx.net/w/1.0/sd?id=537072956&gdpr=1&val=bDBWOmw3XWl3OQRqb2JIaGo0AT53ZgFnaGLjWZwu

43 B
122 B

65ms
56ms

Image
image/gif

34.98.64.218
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072956&gdpr=1&val=bDBWOmw3XWl3OQRqb2JIaGo0AT53ZgFnaGLjWZwu
Requested by: Host: eu-u.openx.net
URL: https://eu-u.openx.net/w/1.0/pd?cc=1&plm=6&ph=92a42b2b-081a-4be8-96bc-8a959e4a3060&gdpr=1&us_privacy=1---
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/16.202.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Referer: https://eu-u.openx.net/w/1.0/pd?cc=1&plm=6&ph=92a42b2b-081a-4be8-96bc-8a959e4a3060&gdpr=1&us_privacy=1---
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 02 Mar 2021 16:27:50 GMT
via: 1.1 google
server: OXGW/16.202.0
vary: Accept
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
content-type: image/gif
alt-svc: clear
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 02 Mar 2021 16:27:50 GMT
strict-transport-security: max-age=86400
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
location: https://us-u.openx.net/w/1.0/sd?id=537072956&gdpr=1&val=bDBWOmw3XWl3OQRqb2JIaGo0AT53ZgFnaGLjWZwu
cache-control: private, no-cache, no-store, proxy-revalidate
content-length: 0
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H2

200

sd
eu-u.openx.net/w/1.0/ Frame 7B43
Redirect Chain

https://c1.adform.net/serving/cookie/match?party=22
https://c1.adform.net/serving/cookie/match?CC=1&party=22
https://eu-u.openx.net/w/1.0/sd?id=537113484&val=6946948813889572783

43 B
106 B

59ms
58ms

Image
image/gif

34.98.64.218
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://eu-u.openx.net/w/1.0/sd?id=537113484&val=6946948813889572783
Requested by: Host: eu-u.openx.net
URL: https://eu-u.openx.net/w/1.0/pd?cc=1&plm=6&ph=92a42b2b-081a-4be8-96bc-8a959e4a3060&gdpr=1&us_privacy=1---
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/16.202.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Referer: https://eu-u.openx.net/w/1.0/pd?cc=1&plm=6&ph=92a42b2b-081a-4be8-96bc-8a959e4a3060&gdpr=1&us_privacy=1---
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 02 Mar 2021 16:27:50 GMT
via: 1.1 google
server: OXGW/16.202.0
vary: Accept
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
content-type: image/gif
alt-svc: clear
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 02 Mar 2021 16:27:50 GMT
server: nginx
location: https://eu-u.openx.net/w/1.0/sd?id=537113484&val=6946948813889572783
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
content-length: 0
expires: -1

GET
H2 200 openx
match.adsrvr.org/track/cmf/ Frame 7B43 70 B
264 B 70ms
68ms Image
image/gif 99.80.71.186
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.adsrvr.org/track/cmf/openx?oxid=22eafb3f-f27d-3578-6be3-e009bcaec86a&gdpr=1
Requested by: Host: eu-u.openx.net
URL: https://eu-u.openx.net/w/1.0/pd?cc=1&plm=6&ph=92a42b2b-081a-4be8-96bc-8a959e4a3060&gdpr=1&us_privacy=1---
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 99.80.71.186 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-99-80-71-186.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

Referer: https://eu-u.openx.net/w/1.0/pd?cc=1&plm=6&ph=92a42b2b-081a-4be8-96bc-8a959e4a3060&gdpr=1&us_privacy=1---
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 02 Mar 2021 16:27:50 GMT
cache-control: private,no-cache, must-revalidate
x-aspnet-version: 4.0.30319
content-type: image/gif
content-length: 70
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"

GET
H3-Q050

200

pixel
cm.g.doubleclick.net/ Frame 7B43
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=MGU4NTI4ZjUtM2IwYS02YmRjLTdlMDMtYmFiMDc2NGMwNjBh
https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=MGU4NTI4ZjUtM2IwYS02YmRjLTdlMDMtYmFiMDc2NGMwNjBh&google_tc=

170 B
190 B

68ms
64ms

Image
image/png

142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=MGU4NTI4ZjUtM2IwYS02YmRjLTdlMDMtYmFiMDc2NGMwNjBh&google_tc=

Requested by

Host: eu-u.openx.net
URL: https://eu-u.openx.net/w/1.0/pd?cc=1&plm=6&ph=92a42b2b-081a-4be8-96bc-8a959e4a3060&gdpr=1&us_privacy=1---

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s05-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://eu-u.openx.net/w/1.0/pd?cc=1&plm=6&ph=92a42b2b-081a-4be8-96bc-8a959e4a3060&gdpr=1&us_privacy=1---
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 02 Mar 2021 16:27:50 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 02 Mar 2021 16:27:50 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=MGU4NTI4ZjUtM2IwYS02YmRjLTdlMDMtYmFiMDc2NGMwNjBh&google_tc=
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 326
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

sd
us-u.openx.net/w/1.0/ Frame 7B43
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_sc
https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm=&google_sc=&google_tc=
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESECEsVouQXy0JEYOoZB6hR8c&google_cver=1

43 B
106 B

59ms
58ms

Image
image/gif

34.98.64.218
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESECEsVouQXy0JEYOoZB6hR8c&google_cver=1
Requested by: Host: eu-u.openx.net
URL: https://eu-u.openx.net/w/1.0/pd?cc=1&plm=6&ph=92a42b2b-081a-4be8-96bc-8a959e4a3060&gdpr=1&us_privacy=1---
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/16.202.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Referer: https://eu-u.openx.net/w/1.0/pd?cc=1&plm=6&ph=92a42b2b-081a-4be8-96bc-8a959e4a3060&gdpr=1&us_privacy=1---
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 02 Mar 2021 16:27:50 GMT
via: 1.1 google
server: OXGW/16.202.0
vary: Accept
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
content-type: image/gif
alt-svc: clear
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 02 Mar 2021 16:27:50 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESECEsVouQXy0JEYOoZB6hR8c&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 295
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

sd
eu-u.openx.net/w/1.0/ Frame 0371
Redirect Chain

https://sync.mathtag.com/sync/img?mt_exid=5&redir=https%3A%2F%2Feu-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D536872786%26val%3D%5BMM_UUID%5D
https://eu-u.openx.net/w/1.0/sd?id=536872786&val=2cfe603e-6786-4700-8950-8fd8aef36ba3

43 B
106 B

68ms
60ms

Image
image/gif

34.98.64.218
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://eu-u.openx.net/w/1.0/sd?id=536872786&val=2cfe603e-6786-4700-8950-8fd8aef36ba3
Requested by: Host: eu-u.openx.net
URL: https://eu-u.openx.net/w/1.0/pd?cc=1&plm=6&ph=92a42b2b-081a-4be8-96bc-8a959e4a3060&gdpr=1&us_privacy=1---
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/16.202.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Referer: https://eu-u.openx.net/w/1.0/pd?cc=1&plm=6&ph=92a42b2b-081a-4be8-96bc-8a959e4a3060&gdpr=1&us_privacy=1---
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 02 Mar 2021 16:27:50 GMT
via: 1.1 google
server: OXGW/16.202.0
vary: Accept
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
content-type: image/gif
alt-svc: clear
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

Date: Tue, 02 Mar 2021 16:28:38 GMT
Server: MT3 3518 2f03077 master cdg-pixel-x9
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location: https://eu-u.openx.net/w/1.0/sd?id=536872786&val=2cfe603e-6786-4700-8950-8fd8aef36ba3
Cache-Control: no-cache
Connection: keep-alive
Content-Type: image/gif
Keep-Alive: timeout=360
Content-Length: 0
Expires: Tue, 02 Mar 2021 16:28:37 GMT

GET
H2

200

sd
us-u.openx.net/w/1.0/ Frame 0371
Redirect Chain

https://pixel.quantserve.com/pixel/p-25CIknq_eSg16.gif?idmatch=0&gdpr=1
https://us-u.openx.net/w/1.0/sd?id=537072956&gdpr=1&val=bDBWOmw3XWl3OQRqb2JIaGo0AT53ZgFnaGLjWZwu

43 B
106 B

65ms
62ms

Image
image/gif

34.98.64.218
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072956&gdpr=1&val=bDBWOmw3XWl3OQRqb2JIaGo0AT53ZgFnaGLjWZwu
Requested by: Host: eu-u.openx.net
URL: https://eu-u.openx.net/w/1.0/pd?cc=1&plm=6&ph=92a42b2b-081a-4be8-96bc-8a959e4a3060&gdpr=1&us_privacy=1---
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/16.202.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Referer: https://eu-u.openx.net/w/1.0/pd?cc=1&plm=6&ph=92a42b2b-081a-4be8-96bc-8a959e4a3060&gdpr=1&us_privacy=1---
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 02 Mar 2021 16:27:50 GMT
via: 1.1 google
server: OXGW/16.202.0
vary: Accept
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
content-type: image/gif
alt-svc: clear
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

location: https://us-u.openx.net/w/1.0/sd?id=537072956&gdpr=1&val=bDBWOmw3XWl3OQRqb2JIaGo0AT53ZgFnaGLjWZwu
pragma: no-cache
date: Tue, 02 Mar 2021 16:27:50 GMT
cache-control: private, no-cache, no-store, proxy-revalidate
content-length: 0
strict-transport-security: max-age=86400
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H2

200

sd
eu-u.openx.net/w/1.0/ Frame 0371
Redirect Chain

https://c1.adform.net/serving/cookie/match?party=22
https://c1.adform.net/serving/cookie/match?CC=1&party=22
https://eu-u.openx.net/w/1.0/sd?id=537113484&val=1848484361306752349

43 B
106 B

64ms
60ms

Image
image/gif

34.98.64.218
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://eu-u.openx.net/w/1.0/sd?id=537113484&val=1848484361306752349
Requested by: Host: eu-u.openx.net
URL: https://eu-u.openx.net/w/1.0/pd?cc=1&plm=6&ph=92a42b2b-081a-4be8-96bc-8a959e4a3060&gdpr=1&us_privacy=1---
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/16.202.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Referer: https://eu-u.openx.net/w/1.0/pd?cc=1&plm=6&ph=92a42b2b-081a-4be8-96bc-8a959e4a3060&gdpr=1&us_privacy=1---
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 02 Mar 2021 16:27:50 GMT
via: 1.1 google
server: OXGW/16.202.0
vary: Accept
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
content-type: image/gif
alt-svc: clear
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 02 Mar 2021 16:27:50 GMT
server: nginx
location: https://eu-u.openx.net/w/1.0/sd?id=537113484&val=1848484361306752349
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
content-length: 0
expires: -1

GET
H2 200 openx
match.adsrvr.org/track/cmf/ Frame 0371 70 B
264 B 79ms
70ms Image
image/gif 99.80.71.186
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.adsrvr.org/track/cmf/openx?oxid=8a058379-a647-31a2-4724-e67bf2e5bb7b&gdpr=1
Requested by: Host: eu-u.openx.net
URL: https://eu-u.openx.net/w/1.0/pd?cc=1&plm=6&ph=92a42b2b-081a-4be8-96bc-8a959e4a3060&gdpr=1&us_privacy=1---
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 99.80.71.186 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-99-80-71-186.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

Referer: https://eu-u.openx.net/w/1.0/pd?cc=1&plm=6&ph=92a42b2b-081a-4be8-96bc-8a959e4a3060&gdpr=1&us_privacy=1---
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 02 Mar 2021 16:27:50 GMT
cache-control: private,no-cache, must-revalidate
x-aspnet-version: 4.0.30319
content-type: image/gif
content-length: 70
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"

GET
H3-Q050 200 pixel
cm.g.doubleclick.net/ Frame 0371 170 B
201 B 147ms
82ms Image
image/png 142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=YTY2YTUwYjMtNmYzMC02ZjA2LTUyYzQtYmNjMjM4MDc3NTFi

Requested by

Host: eu-u.openx.net
URL: https://eu-u.openx.net/w/1.0/pd?cc=1&plm=6&ph=92a42b2b-081a-4be8-96bc-8a959e4a3060&gdpr=1&us_privacy=1---

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s05-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://eu-u.openx.net/w/1.0/pd?cc=1&plm=6&ph=92a42b2b-081a-4be8-96bc-8a959e4a3060&gdpr=1&us_privacy=1---
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 02 Mar 2021 16:27:50 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

sd
us-u.openx.net/w/1.0/ Frame 0371
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_sc
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESECEsVouQXy0JEYOoZB6hR8c&google_cver=1

43 B
106 B

61ms
61ms

Image
image/gif

34.98.64.218
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESECEsVouQXy0JEYOoZB6hR8c&google_cver=1
Requested by: Host: eu-u.openx.net
URL: https://eu-u.openx.net/w/1.0/pd?cc=1&plm=6&ph=92a42b2b-081a-4be8-96bc-8a959e4a3060&gdpr=1&us_privacy=1---
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/16.202.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Referer: https://eu-u.openx.net/w/1.0/pd?cc=1&plm=6&ph=92a42b2b-081a-4be8-96bc-8a959e4a3060&gdpr=1&us_privacy=1---
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 02 Mar 2021 16:27:50 GMT
via: 1.1 google
server: OXGW/16.202.0
vary: Accept
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
content-type: image/gif
alt-svc: clear
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 02 Mar 2021 16:27:50 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESECEsVouQXy0JEYOoZB6hR8c&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 295
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK usync.js Show response
eus.rubiconproject.com/ Frame 9E21 31 KB
10 KB 70ms
64ms Script
text/html 184.30.212.16
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?us_privacy=1---
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 184.30.212.16 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a184-30-212-16.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash: 1dcacffd5056e8521c39d12085fe6a73b310f80bd764e77e067ff15b49a715d3

Request headers

Referer: https://eus.rubiconproject.com/usync.html?us_privacy=1---
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Tue, 02 Mar 2021 16:27:50 GMT
Content-Encoding: gzip
Last-Modified: Thu, 28 Jan 2021 20:32:24 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
Vary: Accept-Encoding
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control: max-age=9941
Connection: keep-alive
Content-Type: text/html; charset=UTF-8
Content-Length: 9308
Expires: Tue, 02 Mar 2021 19:13:31 GMT

GET
H/1.1 200
OK usermatch Show response
ssum-sec.casalemedia.com/ Frame DFFA 54 B
326 B 83ms
77ms Document
text/html 23.202.53.51
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ssum-sec.casalemedia.com/usermatch?gdpr=1&gdpr_consent=CPCcAsZPCcAsZAcABBENBPCgAAAAAAAAAChQAAAAAAJBAGIAAoAHAAeABcAD4ALQAfABJADEAH8ARQAkQBXADNAG0AOIAcgA5wB1AD_AIGAQcAkQBPwChgGEAOqAh8BHoCQgErAJtAWEAugBdQC7QF5AMQAYsAyEBkYDKAGhANGAaUA1MBtADbgG6AOCCQVgAEAALgAoACoAGQAOAAeABAACIAFQAMIAaABqADyAIYAiABMACfAFUAVgAsABcADeAHMAPQAhABDQCIAIkAR0AlgCXAE0AKUAW4AwwBkADLgGoAaoA2QB3gD2AHxAPsA_QCAQEXARgAjQBHACUgFBAKWAU8Aq4BcwC_AGKANYAbQA3ABvAD0AHyAQ2Ah0BF4CRAExAJlATYAnYBQ4CkQFigLQAWwAuQBd4C8wGBAMGAYSAw0Bh4DIgGSAMnAZcAzkBnwDSAGnQNYA1kMASAAWABcAJIAVQAxADSAGqAOIA2QB1AEhAKHAXQAvoBiwDIwGhAN0DQJgAVABWAC4AIYAZAAywBqADZAHYAPwAgABBQCMAFLAKeAVeAtAC0gGsAN4AdUA-QCGwEOgIqAReAkQBNgCdgFIgLkAYEAwkBh4DGAGTgM5AZ4Az4QASAAWABcAGoASQAqgBiAFcANUAcQBIgDcAG8ASEAocBdADFgGhAN0EQIAAVABWAC4AIYAZAAywBqADZAHYAPwAgABGAClgFPAKuAawA6oB8gENgIdAReAkQBNgCdgFIgLkAYEAwkBh4DJwGcgM-FQHgAKAAqACGAEwALgAjgBlgDUAHYAPwAjABHAClgFXgLQAtIBvAEggJiATYApsBbAC5AF5gMCAYeAyIBnIDPAGfANyFADQAxADVAG0AOIAcgA8ACCgHVAR6AvoBmgDQgGvDIDYAFAAVABDACYAFwARwAywBqADsgH2AfgBGACOAFLAKuAVsA3gCYgE2ALRAWwAvMBgQDDwGRAM5AZ4Az4YANABqAGIAaoA2gBxADkAHgAWIA2QB1QEegLyAaEOAsgACAARAA4ADwALgAfABaADkAH4AQQAugBkADQAH8ARQAkQBOgCzAF8AMsAZoA0gBqgDaAHEAOQAc4A6gB2ADuAIAAQMAgsBBwEIAIiASIAm0BPgE_AKWAVAAtoBeoDAAMCAYQA1gBrwDeAHHAOkAdUA8gB8gEIQIfAiABHoCQoErASuAmIBMoCbQFCgKQAUmApgBUwCqgFbAK5AV2AsoBaQC1AFxQLoAuoBfQDAgGIAMWAZCAygBl4DQoGigaMA0oBpoDUwGvANoAbYA24dBnAAXABQAFQAMgAcABAACIAFQALoAYABjADQANQAeAA-gCGAIgATAAnwBVAFYALAAXAAvgBiADMAG8AOYAegBCACGgEQARIAjoBLAEwAJoAUYApQBYgC3gGEAYYAyABlADRAGoANkAb4A7wB7QD7AP0Af8BFgEYAI5ASkBKgCggFPAKuAWKAtAC0gFzALqAXkAvwBigDaAG4gOmA6gB6AENgIdAREAioBF4CQQEiAJUATYAnYBQ4CmgFWALFAWgAtgBcAC5AF2gLvAXmAwYBhIDDQGHgMSAYwAx4BkgDJwGVAMsAZcAzkBnwDRIGkAaSA0sBpwDWAGxkAF4ACAAfgBBADQAH8ASIAtwBfADLAGqANoAcQA5ABzgDsAHgAQUAnwBSwCxAGAAMIAbIA3gB1QDtgIfAR6AkIBK4CYgE2gKFAUgApMBWwC6AF5AL6AYEAzQBoQDRQGlANTAbYA24hA9AAWABQADIAIgAVAAuABiAEMAJgAVQAuABfADEAGYAN4AegBHACxAGEAMoAagA3wB3wD7APwAf4BGACOAEpAKCAUMAp4BV4C0ALSAXMAvwBigDaAHUAPQAkEBIgCVAE2AKaAWKAtEBbAC4AFyALtAYeAxIBkQDJwGcgM8AZ8A0QBpIDSwHAEgEIAAgAHAAXABCADkAMgAkQBcgC-AGWANQAbQA7gCAAEJAJ8AVAA14BvADqgH2ARUAlYBNoCkwFlALSAX0AxEBiwDQgGlANyJQOQAEAALAAoABkADgAIoAYABiADwAIgATAAqgBcAC-AGIAMwAbQBCACGgEQARIAjgBRgClAFuAMIAZQA1QBsgDvAH4ARgAjgBTwCrwFoAWkAuoBigDcAHUAPkAh0BF4CRAE2ALFAWwAu0BeYDDwGRAMnAZYAzkBngDPgGkANYAcAUAhAACAAuAB8AEIALQAcgA_ACsAGQANoAcgBHACRAE6ALkAXwAywBqADXAG0AOIAc4A6gB3ADwAIAAQcAhIBFQCRAE2gJ8An4BSwCxAF1AMAAYQAxQBrwDeAHVAO2AeQA-QB_wEegJiATKAm0BSACmAFTAK7AWgAugBeQC-gGBAMWAaEA0QBpQDTYGpAamA14BwRSCWAAuACgAKgAZAA4ACAAEQAKoAYABjADQANQAeQBDAEQAJgATwApABVACwAFwAL4AYgAzABzAEIAIaARABEgCjAFKALEAW4AwgBlADRAGqANkAd8A-wD9AIsARgAjgBKQCggFDAKuAVsAuYBeQDaAG4APQAh0BF4CRAE2AJ2AUOApoBWwCxQFsALgAXIAu0BeYDDQGHgMYAZEAyQBk4DLgGcgM8AZ9A0gDSYGsAayA2MAA.YAAAAAAAAAAA&d=https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/&s=184674&cb=https%3A%2F%2Fjs-sec.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Requested by: Host: js-sec.indexww.com
URL: https://js-sec.indexww.com/um/ixmatch.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.202.53.51 Vienna, Austria, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-202-53-51.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 863b0e04b9e8af02d763cb98563ca8d9f80c6b99a3ec2eb6395db229bc3f8ba9

Request headers

Host: ssum-sec.casalemedia.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://js-sec.indexww.com/um/ixmatch.html
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://js-sec.indexww.com/um/ixmatch.html

Response headers

Server: Apache
Content-Type: text/html
Vary: Is-Traffic-Usersync
Content-Length: 54
Expires: Tue, 02 Mar 2021 16:27:50 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Tue, 02 Mar 2021 16:27:50 GMT
Connection: keep-alive

GET
H/1.1 200
OK usermatch Show response
ssum-sec.casalemedia.com/ Frame D4A7 54 B
326 B 163ms
76ms Document
text/html 23.202.53.51
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ssum-sec.casalemedia.com/usermatch?gdpr=1&gdpr_consent=CPCcAsZPCcAsZAcABBENBPCgAAAAAAAAAChQAAAAAAJBAGIAAoAHAAeABcAD4ALQAfABJADEAH8ARQAkQBXADNAG0AOIAcgA5wB1AD_AIGAQcAkQBPwChgGEAOqAh8BHoCQgErAJtAWEAugBdQC7QF5AMQAYsAyEBkYDKAGhANGAaUA1MBtADbgG6AOCCQVgAEAALgAoACoAGQAOAAeABAACIAFQAMIAaABqADyAIYAiABMACfAFUAVgAsABcADeAHMAPQAhABDQCIAIkAR0AlgCXAE0AKUAW4AwwBkADLgGoAaoA2QB3gD2AHxAPsA_QCAQEXARgAjQBHACUgFBAKWAU8Aq4BcwC_AGKANYAbQA3ABvAD0AHyAQ2Ah0BF4CRAExAJlATYAnYBQ4CkQFigLQAWwAuQBd4C8wGBAMGAYSAw0Bh4DIgGSAMnAZcAzkBnwDSAGnQNYA1kMASAAWABcAJIAVQAxADSAGqAOIA2QB1AEhAKHAXQAvoBiwDIwGhAN0DQJgAVABWAC4AIYAZAAywBqADZAHYAPwAgABBQCMAFLAKeAVeAtAC0gGsAN4AdUA-QCGwEOgIqAReAkQBNgCdgFIgLkAYEAwkBh4DGAGTgM5AZ4Az4QASAAWABcAGoASQAqgBiAFcANUAcQBIgDcAG8ASEAocBdADFgGhAN0EQIAAVABWAC4AIYAZAAywBqADZAHYAPwAgABGAClgFPAKuAawA6oB8gENgIdAReAkQBNgCdgFIgLkAYEAwkBh4DJwGcgM-FQHgAKAAqACGAEwALgAjgBlgDUAHYAPwAjABHAClgFXgLQAtIBvAEggJiATYApsBbAC5AF5gMCAYeAyIBnIDPAGfANyFADQAxADVAG0AOIAcgA8ACCgHVAR6AvoBmgDQgGvDIDYAFAAVABDACYAFwARwAywBqADsgH2AfgBGACOAFLAKuAVsA3gCYgE2ALRAWwAvMBgQDDwGRAM5AZ4Az4YANABqAGIAaoA2gBxADkAHgAWIA2QB1QEegLyAaEOAsgACAARAA4ADwALgAfABaADkAH4AQQAugBkADQAH8ARQAkQBOgCzAF8AMsAZoA0gBqgDaAHEAOQAc4A6gB2ADuAIAAQMAgsBBwEIAIiASIAm0BPgE_AKWAVAAtoBeoDAAMCAYQA1gBrwDeAHHAOkAdUA8gB8gEIQIfAiABHoCQoErASuAmIBMoCbQFCgKQAUmApgBUwCqgFbAK5AV2AsoBaQC1AFxQLoAuoBfQDAgGIAMWAZCAygBl4DQoGigaMA0oBpoDUwGvANoAbYA24dBnAAXABQAFQAMgAcABAACIAFQALoAYABjADQANQAeAA-gCGAIgATAAnwBVAFYALAAXAAvgBiADMAG8AOYAegBCACGgEQARIAjoBLAEwAJoAUYApQBYgC3gGEAYYAyABlADRAGoANkAb4A7wB7QD7AP0Af8BFgEYAI5ASkBKgCggFPAKuAWKAtAC0gFzALqAXkAvwBigDaAG4gOmA6gB6AENgIdAREAioBF4CQQEiAJUATYAnYBQ4CmgFWALFAWgAtgBcAC5AF2gLvAXmAwYBhIDDQGHgMSAYwAx4BkgDJwGVAMsAZcAzkBnwDRIGkAaSA0sBpwDWAGxkAF4ACAAfgBBADQAH8ASIAtwBfADLAGqANoAcQA5ABzgDsAHgAQUAnwBSwCxAGAAMIAbIA3gB1QDtgIfAR6AkIBK4CYgE2gKFAUgApMBWwC6AF5AL6AYEAzQBoQDRQGlANTAbYA24hA9AAWABQADIAIgAVAAuABiAEMAJgAVQAuABfADEAGYAN4AegBHACxAGEAMoAagA3wB3wD7APwAf4BGACOAEpAKCAUMAp4BV4C0ALSAXMAvwBigDaAHUAPQAkEBIgCVAE2AKaAWKAtEBbAC4AFyALtAYeAxIBkQDJwGcgM8AZ8A0QBpIDSwHAEgEIAAgAHAAXABCADkAMgAkQBcgC-AGWANQAbQA7gCAAEJAJ8AVAA14BvADqgH2ARUAlYBNoCkwFlALSAX0AxEBiwDQgGlANyJQOQAEAALAAoABkADgAIoAYABiADwAIgATAAqgBcAC-AGIAMwAbQBCACGgEQARIAjgBRgClAFuAMIAZQA1QBsgDvAH4ARgAjgBTwCrwFoAWkAuoBigDcAHUAPkAh0BF4CRAE2ALFAWwAu0BeYDDwGRAMnAZYAzkBngDPgGkANYAcAUAhAACAAuAB8AEIALQAcgA_ACsAGQANoAcgBHACRAE6ALkAXwAywBqADXAG0AOIAc4A6gB3ADwAIAAQcAhIBFQCRAE2gJ8An4BSwCxAF1AMAAYQAxQBrwDeAHVAO2AeQA-QB_wEegJiATKAm0BSACmAFTAK7AWgAugBeQC-gGBAMWAaEA0QBpQDTYGpAamA14BwRSCWAAuACgAKgAZAA4ACAAEQAKoAYABjADQANQAeQBDAEQAJgATwApABVACwAFwAL4AYgAzABzAEIAIaARABEgCjAFKALEAW4AwgBlADRAGqANkAd8A-wD9AIsARgAjgBKQCggFDAKuAVsAuYBeQDaAG4APQAh0BF4CRAE2AJ2AUOApoBWwCxQFsALgAXIAu0BeYDDQGHgMYAZEAyQBk4DLgGcgM8AZ9A0gDSYGsAayA2MAA.YAAAAAAAAAAA&d=https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/&s=184674&cb=https%3A%2F%2Fjs-sec.indexww.com%2Fht%2Fhtw-pixel.gif%3F
Requested by: Host: js-sec.indexww.com
URL: https://js-sec.indexww.com/um/ixmatch.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.202.53.51 Vienna, Austria, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-202-53-51.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 863b0e04b9e8af02d763cb98563ca8d9f80c6b99a3ec2eb6395db229bc3f8ba9

Request headers

Host: ssum-sec.casalemedia.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://js-sec.indexww.com/um/ixmatch.html
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://js-sec.indexww.com/um/ixmatch.html

Response headers

Server: Apache
Content-Type: text/html
Vary: Is-Traffic-Usersync
Content-Length: 54
Expires: Tue, 02 Mar 2021 16:27:50 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Tue, 02 Mar 2021 16:27:50 GMT
Connection: keep-alive

GET
H/1.1 200
OK c1057a6f-76fc-470d-9cbc-87c086864674file-3272k-128-48000-1280.m3u8 Show response
dp8hsntg6do36.cloudfront.net/5952801dfd2e616da6000006/ Frame 0372 1 KB
882 B 64ms
63ms XHR
application/x-mpegurl 13.32.24.6
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://dp8hsntg6do36.cloudfront.net/5952801dfd2e616da6000006/c1057a6f-76fc-470d-9cbc-87c086864674file-3272k-128-48000-1280.m3u8?requester=oo
Requested by: Host: d2c8v52ll5s99u.cloudfront.net
URL: https://d2c8v52ll5s99u.cloudfront.net/player/main-cddebf909f5183fb417b.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.24.6 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-24-6.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: ce5692d451b5bc71a34b0892473e4717cb850376ea40184593b5351de24e9382

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Tue, 02 Mar 2021 06:30:21 GMT
Content-Encoding: gzip
Vary: Accept-Encoding,Origin
Age: 35850
Transfer-Encoding: chunked
X-Cache: Hit from cloudfront
Connection: keep-alive
Access-Control-Allow-Origin: *
Last-Modified: Tue, 27 Jun 2017 15:57:42 GMT
Server: AmazonS3
ETag: W/"97682575c4eb22b27f2807c50931d093"
Access-Control-Max-Age: 3000
Access-Control-Allow-Methods: GET, HEAD
Content-Type: application/x-mpegURL
Via: 1.1 fd3cce3e0bafd8b312277d0ad9f4762f.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: FRA56-C2
X-Amz-Cf-Id: IbxafpY06kw7gfYJaHM5dvyX8sS-NRuIuI4x6_ia5B5qLmPH6e6EKg==

GET
H/1.1 200
OK c1057a6f-76fc-470d-9cbc-87c086864674file-3272k-128-48000-1280-00002.ts Show response
dp8hsntg6do36.cloudfront.net/5952801dfd2e616da6000006/ Frame 0372 1 MB
1 MB 67ms
66ms XHR
application/x-mpegurl 13.32.24.6
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://dp8hsntg6do36.cloudfront.net/5952801dfd2e616da6000006/c1057a6f-76fc-470d-9cbc-87c086864674file-3272k-128-48000-1280-00002.ts?requester=oo
Requested by: Host: d2c8v52ll5s99u.cloudfront.net
URL: https://d2c8v52ll5s99u.cloudfront.net/player/main-cddebf909f5183fb417b.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.24.6 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-24-6.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 4cd8e5548ab405e238b77c140a137d71e1f594a9ed18ce68d12246d8c0e637a0

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Mon, 01 Mar 2021 21:15:36 GMT
Content-Encoding: gzip
Vary: Origin
Age: 69136
Transfer-Encoding: chunked
X-Cache: Hit from cloudfront
Connection: keep-alive
Access-Control-Allow-Origin: *
Last-Modified: Tue, 27 Jun 2017 15:57:42 GMT
Server: AmazonS3
ETag: W/"323c0a5fba318aef044d6539b2065e38"
Access-Control-Max-Age: 3000
Access-Control-Allow-Methods: GET, HEAD
Content-Type: application/x-mpegURL
Via: 1.1 fd3cce3e0bafd8b312277d0ad9f4762f.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: FRA56-C2
X-Amz-Cf-Id: enajqMogd96ATudfLkT4S_LHQL5iHNoUjjXp5sgQDUHxdCbYl2V7qQ==

GET
H2 200 pixel.gif
px.moatads.com/ 43 B
260 B 61ms
59ms Image
image/gif 23.202.53.245
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=5&q=0&hp=1&wf=1&vz=-&zp=0&vb=8&kq=1&lo=0&tr=1&uk=null&pk=1&wk=1&rk=1&tk=1&ak=-&i=CONDEVIDEOCONTENT1&ud=undefined&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRGt%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%5Elv%3Ch%2CeI8!A2QnbjPSI.%24ki)sV~1HmDkx2KD5pf5%5BG%5BZFZ8R6tbK0pH%23bU%24(9N%2CNJJ)%2CW%2FKo7FY&th=3645823656&tf=Id8O-DxRgoC-xFQTS-CSa7H-XSSptC-j7VIQD-xFQTS-nMzjG-&vi=111111&qp=00000&is=BBBBB2BBEYBvGl2BBCBBtUTBBRmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7OxBb8MxOtJYHCBdm5kBhBBC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBSqj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNBBBBBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbBBC4ehueB57NG9aJeRzBqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=null&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-60&qa=1600&qb=1200&qi=1600&qj=1200&to=00&po=1-0020002000002120&vy=&qr=0&url=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2021%2F02%2Fnew-malware-found-on-30000-macs-has-security-pros-stumped%2F&confidence=2&pcode=condenastprebidheader987326845656&ql=&qo=0&vf=1&vg=100&bq=8&g=2&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=155&w=276&fy=0&gp=0&zGSRC=1&gu=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2021%2F02%2Fnew-malware-found-on-30000-macs-has-security-pros-stumped%2F&id=1&ii=4&f=0&j=&t=1614702469722&de=407007513103&cu=1614702469722&m=1547&ar=b6cd16e-clean&iw=fab7aad&cb=0&ym=0&ll=2&lm=0&ln=1&r=0&dl=0&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=6149&le=1&gm=1&io=1&ch=0&vv=1&vw=1%3A3%3A0&vp=100&vx=100%3A100%3A-&pe=1%3A911%3A911%3A0%3A1201&as=1&ag=1251&an=73&gi=1&gf=1251&gg=73&ez=1&kw=1280&aj=1&pg=100&pf=100&ib=0&dw=1&cc=1&bw=1251&bx=73&jz=1280&dj=1&dx=1&aa=1&ad=1122&cn=0&gn=1&gk=1122&gl=0&cp=1280&cq=1&cr=1&hj=0&pv=0&em=0&en=0&st=1&su=1&of=1&oz=1&oe=1%3A1%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=1280&cd=357&ah=1280&am=357&dq=1069&dr=146&ds=1069&dt=146&zx=0&tb=0&vm=1&vl=0&vt=2&vd=0&zMoatSRE=0.02228125&zMoatVSD=86&hc=0&er=0&es=0&gs=0&gt=0&eu=0&ev=0&et=1&dz=1&eb=1&ec=5078&ef=1&rf=0&re=0&cl=0&at=0&d=How%20the%20Internet%20could%20change%20under%20Trump%3A%2F3379%2Fconde.ars%2Finline-player%2Finformation-technology%2Farticle%3Aundefined%3Aundefined&gw=condenastjsvideocontent160527792519&zMoatDomain=arstechnica.com&zMoatSubdomain=arstechnica.com&zMoatVideoId=5952801dfd2e616da6000006&zMoatAP=true&ab=3&ac=1&fd=1&kt=strict&it=500&fz=1&or=0&oq=1&ot=ff&zMoatJS=3%3A-&ti=0&ih=1&tc=0&fs=188403&na=583801035&cs=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.202.53.245 Vienna, Austria, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-202-53-245.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 02 Mar 2021 16:27:51 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: AkamaiNetStorage
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Tue, 02 Mar 2021 16:27:51 GMT

GET
H/1.1 200
OK c1057a6f-76fc-470d-9cbc-87c086864674file-3272k-128-48000-1280-00003.ts Show response
dp8hsntg6do36.cloudfront.net/5952801dfd2e616da6000006/ Frame 0372 2 MB
2 MB 64ms
63ms XHR
application/x-mpegurl 13.32.24.6
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://dp8hsntg6do36.cloudfront.net/5952801dfd2e616da6000006/c1057a6f-76fc-470d-9cbc-87c086864674file-3272k-128-48000-1280-00003.ts?requester=oo
Requested by: Host: d2c8v52ll5s99u.cloudfront.net
URL: https://d2c8v52ll5s99u.cloudfront.net/player/main-cddebf909f5183fb417b.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.24.6 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-24-6.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: e3d91f02be28f0efc89955dab730a4c0c4ab25ac52133e8c9bb00ec8ce80ca49

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Tue, 02 Mar 2021 05:24:07 GMT
Content-Encoding: gzip
Vary: Origin
Age: 39825
Transfer-Encoding: chunked
X-Cache: Hit from cloudfront
Connection: keep-alive
Access-Control-Allow-Origin: *
Last-Modified: Tue, 27 Jun 2017 15:57:42 GMT
Server: AmazonS3
ETag: W/"edf3594cf23bbc284f1e0f179dcdeef3"
Access-Control-Max-Age: 3000
Access-Control-Allow-Methods: GET, HEAD
Content-Type: application/x-mpegURL
Via: 1.1 fd3cce3e0bafd8b312277d0ad9f4762f.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: FRA56-C2
X-Amz-Cf-Id: V0Hd2Hu2R-3c3sx7g1Ts0h3pIXJWs0VicacpWwWYG4WkLHbQDV8V3w==

GET
H2 200 pixel.gif
px.moatads.com/ 43 B
260 B 61ms
61ms Image
image/gif 23.202.53.245
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=37&q=0&hp=1&wf=1&vz=-&zp=0&vb=8&kq=1&lo=0&tr=1&uk=null&pk=1&wk=1&rk=1&tk=1&ak=-&i=CONDEVIDEOCONTENT1&ud=undefined&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRGt%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%5Elv%3Ch%2CeI8!A2QnbjPSI.%24ki)sV~1HmDkx2KD5pf5%5BG%5BZFZ8R6tbK0pH%23bU%24(9N%2CNJJ)%2CW%2FKo7FY&th=3645823656&tf=Id8O-DxRgoC-xFQTS-CSa7H-XSSptC-j7VIQD-xFQTS-nMzjG-&vi=111111&qp=00000&is=BBBBB2BBEYBvGl2BBCBBtUTBBRmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7OxBb8MxOtJYHCBdm5kBhBBC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBSqj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNBBBBBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbBBC4ehueB57NG9aJeRzBqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=null&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-60&qa=1600&qb=1200&qi=1600&qj=1200&to=00&po=1-0020002000002120&vy=&qr=0&url=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2021%2F02%2Fnew-malware-found-on-30000-macs-has-security-pros-stumped%2F&confidence=2&pcode=condenastprebidheader987326845656&ql=&qo=0&vf=1&vg=100&bq=8&g=3&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=155&w=276&fy=0&gp=0&zGSRC=1&gu=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2021%2F02%2Fnew-malware-found-on-30000-macs-has-security-pros-stumped%2F&id=1&ii=4&f=0&j=&t=1614702469722&de=407007513103&cu=1614702469722&m=1557&ar=b6cd16e-clean&iw=fab7aad&cb=0&ym=0&ll=2&lm=0&ln=1&r=0&dl=0&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=6149&le=1&gm=1&io=1&ch=0&vv=1&vw=1%3A3%3A0&vp=100&vx=100%3A100%3A-&pe=1%3A911%3A911%3A0%3A1201&as=1&ag=1251&an=1251&gi=1&gf=1251&gg=1251&ez=1&kw=1280&aj=1&pg=100&pf=100&ib=0&dw=1&cc=1&bw=1251&bx=1251&jz=1280&dj=1&dx=1&aa=1&ad=1122&cn=1122&gn=1&gk=1122&gl=1122&cp=1280&cq=1&cr=1&hj=0&pv=0&em=0&en=0&st=1&su=1&of=1&oz=1&oe=1%3A1%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=1280&cd=1280&ah=1280&am=1280&dq=1069&dr=1069&ds=1069&dt=1069&zx=0&tb=0&vm=1&vl=2&vt=2&vd=0&zMoatSRE=0.02228125&zMoatVSD=86&hc=0&er=0&es=0&gs=0&gt=0&eu=0&ev=0&et=1&dz=1&eb=1&ec=5078&ef=1&rf=0&re=0&cl=0&at=0&d=How%20the%20Internet%20could%20change%20under%20Trump%3A%2F3379%2Fconde.ars%2Finline-player%2Finformation-technology%2Farticle%3Aundefined%3Aundefined&gw=condenastjsvideocontent160527792519&zMoatDomain=arstechnica.com&zMoatSubdomain=arstechnica.com&zMoatVideoId=5952801dfd2e616da6000006&zMoatAP=true&ab=3&ac=1&fd=1&kt=strict&it=500&fz=1&or=0&oq=1&ot=ff&zMoatJS=3%3A-&ti=0&ih=1&tc=0&fs=188403&na=291951485&cs=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.202.53.245 Vienna, Austria, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-202-53-245.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 02 Mar 2021 16:27:51 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: AkamaiNetStorage
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Tue, 02 Mar 2021 16:27:51 GMT

GET
H/1.1 200
OK khaos.jpg
token.rubiconproject.com/ Frame 9E21 284 B
536 B 212ms
53ms Image
image/jpg 69.173.144.139
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://token.rubiconproject.com/khaos.jpg?us_privacy=1---
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_GCM
Server: 69.173.144.139 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: 492abbc30ace41332a8f68b7f34f56333a037aebac34e0bc9b9cedb0d1c3b032

Request headers

Referer: https://eus.rubiconproject.com/usync.html?us_privacy=1---
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
content-length: 284
X-RPHost: de8527bfa1ccfd6c1590da0d3b6cff52
Content-Type: image/jpg

GET
H/1.1 200
OK c1057a6f-76fc-470d-9cbc-87c086864674file-5872k-128-48000-1920.m3u8 Show response
dp8hsntg6do36.cloudfront.net/5952801dfd2e616da6000006/ Frame 0372 1 KB
878 B 62ms
61ms XHR
application/x-mpegurl 13.32.24.6
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://dp8hsntg6do36.cloudfront.net/5952801dfd2e616da6000006/c1057a6f-76fc-470d-9cbc-87c086864674file-5872k-128-48000-1920.m3u8?requester=oo
Requested by: Host: d2c8v52ll5s99u.cloudfront.net
URL: https://d2c8v52ll5s99u.cloudfront.net/player/main-cddebf909f5183fb417b.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.24.6 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-24-6.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: c9d4c695d47897b02b09abe77f54fb8ff3125de769df6ef77a442f586fb6da81

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Tue, 02 Mar 2021 05:18:24 GMT
Content-Encoding: gzip
Vary: Accept-Encoding,Origin
Age: 40168
Transfer-Encoding: chunked
X-Cache: Hit from cloudfront
Connection: keep-alive
Access-Control-Allow-Origin: *
Last-Modified: Tue, 27 Jun 2017 15:57:32 GMT
Server: AmazonS3
ETag: W/"1f36e1b0cf7efe2df3884cf05b213c0f"
Access-Control-Max-Age: 3000
Access-Control-Allow-Methods: GET, HEAD
Content-Type: application/x-mpegURL
Via: 1.1 fd3cce3e0bafd8b312277d0ad9f4762f.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: FRA56-C2
X-Amz-Cf-Id: lojCRkTjRhj-zR1Mo98sG24yFZpNKQpXzEcLea0u4TuU2dOWndhRMQ==

GET
H/1.1 200
OK c1057a6f-76fc-470d-9cbc-87c086864674file-5872k-128-48000-1920-00003.ts Show response
dp8hsntg6do36.cloudfront.net/5952801dfd2e616da6000006/ Frame 0372 3 MB
3 MB 63ms
62ms XHR
application/x-mpegurl 13.32.24.6
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://dp8hsntg6do36.cloudfront.net/5952801dfd2e616da6000006/c1057a6f-76fc-470d-9cbc-87c086864674file-5872k-128-48000-1920-00003.ts?requester=oo
Requested by: Host: d2c8v52ll5s99u.cloudfront.net
URL: https://d2c8v52ll5s99u.cloudfront.net/player/main-cddebf909f5183fb417b.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.24.6 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-24-6.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 7eb948a3546f5f32d94ddf09fbfa649a41093c39405d46cae67698e149dddc58

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Tue, 02 Mar 2021 04:45:24 GMT
Content-Encoding: gzip
Vary: Origin
Age: 42148
Transfer-Encoding: chunked
X-Cache: Hit from cloudfront
Connection: keep-alive
Access-Control-Allow-Origin: *
Last-Modified: Tue, 27 Jun 2017 15:57:33 GMT
Server: AmazonS3
ETag: W/"b7b34d3581d35d2a34838c07a1e9a0c4"
Access-Control-Max-Age: 3000
Access-Control-Allow-Methods: GET, HEAD
Content-Type: application/x-mpegURL
Via: 1.1 fd3cce3e0bafd8b312277d0ad9f4762f.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: FRA56-C2
X-Amz-Cf-Id: fjzwgptcRLwG6q0PwmiCyuhlB5lsHvuTDX2SyXAI7M6h067cHWPlDA==

GET
H2 200 /
www.facebook.com/tr/ Frame 0372 44 B
258 B 6ms
6ms Image
image/gif 2a03:2880:f11c:8183:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=1663130473914833&ev=Microdata&dl=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2021%2F02%2Fnew-malware-found-on-30000-macs-has-security-pros-stumped%2F&rl=&if=true&ts=1614702471680&cd[DataLayer]=%5B%5D&cd[Meta]=%7B%22title%22%3A%22%22%7D&cd[OpenGraph]=%7B%7D&cd[Schema.org]=%5B%5D&cd[JSON-LD]=%5B%5D&sw=1600&sh=1200&v=2.9.33&r=stable&ec=1&o=30&fbp=fb.1.1614702471679.23155375&it=1614702468009&coo=false&es=automatic&tm=3&rqm=GET

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f11c:8183:face:b00c:0:25de , United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 02 Mar 2021 16:27:51 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
cache-control: no-cache, must-revalidate, max-age=0
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 44
expires: Tue, 02 Mar 2021 16:27:51 GMT

GET
H/1.1 200
OK c1057a6f-76fc-470d-9cbc-87c086864674file-5872k-128-48000-1920-00004.ts Show response
dp8hsntg6do36.cloudfront.net/5952801dfd2e616da6000006/ Frame 0372 2 MB
2 MB 66ms
65ms XHR
application/x-mpegurl 13.32.24.6
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://dp8hsntg6do36.cloudfront.net/5952801dfd2e616da6000006/c1057a6f-76fc-470d-9cbc-87c086864674file-5872k-128-48000-1920-00004.ts?requester=oo
Requested by: Host: d2c8v52ll5s99u.cloudfront.net
URL: https://d2c8v52ll5s99u.cloudfront.net/player/main-cddebf909f5183fb417b.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.24.6 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-24-6.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 4699bf08167c6062952580605d7e01cc8eac865733ee427dbf050f8f9c6ffca9

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Tue, 02 Mar 2021 05:18:26 GMT
Content-Encoding: gzip
Vary: Accept-Encoding,Origin
Age: 40166
Transfer-Encoding: chunked
X-Cache: Hit from cloudfront
Connection: keep-alive
Access-Control-Allow-Origin: *
Last-Modified: Tue, 27 Jun 2017 15:57:33 GMT
Server: AmazonS3
ETag: W/"344f6f777652116ae9833de9ebf6f08a"
Access-Control-Max-Age: 3000
Access-Control-Allow-Methods: GET, HEAD
Content-Type: application/x-mpegURL
Via: 1.1 fd3cce3e0bafd8b312277d0ad9f4762f.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: FRA56-C2
X-Amz-Cf-Id: W-wmL1EW9jqUpW8IrqPT3ub8ckTzZTHPyihIH23uUxrge5zhbQfrUA==

GET
H2 200 pixel.gif
px.moatads.com/ 43 B
260 B 60ms
60ms Image
image/gif 23.202.53.245
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=37&q=1&hp=1&wf=1&vz=-&zp=0&vb=8&kq=1&lo=0&tr=1&uk=null&pk=1&wk=1&rk=1&tk=1&ak=-&i=CONDEVIDEOCONTENT1&ud=undefined&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRGt%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%5Elv%3Ch%2CeI8!A2QnbjPSI.%24ki)sV~1HmDkx2KD5pf5%5BG%5BZFZ8R6tbK0pH%23bU%24(9N%2CNJJ)%2CW%2FKo7FY&th=3645823656&tf=Id8O-DxRgoC-xFQTS-CSa7H-XSSptC-j7VIQD-xFQTS-nMzjG-&vi=111111&qp=00000&is=BBBBB2BBEYBvGl2BBCBBtUTBBRmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7OxBb8MxOtJYHCBdm5kBhBBC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBSqj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNBBBBBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbBBC4ehueB57NG9aJeRzBqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=null&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-60&qa=1600&qb=1200&qi=1600&qj=1200&to=00&po=1-0020002000002120&vy=&qr=0&url=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2021%2F02%2Fnew-malware-found-on-30000-macs-has-security-pros-stumped%2F&confidence=2&pcode=condenastprebidheader987326845656&ql=&qo=0&vf=1&vg=100&bq=8&g=4&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=155&w=276&fy=0&gp=0&zGSRC=1&gu=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2021%2F02%2Fnew-malware-found-on-30000-macs-has-security-pros-stumped%2F&id=1&ii=4&f=0&j=&t=1614702469722&de=407007513103&cu=1614702469722&m=2406&ar=b6cd16e-clean&iw=fab7aad&cb=0&ym=0&ll=2&lm=0&ln=1&r=0&dl=0&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=6149&le=1&gm=1&io=1&ch=0&vv=1&vw=1%3A3%3A0&vp=100&vx=100%3A100%3A-&pe=1%3A911%3A911%3A0%3A1201&as=1&ag=2111&an=1251&gi=1&gf=2111&gg=1251&ez=1&ck=2111&kw=1280&aj=1&pg=100&pf=100&ib=0&dw=1&ka=1&kb=1&cc=1&bw=2111&bx=1251&ci=2111&jz=1280&dj=1&dx=1&undefined=1&aa=1&ad=1982&cn=1122&gn=1&gk=1982&gl=1122&cp=1280&cq=1&cr=1&hj=0&pv=1&em=0&en=0&st=1&su=1&of=1&oz=1&oe=1%3A1%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=2172&cd=1280&ah=2172&am=1280&dq=1961&dr=1069&ds=1961&dt=1069&zx=0&tb=0&vm=1&vl=2&vt=3&vd=0&zMoatSRE=0.02228125&zMoatVSD=86&hc=0&er=0&es=0&gs=0&gt=0&eu=0&ev=0&et=1&dz=1&eb=1&ec=5078&ef=1&rf=0&re=0&cl=0&at=0&d=How%20the%20Internet%20could%20change%20under%20Trump%3A%2F3379%2Fconde.ars%2Finline-player%2Finformation-technology%2Farticle%3Aundefined%3Aundefined&gw=condenastjsvideocontent160527792519&zMoatDomain=arstechnica.com&zMoatSubdomain=arstechnica.com&zMoatVideoId=5952801dfd2e616da6000006&zMoatAP=true&ab=3&ac=1&fd=1&kt=strict&it=500&fz=1&or=0&oq=1&ot=ff&zMoatJS=3%3A-&ti=0&ih=1&tc=0&fs=188403&na=1878455748&cs=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.202.53.245 Vienna, Austria, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-202-53-245.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 02 Mar 2021 16:27:52 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: AkamaiNetStorage
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Tue, 02 Mar 2021 16:27:52 GMT

GET
H/1.1 200
OK track
capture.condenastdigital.com/ Frame 0372 48 B
48 B 138ms
137ms Image
image/gif 3.223.14.133
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://capture.condenastdigital.com/track?_o=cne&_ts=2021-03-02T16%3A27%3A52.131Z&_c=Player%20Event&_t=2%20Sec%20In-View%20Moat&app=playerservice&cBr=arstechnica&cCh=videos%2Fshow&cCu=https%3A%2F%2Fwww.arstechnica.com%2Fvideo%2Fwatch%2Fhow-the-internet-could-change-under-trump&cId=5952801dfd2e616da6000006&cKe=internet%2Cinternet%20privacy%2Cnet%20neutrality%2Cobama%2Cobama%20administration%2Cprivacy%2Ctrump&cPd=2017-06-28T10%3A00%3A00%2B00%3A00&cTi=How%20the%20Internet%20could%20change%20under%20Trump&cTy=%2F3379%2Fconde.ars%2Finline-player%2Finformation-technology%2Farticle&mDu=86&pHr=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2021%2F02%2Fnew-malware-found-on-30000-macs-has-security-pros-stumped%2F&pID=4e78db71-a622-4623-8f8c-129b7f97ef02&pWw=276&pWh=155.25&sID=eeca8fd2-2ede-4309-b7f8-017d7fcdf896&uId=0ba4f8f3-3dcb-4625-8858-f8cc027e953a&xid=50b8ab59-83f4-4626-9718-6b8bf7dc3673&dim1=%7B%22contentStartType%22%3A%22autoplay%22%2C%22doNotTrackSetting%22%3Anull%2C%22environment%22%3A%22oo%22%2C%22gitBranch%22%3A%22master%22%2C%22gitSha%22%3A%2251ae250%22%2C%22guid%22%3A%22fa0034af-4523-c7d2-6bc7-6f82408a5d7f%22%2C%22isMobile%22%3Afalse%2C%22isVerso%22%3Afalse%2C%22initialPlayerStartType%22%3A%22autoplay%22%2C%22persistent%22%3Afalse%2C%22playerDepth%22%3A481%2C%22playerType%22%3A%22interlude%22%2C%22playsOnPage%22%3A0%2C%22prerollPlayed%22%3Afalse%2C%22recAlgorithm%22%3A%22recommendations_cne-interlude-arstechnica_4f617df1-eac3-4775-9554-b0e3db036855_similar2-3%22%2C%22recStrategy%22%3A%22similar2_3%22%2C%22isRightRail%22%3Afalse%2C%22tabStatus%22%3A%22active%22%2C%22videoViews%22%3A1%2C%22viewportStatus%22%3A%22FULLY_IN_VIEWPORT%22%7D&dim2=%7B%22adBlocked%22%3Afalse%2C%22adId%22%3A%22%22%2C%22adType%22%3A%22%22%2C%22creativeId%22%3A%22%22%2C%22wrapperAdIds%22%3A%22%22%2C%22wrapperAdSystems%22%3A%22%22%2C%22dfpLineItem%22%3A%22%22%2C%22publicaEnabled%22%3Afalse%2C%22podIndex%22%3A%22%22%7D&adId=
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.223.14.133 , United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-223-14-133.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Access-Control-Allow-Origin: *
Date: Tue, 02 Mar 2021 16:27:52 GMT
Connection: keep-alive
Content-Length: 48
Content-Type: image/gif

GET
H/1.1 200
OK c1057a6f-76fc-470d-9cbc-87c086864674file-5872k-128-48000-1920-00005.ts Show response
dp8hsntg6do36.cloudfront.net/5952801dfd2e616da6000006/ Frame 0372 2 MB
2 MB 65ms
64ms XHR
application/x-mpegurl 13.32.24.6
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://dp8hsntg6do36.cloudfront.net/5952801dfd2e616da6000006/c1057a6f-76fc-470d-9cbc-87c086864674file-5872k-128-48000-1920-00005.ts?requester=oo
Requested by: Host: d2c8v52ll5s99u.cloudfront.net
URL: https://d2c8v52ll5s99u.cloudfront.net/player/main-cddebf909f5183fb417b.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.24.6 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-24-6.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: e719a5fd2292f75cad472976bbc384a9cd2a8b49d94b6bc7a2026e387743aa50

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Tue, 02 Mar 2021 06:42:34 GMT
Content-Encoding: gzip
Vary: Origin
Age: 35119
Transfer-Encoding: chunked
X-Cache: Hit from cloudfront
Connection: keep-alive
Access-Control-Allow-Origin: *
Last-Modified: Tue, 27 Jun 2017 15:57:33 GMT
Server: AmazonS3
ETag: W/"f94c7ad3b88730a7046b6246a949fcfa"
Access-Control-Max-Age: 3000
Access-Control-Allow-Methods: GET, HEAD
Content-Type: application/x-mpegURL
Via: 1.1 fd3cce3e0bafd8b312277d0ad9f4762f.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: FRA56-C2
X-Amz-Cf-Id: w1roucGT3k26mt3r6oFOU0SL8t1mqO3WqhlNkwpFk25X7swIgzKbYA==

GET
H2 200 pixel.gif
px.moatads.com/ 43 B
260 B 59ms
59ms Image
image/gif 23.202.53.245
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=5&q=1&hp=1&wf=1&vz=-&zp=0&vb=8&kq=1&lo=0&tr=1&uk=null&pk=1&wk=1&rk=1&tk=1&ak=-&i=CONDEVIDEOCONTENT1&ud=undefined&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRGt%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%5Elv%3Ch%2CeI8!A2QnbjPSI.%24ki)sV~1HmDkx2KD5pf5%5BG%5BZFZ8R6tbK0pH%23bU%24(9N%2CNJJ)%2CW%2FKo7FY&th=3645823656&tf=Id8O-DxRgoC-xFQTS-CSa7H-XSSptC-j7VIQD-xFQTS-nMzjG-&vi=111111&qp=00000&is=BBBBB2BBEYBvGl2BBCBBtUTBBRmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7OxBb8MxOtJYHCBdm5kBhBBC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBSqj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNBBBBBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbBBC4ehueB57NG9aJeRzBqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=null&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-60&qa=1600&qb=1200&qi=1600&qj=1200&to=00&po=1-0020002000002120&vy=&qr=0&url=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2021%2F02%2Fnew-malware-found-on-30000-macs-has-security-pros-stumped%2F&confidence=2&pcode=condenastprebidheader987326845656&ql=&qo=0&vf=1&vg=100&bq=8&g=5&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=155&w=276&fy=0&gp=0&zGSRC=1&gu=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2021%2F02%2Fnew-malware-found-on-30000-macs-has-security-pros-stumped%2F&id=1&ii=4&f=0&j=&t=1614702469722&de=407007513103&cu=1614702469722&m=2407&ar=b6cd16e-clean&iw=fab7aad&cb=0&ym=0&ll=2&lm=0&ln=1&r=0&dl=0&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=6149&le=1&gm=1&io=1&ch=0&vv=1&vw=1%3A3%3A0&vp=100&vx=100%3A100%3A-&pe=1%3A911%3A911%3A0%3A1201&as=1&ag=2111&an=2111&gi=1&gf=2111&gg=2111&ez=1&ck=2111&kw=1280&aj=1&pg=100&pf=100&ib=0&dw=1&ka=1&kb=1&cc=1&bw=2111&bx=2111&ci=2111&jz=1280&dj=1&dx=1&undefined=1&aa=1&ad=1982&cn=1982&gn=1&gk=1982&gl=1982&cp=1280&cq=1&cr=1&hj=0&pv=1&em=0&en=0&st=1&su=1&of=1&oz=1&oe=1%3A1%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=2172&cd=2172&ah=2172&am=2172&dq=1961&dr=1961&ds=1961&dt=1961&zx=0&tb=0&vm=1&vl=3&vt=3&vd=0&zMoatSRE=0.02228125&zMoatVSD=86&hc=0&er=0&es=0&gs=0&gt=0&eu=0&ev=0&et=1&dz=1&eb=1&ec=5078&ef=1&rf=0&re=0&cl=0&at=0&d=How%20the%20Internet%20could%20change%20under%20Trump%3A%2F3379%2Fconde.ars%2Finline-player%2Finformation-technology%2Farticle%3Aundefined%3Aundefined&gw=condenastjsvideocontent160527792519&zMoatDomain=arstechnica.com&zMoatSubdomain=arstechnica.com&zMoatVideoId=5952801dfd2e616da6000006&zMoatAP=true&ab=3&ac=1&fd=1&kt=strict&it=500&fz=1&or=0&oq=1&ot=ff&zMoatJS=3%3A-&ti=0&ih=1&tc=0&fs=188403&na=1728662952&cs=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.202.53.245 Vienna, Austria, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-202-53-245.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 02 Mar 2021 16:27:52 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: AkamaiNetStorage
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Tue, 02 Mar 2021 16:27:52 GMT

GET
H2 200 pixel.gif
px.moatads.com/ 43 B
260 B 60ms
60ms Image
image/gif 23.202.53.245
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=5&q=2&hp=1&wf=1&vz=-&zp=0&vb=8&kq=1&lo=0&tr=1&uk=null&pk=1&wk=1&rk=1&tk=1&ak=-&i=CONDEVIDEOCONTENT1&ud=undefined&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRGt%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%5Elv%3Ch%2CeI8!A2QnbjPSI.%24ki)sV~1HmDkx2KD5pf5%5BG%5BZFZ8R6tbK0pH%23bU%24(9N%2CNJJ)%2CW%2FKo7FY&th=3645823656&tf=Id8O-DxRgoC-xFQTS-CSa7H-XSSptC-j7VIQD-xFQTS-nMzjG-&vi=111111&qp=00000&is=BBBBB2BBEYBvGl2BBCBBtUTBBRmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7OxBb8MxOtJYHCBdm5kBhBBC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBSqj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNBBBBBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbBBC4ehueB57NG9aJeRzBqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=null&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-60&qa=1600&qb=1200&qi=1600&qj=1200&to=00&po=1-0020002000002120&vy=&qr=0&url=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2021%2F02%2Fnew-malware-found-on-30000-macs-has-security-pros-stumped%2F&confidence=2&pcode=condenastprebidheader987326845656&ql=&qo=0&vf=1&vg=100&bq=8&g=6&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=155&w=276&fy=0&gp=0&zGSRC=1&gu=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2021%2F02%2Fnew-malware-found-on-30000-macs-has-security-pros-stumped%2F&id=1&ii=4&f=0&j=&t=1614702469722&de=407007513103&cu=1614702469722&m=2612&ar=b6cd16e-clean&iw=fab7aad&cb=0&ym=0&ll=2&lm=0&ln=1&r=0&dl=0&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=6149&le=1&gm=1&io=1&ch=0&vv=1&vw=1%3A3%3A0&vp=100&vx=100%3A100%3A-&pe=1%3A911%3A911%3A0%3A1201&as=1&ag=2317&an=2111&gi=1&gf=2317&gg=2111&ez=1&ck=2111&kw=1280&aj=1&pg=100&pf=100&ib=0&dw=1&ka=1&kb=1&cc=1&bw=2317&bx=2111&ci=2111&jz=1280&dj=1&dx=1&undefined=1&aa=1&ad=2188&cn=1982&gn=1&gk=2188&gl=1982&co=2188&cp=1280&cq=1&cr=1&ew=1&ex=1&hj=0&pv=1&em=0&en=0&st=1&su=1&of=1&oz=1&oe=1%3A1%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=2395&cd=2172&ah=2395&am=2172&dq=2184&dr=1961&ds=2184&dt=1961&zx=0&tb=0&vm=1&vl=3&vt=4&vd=0&zMoatSRE=0.02228125&zMoatVSD=86&hc=0&er=0&es=0&gs=0&gt=0&eu=0&ev=0&et=1&dz=1&eb=1&ec=5078&ef=1&rf=0&re=0&cl=0&at=0&d=How%20the%20Internet%20could%20change%20under%20Trump%3A%2F3379%2Fconde.ars%2Finline-player%2Finformation-technology%2Farticle%3Aundefined%3Aundefined&gw=condenastjsvideocontent160527792519&zMoatDomain=arstechnica.com&zMoatSubdomain=arstechnica.com&zMoatVideoId=5952801dfd2e616da6000006&zMoatAP=true&ab=3&ac=1&fd=1&kt=strict&it=500&fz=1&or=0&oq=1&ot=ff&zMoatJS=3%3A-&ti=0&ih=1&tc=0&fs=188403&na=2087034234&cs=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.202.53.245 Vienna, Austria, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-202-53-245.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 02 Mar 2021 16:27:52 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: AkamaiNetStorage
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Tue, 02 Mar 2021 16:27:52 GMT

GET
H/1.1 200
OK c1057a6f-76fc-470d-9cbc-87c086864674file-5872k-128-48000-1920-00006.ts Show response
dp8hsntg6do36.cloudfront.net/5952801dfd2e616da6000006/ Frame 0372 2 MB
2 MB 64ms
63ms XHR
application/x-mpegurl 13.32.24.6
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://dp8hsntg6do36.cloudfront.net/5952801dfd2e616da6000006/c1057a6f-76fc-470d-9cbc-87c086864674file-5872k-128-48000-1920-00006.ts?requester=oo
Requested by: Host: d2c8v52ll5s99u.cloudfront.net
URL: https://d2c8v52ll5s99u.cloudfront.net/player/main-cddebf909f5183fb417b.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.24.6 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-24-6.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 74524c1f0502c1641d7346099315c9abda4ceb18a76acaf7462730dce8b0272d

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Tue, 02 Mar 2021 05:18:27 GMT
Content-Encoding: gzip
Vary: Origin
Age: 40166
Transfer-Encoding: chunked
X-Cache: Hit from cloudfront
Connection: keep-alive
Access-Control-Allow-Origin: *
Last-Modified: Tue, 27 Jun 2017 15:57:33 GMT
Server: AmazonS3
ETag: W/"d6d92ddf6a5991acc0ae361357c959e6"
Access-Control-Max-Age: 3000
Access-Control-Allow-Methods: GET, HEAD
Content-Type: application/x-mpegURL
Via: 1.1 fd3cce3e0bafd8b312277d0ad9f4762f.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: FRA56-C2
X-Amz-Cf-Id: xS8edXgLTCzHgnPV5NrLDkIivfc5pk9U6fNOu8F6Z287Mt-bePCvJg==

GET
H/1.1 200
OK track
capture.condenastdigital.com/ 48 B
48 B 137ms
136ms Image
image/gif 3.223.14.133
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://capture.condenastdigital.com/track?_ts=2021-03-02T16%3A27%3A52.899Z&_t=timespent&cBr=Ars%20Technica&cKe=M1%7CMacOS%7CMacs%7Cmalware&cCh=information%20technology&cTi=New%20malware%20found%20on%2030%2C000%20Macs%20has%20security%20pros%20stumped&cTy=article%7Creport&cTp=ALLBRANDS_70%2C%20ALLBRANDS_7%2C%20ALLBRANDS_63%2C%20ALLBRANDS_38%2C%20ALLBRANDS_31%2C%20ALLBRANDS_283%2C%20ALLBRANDS_274%2C%20ALLBRANDS_258%2C%20ALLBRANDS_167%2C%20ALLBRANDS_134%2C%20ALLBRANDS_64%2C%20ALLBRANDS_57%2C%20ALLBRANDS_28%2C%20ALLBRANDS_244%2C%20ALLBRANDS_21%2C%20ALLBRANDS_192&cTpw=0.4428023467608065%2C%200.4428023467608065%2C%200.4428023467608065%2C%200.4428023467608065%2C%200.4428023467608065%2C%200.4428023467608065%2C%200.4428023467608065%2C%200.4428023467608065%2C%200.4428023467608065%2C%200.4428023467608065%2C%200.23651113530694187%2C%200.23651113530694187%2C%200.23651113530694187%2C%200.23651113530694187%2C%200.23651113530694187%2C%200.23651113530694187&cEnt=malware%2C%20silver%20sparrow%2C%20page%20layout%2C%20javascript%2C%20content%20delivery%20network%2C%20installer%2C%20red%20canary%2C%20malwarebytes%2C%20dan%20goodin%2C%20apple%2C%20utc%2C%20amazon%20web%20services%2C%20silver%20sparrow.%2C%20akamai%2C%20cond%C3%A9%20nast%2C%20ars%20orbital%20transmission%2C%20internet%2C%20us%2C%20uk%2C%20canada&cEnw=1%2C%200.8108515340695781%2C%200.5893825025693292%2C%200.5234062396520748%2C%200.43266986241070404%2C%200.396383436053935%2C%200.3898142923956203%2C%200.3872030879274411%2C%200.3671837196954457%2C%200.3629702313547694%2C%200.3405881861694213%2C%200.33698642251846816%2C%200.31814344541785544%2C%200.3093789231264289%2C%200.295673457733113%2C%200.26469478813217723%2C%200.2506862805752175%2C%200.23981631622050187%2C%200.2397308210939932%2C%200.2396455567199375&cCu=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2021%2F02%2Fnew-malware-found-on-30000-macs-has-security-pros-stumped%2F&org_id=4gKgcFGUFUvCGFzHakTPfYp85Yi8&cCl=939&cId=1744063&cPd=2021-02-20T15%3A10%3A13.000%2B00%3A00&ccS=web&cPv=all&pHr=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2021%2F02%2Fnew-malware-found-on-30000-macs-has-security-pros-stumped&pRt=referral&pHp=%2Finformation-technology%2F2021%2F02%2Fnew-malware-found-on-30000-macs-has-security-pros-stumped%2F&pRr=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2021%2F02%2Fnew-malware-found-on-30000-macs-has-security-pros-stumped%2F&pWw=1600&pWh=1200&pPw=1600&pPh=6100&pSw=1600&pSh=1200&uID=668a3706-c067-4679-88d4-e763b746bdb6&uNw=1&uUq=1&pID=88a37e46-f606-4266-8066-34c3ce45374c&uDt=desktop&dim1=v1.0.25_iframe_query&_o=ars-technica&_c=general&xID=50b8ab59-83f4-4626-9718-6b8bf7dc3673&_v=5000&environment=prod&origin=ars-technica&cKh=malware%2Csilver%20sparrow%2Cpayload%2Cresearcher
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.223.14.133 , United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-223-14-133.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Access-Control-Allow-Origin: *
Date: Tue, 02 Mar 2021 16:27:52 GMT
Connection: keep-alive
Content-Length: 48
Content-Type: image/gif

GET
H/1.1 200
OK c1057a6f-76fc-470d-9cbc-87c086864674file-5872k-128-48000-1920-00007.ts Show response
dp8hsntg6do36.cloudfront.net/5952801dfd2e616da6000006/ Frame 0372 3 MB
3 MB 63ms
63ms XHR
application/x-mpegurl 13.32.24.6
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://dp8hsntg6do36.cloudfront.net/5952801dfd2e616da6000006/c1057a6f-76fc-470d-9cbc-87c086864674file-5872k-128-48000-1920-00007.ts?requester=oo
Requested by: Host: d2c8v52ll5s99u.cloudfront.net
URL: https://d2c8v52ll5s99u.cloudfront.net/player/main-cddebf909f5183fb417b.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.24.6 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-24-6.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: cd8f568e941e596d0da92f143a8c658f56cddd777ce4f6b7e486fd4cb3df11d6

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Tue, 02 Mar 2021 06:42:35 GMT
Content-Encoding: gzip
Vary: Origin
Age: 35119
Transfer-Encoding: chunked
X-Cache: Hit from cloudfront
Connection: keep-alive
Access-Control-Allow-Origin: *
Last-Modified: Tue, 27 Jun 2017 15:57:33 GMT
Server: AmazonS3
ETag: W/"d13c15e9ba1faa9f0e7af6118a32d3a4"
Access-Control-Max-Age: 3000
Access-Control-Allow-Methods: GET, HEAD
Content-Type: application/x-mpegURL
Via: 1.1 fd3cce3e0bafd8b312277d0ad9f4762f.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: FRA56-C2
X-Amz-Cf-Id: osecqOv527q7rWMiwGJe5hrxatu-vjUXNiogi91Nru1ekaG_tGtNZg==

GET
H/1.1 200
OK track
capture.condenastdigital.com/ 48 B
48 B 137ms
136ms Image
image/gif 3.223.14.133
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://capture.condenastdigital.com/track?_ts=2021-03-02T16%3A27%3A55.054Z&_t=adBlock&cBr=Ars%20Technica&cKe=M1%7CMacOS%7CMacs%7Cmalware&cCh=information%20technology&cTi=New%20malware%20found%20on%2030%2C000%20Macs%20has%20security%20pros%20stumped&cTy=article%7Creport&cTp=ALLBRANDS_70%2C%20ALLBRANDS_7%2C%20ALLBRANDS_63%2C%20ALLBRANDS_38%2C%20ALLBRANDS_31%2C%20ALLBRANDS_283%2C%20ALLBRANDS_274%2C%20ALLBRANDS_258%2C%20ALLBRANDS_167%2C%20ALLBRANDS_134%2C%20ALLBRANDS_64%2C%20ALLBRANDS_57%2C%20ALLBRANDS_28%2C%20ALLBRANDS_244%2C%20ALLBRANDS_21%2C%20ALLBRANDS_192&cTpw=0.4428023467608065%2C%200.4428023467608065%2C%200.4428023467608065%2C%200.4428023467608065%2C%200.4428023467608065%2C%200.4428023467608065%2C%200.4428023467608065%2C%200.4428023467608065%2C%200.4428023467608065%2C%200.4428023467608065%2C%200.23651113530694187%2C%200.23651113530694187%2C%200.23651113530694187%2C%200.23651113530694187%2C%200.23651113530694187%2C%200.23651113530694187&cEnt=malware%2C%20silver%20sparrow%2C%20page%20layout%2C%20javascript%2C%20content%20delivery%20network%2C%20installer%2C%20red%20canary%2C%20malwarebytes%2C%20dan%20goodin%2C%20apple%2C%20utc%2C%20amazon%20web%20services%2C%20silver%20sparrow.%2C%20akamai%2C%20cond%C3%A9%20nast%2C%20ars%20orbital%20transmission%2C%20internet%2C%20us%2C%20uk%2C%20canada&cEnw=1%2C%200.8108515340695781%2C%200.5893825025693292%2C%200.5234062396520748%2C%200.43266986241070404%2C%200.396383436053935%2C%200.3898142923956203%2C%200.3872030879274411%2C%200.3671837196954457%2C%200.3629702313547694%2C%200.3405881861694213%2C%200.33698642251846816%2C%200.31814344541785544%2C%200.3093789231264289%2C%200.295673457733113%2C%200.26469478813217723%2C%200.2506862805752175%2C%200.23981631622050187%2C%200.2397308210939932%2C%200.2396455567199375&cCu=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2021%2F02%2Fnew-malware-found-on-30000-macs-has-security-pros-stumped%2F&org_id=4gKgcFGUFUvCGFzHakTPfYp85Yi8&cCl=939&cId=1744063&cPd=2021-02-20T15%3A10%3A13.000%2B00%3A00&ccS=web&cPv=all&pHr=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2021%2F02%2Fnew-malware-found-on-30000-macs-has-security-pros-stumped&pRt=referral&pHp=%2Finformation-technology%2F2021%2F02%2Fnew-malware-found-on-30000-macs-has-security-pros-stumped%2F&pRr=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2021%2F02%2Fnew-malware-found-on-30000-macs-has-security-pros-stumped%2F&pWw=1600&pWh=1200&pPw=1600&pPh=6100&pSw=1600&pSh=1200&uID=384fa8ec-3092-4165-a774-867b43441550&uNw=1&uUq=1&pID=9ee1a6bd-fbe7-413e-bf4a-dd7bc94a75b7&uDt=desktop&dim1=%7B%22runtimeId%22%3A%22fxezXopc1n4p3%22%2C%22device%22%3A%22desktop%22%2C%22pageContext%22%3A%7B%22contentType%22%3A%22article%22%2C%22templateType%22%3A%22article%22%2C%22channel%22%3A%22information-technology%22%2C%22slug%22%3A%22new-malware-found-on-30000-macs-has-security-pros-stumped%22%2C%22server%22%3A%22production%22%2C%22keywords%22%3A%7B%22tags%22%3A%5B%22m1%22%2C%22macos%22%2C%22macs%22%2C%22malware%22%5D%2C%22cm%22%3A%5B%5D%2C%22platform%22%3A%5B%22wordpress%22%5D%2C%22copilotid%22%3A%22%22%7D%2C%22adBlock%22%3Atrue%7D%2C%22adBlock%22%3Atrue%7D&_o=ars-technica&_c=ad_metrics&xID=50b8ab59-83f4-4626-9718-6b8bf7dc3673&environment=prod&origin=ars-technica&cKh=malware%2Csilver%20sparrow%2Cpayload%2Cresearcher
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.223.14.133 , United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-223-14-133.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Access-Control-Allow-Origin: *
Date: Tue, 02 Mar 2021 16:27:55 GMT
Connection: keep-alive
transfer-encoding: chunked
Content-Type: image/gif

GET
H2 200 pixel.gif
px.moatads.com/ 43 B
260 B 59ms
58ms Image
image/gif 23.202.53.245
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=30&q=0&hp=1&wf=1&vz=-&zp=0&vb=8&kq=1&lo=0&tr=1&uk=null&pk=1&wk=1&rk=1&tk=1&ak=-&i=CONDEVIDEOCONTENT1&ud=undefined&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8CL6k%24)m3*%5B%605*mF%40%23b%3DhjdbEW%3C7bNC%3ElaKc%2C%26WLRGt%269RHrOCFxBoocF)uhFAkD%3Dv%3Cy%5Dv%5BLy*hgMcpk%3FqFm%5Dm%22%2Bx%7Co%3Ee%7CwR3yC%7CQ%5Elv%3Ch%2CeI8!A2QnbjPSI.%24ki)sV~1HmDkx2KD5pf5%5BG%5BZFZ8R6tbK0pH%23bU%24(9N%2CNJJ)%2CW%2FKo7FY&th=3645823656&tf=Id8O-DxRgoC-xFQTS-CSa7H-XSSptC-j7VIQD-xFQTS-nMzjG-&vi=111111&qp=00000&is=BBBBB2BBEYBvGl2BBCBBtUTBBRmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7OxBb8MxOtJYHCBdm5kBhBBC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBSqj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNBBBBBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbBBC4ehueB57NG9aJeRzBqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=null&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-60&qa=1600&qb=1200&qi=1600&qj=1200&to=00&po=1-0020002000002120&vy=&qr=0&url=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2021%2F02%2Fnew-malware-found-on-30000-macs-has-security-pros-stumped%2F&confidence=2&pcode=condenastprebidheader987326845656&ql=&qo=0&vf=1&vg=100&bq=8&g=7&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=155&w=276&fy=0&gp=0&zGSRC=1&gu=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2021%2F02%2Fnew-malware-found-on-30000-macs-has-security-pros-stumped%2F&id=1&ii=4&f=0&j=&t=1614702469722&de=407007513103&cu=1614702469722&m=5457&ar=b6cd16e-clean&iw=fab7aad&cb=0&ym=0&ll=2&lm=0&ln=1&r=0&dl=0&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=6149&le=1&gm=1&io=1&ch=0&vv=1&vw=1%3A3%3A0&vp=100&vx=100%3A100%3A-&pe=1%3A911%3A911%3A0%3A1201&as=1&ag=5162&an=2317&gi=1&gf=5162&gg=2317&ez=1&ck=2111&kw=1280&aj=1&pg=100&pf=100&ib=0&dw=1&ka=1&kb=1&cc=1&bw=5162&bx=2317&ci=2111&jz=1280&dj=1&dx=1&undefined=1&aa=1&ad=5033&cn=2188&gn=1&gk=5033&gl=2188&co=2188&cp=1280&cq=1&cr=1&ew=1&ex=1&hj=0&pv=1&em=0&en=0&st=1&su=1&of=1&oz=1&oe=1%3A1%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=5446&cd=2395&ah=5446&am=2395&dq=5235&dr=2184&ds=5235&dt=2184&zx=0&tb=0&vm=1&vl=4&vt=9&vd=0&zMoatSRE=0.02228125&zMoatVSD=86&hc=0&er=0&es=0&gs=0&gt=0&eu=0&ev=0&et=1&dz=1&eb=1&ec=5078&ek=1&ef=1&rf=0&re=0&cl=0&at=0&d=How%20the%20Internet%20could%20change%20under%20Trump%3A%2F3379%2Fconde.ars%2Finline-player%2Finformation-technology%2Farticle%3Aundefined%3Aundefined&gw=condenastjsvideocontent160527792519&zMoatDomain=arstechnica.com&zMoatSubdomain=arstechnica.com&zMoatVideoId=5952801dfd2e616da6000006&zMoatAP=true&ab=3&ac=1&fd=1&kt=strict&it=500&fz=1&or=0&oq=1&ot=ff&zMoatJS=3%3A-&ti=0&ih=1&tc=0&fs=188403&na=1695741624&cs=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.202.53.245 Vienna, Austria, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-202-53-245.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 02 Mar 2021 16:27:55 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: AkamaiNetStorage
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Tue, 02 Mar 2021 16:27:55 GMT

POST
H/1.1 204
No Content events
wren.condenastdigital.com/1.0/conde/ 0
732 B 146ms
146ms Other
image/gif 52.207.120.193
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://wren.condenastdigital.com/1.0/conde/events?topic=wren.events.ads&api_key=d3Jlbg

Requested by

Host: cdn.arstechnica.net
URL: https://cdn.arstechnica.net/cns/ars-technica.min.js?v=1614702432

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.207.120.193 , United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-52-207-120-193.compute-1.amazonaws.com

Software

nginx/1.15.8 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

Date: Tue, 02 Mar 2021 16:27:56 GMT
x-content-type-options: nosniff
Server: nginx/1.15.8
x-frame-options: DENY
x-download-options: noopen
vary: origin
Connection: keep-alive
Content-Type: image/gif
access-control-allow-origin: https://arstechnica.com
access-control-expose-headers: WWW-Authenticate,Server-Authorization
cache-control: no-cache
access-control-allow-credentials: true
strict-transport-security: max-age=15768000; preload
x-xss-protection: 1; mode=block

GET
H/1.1 200
OK c1057a6f-76fc-470d-9cbc-87c086864674file-5872k-128-48000-1920-00008.ts Show response
dp8hsntg6do36.cloudfront.net/5952801dfd2e616da6000006/ Frame 0372 2 MB
2 MB 64ms
63ms XHR
application/x-mpegurl 13.32.24.6
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://dp8hsntg6do36.cloudfront.net/5952801dfd2e616da6000006/c1057a6f-76fc-470d-9cbc-87c086864674file-5872k-128-48000-1920-00008.ts?requester=oo
Requested by: Host: d2c8v52ll5s99u.cloudfront.net
URL: https://d2c8v52ll5s99u.cloudfront.net/player/main-cddebf909f5183fb417b.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.24.6 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-24-6.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: dd7cbc3d9d129b13e77dfc973e2063ef702bd96367570011c40eb0005b037131

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Tue, 02 Mar 2021 04:38:04 GMT
Content-Encoding: gzip
Vary: Origin
Age: 42593
Transfer-Encoding: chunked
X-Cache: Hit from cloudfront
Connection: keep-alive
Access-Control-Allow-Origin: *
Last-Modified: Tue, 27 Jun 2017 15:57:32 GMT
Server: AmazonS3
ETag: W/"88688869c42e2724af8ace7939bfdc95"
Access-Control-Max-Age: 3000
Access-Control-Allow-Methods: GET, HEAD
Content-Type: application/x-mpegURL
Via: 1.1 fd3cce3e0bafd8b312277d0ad9f4762f.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: FRA56-C2
X-Amz-Cf-Id: Af-0qD9sTKuIH0tesG_2-ZGAiXMgB2cr3MWCOxMpwMTSAVYBMlX0MA==

GET
H/1.1

200
OK

p2
sb.scorecardresearch.com/ Frame 0372
Redirect Chain

https://sb.scorecardresearch.com/p?c1=2&c2=6035094&ns_type=hidden&ns_st_sv=4.1505.18&ns_st_it=r&ns_st_id=1614702468331_1&ns_st_ec=2&ns_st_sp=1&ns_st_cn=1&ns_st_ev=hb&ns_st_po=10032&ns_st_cl=86000&n...
https://sb.scorecardresearch.com/p2?c1=2&c2=6035094&ns_type=hidden&ns_st_sv=4.1505.18&ns_st_it=r&ns_st_id=1614702468331_1&ns_st_ec=2&ns_st_sp=1&ns_st_cn=1&ns_st_ev=hb&ns_st_po=10032&ns_st_cl=86000&...

43 B
589 B

97ms
96ms

Image
image/gif

104.111.238.139
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sb.scorecardresearch.com/p2?c1=2&c2=6035094&ns_type=hidden&ns_st_sv=4.1505.18&ns_st_it=r&ns_st_id=1614702468331_1&ns_st_ec=2&ns_st_sp=1&ns_st_cn=1&ns_st_ev=hb&ns_st_po=10032&ns_st_cl=86000&ns_st_hc=1&ns_st_mp=streamsense&ns_st_mv=4.1505.18&ns_st_pn=1&ns_st_tp=0&ns_st_pt=10032&ns_st_pa=10032&ns_st_ci=5952801dfd2e616da6000006&ns_ts=1614702478363&ns_st_bt=0&ns_st_bp=0&ns_st_pc=0&ns_st_pp=0&ns_st_br=0&ns_st_ub=0&ns_st_pr=*null&ns_st_ep=*null&ns_st_ct=vc&ns_st_ge=*null&ns_st_st=*null&ns_st_pu=*null&c3=ARSTECHNICA&c4=*null&c6=*null&c7=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2021%2F02%2Fnew-malware-found-on-30000-macs-has-security-pros-stumped%2F&c8=How%20the%20Internet%20could%20change%20under%20Trump&c9=&ns_st_sn=*null&ns_st_en=*null&ns_st_ti=*null&ns_st_ia=*null&ns_st_ce=*null&ns_st_ddt=*null&ns_st_tdt=*null&cs_ak_ss=1
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 104.111.238.139 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-238-139.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 24e480e4659fbae818853a38f8a3036f529f539024dc3e772c0b594ce02ea9db

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 02 Mar 2021 16:27:58 GMT
Cache-Control: private, no-cache, no-cache=Set-Cookie, no-store, proxy-revalidate
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Mon, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://sb.scorecardresearch.com/p2?c1=2&c2=6035094&ns_type=hidden&ns_st_sv=4.1505.18&ns_st_it=r&ns_st_id=1614702468331_1&ns_st_ec=2&ns_st_sp=1&ns_st_cn=1&ns_st_ev=hb&ns_st_po=10032&ns_st_cl=86000&ns_st_hc=1&ns_st_mp=streamsense&ns_st_mv=4.1505.18&ns_st_pn=1&ns_st_tp=0&ns_st_pt=10032&ns_st_pa=10032&ns_st_ci=5952801dfd2e616da6000006&ns_ts=1614702478363&ns_st_bt=0&ns_st_bp=0&ns_st_pc=0&ns_st_pp=0&ns_st_br=0&ns_st_ub=0&ns_st_pr=*null&ns_st_ep=*null&ns_st_ct=vc&ns_st_ge=*null&ns_st_st=*null&ns_st_pu=*null&c3=ARSTECHNICA&c4=*null&c6=*null&c7=https%3A%2F%2Farstechnica.com%2Finformation-technology%2F2021%2F02%2Fnew-malware-found-on-30000-macs-has-security-pros-stumped%2F&c8=How%20the%20Internet%20could%20change%20under%20Trump&c9=&ns_st_sn=*null&ns_st_en=*null&ns_st_ti=*null&ns_st_ia=*null&ns_st_ce=*null&ns_st_ddt=*null&ns_st_tdt=*null&cs_ak_ss=1
Pragma: no-cache
Date: Tue, 02 Mar 2021 16:27:58 GMT
Cache-Control: private, no-cache, no-cache=Set-Cookie, no-store, proxy-revalidate
Connection: keep-alive
Content-Length: 0
Expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK c1057a6f-76fc-470d-9cbc-87c086864674file-5872k-128-48000-1920-00009.ts Show response
dp8hsntg6do36.cloudfront.net/5952801dfd2e616da6000006/ Frame 0372 2 MB
2 MB 65ms
65ms XHR
application/x-mpegurl 13.32.24.6
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://dp8hsntg6do36.cloudfront.net/5952801dfd2e616da6000006/c1057a6f-76fc-470d-9cbc-87c086864674file-5872k-128-48000-1920-00009.ts?requester=oo
Requested by: Host: d2c8v52ll5s99u.cloudfront.net
URL: https://d2c8v52ll5s99u.cloudfront.net/player/main-cddebf909f5183fb417b.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.24.6 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-24-6.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 20ed77a4522b2f9cba90121ccdf4041a270e49680354c2f1bb66a13139aa5f65

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Tue, 02 Mar 2021 05:18:34 GMT
Content-Encoding: gzip
Vary: Accept-Encoding,Origin
Age: 40166
Transfer-Encoding: chunked
X-Cache: Hit from cloudfront
Connection: keep-alive
Access-Control-Allow-Origin: *
Last-Modified: Tue, 27 Jun 2017 15:57:33 GMT
Server: AmazonS3
ETag: W/"cd8cd80f2fd50c3979e6377fcfb2532b"
Access-Control-Max-Age: 3000
Access-Control-Allow-Methods: GET, HEAD
Content-Type: application/x-mpegURL
Via: 1.1 fd3cce3e0bafd8b312277d0ad9f4762f.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: FRA56-C2
X-Amz-Cf-Id: YAlBZ5Z4RivIhLQRsrH5ZPagXvRJM154svu6Js-JyqdMjzp0yPTH9w==

GET
H/1.1 200
OK usersync Show response
usersync.getpublica.com/ Frame 2FFC 0
198 B 573ms
140ms Document
text/plain 3.230.55.171
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://usersync.getpublica.com/usersync?gpdr=0&consent=&us_privacy=
Requested by: Host: sync.getpublica.com
URL: https://sync.getpublica.com/sync.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.230.55.171 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-230-55-171.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Host: usersync.getpublica.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/

Response headers

Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate
Expires: 0
Pragma: no-cache
Vary: Origin
Date: Tue, 02 Mar 2021 16:28:00 GMT
Content-Length: 0

GET
H/1.1 200
OK usersync Show response
usersync.getpublica.com/ Frame 63B5 0
198 B 563ms
143ms Document
text/plain 3.230.55.171
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://usersync.getpublica.com/usersync?gpdr=0&consent=&us_privacy=
Requested by: Host: sync.getpublica.com
URL: https://sync.getpublica.com/sync.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.230.55.171 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-230-55-171.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Host: usersync.getpublica.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/

Response headers

Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate
Expires: 0
Pragma: no-cache
Vary: Origin
Date: Tue, 02 Mar 2021 16:28:00 GMT
Content-Length: 0

GET
H/1.1 200
OK c1057a6f-76fc-470d-9cbc-87c086864674file-5872k-128-48000-1920-00010.ts Show response
dp8hsntg6do36.cloudfront.net/5952801dfd2e616da6000006/ Frame 0372 2 MB
2 MB 64ms
64ms XHR
application/x-mpegurl 13.32.24.6
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://dp8hsntg6do36.cloudfront.net/5952801dfd2e616da6000006/c1057a6f-76fc-470d-9cbc-87c086864674file-5872k-128-48000-1920-00010.ts?requester=oo
Requested by: Host: d2c8v52ll5s99u.cloudfront.net
URL: https://d2c8v52ll5s99u.cloudfront.net/player/main-cddebf909f5183fb417b.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.24.6 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-24-6.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: f082ad0a8aed89f5573ea8d795de90595477f3bc7a5fe4805199864a56026a46

Request headers

Referer: https://arstechnica.com/information-technology/2021/02/new-malware-found-on-30000-macs-has-security-pros-stumped/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Tue, 02 Mar 2021 04:38:10 GMT
Content-Encoding: gzip
Vary: Origin
Age: 42593
Transfer-Encoding: chunked
X-Cache: Hit from cloudfront
Connection: keep-alive
Access-Control-Allow-Origin: *
Last-Modified: Tue, 27 Jun 2017 15:57:32 GMT
Server: AmazonS3
ETag: W/"f30b552991a3db8904f44f96976c4163"
Access-Control-Max-Age: 3000
Access-Control-Allow-Methods: GET, HEAD
Content-Type: application/x-mpegURL
Via: 1.1 fd3cce3e0bafd8b312277d0ad9f4762f.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: FRA56-C2
X-Amz-Cf-Id: -iCyMhEfYzkGlgpCnQswMEdKukoSrFzdfVVUQiYoRv1QTCMJCz3TEw==

Verdicts & Comments Add Verdict or Comment

161 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

4 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	error	URL: https://player.cnevids.com/script/video/5952801dfd2e616da6000006.js?autoplay=1&hasCompanion=false&hideHoverTitle=1&hidePosterTitle=1&muted=1&onReady=setupInterlude1&playerType=interlude&recAlgorithm=recommendations_cne-interlude-arstechnica_4f617df1-eac3-4775-9554-b0e3db036855_similar2-3&recStrategy=similar2_3&showPlaylistBar=false(Line 1) Message: CNE Player: Error fetching or parsing prebid Error: Empty errorData => [object Object]
console-api	log	URL: https://cdn.cookielaw.org/opt-out/otCCPAiab.js(Line 96) Message: received a request for uspapi
console-api	log	URL: https://cdn.cookielaw.org/opt-out/otCCPAiab.js(Line 96) Message: received a request for uspapi
console-api	log	URL: https://d2c8v52ll5s99u.cloudfront.net/player/main-cddebf909f5183fb417b.js(Line 12) Message: VIDEOJS: adserror (Preroll)

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	default-src https: data: 'unsafe-inline' 'unsafe-eval'; child-src https: data: blob:; connect-src https: data: blob:; font-src https: data:; img-src https: data:; media-src blob: data: https:; object-src https:; script-src https: data: blob: 'unsafe-inline' 'unsafe-eval'; style-src https: 'unsafe-inline'; block-all-mixed-content; upgrade-insecure-requests
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

4d.condenastdigital.com
acdn.adnxs.com
ampcid.google.com
ampcid.google.de
api.cnevids.com
api.condenast.io
api.rlcdn.com
arstechnica.com
as-sec.casalemedia.com
assoc-na.associates-amazon.com
c.amazon-adsystem.com
c1.adform.net
c2shb.ssp.yahoo.com
capture.condenastdigital.com
cdn.arstechnica.net
cdn.cookielaw.org
cdn.mediavoice.com
cm.g.doubleclick.net
condenastus-d.openx.net
connect.facebook.net
contextual.media.net
d2c8v52ll5s99u.cloudfront.net
dp8hsntg6do36.cloudfront.net
dwgyu36up6iuz.cloudfront.net
eu-u.openx.net
eus.rubiconproject.com
fastlane.rubiconproject.com
fpa-cdn.arstechnica.com
fpa-events.arstechnica.com
geolocation.onetrust.com
hblg.media.net
htlb.casalemedia.com
ib.adnxs.com
images.outbrainimg.com
imasdk.googleapis.com
infinityid.condenastdigital.com
js-sec.indexww.com
log.outbrainimg.com
match.adsrvr.org
mb.moatads.com
mcdp-nydc1.outbrain.com
mid.rkdms.com
odb.outbrain.com
p.skimresources.com
pagead2.googlesyndication.com
pbs.getpublica.com
pixel.condenastdigital.com
pixel.quantserve.com
player.cnevids.com
plugin.mediavoice.com
polarcdn-terrax.com
prebid.media.net
pubads.g.doubleclick.net
px.moatads.com
r.skimresources.com
s.skimresources.com
s0.2mdn.net
sb.scorecardresearch.com
securepubads.g.doubleclick.net
segment-data.zqtk.net
srv-1970-01-01-00.pixel.parsely.com
ssum-sec.casalemedia.com
stats.g.doubleclick.net
sync.getpublica.com
sync.mathtag.com
t.skimresources.com
tcheck.outbrainimg.com
token.rubiconproject.com
us-u.openx.net
usersync.getpublica.com
widget-pixels.outbrain.com
widgets.outbrain.com
wren.condenastdigital.com
www.facebook.com
www.google-analytics.com
www.google.com
www.google.de
www.googletagmanager.com
www.googletagservices.com
z-na.associates-amazon.com
z.moatads.com
104.111.238.139
104.85.4.23
104.85.5.185
13.224.192.34
13.225.82.136
13.32.23.187
13.32.24.125
13.32.24.41
13.32.24.6
142.250.186.34
142.250.186.66
151.101.13.108
151.101.14.132
151.101.192.239
151.139.128.11
18.156.195.47
18.190.81.75
18.211.112.77
184.30.212.16
184.31.84.150
185.29.135.233
185.33.221.88
205.234.175.175
23.202.53.159
23.202.53.245
23.202.53.51
2600:9000:2156:1e00:4:14f9:7480:93a1
2606:4700:10::6814:b944
2606:4700::6810:9440
2606:4700::6811:4032
2606:4700::6813:d983
2620:116:800d:21:8c6e:cf2c:8d6:9fb5
2a00:1450:4001:802::2002
2a00:1450:4001:80f::2003
2a00:1450:4001:80f::2008
2a00:1450:4001:80f::200e
2a00:1450:4001:813::2004
2a00:1450:4001:813::2006
2a00:1450:4001:827::200a
2a00:1450:4001:827::200e
2a00:1450:4001:829::200e
2a00:1450:400c:c0c::9a
2a03:2880:f01c:8012:face:b00c:0:3
2a03:2880:f11c:8183:face:b00c:0:25de
3.208.40.114
3.214.160.249
3.223.14.133
3.230.55.171
34.120.207.148
34.231.165.20
34.253.148.162
34.98.64.218
35.190.59.101
35.190.91.160
35.201.67.47
37.157.6.247
52.207.120.193
52.94.243.89
54.145.213.132
54.194.105.192
54.209.211.127
64.202.112.31
65.9.58.74
65.9.67.76
69.173.144.139
69.173.144.141
70.42.32.63
99.80.71.186
0186840386391fa2c0750ff7450a78e066498ba3274546a6fcf0fa9c55cd457c
030e91b7512dbb40e9b9057f20bcf54c296a7f28c04bbcde0f2d2706dd2a3a06
03449ecbbdb76ecc662e2ad64ea3d61da16722c7f1bb3c0fcc87e52db7eba42f
039f13cdf684666dd973e2385f773385adb074039e8a832ec48e1ae35fb20c15
050dd574b27efe92f91dc7ebd38b529a487c5565ffd4af3e8ab56152e32f8298
06aef6ad8a55bd62e43cb59c34dae99579be260c600327bdb0ee737dea694661
06b33c040105224101afcdaacd82b6dfb3ea1bf9ef3d7478cf5fa163a0ad65e0
06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844
078981fc821f3cf39ab491128cca5f9e9f9aeda1987a4baf81ce5ddc3bbe860c
08b8b78504677c4bb61018fbcfe343bf7603d3ea56b3b47d9532569104f9b5c0
08ed3bf6e73a999bafb422b878fb05b87269b00a65230c9457ce75aee10b873e
09129fc345d4d48e4b4fab5c7d0a2d789540768e7b65d92553975f58c28c6594
0a15aa5505b21b62953249515bd4c74ea9bce17b4e5416f74374aa98023a40e5
0a7188ca97decc5be0cbf72a8faad44c1e62b0e6bc9af245db46870c8dcf8c45
0b5c6a8d4a856db56da956eced8af9a5eb6e0a89dc67de5ffc4c83513472a3cc
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
0be98834a252aa173b24c2de062a0e5623d684baadb1b1d18ee26b93f3c8f6b7
0c09c070833c786cb25be38bc30992b30bad578f817dbc9e34beacd8b8ea44c5
0cb247be3e04fe36794b875373c19153f34f03eb05aae37ff743e68708cc5a51
0f3be44690ae9914ae3e47b7752e1bdea316f09938e9094f99e0de19ccd8987a
1097abb6f0992cccc79428374463e7f23b99dae5eb85d7317b20bd57c96031bb
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
114337975e73acb5a340f406cd8b20163496ed66e1a543f2d0719f4c4e06586a
1193e934b76ed372f47e23f78f8a13e99d9588e564aff866e8f700e7a0650a83
119469f02e1dfeb4757bb7d609dcf00b2237a78212bb6b05977c4b0af0dd3363
12b9bdf3807ad4ff800194feeee5ba36cb07be022f3709f99c1f105a4fd5df31
130eab0b79272570e565d77bb286b5755b9aae8f33efe8af7a2689bf8eabb859
1370c96be1c754ed05c9d7fa4107cd6f1c7e25b1eee343b06d4b0b0271febb7f
13c28910868fabba31657c04b0ae5101c420762f1338607b97fff58f9d856274
13f63ab5fa8d3973eef6d6366052135fb3958b54ca2149cc691864b03ed7d848
159870d28d6a141f4c7da2dcf3970caf103a391dea9149500a8407276a69b070
16708dda2536b4b3782313db4a6ec8456cd84da7ae0f56d7d2455e68fc9bc4f0
16f86804dd013db340fee4020a539d3e9d6e5a03d6841e431e50c428e99c26e8
17f21ab470f0a1cacd46e91124483e9223826b56adb10a874538b4bd9a0f45ed
18ced2cb193607eafa1f7c88780c693fbf0c88a0e6cbf13c83b78b082ead1836
19c68177806d520a04ae71ded68085e5eef7f05b209ec4896efafb0f164432d7
1a3030de2b854c090bd24bef92c316193cdb65d9483e593b66f9acbb26d58f0b
1b94f9074fc2ef1b63132fc70fe244cc5d5322e5982a80b6273a45a935ae335f
1bf55bc00dbf13180884211c3d301729e67b81f3456225c1fbf97d271d636509
1c7dcc8216c6f82da2998ceeac2523632c7f9bffe510824b6d082621201f2012
1dcacffd5056e8521c39d12085fe6a73b310f80bd764e77e067ff15b49a715d3
1defb6bc54a7ee9c066136908360e8455c23ee9ad0dec9924e7255d7948cd4be
1e026b1ec6226d83238026e75d5b1b9e575cc563f350eeceeb90f1db91d66138
1f466b08649eef5ad16c20f6d7207bf8818cb107b6241950dbc568cdffc03d63
1f9cd4a445ba85172da6090dd7b95edf55fd9e81ddb193e0b78093c1afa84378
20660a9ef7ec454c15b2dc62b3db084e0cc9f74c5bb6de71a96fb1a54aef00f8
20ed77a4522b2f9cba90121ccdf4041a270e49680354c2f1bb66a13139aa5f65
24e480e4659fbae818853a38f8a3036f529f539024dc3e772c0b594ce02ea9db
265974f7dd29be4bae22250bd4afd4e57a20eb3c12dc8f623218e1cd8b03fd76
2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df
27348ba4b98bd80f1038496ec5dea6ad865680540058fb085b8ca199b8aaf4c5
281ba70d6e7e5c193cd6b4bbb0c656e15e9479573bc02debaeba7c084c37bb21
28fd8292cd179f7501cd6540946091259ada3e6fd363ef40c126528e0ac8b60f
29637e0647104ccc5d5583e652db29ce99e947c858c3d9502960e7ea7f1aea19
2bc266428249de342be33433e44908cf53432be4fe1fe7594db37b443ebe6b63
2db2f16f2ca017e865150e9b6edbbc4c4349ad8448db72e8bb21bbfb40cc4092
2f72c08bf85b4f043471e7d56c29dc5d084b6744ff5345a57582ec24eb1de919
38c1171626aa245f31b9441b2a7d7545ad80033bf463ed4bc591b6cf9302f588
3a268d0781eb4eeaffdfd67f4afcc7d3e1e9c28e1a3133ced5d8a6ec8dcec79e
3a478cc89688c6d5bc04418bbfd3da092d2df5c78ad9b6663975cceb83832e61
3b0209841325362235c221628e471145726897e4e1c9b210b6e6b2217fdf2ee8
3b49902701ca966d959b465a55168153d535ca2cf9241e6abd740cab6dfe614a
3c4c9e412b61eeff2c5e3743ef2a3cb0b6c0e11961bfb033a04be504c58bf081
3ce7e824185893264ab44fbf8370a8f1262831c4c6c367b15f7d4f1e88fadc8c
3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd
3f2cf5f857c617761a251ceef8f6ed452a7690e21f16eff0a70dddf9beea8633
43e5f72df0718e67f1b947b4910933307c75b55148777f686cc197e3e24dea49
451c12f71b589bb0f76d663003c2090670e94f3f104baf6a4377c150d82964ae
4699bf08167c6062952580605d7e01cc8eac865733ee427dbf050f8f9c6ffca9
46a9ddb1f206a46900872e0a832750ae06925528f81883a3d3517fdb42aefb6d
47816b9ab41f9e6b513817cd19ff0e3fd5f646c733942ce1f8153030cf8e4223
49282a74c6ced31e99f808232188ade8d82652004df4d664dcdb98c32563dd39
492abbc30ace41332a8f68b7f34f56333a037aebac34e0bc9b9cedb0d1c3b032
4980853759711c8e9e2779239acd62e9e802fba38371763c65ecdd016a83fdbd
49e468dc2f899f16654273e495fadf87ca7a840d2d80f839b2f0b681af187e6d
4cd8e5548ab405e238b77c140a137d71e1f594a9ed18ce68d12246d8c0e637a0
4ddc003bfd0366a9c5e059509b3bac51972a8e803904b2a90b6b5c5ee7b26720
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
4ec4b6769730ca98db1f40b152c52bd5bec01f61f559fb92709c307750388ac8
4f27473112250ff771b069a5640dd77e4b4618a8205203aadf9b1ca1fc63079e
4f3b933077b738b503f7543ffc82fa0a061f0fe7d0ff1470865fde561a324bcc
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
5315cf641e62ac7de4a82e6003cc1bd1ff09218400d8ff5286c951e25aee966b
56f8838a24cb0cc47dc34a19d6b84d6ce8bf8086b1682bbb990abc13b1e2da65
575d85bcb7691a3cf88b885296ecdffb8f9f1857847a1b256f1ad54c5be891ba
57fa08d15c38c75b5d2501f6845a6f42a380cbccf07c645ee410658ab901c955
59201950b83489808587827b4050ffe0597992825daa88c227476cdbbf8ca282
5ab499494548829e507e9b6cd57247a6cd565e7f1bc6eb55e3da445af76f1f0c
5be5b0170ad4bbd2be91182d137933e7de9c7e86b09ec855a4bac015ebfd746f
5e47ba3677210affb7d14f8c3147b57c2503df00f455809a79a7ee5c0fd640a5
5ecbfb541946a9a9437190a21d98e1c7ab7d863837d7d038a9a1e053c649c8ba
6139e1fc0d3709eebbe2b18510cf24361b9f8a538c3529a73c282bafe6c78474
61427e2bab387b8f902367d19f7a7f302c64419d04c302bee5ecc994e9ec5970
617e0f9fee7ef0ca891735246b4b5a61caa3622db4a4256685b061c9f43bd053
62c7d2da9a5942053f17c9756e53b7cda414541619bd35c2b1441cd88c77f235
6778c1cbaff93c029c520c00f0d3463b7f296adea236f22410bbabbebc8a6cea
6b57b536ffc354851a6d8595fed472777034c541ada2be4edd321748bad3e3d8
6b9787f057bf70e98ef534ee4e6916b294ee043dd398fcbfbd06ad7e742c1d23
6f25e54ff758a69c92c7260b3647788acb86b4fc6266141893e1a4316b5a0862
6f261533d4b74ae931965cf3609bf47bb55001e39eb7029502d96cec73c4749a
701611e702ac07e223abf07eb261c4de26244b60f99fac346ca19da3b23ce57c
7304d6dbfd2cebc5fa4d0c8078f3a834486f7a717dc3cf5cdcfa39e0b7299849
7364fcbb6c5d775f07816712af8a6419db99268f72c337a4977f706dc3423bb3
73c3fc6b03919dcf186364edf822f462cc8c2e3d5fd42e14583267ff65165095
7401eddcf89110f15c8ae1dbc8bb7c246c19ea1d5ddb8316635b8e0863a812f2
74524c1f0502c1641d7346099315c9abda4ceb18a76acaf7462730dce8b0272d
745a085b52b8371ec6705413fca70a28c6d8bff0db480e6b124bd08c54e95ef8
7475f5c70d3b6020b6f4621b2e69fba3360bea00a913e60b085af165b93842ec
7637a6c8fa6c7c9ce19cebb23b29bf76e3ccec9fdf037483433262df92115388
7725538fe2f71147bffeba7452b434c826aef9009666cb4360c605d0b2a91d1d
774450873519c5e57ff4563f98c016010952d04b7cf3c75f851bfd0c185bed31
7806a4df34b650cf1d585d921415065b0d2fd3875d3c4596123f2426d566be96
78c8c364b438f0be81f1c51627902fda95b7aebdd2c04aee28c2f72cd4390207
796c46ec10bc9105545f6f90d51593921b69956bd9087eb72bee83f40ad86f90
7c9c9c29b3dba83c4fcb627a7d9e746c8edac1ca8e8d21a6d20e816e9ceaf03e
7d19976e2b1dbcfb861853c6571731616fedf63e37bb9631de6bbdf63e19afdf
7d91c04c657709af03f6dad61d375c3208d18ab5ff7851c2472007dc05201342
7eb948a3546f5f32d94ddf09fbfa649a41093c39405d46cae67698e149dddc58
7eca7977c6ade416c20775a7fd7cfa2291c5752cd1225d5c4342b057c37a000c
7fa08d7f9994608e0beaffa2eddc86eb4d187be7560e968702f14293dc506fac
7fc88c65d46e83b3f3e9f098f05fd639480332fc3718cd714725e2e4633af4e8
807271433f80bb33654a84ec904035be3d2b34e505a051e3469a47fe39ccb752
81469a461efda75b24794f73dadc9ce5606d1bd75b505f5d117d89e9a562813b
82cd1a97f81e5b63a621311be2993916eea0907b5eadd53bb6b280f4bb0f8391
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
833a86642252016b29f08dd45ffd27f9e00ca237f28d8c5f0147a6e15d009377
83a366075eb2387c6d9f848f42b08df0546027333eccf5813edf95ba45709be2
845ceb7470fa8137610b4f7e0d862f5d1186e060b8914addca7e6f8a1414bfd1
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
85db95dbe15c810a710ca6d9094a2a29f2eeea05791cc7aaab7af8939684b978
86096831a70c72ac0c08f5e65ae92d98330d9fd2b7511dde65ff50b8a16bfd9a
863b0e04b9e8af02d763cb98563ca8d9f80c6b99a3ec2eb6395db229bc3f8ba9
8672345ec715b43b89a4de8e3f54b8cb7de995c33db14a1665356b6beb1aecea
88288b8bccc37e461dbe1c53467610729f6aaead1cdec295b096b144a0676a1e
8a5f30ebe17876cba2fcd044b340e9b232a981bb2f1601856d4c1f713e231a29
8b3b177ff5d680541fb0dfe91141757ae86d3dfb4ecb3508cf601a02261fb8ba
8b72952d3fd656ee6594f0d9735d928113ad1d590705b14f77abf75f1d4d5d69
8d5126dc968032c4858517a11dfe633130a8c31d577fe6f5c2de404eefb0982f
8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0
8dc40a5096530714279199bd98ffbe44f3108bf9dd183ec74d85f69705d86e25
8fd3b78ce066771a0b6aa2c4ad501e8d1305ce43eb2b4dde84d5f88b1a299fd7
90daf70d02545637e50825cbb49be93e91b36f3f1f9674b75724743c013cca6b
929701ed632814943e3df803ddd9e3f179ccf889c0ad7b7f3392bd8d109b174f
92fca55833f48b4289ac8f1cedd48752b580fce4ec4b5d81670b8193d6e51b54
9431bc6d1a6d036a70c92dfc9000d7965f939671a59705bdd01c3e652048ed9a
948226984e93a8a49e2fbc6ae7d4f3c17d68e606f703d76ec956f771fbc670cb
94ea4c125ce31b5a17e000088c07129c7b73a225ae5f87d58b82490e663413d7
96824b72aa12ccea1334a545f44967fbc0fd04aaad0a1cb8cac609fab148ca89
968becb1b046753d1c398fa0f40052923873c2423147903a37958b198a64ffe9
97b0d993c6c0d74e3288226c3a688e8383d23ddd7abbfedad9752893db9307f2
991bfe84fec788f2b7d432b99a60c1e2aa2e799bc0137da8cf478299d0fc9a10
9933997608e86beaf1e7f7188a5c657cdad8ccd9d20eb7b1a46adaa83fa850ab
9e7ea2b4ba8e2bcc4a964d6192e4671dc5f6863a1c7e35b52b229a3c1e67a68d
a11f37584d425c821f06a42bb6a20546c9ceaf34bbf5d4d776afbaef40148e6e
a92675588de87ecbcfe5bdea2fff0f7078d46c1d599a7e62093a1f182e324b91
aa3b9513abbbf65a2c8483122648fce1b39b1afa2a69bdf863242f1411baba58
ab42a6882b7ca7c6dd39ff409d4d26cb0f7969b608e077331b3afc1a0a72087b
afb145bd40df8dffa617b6e9e404d0284c792dd7a3e40884b49df9c9279c625b
b1c52447e6a8c00f86e06e19b3bdc943378a2f915fd14c69eee5a7fb3df92196
b590c537ff7de705d0d0cf02d11fac9e1103536fa07d4281b5f43e3fd2328897
b5ac9be9ddb414f29f9729dbd5295284938848998df6fec71e95919c2831fd89
b5bea41b6c623f7c09f1bf24dcae58ebab3c0cdd90ad966bc43a45b44867e12b
b646001359b46d5e8456dc8e3ac7ca91e57532928e5468577cd8c54e05469095
bf2142e8062f7d0db34466f799b38a66a9130750ad501dad7455b41b2d059096
bfd2d2d2a2c611d8f7376cfd3e734b434ef888043df725ce84a8b2d7e39492e0
c14a030b0b5ef06f710d9bbff164662d4b43c037e62f254aa6280504013caa34
c183713781265a2abdc03eab5050b102a17a1170eaa908604e61fc9f07c9aad4
c21029f21dc145723d40362da85504ee5a5bd33f5db6636beae3a01c7aba1fa2
c462d460eab61de19f36cc384c99666e5bf65eaeba0c12b8f594c5410c01f220
c6a9af0e8366289a295ada98808d055eac76782b34e953da164e5626c18b7d3d
c7f2558d7005dc61e343b6abb61a63da8ace760a0fdd45cb0cc124b0de5b4c2f
c9d4c695d47897b02b09abe77f54fb8ff3125de769df6ef77a442f586fb6da81
ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356
caa3854f28740fa98125ded826446ee4456379e8ad7c4ff46643347d1901506a
cbc5a8c8a917bb8cd2082195272016b6ff5f9cd403ce464bacf5bb8a17b5615a
cd8f568e941e596d0da92f143a8c658f56cddd777ce4f6b7e486fd4cb3df11d6
ce5692d451b5bc71a34b0892473e4717cb850376ea40184593b5351de24e9382
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
cf4b6263061854368fa177690445fcccfefa9dc7349e4981343109586c0a5e0d
d0bffc7261df1454c5e05475cda7d9e6647318dc6c3936767e1252bfe8849c54
d20116f3604125cd796346ed202f0ae2f7529f5af03bba27548ba36e7c92402d
d281c9d6bae645f3da6d2f0769a2cf0668709fd28e2021ce74821cdd8c7117b3
d2af09dd1f0e5ea8911299520de4e42718847787e7666f7240efde750093c8e6
d5f3418a3fa657175d5341b5e032be036cb4d5818de5d1497f2175be5a7e3701
d6f350f62fc19bfd7091e3841649be70e806fb94c00a1f777dbed2ea8ecc9daa
d77f13ec3935533f066143f9de66f3a6d2ef5166cea8f4cc275430ca175739d1
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
dd4b42f7c8ddeeedbc0e556a5da8b647fd08c56a2ac3540b1e5a6d9342ba5c4f
dd7cbc3d9d129b13e77dfc973e2063ef702bd96367570011c40eb0005b037131
de24551bd4396fc8579b2d87ce01944553dd48fb52775d14373725a50efa0c37
de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af
de5e37739b5797e8ba9dba4a2dcb65f37c36a65fe839cb306162e21c74ba166e
dfeb7783a538aaf85df056bf149c808937dccdb3e3af5714d6fba017054e2f94
e336ff50623cff960c2396944be4392139f63dcc032e5f3428d81489fdfe697a
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e3d91f02be28f0efc89955dab730a4c0c4ab25ac52133e8c9bb00ec8ce80ca49
e46d360d76c0447642cba9580a52bda77c7b852817fb980f9f8351f6701903b1
e67cf300c813f9b1e1524d9fe95e8ed82aa5d2902cb3d82a9580776d2faf8604
e719a5fd2292f75cad472976bbc384a9cd2a8b49d94b6bc7a2026e387743aa50
e74b9cb9d8871d300d2a1d36ce2cd00dfbfe0c5d8066d1d415c4ce620a919d47
e8830a414dfeb4c0e0f519d3419f69849df9226f329357c938333dbf2c956f63
e8f2720b4935f9b2bb8805db58f1db4bb9e86cce89af21dd2a373c7a2603dec7
e9216d2eb53d1954da6139b158c6b1f25d5df04e78be8daa019e082bfacc68b8
e9848fb823bccc9d79f591be7bd57f02a80c6d570f257ef554b787336b538ca5
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f082ad0a8aed89f5573ea8d795de90595477f3bc7a5fe4805199864a56026a46
f387907dcb88532c842b6c98ad655d18fc4ac65316981d430245d3cd03f7e803
f95836cdd8c1af1d8261e8e198a4c1dd306e2b50ddc389fe820b56212a9cb17d
f9d9e96c4439beeca49a1a10f9dffe6f5cd0b604d13aa13af170d0bc62d8ca1b
fcc83a5b6aef86420c1ad553167106df96bd0ff4192ffe52b1647599948edbcf
fd1ae1483beedd5a4d88a891be815d773ac085b8829d7bcbe05a473560b798e0

arstechnica.com Open in urlscan Pro 18.190.81.75 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

308 Requests

98 %HTTPS

26 %IPv6

44 Domains

81 Subdomains

66 IPs

8 Countries

27611 kBTransfer

35754 kBSize

0 Cookies

58 Outgoing links

Redirected requests

308 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 11 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

arstechnica.com Open in urlscan Pro
18.190.81.75 Public Scan

Screenshot
Live screenshot

Full Image

308
Requests

98 %
HTTPS

26 %
IPv6

44
Domains

81
Subdomains

66
IPs

8
Countries

27611 kB
Transfer

35754 kB
Size

0
Cookies

308 HTTP transactions
11 data transactions