threatpost.com Open in urlscan Pro
35.173.160.135 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Submission: On September 09 via api (September 9th 2020, 4:12:24 pm UTC) from US

Summary HTTP 291 Redirects Links 14 Behaviour Indicators

Summary

This website contacted 61 IPs in 9 countries across 46 domains to perform 291 HTTP transactions. The main IP is 35.173.160.135, located in Ashburn, United States and belongs to AMAZON-AES, US. The main domain is threatpost.com.
TLS certificate: Issued by DigiCert SHA2 Secure Server CA on June 10th 2020. Valid for: a year.

This is the only time threatpost.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
18	35.173.160.135 35.173.160.135	14618 (AMAZON-AES) (AMAZON-AES)
11	99.84.156.34 99.84.156.34	16509 (AMAZON-02) (AMAZON-02)
6	2606:4700:e6:... 2606:4700:e6::ac40:c31a	13335 (CLOUDFLAR...) (CLOUDFLARENET)
16	2a00:1450:400... 2a00:1450:4001:809::2002	15169 (GOOGLE) (GOOGLE)
8	2600:9000:20e... 2600:9000:20e8:ba00:2:9275:3d40:93a1	16509 (AMAZON-02) (AMAZON-02)
11	2600:9000:20e... 2600:9000:20e8:7200:0:5c46:4f40:93a1	16509 (AMAZON-02) (AMAZON-02)
2 10	2a00:1450:400... 2a00:1450:4001:81a::2004	15169 (GOOGLE) (GOOGLE)
30	185.220.204.204 185.220.204.204	41436 (CLOUDWEBM...) (CLOUDWEBMANAGE-EU)
10	216.58.206.2 216.58.206.2	15169 (GOOGLE) (GOOGLE)
5	99.84.153.196 99.84.153.196	16509 (AMAZON-02) (AMAZON-02)
1	2a00:1450:400... 2a00:1450:4001:824::2008	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:808::2003	15169 (GOOGLE) (GOOGLE)
2 8	37.252.172.36 37.252.172.36	29990 (ASN-APPNEX) (ASN-APPNEX)
2 9	35.244.159.8 35.244.159.8	15169 (GOOGLE) (GOOGLE)
1 3	72.251.249.9 72.251.249.9	29791 (VOXEL-DOT...) (VOXEL-DOT-NET)
10 15	2606:2800:233... 2606:2800:233:97b6:26be:138a:cba8:bb01	15133 (EDGECAST) (EDGECAST)
1	35.156.68.202 35.156.68.202	16509 (AMAZON-02) (AMAZON-02)
4	69.173.144.143 69.173.144.143	26667 (RUBICONPR...) (RUBICONPROJECT)
1	52.212.5.193 52.212.5.193	16509 (AMAZON-02) (AMAZON-02)
6	185.64.189.112 185.64.189.112	62713 (AS-PUBMATIC) (AS-PUBMATIC)
1 8	23.210.249.164 23.210.249.164	16625 (AKAMAI-AS) (AKAMAI-AS)
1	167.172.1.14 167.172.1.14	14061 (DIGITALOC...) (DIGITALOCEAN-ASN)
1	34.237.157.170 34.237.157.170	14618 (AMAZON-AES) (AMAZON-AES)
1	2a00:1450:400... 2a00:1450:4001:825::200e	15169 (GOOGLE) (GOOGLE)
1 3	2620:116:800d... 2620:116:800d:21:5a23:9c4e:e774:96c1	16509 (AMAZON-02) (AMAZON-02)
1	151.101.112.157 151.101.112.157	54113 (FASTLY) (FASTLY)
2	2a00:1450:400... 2a00:1450:4001:824::200e	15169 (GOOGLE) (GOOGLE)
1	2600:9000:20e... 2600:9000:20e8:9400:6:44e3:f8c0:93a1	16509 (AMAZON-02) (AMAZON-02)
1	104.244.42.133 104.244.42.133	13414 (TWITTER) (TWITTER)
1	2a00:1450:400... 2a00:1450:400c:c06::9c	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:817::2003	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:820::200a	15169 (GOOGLE) (GOOGLE)
4	23.210.249.92 23.210.249.92	16625 (AKAMAI-AS) (AKAMAI-AS)
2 2	185.94.180.125 185.94.180.125	35220 (SPOTX-AMS) (SPOTX-AMS)
19	45.83.41.102 45.83.41.102	204548 (CLOUDWEBM...) (CLOUDWEBMANAGE-IL-FR)
1 2	18.194.69.213 18.194.69.213	16509 (AMAZON-02) (AMAZON-02)
1 1	195.201.164.125 195.201.164.125	24940 (HETZNER-AS) (HETZNER-AS)
1	2a00:1450:400... 2a00:1450:4001:819::2003	15169 (GOOGLE) (GOOGLE)
5	18.197.185.70 18.197.185.70	16509 (AMAZON-02) (AMAZON-02)
4	2a00:1450:400... 2a00:1450:4001:814::2002	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:802::2002	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:815::2001	15169 (GOOGLE) (GOOGLE)
33	2a00:1450:400... 2a00:1450:4001:820::2001	15169 (GOOGLE) (GOOGLE)
1	104.244.42.195 104.244.42.195	13414 (TWITTER) (TWITTER)
1	2a03:2880:f01... 2a03:2880:f01c:800e:face:b00c:0:2	32934 (FACEBOOK) (FACEBOOK)
1	2620:1ec:21::14 2620:1ec:21::14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	199.232.53.140 199.232.53.140	54113 (FASTLY) (FASTLY)
16	99.84.156.60 99.84.156.60	16509 (AMAZON-02) (AMAZON-02)
2	2a00:1450:400... 2a00:1450:4001:809::200a	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:815::2003	15169 (GOOGLE) (GOOGLE)
2	23.210.249.83 23.210.249.83	16625 (AKAMAI-AS) (AKAMAI-AS)
2 3	52.31.46.99 52.31.46.99	16509 (AMAZON-02) (AMAZON-02)
1 5	35.156.153.71 35.156.153.71	16509 (AMAZON-02) (AMAZON-02)
1 1	172.217.18.2 172.217.18.2	15169 (GOOGLE) (GOOGLE)
1 2	3.126.56.137 3.126.56.137	16509 (AMAZON-02) (AMAZON-02)
2 2	151.101.14.49 151.101.14.49	54113 (FASTLY) (FASTLY)
1	2a00:1288:110... 2a00:1288:110:c305::8000	34010 (YAHOO-IRD) (YAHOO-IRD)
1 2	54.93.147.19 54.93.147.19	16509 (AMAZON-02) (AMAZON-02)
1 1	134.209.129.254 134.209.129.254	14061 (DIGITALOC...) (DIGITALOCEAN-ASN)
1	205.185.216.42 205.185.216.42	20446 (HIGHWINDS3) (HIGHWINDS3)
1	104.111.230.142 104.111.230.142	16625 (AKAMAI-AS) (AKAMAI-AS)
1	2620:1ec:bdf::10 2620:1ec:bdf::10	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	2a02:fa8:8806... 2a02:fa8:8806:16::1370	41041 (VCLK-EU-) (VCLK-EU-)
1	37.157.3.30 37.157.3.30	198622 (ADFORM) (ADFORM)
4	52.5.29.22 52.5.29.22	14618 (AMAZON-AES) (AMAZON-AES)
1 1	185.64.190.80 185.64.190.80	62713 (AS-PUBMATIC) (AS-PUBMATIC)
291	61

18 35.173.160.135 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-35-173-160-135.compute-1.amazonaws.com

threatpost.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
kasperskycontenthub.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 99.84.156.34 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-99-84-156-34.txl52.r.cloudfront.net

tagan.adlightning.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2606:4700:e6::ac40:c31a (United States)

ASN13335 (CLOUDFLARENET, US)

qd.admetricspro.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

16 2a00:1450:4001:809::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
adservice.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 2600:9000:20e8:ba00:2:9275:3d40:93a1 (United States)

ASN16509 (AMAZON-02, US)

assets.threatpost.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 2600:9000:20e8:7200:0:5c46:4f40:93a1 (United States)

ASN16509 (AMAZON-02, US)

media.threatpost.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 2a00:1450:4001:81a::2004 (Frankfurt am Main, Germany) 2 redirects

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

30 185.220.204.204 (Amsterdam, Netherlands)

ASN41436 (CLOUDWEBMANAGE-EU, GB)

live.sekindo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 216.58.206.2 (Mountain View, United States)

ASN15169 (GOOGLE, US)
PTR: fra16s20-in-f2.1e100.net

securepubads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 99.84.153.196 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-99-84-153-196.txl52.r.cloudfront.net

c.amazon-adsystem.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:824::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:808::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 37.252.172.36 (Ascension Island) 2 redirects

ASN29990 (ASN-APPNEX, US)
PTR: 692.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

ib.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 35.244.159.8 (Mountain View, United States) 2 redirects

ASN15169 (GOOGLE, US)
PTR: 8.159.244.35.bc.googleusercontent.com

teachingaids-d.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
u.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
eu-u.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 72.251.249.9 (Amsterdam, Netherlands) 1 redirects

ASN29791 (VOXEL-DOT-NET, US)

ap.lijit.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

15 2606:2800:233:97b6:26be:138a:cba8:bb01 (United States) 10 redirects

ASN15133 (EDGECAST, US)

adserver-us.adtech.advertising.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.156.68.202 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-35-156-68-202.eu-central-1.compute.amazonaws.com

tlx.3lift.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 69.173.144.143 (Frankfurt am Main, Germany)

ASN26667 (RUBICONPROJECT, US)

fastlane.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.212.5.193 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-212-5-193.eu-west-1.compute.amazonaws.com

ads.servenobid.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 185.64.189.112 (United Kingdom)

ASN62713 (AS-PUBMATIC, US)

hbopenbid.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 23.210.249.164 (Netherlands) 1 redirects

ASN16625 (AKAMAI-AS, US)
PTR: a23-210-249-164.deploy.static.akamaitechnologies.com

as-sec.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
js-sec.indexww.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
ssum.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 167.172.1.14 (United States)

ASN14061 (DIGITALOCEAN-ASN, US)

e.serverbid.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.237.157.170 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-34-237-157-170.compute-1.amazonaws.com

prebid.a-mo.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:825::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2620:116:800d:21:5a23:9c4e:e774:96c1 (United States) 1 redirects

ASN16509 (AMAZON-02, US)

secure.quantserve.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
pixel.quantserve.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.112.157 (Frankfurt am Main, Germany)

ASN54113 (FASTLY, US)

static.ads-twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:824::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:20e8:9400:6:44e3:f8c0:93a1 (United States)

ASN16509 (AMAZON-02, US)

rules.quantcount.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.244.42.133 (United States)

ASN13414 (TWITTER, US)

t.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:400c:c06::9c (Brussels, Belgium)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:817::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:820::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 23.210.249.92 (Netherlands)

ASN16625 (AKAMAI-AS, US)
PTR: a23-210-249-92.deploy.static.akamaitechnologies.com

ads.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 185.94.180.125 (Netherlands) 2 redirects

ASN35220 (SPOTX-AMS, NL)

sync.search.spotxchange.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

19 45.83.41.102 (Frankfurt am Main, Germany)

ASN204548 (CLOUDWEBMANAGE-IL-FR, GB)

video.sekindo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 18.194.69.213 (Frankfurt am Main, Germany) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-18-194-69-213.eu-central-1.compute.amazonaws.com

x.bidswitch.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 195.201.164.125 (Germany) 1 redirects

ASN24940 (HETZNER-AS, DE)

csync.loopme.me	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:819::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 18.197.185.70 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-18-197-185-70.eu-central-1.compute.amazonaws.com

ads.adaptv.advertising.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:814::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:802::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:815::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

5214586febd538a8a28723ff5f414638.safeframe.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

33 2a00:1450:4001:820::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
cdn.ampproject.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.244.42.195 (United States)

ASN13414 (TWITTER, US)

analytics.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a03:2880:f01c:800e:face:b00c:0:2 (Ireland)

ASN32934 (FACEBOOK, US)

graph.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2620:1ec:21::14 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

www.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 199.232.53.140 (United States)

ASN54113 (FASTLY, US)

www.reddit.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

16 99.84.156.60 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-99-84-156-60.txl52.r.cloudfront.net

math-aids-threatpost-tagan.adlightning.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:809::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:815::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 23.210.249.83 (Netherlands)

ASN16625 (AKAMAI-AS, US)
PTR: a23-210-249-83.deploy.static.akamaitechnologies.com

acdn.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 52.31.46.99 (Dublin, Ireland) 2 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-52-31-46-99.eu-west-1.compute.amazonaws.com

match.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 35.156.153.71 (Frankfurt am Main, Germany) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-35-156-153-71.eu-central-1.compute.amazonaws.com

pixel.advertising.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.217.18.2 (United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: fra15s28-in-f2.1e100.net

cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 3.126.56.137 (Frankfurt am Main, Germany) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-3-126-56-137.eu-central-1.compute.amazonaws.com

ups.analytics.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 151.101.14.49 (Frankfurt am Main, Germany) 2 redirects

ASN54113 (FASTLY, US)

sync-tm.everesttech.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1288:110:c305::8000 (United Kingdom)

ASN34010 (YAHOO-IRD, GB)

pr-bh.ybp.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 54.93.147.19 (Frankfurt am Main, Germany) 1 redirects

ASN16509 (AMAZON-02, US)

eb2.3lift.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 134.209.129.254 (North Bergen, United States) 1 redirects

ASN14061 (DIGITALOCEAN-ASN, US)

sync.serverbid.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 205.185.216.42 (Phoenix, United States)

ASN20446 (HIGHWINDS3, US)
PTR: map2.hwcdn.net

serverbid-sync.nyc3.cdn.digitaloceanspaces.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.111.230.142 (Netherlands)

ASN16625 (AKAMAI-AS, US)
PTR: a104-111-230-142.deploy.static.akamaitechnologies.com

eus.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2620:1ec:bdf::10 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

public.servenobid.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:fa8:8806:16::1370 (Sweden)

ASN41041 (VCLK-EU-, SE)

aol-match.dotomi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 37.157.3.30 (Denmark)

ASN198622 (ADFORM, DK)

c1.adform.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 52.5.29.22 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-5-29-22.compute-1.amazonaws.com

aas.dc-1.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 185.64.190.80 (United Kingdom) 1 redirects

ASN62713 (AS-PUBMATIC, US)

image2.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
49	sekindo.com live.sekindo.com video.sekindo.com	2 MB
36	threatpost.com threatpost.com assets.threatpost.com media.threatpost.com	662 KB
31	googlesyndication.com 5214586febd538a8a28723ff5f414638.safeframe.googlesyndication.com tpc.googlesyndication.com pagead2.googlesyndication.com	275 KB
27	adlightning.com tagan.adlightning.com math-aids-threatpost-tagan.adlightning.com	236 KB
25	advertising.com 11 redirects adserver-us.adtech.advertising.com ads.adaptv.advertising.com pixel.advertising.com	11 KB
16	doubleclick.net 1 redirects securepubads.g.doubleclick.net stats.g.doubleclick.net googleads.g.doubleclick.net cm.g.doubleclick.net	126 KB
12	ampproject.org cdn.ampproject.org	299 KB
12	google.com 2 redirects www.google.com adservice.google.com	3 KB
11	pubmatic.com 1 redirects hbopenbid.pubmatic.com ads.pubmatic.com image2.pubmatic.com	1 KB
10	adnxs.com 2 redirects ib.adnxs.com acdn.adnxs.com	6 KB
9	openx.net 2 redirects teachingaids-d.openx.net u.openx.net eu-u.openx.net	2 KB
6	casalemedia.com 1 redirects as-sec.casalemedia.com ssum.casalemedia.com	4 KB
6	admetricspro.com qd.admetricspro.com	222 KB
5	rubiconproject.com fastlane.rubiconproject.com eus.rubiconproject.com	7 KB
5	gstatic.com www.gstatic.com fonts.gstatic.com	297 KB
5	amazon-adsystem.com c.amazon-adsystem.com	59 KB
4	dc-1.net aas.dc-1.net	777 B
4	googletagservices.com www.googletagservices.com	101 KB
3	yahoo.com 1 redirects ups.analytics.yahoo.com pr-bh.ybp.yahoo.com	2 KB
3	adsrvr.org 2 redirects match.adsrvr.org	1 KB
3	googleapis.com fonts.googleapis.com	2 KB
3	google.de www.google.de adservice.google.de	1 KB
3	quantserve.com 1 redirects secure.quantserve.com pixel.quantserve.com	9 KB
3	google-analytics.com www.google-analytics.com	18 KB
3	3lift.com 1 redirects tlx.3lift.com eb2.3lift.com	619 B
3	lijit.com 1 redirects ap.lijit.com	1 KB
2	everesttech.net 2 redirects sync-tm.everesttech.net	676 B
2	indexww.com js-sec.indexww.com
2	bidswitch.net 1 redirects x.bidswitch.net	1016 B
2	spotxchange.com 2 redirects sync.search.spotxchange.com	1 KB
2	serverbid.com 1 redirects e.serverbid.com sync.serverbid.com	1 KB
2	servenobid.com ads.servenobid.com public.servenobid.com	3 KB
1	adform.net c1.adform.net	187 B
1	dotomi.com aol-match.dotomi.com	104 B
1	digitaloceanspaces.com serverbid-sync.nyc3.cdn.digitaloceanspaces.com
1	reddit.com www.reddit.com	1 KB
1	linkedin.com www.linkedin.com
1	facebook.com graph.facebook.com	491 B
1	twitter.com analytics.twitter.com	282 B
1	loopme.me 1 redirects csync.loopme.me	224 B
1	t.co t.co	171 B
1	quantcount.com rules.quantcount.com	358 B
1	ads-twitter.com static.ads-twitter.com	2 KB
1	a-mo.net prebid.a-mo.net	800 B
1	googletagmanager.com www.googletagmanager.com	47 KB
1	kasperskycontenthub.com kasperskycontenthub.com	398 B
291	46

	Domain	Requested by
30	live.sekindo.com	threatpost.com live.sekindo.com tagan.adlightning.com
21	tpc.googlesyndication.com	tagan.adlightning.com threatpost.com cdn.ampproject.org
19	video.sekindo.com	threatpost.com live.sekindo.com
17	threatpost.com	threatpost.com
16	math-aids-threatpost-tagan.adlightning.com	tagan.adlightning.com
15	adserver-us.adtech.advertising.com	10 redirects threatpost.com
12	cdn.ampproject.org	threatpost.com
11	media.threatpost.com	threatpost.com
11	tagan.adlightning.com	threatpost.com tagan.adlightning.com
10	securepubads.g.doubleclick.net	www.googletagservices.com securepubads.g.doubleclick.net threatpost.com
10	www.google.com	2 redirects threatpost.com tagan.adlightning.com
9	pagead2.googlesyndication.com	tagan.adlightning.com pagead2.googlesyndication.com threatpost.com securepubads.g.doubleclick.net
8	ib.adnxs.com	2 redirects qd.admetricspro.com live.sekindo.com
8	assets.threatpost.com	threatpost.com assets.threatpost.com
6	hbopenbid.pubmatic.com	qd.admetricspro.com live.sekindo.com
6	qd.admetricspro.com	threatpost.com qd.admetricspro.com
5	pixel.advertising.com	1 redirects threatpost.com
5	ads.adaptv.advertising.com	live.sekindo.com
5	as-sec.casalemedia.com	qd.admetricspro.com live.sekindo.com
5	teachingaids-d.openx.net	qd.admetricspro.com live.sekindo.com
5	c.amazon-adsystem.com	qd.admetricspro.com c.amazon-adsystem.com live.sekindo.com
4	aas.dc-1.net	threatpost.com
4	googleads.g.doubleclick.net	threatpost.com tagan.adlightning.com
4	ads.pubmatic.com	tagan.adlightning.com live.sekindo.com qd.admetricspro.com
4	fastlane.rubiconproject.com	qd.admetricspro.com
4	www.googletagservices.com	threatpost.com tagan.adlightning.com securepubads.g.doubleclick.net
3	match.adsrvr.org	2 redirects threatpost.com
3	fonts.gstatic.com	fonts.googleapis.com
3	u.openx.net	2 redirects live.sekindo.com
3	fonts.googleapis.com	tagan.adlightning.com threatpost.com
3	www.google-analytics.com	www.googletagmanager.com www.google-analytics.com threatpost.com
3	ap.lijit.com	1 redirects qd.admetricspro.com
2	eb2.3lift.com	1 redirects qd.admetricspro.com
2	sync-tm.everesttech.net	2 redirects
2	ups.analytics.yahoo.com	1 redirects threatpost.com
2	js-sec.indexww.com	live.sekindo.com qd.admetricspro.com
2	acdn.adnxs.com	live.sekindo.com qd.admetricspro.com
2	pixel.quantserve.com	1 redirects threatpost.com
2	adservice.google.com	tagan.adlightning.com
2	adservice.google.de	tagan.adlightning.com
2	x.bidswitch.net	1 redirects threatpost.com
2	sync.search.spotxchange.com	2 redirects
2	www.gstatic.com	www.google.com
1	ssum.casalemedia.com	1 redirects
1	image2.pubmatic.com	1 redirects
1	c1.adform.net	threatpost.com
1	aol-match.dotomi.com	threatpost.com
1	eu-u.openx.net	qd.admetricspro.com
1	public.servenobid.com	qd.admetricspro.com
1	eus.rubiconproject.com	qd.admetricspro.com
1	serverbid-sync.nyc3.cdn.digitaloceanspaces.com	qd.admetricspro.com
1	sync.serverbid.com	1 redirects
1	pr-bh.ybp.yahoo.com	threatpost.com
1	cm.g.doubleclick.net	1 redirects
1	www.reddit.com	threatpost.com
1	www.linkedin.com	threatpost.com
1	graph.facebook.com	threatpost.com
1	analytics.twitter.com	tagan.adlightning.com
1	5214586febd538a8a28723ff5f414638.safeframe.googlesyndication.com	tagan.adlightning.com
1	csync.loopme.me	1 redirects
1	www.google.de	threatpost.com
1	stats.g.doubleclick.net	www.google-analytics.com
1	t.co	threatpost.com
1	rules.quantcount.com	secure.quantserve.com
1	static.ads-twitter.com	www.googletagmanager.com
1	secure.quantserve.com	www.googletagmanager.com
1	prebid.a-mo.net	qd.admetricspro.com
1	e.serverbid.com	qd.admetricspro.com
1	ads.servenobid.com	qd.admetricspro.com
1	tlx.3lift.com	qd.admetricspro.com
1	www.googletagmanager.com	threatpost.com
1	kasperskycontenthub.com	threatpost.com
291	72

This site contains links to these domains. Also see Links.

Domain
www.facebook.com
twitter.com
www.linkedin.com
www.youtube.com
feedly.com
www.instagram.com
www.intego.com
attendee.gotowebinar.com
akismet.com
t.co
indd.adobe.com
spotlight.threatpost.com

Subject Issuer	Validity	Valid
threatpost.com DigiCert SHA2 Secure Server CA	`2020-06-10` - `2021-06-15`	a year	crt.sh
*.adlightning.com Amazon	`2020-07-22` - `2021-08-22`	a year	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2020-08-10` - `2021-08-10`	a year	crt.sh
*.g.doubleclick.net GTS CA 1O1	`2020-08-19` - `2020-11-11`	3 months	crt.sh
assets.threatpost.com Amazon	`2020-03-04` - `2021-04-04`	a year	crt.sh
media.threatpost.com Amazon	`2020-03-04` - `2021-04-04`	a year	crt.sh
www.google.com GTS CA 1O1	`2020-08-19` - `2020-11-11`	3 months	crt.sh
www.sekindo.com Go Daddy Secure Certificate Authority - G2	`2020-05-27` - `2022-06-18`	2 years	crt.sh
*.google.com GTS CA 1O1	`2020-08-19` - `2020-11-11`	3 months	crt.sh
c.amazon-adsystem.com Amazon	`2020-08-04` - `2021-08-02`	a year	crt.sh
kasperskycontenthub.com DigiCert SHA2 Secure Server CA	`2020-06-01` - `2021-06-09`	a year	crt.sh
*.google-analytics.com GTS CA 1O1	`2020-08-19` - `2020-11-11`	3 months	crt.sh
*.gstatic.com GTS CA 1O1	`2020-08-19` - `2020-11-11`	3 months	crt.sh
*.adnxs.com DigiCert ECC Secure Server CA	`2019-01-23` - `2021-03-08`	2 years	crt.sh
*.openx.net GeoTrust RSA CA 2018	`2020-06-18` - `2021-08-17`	a year	crt.sh
*.lijit.com Go Daddy Secure Certificate Authority - G2	`2020-03-11` - `2021-05-10`	a year	crt.sh
*.adtech.advertising.com DigiCert SHA2 Secure Server CA	`2020-04-16` - `2022-04-21`	2 years	crt.sh
*.3lift.com Amazon	`2020-07-04` - `2021-08-05`	a year	crt.sh
*.rubiconproject.com DigiCert SHA2 Secure Server CA	`2019-01-10` - `2021-01-14`	2 years	crt.sh
*.servenobid.com Amazon	`2020-03-12` - `2021-04-12`	a year	crt.sh
*.pubmatic.com Sectigo RSA Organization Validation Secure Server CA	`2019-02-22` - `2021-02-21`	2 years	crt.sh
san.casalemedia.com GeoTrust RSA CA 2018	`2020-03-02` - `2021-04-01`	a year	crt.sh
e.serverbid.com Let's Encrypt Authority X3	`2020-06-22` - `2020-09-20`	3 months	crt.sh
*.a-mo.net Amazon	`2020-08-24` - `2021-09-24`	a year	crt.sh
*.quantserve.com DigiCert SHA2 High Assurance Server CA	`2019-10-04` - `2020-10-07`	a year	crt.sh
ads-twitter.com DigiCert SHA2 High Assurance Server CA	`2020-08-14` - `2021-08-19`	a year	crt.sh
t.co DigiCert SHA2 High Assurance Server CA	`2020-03-05` - `2021-03-02`	a year	crt.sh
www.google.de GTS CA 1O1	`2020-08-19` - `2020-11-11`	3 months	crt.sh
upload.video.google.com GTS CA 1O1	`2020-08-19` - `2020-11-11`	3 months	crt.sh
*.bidswitch.net Sectigo RSA Domain Validation Secure Server CA	`2020-04-23` - `2022-05-04`	2 years	crt.sh
*.v.ssp.yahoo.com DigiCert SHA2 High Assurance Server CA	`2020-07-29` - `2021-01-25`	6 months	crt.sh
*.google.de GTS CA 1O1	`2020-08-19` - `2020-11-11`	3 months	crt.sh
tpc.googlesyndication.com GTS CA 1O1	`2020-08-19` - `2020-11-11`	3 months	crt.sh
*.twitter.com DigiCert SHA2 High Assurance Server CA	`2020-03-05` - `2021-03-02`	a year	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2020-07-21` - `2020-10-12`	3 months	crt.sh
www.linkedin.com DigiCert SHA2 Secure Server CA	`2020-05-01` - `2020-11-01`	6 months	crt.sh
*.reddit.com DigiCert SHA2 Secure Server CA	`2020-08-26` - `2021-02-22`	6 months	crt.sh
misc-sni.google.com GTS CA 1O1	`2020-08-19` - `2020-11-11`	3 months	crt.sh
cdn.adnxs.com GeoTrust RSA CA 2018	`2020-01-02` - `2021-04-02`	a year	crt.sh
pixel.advertising.com DigiCert SHA2 High Assurance Server CA	`2020-08-08` - `2020-11-03`	3 months	crt.sh
ups.analytics.yahoo.com DigiCert SHA2 High Assurance Server CA	`2020-05-27` - `2020-11-23`	6 months	crt.sh
*.ybp.yahoo.com DigiCert SHA2 High Assurance Server CA	`2020-06-02` - `2020-11-29`	6 months	crt.sh
*.nyc3.cdn.digitaloceanspaces.com DigiCert SHA2 Secure Server CA	`2020-03-11` - `2021-04-14`	a year	crt.sh
public.servenobid.com DigiCert SHA2 Secure Server CA	`2020-08-26` - `2021-08-25`	a year	crt.sh
*.dotomi.com GlobalSign RSA OV SSL CA 2018	`2019-06-19` - `2021-08-31`	2 years	crt.sh
track.adform.net DigiCert SHA2 Secure Server CA	`2019-09-16` - `2021-09-20`	2 years	crt.sh
*.betrad.net Amazon	`2019-12-12` - `2021-01-12`	a year	crt.sh
*.adsrvr.org Trustwave Organization Validation SHA256 CA, Level 1	`2019-03-07` - `2021-04-19`	2 years	crt.sh

This page contains 31 frames:

Primary Page: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Frame ID: C1A133243332EBB0E53761BE2ED46C29
Requests: 165 HTTP requests in this frame

Frame: https://live.sekindo.com/live/liveView.php?s=101281&cbuster=%%CACHEBUSTER%%&pubUrl=%%REFERRER_URL_ESC%%&x=[WIDTH]&y=[HEIGHT]&vp_content=plembed173akunvrojp&vp_template=6615&subId=[SUBID_ENCODED]&schain=1.0,1!admetricspro.com,1005,1&cbuster=1599667908&pubUrlAuto=https%3A%2F%2Fthreatpost.com%2Fshlayer-mac-malware-extra-sneakiness%2F156669%2F%3Fweb_view%3Dtrue&videoType=flow&floatWidth=320&floatHeight=180&floatDirection=br&floatVerticalOffset=10&floatHorizontalOffset=10&floatCloseBtn=1&flowMode=both&flowCloseButtonPosition=right
Frame ID: 972394F12FC76125B2518FCC1E68B179
Requests: 40 HTTP requests in this frame

Frame: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=159196&userIdMacro=PM_UID&gdpr=1&gdpr_consent=&predirect=https%3A%2F%2Flive.sekindo.com%2Flive%2FliveCS.php%3Fsource%3Dexternal%26pixel%3D%26advId%3D91%26advUuid%3DPM_UID%26gdpr%3D1%26gdpr_consent%3D
Frame ID: B188B9377C0D79D69179B2011F25BF43
Requests: 1 HTTP requests in this frame

Frame: https://live.sekindo.com/live/liveCS.php?source=external&pixel=&advId=94&advUuid=2a65efb9-f2b7-11ea-a685-125b01370e06
Frame ID: AB1FE136B09E539734C22F0246D6F954
Requests: 1 HTTP requests in this frame

Frame: https://live.sekindo.com/live/liveCS.php?source=external&pixel=&advId=98&advUuid=1f9eecb3-8f60-4d84-900f-4add1cfbd175
Frame ID: 22905CA81C622D2048004E30B32A1715
Requests: 1 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6Lfgf_8SAAAAADYbQAnKFOk7cvnWbkqo6y57-4-U&co=aHR0cHM6Ly90aHJlYXRwb3N0LmNvbTo0NDM.&hl=en&v=iSHzt4kCrNgSxGUYDFqaZAL9&theme=standard&size=normal&cb=c47wb3b29qg
Frame ID: DA26697B3E4D28DCE3B70BD144862773
Requests: 1 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LehhAETAAAAAAcsm2ZGDsLCqyGhesy4Yn43WNBe&co=aHR0cHM6Ly90aHJlYXRwb3N0LmNvbTo0NDM.&hl=en&v=iSHzt4kCrNgSxGUYDFqaZAL9&theme=light&size=normal&cb=oexqizclw0sz
Frame ID: 66C1C1BA8BB6E16996BAB5541FDC9FC8
Requests: 1 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/bframe?hl=en&v=iSHzt4kCrNgSxGUYDFqaZAL9&k=6Lfgf_8SAAAAADYbQAnKFOk7cvnWbkqo6y57-4-U&cb=70qjetetlru
Frame ID: 0F83436299495A443F15568250A8EFDD
Requests: 1 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/bframe?hl=en&v=iSHzt4kCrNgSxGUYDFqaZAL9&k=6LehhAETAAAAAAcsm2ZGDsLCqyGhesy4Yn43WNBe&cb=s2zoqg5fto7l
Frame ID: 46703B7ABDFCF68F7560FF80423C0217
Requests: 1 HTTP requests in this frame

Frame: https://tagan.adlightning.com/math-aids-threatpost/bl-9a4f7ce-ca40eed9.js
Frame ID: EFC415FB399C9828294B379CFEDF00A3
Requests: 23 HTTP requests in this frame

Frame: https://tagan.adlightning.com/math-aids-threatpost/bl-9a4f7ce-ca40eed9.js
Frame ID: 2F598114918A5841DB2A8A1BF9C61E38
Requests: 11 HTTP requests in this frame

Frame: https://tagan.adlightning.com/math-aids-threatpost/bl-9a4f7ce-ca40eed9.js
Frame ID: BDD6B8FE051BB1CA667DF27D20CBF477
Requests: 17 HTTP requests in this frame

Frame: https://tagan.adlightning.com/math-aids-threatpost/bl-9a4f7ce-ca40eed9.js
Frame ID: DFFDB1143A52B65D7CED9456A99B4D1D
Requests: 14 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20200901/r20190131/zrt_lookup.html
Frame ID: 16882A4393D4FC65570F610C06DF7753
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-7500593236707325&output=html&h=250&slotname=2376748102&adk=2477513961&adf=776186316&w=300&psa=0&guci=1.2.0.0.2.2.0.0&format=300x250&url=https%3A%2F%2Fthreatpost.com%2Fshlayer-mac-malware-extra-sneakiness%2F156669%2F%3Fweb_view%3Dtrue&ea=0&flash=0&wgl=1&adsid=NT&dt=1599667910604&bpp=20&bdt=144&idt=103&shv=r20200901&cbv=r20190131&ptt=9&saldr=aa&correlator=5686873144420&frm=23&ife=4&pv=2&ga_vid=1262107814.1599667909&ga_sid=1599667911&ga_hid=234238073&ga_fc=1&iag=3&icsg=8362&nhd=1&dssz=14&mdo=0&mso=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1082&ady=1574&biw=1600&bih=1200&isw=300&ish=250&ifk=65441356&scr_x=0&scr_y=0&eid=42530621%2C42530672%2C21066648&oid=3&pvsid=274053545329849&pem=119&rx=0&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C300%2C250&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=8196&bc=31&ifi=1&uci=1.g8ieqwo3u1il&btvi=1&fsb=1&dtd=117
Frame ID: 3A07D3C30EC2F42367E9ACB2DD111B5D
Requests: 1 HTTP requests in this frame

Frame: https://ads.pubmatic.com/AdServer/js/showad.js
Frame ID: 5D1FEA789F906AAA15A3B1A3B3EDFE11
Requests: 1 HTTP requests in this frame

Frame: https://ads.pubmatic.com/AdServer/js/showad.js
Frame ID: 36A0B9F7529BCF7F36E59605593EA9B9
Requests: 1 HTTP requests in this frame

Frame: https://acdn.adnxs.com/ib/static/usersync/v3/async_usersync.html
Frame ID: 821C4FD5DDE1BB2E245B95D41E1F70E7
Requests: 1 HTTP requests in this frame

Frame: https://u.openx.net/w/1.0/pd?gdpr=1&gdpr_consent=
Frame ID: FC52CD58EE5258F324AC4ACBB6C7E969
Requests: 1 HTTP requests in this frame

Frame: https://js-sec.indexww.com/um/ixmatch.html
Frame ID: 3E9D731835A422A94F2D59B14AE12331
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/210/runner.html
Frame ID: 3F9B69FEEC5781F4ABCD83F0CCEBEA63
Requests: 1 HTTP requests in this frame

Frame: https://eb2.3lift.com/sync?&ld=1
Frame ID: 8390B2C8C46E812DD4D3D236D3BF82E2
Requests: 1 HTTP requests in this frame

Frame: https://serverbid-sync.nyc3.cdn.digitaloceanspaces.com/ss/2000891.html
Frame ID: C5C47778E6E72B36F45623C9A0681DDB
Requests: 1 HTTP requests in this frame

Frame: https://eus.rubiconproject.com/usync.html
Frame ID: F1B843FDECAD203BA056BA2A501BA858
Requests: 1 HTTP requests in this frame

Frame: https://js-sec.indexww.com/um/ixmatch.html
Frame ID: 7D3CE99C6D6F411C8E51D167BBE4AC3A
Requests: 1 HTTP requests in this frame

Frame: https://ap.lijit.com/beacon?informer=13394437
Frame ID: 807D41BEDAEFD8B0A50745677A82F507
Requests: 1 HTTP requests in this frame

Frame: https://public.servenobid.com/sync.html
Frame ID: 84A7A8037FF82557ABE82E542600B3DD
Requests: 1 HTTP requests in this frame

Frame: https://acdn.adnxs.com/dmp/async_usersync.html
Frame ID: 52034CCA1494A15CDF5962ABFC53889E
Requests: 1 HTTP requests in this frame

Frame: https://eu-u.openx.net/w/1.0/pd?plm=6&ph=e1b1f5e1-3c2c-4287-9806-317cfbf3bd12&gdpr=0
Frame ID: 0D1D41C918007694D92B0EA99A7F6C13
Requests: 1 HTTP requests in this frame

Frame: https://ads.pubmatic.com/AdServer/js/showad.js
Frame ID: CE1C05158F219D609681C23156B9FAA6
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/210/runner.html
Frame ID: 41867158DD490764A7409CF9B10635C7
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

headers link /rel="https:\/\/api\.w\.org\/"/i

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

headers link /rel="https:\/\/api\.w\.org\/"/i

MySQL (Databases) Expand

Overall confidence: 100%
Detected patterns

headers link /rel="https:\/\/api\.w\.org\/"/i

Nginx (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /nginx(?:\/([\d.]+))?/i

Page Statistics

291
Requests

100 %
HTTPS

41 %
IPv6

46
Domains

72
Subdomains

61
IPs

9
Countries

4931 kB
Transfer

9763 kB
Size

0
Cookies

14 Outgoing links

These are links going to different origins than the main page.

URL: https://www.facebook.com/Threatpost/

Search URL Search Domain Scan URL

URL: https://twitter.com/threatpost/

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/threatpost/

Search URL Search Domain Scan URL

URL: https://www.youtube.com/user/threatpost

Search URL Search Domain Scan URL

URL: https://feedly.com/threatpost

Search URL Search Domain Scan URL

URL: https://www.instagram.com/Threatpost/

Search URL Search Domain Scan URL

URL: https://www.intego.com/mac-security-blog/new-mac-malware-reveals-google-searches-can-be-unsafe/
Title: a posting

Search URL Search Domain Scan URL

URL: https://attendee.gotowebinar.com/register/3265005683762389007?source=ART
Title: June 24 at 2 p.m. ET

Search URL Search Domain Scan URL

URL: https://akismet.com/privacy/
Title: Learn how your comment data is processed

Search URL Search Domain Scan URL

URL: http://twitter.com/search?q=%23cyberattacks
Title: #cyberattacks

Search URL Search Domain Scan URL

URL: https://t.co/E7xQeBFcHT
Title: https://t.co/E7xQeBFcHT

Search URL Search Domain Scan URL

URL: https://twitter.com/threatpost
Title: Follow @threatpost

Search URL Search Domain Scan URL

URL: https://indd.adobe.com/view/01579c19-a6ca-4cb0-8106-ed4d5d02a292
Title: Advertise With Us

Search URL Search Domain Scan URL

URL: https://spotlight.threatpost.com/
Title: HackerOne Spotlight

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 53

https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166606/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=582565d4588e9bc;misc=1599667908918; HTTP 302
https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166606/0/0/ADTECH;cfp=1;rndc=1599667908;v=2;cmd=bid;cors=yes;alias=582565d4588e9bc;misc=1599667908918 HTTP 302
https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166606/0/0/ADTECH;apid=1A2a527996-f2b7-11ea-bc35-12795fd23bd8;cfp=1;rndc=1599667908;v=2;cmd=bid;cors=yes;alias=582565d4588e9bc;misc=1599667908918

Request Chain 54

https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166847/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=590109fcd6afeb7;misc=1599667908918; HTTP 302
https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166847/0/0/ADTECH;cfp=1;rndc=1599667908;v=2;cmd=bid;cors=yes;alias=590109fcd6afeb7;misc=1599667908918 HTTP 302
https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166847/0/0/ADTECH;apid=1A2a4dbde8-f2b7-11ea-94b5-1273d078354a;cfp=1;rndc=1599667908;v=2;cmd=bid;cors=yes;alias=590109fcd6afeb7;misc=1599667908918

Request Chain 55

https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166615/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=6097b41367b053b;misc=1599667908918; HTTP 302
https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166615/0/0/ADTECH;cfp=1;rndc=1599667908;v=2;cmd=bid;cors=yes;alias=6097b41367b053b;misc=1599667908918 HTTP 302
https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166615/0/0/ADTECH;apid=1A2a5093ce-f2b7-11ea-9e2d-1222202f268e;cfp=1;rndc=1599667908;v=2;cmd=bid;cors=yes;alias=6097b41367b053b;misc=1599667908918

Request Chain 56

https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166612/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=61b055084dd159;misc=1599667908918; HTTP 302
https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166612/0/0/ADTECH;cfp=1;rndc=1599667908;v=2;cmd=bid;cors=yes;alias=61b055084dd159;misc=1599667908918 HTTP 302
https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166612/0/0/ADTECH;apid=1A2a4db208-f2b7-11ea-9d06-126145921f52;cfp=1;rndc=1599667908;v=2;cmd=bid;cors=yes;alias=61b055084dd159;misc=1599667908918

Request Chain 57

https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166617/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=62aa5d911b7933d;misc=1599667908918; HTTP 302
https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166617/0/0/ADTECH;cfp=1;rndc=1599667908;v=2;cmd=bid;cors=yes;alias=62aa5d911b7933d;misc=1599667908918 HTTP 302
https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166617/0/0/ADTECH;apid=1A2a50d852-f2b7-11ea-8e19-12e1ea48904a;cfp=1;rndc=1599667908;v=2;cmd=bid;cors=yes;alias=62aa5d911b7933d;misc=1599667908918

Request Chain 93

https://sync.search.spotxchange.com/partner?adv_id=8805&redir=https%3A%2F%2Flive.sekindo.com%2Flive%2FliveCS.php%3Fsource%3Dexternal%26pixel%3D%26advId%3D94%26advUuid%3D%24SPOTX_USER_ID HTTP 302
https://sync.search.spotxchange.com/partner?adv_id=8805&redir=https%3A%2F%2Flive.sekindo.com%2Flive%2FliveCS.php%3Fsource%3Dexternal%26pixel%3D%26advId%3D94%26advUuid%3D%24SPOTX_USER_ID&__user_check__=1&sync_id=2a65efe9-f2b7-11ea-a685-125b01370e06 HTTP 302
https://live.sekindo.com/live/liveCS.php?source=external&pixel=&advId=94&advUuid=2a65efb9-f2b7-11ea-a685-125b01370e06

Request Chain 94

https://u.openx.net/w/1.0/cm?id=476b50d3-5ccf-49a1-89b8-1ddf8ea18042&r=https%3A%2F%2Flive.sekindo.com%2Flive%2FliveCS.php%3Fsource%3Dexternal%26pixel%3D%26advId%3D98%26advUuid%3D HTTP 302
https://u.openx.net/w/1.0/cm?cc=1&id=476b50d3-5ccf-49a1-89b8-1ddf8ea18042&r=https%3A%2F%2Flive.sekindo.com%2Flive%2FliveCS.php%3Fsource%3Dexternal%26pixel%3D%26advId%3D98%26advUuid%3D HTTP 302
https://live.sekindo.com/live/liveCS.php?source=external&pixel=&advId=98&advUuid=1f9eecb3-8f60-4d84-900f-4add1cfbd175

Request Chain 105

https://x.bidswitch.net/sync?ssp=sekindo&user_id=5f58fec4dc913&custom_data=5f58fec4dc913&gdpr=1&gdpr_consent= HTTP 302
https://x.bidswitch.net/ul_cb/sync?ssp=sekindo&user_id=5f58fec4dc913&custom_data=5f58fec4dc913&gdpr=1&gdpr_consent=

Request Chain 106

https://csync.loopme.me/?redirect=https%3A%2F%2Flive.sekindo.com%2Flive%2FliveCS.php%3Fsource%3Dexternal%26pixel%3D%26advId%3D93%26advUuid%3D%7Bdevice_id%7D HTTP 307
https://live.sekindo.com/live/liveCS.php?source=external&pixel=&advId=93&advUuid=44fefe1d-a1b2-4ea1-9404-df71604e4d7e

Request Chain 179

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si

Request Chain 216

https://match.adsrvr.org/track/cmf/generic?ttd_pid=adaptv&ttd_tpi=1 HTTP 302
https://match.adsrvr.org/track/cmb/generic?ttd_pid=adaptv&ttd_tpi=1 HTTP 302
https://pixel.advertising.com/ups/55953/sync?uid=d3628999-3edf-49ea-babb-8e6fa8134f97&_origin=1&gdpr=1&gdpr_consent=&piggybackCookie=d3628999-3edf-49ea-babb-8e6fa8134f97

Request Chain 217

https://cm.g.doubleclick.net/pixel?google_nid=adaptv_dbm&google_cm&google_sc HTTP 302
https://pixel.advertising.com/ups/57304/sync?uid=CAESEDlPERJWn8ZL_B_IBiS9XaU&google_cver=1 HTTP 302
https://ups.analytics.yahoo.com/ups/57304/sync?uid=CAESEDlPERJWn8ZL_B_IBiS9XaU&google_cver=1&apid=1A2a527996-f2b7-11ea-bc35-12795fd23bd8 HTTP 302
https://ups.analytics.yahoo.com/ups/57304/sync?uid=CAESEDlPERJWn8ZL_B_IBiS9XaU&google_cver=1&apid=1A2a527996-f2b7-11ea-bc35-12795fd23bd8&verify=true

Request Chain 218

https://sync-tm.everesttech.net/upi/pid/m7y5t93k?gdpr=1&gdpr_consent=&redir=https%3A%2F%2Fpixel.advertising.com%2Fups%2F55986%2Fsync%3Fuid%3D%24%7BUSER_ID%7D%26_origin%3D0&gdpr=1&gdpr_consent= HTTP 302
https://sync-tm.everesttech.net/ct/upi/pid/m7y5t93k?gdpr=1&gdpr_consent=&redir=https%3A%2F%2Fpixel.advertising.com%2Fups%2F55986%2Fsync%3Fuid%3D%24%7BUSER_ID%7D%26_origin%3D0&gdpr=1&gdpr_consent=&_test=X1j_xgAAAEONDXYV HTTP 302
https://pixel.advertising.com/ups/55986/sync?uid=X1j_xgAAAEONDXYV&_origin=0&gdpr=1&gdpr_consent=&_test=X1j_xgAAAEONDXYV

Request Chain 220

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si

Request Chain 233

https://eb2.3lift.com/sync HTTP 302
https://eb2.3lift.com/sync?&ld=1

Request Chain 234

https://sync.serverbid.com/ss/2000891.html HTTP 302
https://serverbid-sync.nyc3.cdn.digitaloceanspaces.com/ss/2000891.html

Request Chain 244

https://ib.adnxs.com/getuid?https%3A%2F%2Faas.dc-1.net%2Fsetuid%3FA%3Dece9205e-dc04-4ae6-a2be-d426a0b775ae%26D%3D%26bidder%3Dappnexus%26uid%3D%24UID HTTP 307
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%253A%252F%252Faas.dc-1.net%252Fsetuid%253FA%253Dece9205e-dc04-4ae6-a2be-d426a0b775ae%2526D%253D%2526bidder%253Dappnexus%2526uid%253D%2524UID HTTP 302
https://aas.dc-1.net/setuid?A=ece9205e-dc04-4ae6-a2be-d426a0b775ae&D=&bidder=appnexus&uid=5552695140468941548

Request Chain 245

https://image2.pubmatic.com/AdServer/UCookieSetPug?rd=https%3A%2F%2Faas.dc-1.net%2Fsetuid%3FA%3Dece9205e-dc04-4ae6-a2be-d426a0b775ae%26D%3D%26bidder%3Dpubmatic%26uid%3D%23PM_USER_ID HTTP 302
https://aas.dc-1.net/setuid?A=ece9205e-dc04-4ae6-a2be-d426a0b775ae&D=&bidder=pubmatic&uid=8C11317B-B416-432D-86AA-AD1B0A1D1554

Request Chain 247

https://ap.lijit.com/pixel?redir=https%3A%2F%2Faas.dc-1.net%2Fsetuid%3FA%3Dece9205e-dc04-4ae6-a2be-d426a0b775ae%26D%3D%26bidder%3Dsovrn%26uid%3D%24UID HTTP 307
https://aas.dc-1.net/setuid?A=ece9205e-dc04-4ae6-a2be-d426a0b775ae&D=&bidder=sovrn&uid=5c77613319777788922ea239

Request Chain 249

https://ssum.casalemedia.com/usermatchredir?s=191503&cb=https%3A%2F%2Faas.dc-1.net%2Fsetuid%3FA%3Dece9205e-dc04-4ae6-a2be-d426a0b775ae%26D%3D%26bidder%3Dindex_rtb%26uid%3D HTTP 302
https://aas.dc-1.net/setuid?A=ece9205e-dc04-4ae6-a2be-d426a0b775ae&D=&bidder=index_rtb&uid=X1j.x7lQJvgAAD2cFXoAAAAD%261185

Request Chain 250

https://pixel.quantserve.com/pixel/p-NcBg8UA4xqUFp.gif?idmatch=0&gdpr=1&gdpr_consent= HTTP 302
https://pixel.advertising.com/ups/55965/sync?_origin=0&gdpr=1&uid=SF6dZBtdy2lQAM4-SF2FPUkNzT5QWs1oTQgLhLkM

291 HTTP transactions
4 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request / Show response
threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/ 78 KB
20 KB 523ms
202ms Document
text/html 35.173.160.135
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-35-173-160-135.compute-1.amazonaws.com

Software

nginx /

Resource Hash

a612051e7fded859faaa74f2ccf3a7ecdefc622d380ca549360e45e1079f06b5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Host: threatpost.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: none
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Server: nginx
Date: Wed, 09 Sep 2020 16:11:47 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: close
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Link: <https://threatpost.com/wp-json/>; rel="https://api.w.org/" <https://threatpost.com/?p=156669>; rel=shortlink
X-Frame-Options: SAMEORIGIN
X-Debug-Auth: off
X-Request-Host: threatpost.com
x-cache-hit: HIT
Content-Encoding: gzip

GET
H/1.1 200
OK main.css
threatpost.com/wp-content/themes/threatpost-2018/assets/css/ 253 KB
39 KB 302ms
102ms Stylesheet
text/css 35.173.160.135
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1599667780
Requested by: Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-173-160-135.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 41f3222c29889fb48f5dca1d481858e5339a759655510c256ef4edf56c80f7f5

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: public
Date: Wed, 09 Sep 2020 16:11:48 GMT
Content-Encoding: gzip
Last-Modified: Wed, 09 Sep 2020 08:46:19 GMT
Server: nginx
ETag: W/"5f58965b-3f2b8"
Transfer-Encoding: chunked
Content-Type: text/css
Cache-Control: max-age=604800, public
Connection: close
Expires: Wed, 16 Sep 2020 16:11:48 GMT

GET
H2 200 op.js Show response
tagan.adlightning.com/math-aids-threatpost/ 37 KB
14 KB 100ms
33ms Script
application/javascript 99.84.156.34
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Requested by: Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.84.156.34 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-84-156-34.txl52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: e61ebc98c55c6cacbb719c5d4f078023918a327ead894889367048af9845aabf

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-version-id: jqkEl5JulvU4sKGI7.sdLpLw50qJOOs1
content-encoding: gzip
etag: "41eb62366e460475c1c26f11370e45c0"
age: 306
x-cache: Hit from cloudfront
status: 200
content-length: 13579
x-amz-meta-git_commit: 9a4f7ce
last-modified: Tue, 08 Sep 2020 22:18:03 GMT
server: AmazonS3
date: Wed, 09 Sep 2020 16:06:42 GMT
content-type: application/javascript
via: 1.1 df792ea3bbbe656e2f5c7b61aa85cc47.cloudfront.net (CloudFront)
cache-control: max-age=3600
x-amz-cf-pop: TXL52-C1
accept-ranges: bytes
x-amz-cf-id: Q9kHd9AhhoOTzkMa9d1yX3YZ6QgL1JomDHmjaNILTshbJEiN1dgvVg==

GET
H2 200 ros-layout.js Show response
qd.admetricspro.com/js/threatpost/ 22 KB
3 KB 43ms
11ms Script
application/javascript 2606:4700:e6::ac40:c31a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://qd.admetricspro.com/js/threatpost/ros-layout.js
Requested by: Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:e6::ac40:c31a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7e2b472509d9e149690aba45c5917ebdd2f52471b98d414c2726301b90e08f21

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 09 Sep 2020 16:11:47 GMT
content-encoding: br
cf-cache-status: HIT
age: 337
status: 200
cf-request-id: 05153c454700002c2eaca14200000001
last-modified: Thu, 06 Aug 2020 02:14:13 GMT
server: cloudflare
etag: W/"579e-5ac2c0b6aa2e7-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=14400
cf-ray: 5d022fe87fea2c2e-FRA
expires: Wed, 09 Sep 2020 16:15:36 GMT

GET
H2 200 gpt.js Show response
www.googletagservices.com/tag/js/ 55 KB
19 KB 62ms
39ms Script
text/javascript 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/tag/js/gpt.js

Requested by

Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

98e804f97bd2d52ec902f0275aa9823f8387a22585bb41e56f829b03700ff86b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 09 Sep 2020 16:11:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "627 / 208 of 1000 / last-modified: 1599648006"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 18749
x-xss-protection: 0
expires: Wed, 09 Sep 2020 16:11:47 GMT

GET
H2 200 cmp.js Show response
qd.admetricspro.com/js/threatpost/ 305 KB
82 KB 56ms
24ms Script
application/javascript 2606:4700:e6::ac40:c31a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://qd.admetricspro.com/js/threatpost/cmp.js
Requested by: Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:e6::ac40:c31a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d89d98593ac65c9f002b856f3e22a1479f3aea866f7fd15c85903c0a6d66f0e3

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 09 Sep 2020 16:11:47 GMT
content-encoding: br
cf-cache-status: HIT
age: 306
status: 200
cf-request-id: 05153c454800002c2eaca15200000001
last-modified: Tue, 25 Aug 2020 22:57:08 GMT
server: cloudflare
etag: W/"4c455-5adbb9f62c25a-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=14400
cf-ray: 5d022fe87fef2c2e-FRA
expires: Wed, 09 Sep 2020 16:07:48 GMT

GET
H2 200 targeting.js Show response
qd.admetricspro.com/js/threatpost/ 275 B
264 B 44ms
13ms Script
application/javascript 2606:4700:e6::ac40:c31a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://qd.admetricspro.com/js/threatpost/targeting.js
Requested by: Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:e6::ac40:c31a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6cdc57f82f4b0d09e5b4e584ca4736cd3871f20563d4ce25120b057d8ffb4eb2

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 09 Sep 2020 16:11:47 GMT
content-encoding: br
cf-cache-status: HIT
age: 338
status: 200
cf-request-id: 05153c454800002c2eaca16200000001
last-modified: Sat, 08 Feb 2020 20:49:18 GMT
server: cloudflare
etag: W/"113-59e16a3cfb471-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=14400
cf-ray: 5d022fe87ff12c2e-FRA
expires: Wed, 09 Sep 2020 16:07:48 GMT

GET
H2 200 prebid.js Show response
qd.admetricspro.com/js/threatpost/ 384 KB
108 KB 62ms
31ms Script
application/javascript 2606:4700:e6::ac40:c31a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Requested by: Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:e6::ac40:c31a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ed1bd9b5fc31e624bb0b3ca2c510546c8a1bb6b41923e06768a735c75a9c704c

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 09 Sep 2020 16:11:47 GMT
content-encoding: br
cf-cache-status: HIT
age: 306
status: 200
cf-request-id: 05153c454800002c2eaca17200000001
last-modified: Wed, 22 Jul 2020 04:38:40 GMT
server: cloudflare
etag: W/"601dd-5ab005060aaae-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=14400
cf-ray: 5d022fe87ff32c2e-FRA
expires: Wed, 09 Sep 2020 16:07:48 GMT

GET
H2 200 engine.js Show response
qd.admetricspro.com/js/threatpost/ 25 KB
7 KB 45ms
14ms Script
application/javascript 2606:4700:e6::ac40:c31a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://qd.admetricspro.com/js/threatpost/engine.js
Requested by: Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:e6::ac40:c31a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: aa90c2d77583dd25e7fbdc1411c8d718f29d9665ab48f985ffe6f3a38b34b6a7

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 09 Sep 2020 16:11:47 GMT
content-encoding: br
cf-cache-status: HIT
age: 306
status: 200
cf-request-id: 05153c454800002c2eaca18200000001
last-modified: Wed, 26 Aug 2020 03:04:19 GMT
server: cloudflare
etag: W/"637a-5adbf1363c190-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=14400
cf-ray: 5d022fe87ff42c2e-FRA
expires: Wed, 09 Sep 2020 16:07:48 GMT

GET
H2 200 /
assets.threatpost.com/wp-content/plugins/bwp-minify/min/ 89 KB
18 KB 529ms
486ms Stylesheet
text/css 2600:9000:20e8:ba00:2:9275:3d40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-includes/css/dist/block-library/style.min.css,wp-content/plugins/wds-rss-builder/includes/css/select2.min.css,wp-content/plugins/wds-rss-builder/includes/css/wds-rss.css,wp-content/plugins/honeypot-comments/public/assets/css/public.css,wp-content/plugins/kspr_twitter_pullquote/css/style.css,wp-content/plugins/pullquote-shortcode/css/pullquote-shortcode.css,wp-content/plugins/kaspersky-social-sharing/assets/css/style.css,wp-content/plugins/kaspersky-social-sharing/assets/css/custom.css&ver=cf1c8861

Requested by

Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:20e8:ba00:2:9275:3d40:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

15e9840f31982980328598c38e5c60434072901f2c902713ef9c4d4900e05307

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 09 Sep 2020 16:11:48 GMT
content-encoding: gzip
x-amz-cf-pop: TXL52-C1
x-cache: Miss from cloudfront
status: 200
content-length: 18049
x-cache-hit: HIT
last-modified: Wed, 09 Sep 2020 16:09:39 GMT
server: nginx
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: text/css; charset=utf-8
via: 1.1 c6649c9545bbfa66bc79c9ba552d7a4a.cloudfront.net (CloudFront)
cache-control: max-age=86400
x-debug-auth: off
x-request-host: assets.threatpost.com
x-amz-cf-id: r2GA8ynab-KAp2urvgoqVOz4guFYVLRtIClRMWVkXCWr_ilhwHjNJQ==
expires: Thu, 10 Sep 2020 16:10:25 GMT

GET
H/1.1 200
OK jquery.js Show response
threatpost.com/wp-includes/js/jquery/ 95 KB
37 KB 419ms
204ms Script
application/x-javascript 35.173.160.135
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://threatpost.com/wp-includes/js/jquery/jquery.js?ver=1.12.4-wp
Requested by: Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-173-160-135.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 1db21d816296e6939ba1f42962496e4134ae2b0081e26970864c40c6d02bb1df

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: public
Date: Wed, 09 Sep 2020 16:11:48 GMT
Content-Encoding: gzip
Last-Modified: Wed, 10 Jun 2020 22:05:38 GMT
Server: nginx
ETag: W/"5ee15932-17a69"
Transfer-Encoding: chunked
Content-Type: application/x-javascript
Cache-Control: max-age=604800, public
Connection: close
Expires: Wed, 16 Sep 2020 16:11:48 GMT

GET
H2 200 / Show response
assets.threatpost.com/wp-content/plugins/bwp-minify/min/ 177 KB
55 KB 782ms
740ms Script
application/x-javascript 2600:9000:20e8:ba00:2:9275:3d40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-content/plugins/kaspersky-cookies-notification/scripts/alert_text.js,wp-content/plugins/kaspersky-cookies-notification/scripts/alert.js,wp-content/plugins/honeypot-comments/public/assets/js/public.js,wp-content/plugins/kspr_twitter_pullquote/js/kaspersky-twitter-pullquote.js,wp-content/themes/threatpost-2018/assets/js/main.js,wp-content/themes/threatpost-2018/assets/js/loadmore.js,wp-content/plugins/kaspersky-social-sharing/assets/js/social-share.js&ver=cf1c8861

Requested by

Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:20e8:ba00:2:9275:3d40:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

b0209d39595432d762f6ba2a81dc0bffa6a6e1ed9021ba24ffa06c3c7e4bcb02

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 09 Sep 2020 16:11:48 GMT
content-encoding: gzip
x-amz-cf-pop: TXL52-C1
x-cache: Miss from cloudfront
status: 200
content-length: 56256
x-cache-hit: HIT
last-modified: Wed, 09 Sep 2020 08:46:19 GMT
server: nginx
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/x-javascript; charset=utf-8
via: 1.1 c6649c9545bbfa66bc79c9ba552d7a4a.cloudfront.net (CloudFront)
cache-control: max-age=86400
x-debug-auth: off
x-request-host: assets.threatpost.com
x-amz-cf-id: ajEirgr-O7marUNqeig0ZAaBMaeUe9pc3913BI20wu-iQBveqZ11Tw==
expires: Thu, 10 Sep 2020 12:47:57 GMT

GET
H2 200 trojan-malware.jpg
media.threatpost.com/wp-content/uploads/sites/103/2020/01/22100148/ 126 KB
126 KB 53ms
18ms Image
image/jpeg 2600:9000:20e8:7200:0:5c46:4f40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media.threatpost.com/wp-content/uploads/sites/103/2020/01/22100148/trojan-malware.jpg
Requested by: Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20e8:7200:0:5c46:4f40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 4edf4e4d19fa8ec8abf42e728012fb704a7d8e49a25bbf778b77abd20d90b8ce

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 12 Aug 2020 09:22:42 GMT
via: 1.1 9d27077cd67d98c0474b05ec9d68df4a.cloudfront.net (CloudFront), 1.1 c6649c9545bbfa66bc79c9ba552d7a4a.cloudfront.net (CloudFront)
last-modified: Wed, 22 Jan 2020 15:01:49 GMT
server: AmazonS3
age: 2443746
etag: "3f035e1c9c491a99670f6755b2e8e29f"
x-cache: Hit from cloudfront
content-type: image/jpeg
status: 200
cache-control: max-age=31536000
x-amz-cf-pop: FRA53-C1, TXL52-C1
accept-ranges: bytes
content-length: 128905
x-amz-cf-id: bww03E1DolYgJgTrg_a6d-icIq7tWoMaf-hfXvNd_5Jzzgj51_2JuA==
expires: Thu, 21 Jan 2021 15:01:48 GMT

GET
H2 200 Tara-headshot.jpg
media.threatpost.com/wp-content/uploads/sites/103/2018/08/15114841/ 13 KB
13 KB 86ms
51ms Image
image/jpeg 2600:9000:20e8:7200:0:5c46:4f40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media.threatpost.com/wp-content/uploads/sites/103/2018/08/15114841/Tara-headshot.jpg
Requested by: Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20e8:7200:0:5c46:4f40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 89ce08431545cd3c6d42419d99ee0152027a68c1d0c7c82838cc9a51d9d52451

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 21 Aug 2020 10:44:56 GMT
via: 1.1 89cb19c6f2c9ed0983294d3b12e80e43.cloudfront.net (CloudFront), 1.1 c6649c9545bbfa66bc79c9ba552d7a4a.cloudfront.net (CloudFront)
last-modified: Fri, 17 Aug 2018 16:22:08 GMT
server: AmazonS3
age: 1661213
etag: "dee18dfeea6de13bec60c1e5237eb723"
x-cache: Hit from cloudfront
content-type: image/jpeg
status: 200
cache-control: max-age=31536000
x-amz-cf-pop: FRA53-C1, TXL52-C1
accept-ranges: bytes
content-length: 13097
x-amz-cf-id: PUGrDuoxQC2xyKVCP3knLrc7SR9u85jMyzt7rGY_SfO14rtBumHOKw==
expires: Sat, 17 Aug 2019 16:22:07 GMT

GET
H2 200 subscribe2.jpg
media.threatpost.com/wp-content/uploads/sites/103/2019/02/19151457/ 8 KB
9 KB 86ms
51ms Image
image/jpeg 2600:9000:20e8:7200:0:5c46:4f40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media.threatpost.com/wp-content/uploads/sites/103/2019/02/19151457/subscribe2.jpg
Requested by: Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20e8:7200:0:5c46:4f40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: aa64fa30a3263fa3105736228a6feaaa4f7d32d8ef96b12e56f6fb95511b66a7

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 31 Aug 2020 02:20:15 GMT
via: 1.1 997f66fda0069dac50a85c7a4fa51b7e.cloudfront.net (CloudFront), 1.1 c6649c9545bbfa66bc79c9ba552d7a4a.cloudfront.net (CloudFront)
last-modified: Tue, 19 Feb 2019 20:14:58 GMT
server: AmazonS3
age: 827494
etag: "5ba45563f793f39ef6baf02645651654"
x-cache: Hit from cloudfront
content-type: image/jpeg
status: 200
cache-control: max-age=31536000
x-amz-cf-pop: FRA53-C1, TXL52-C1
accept-ranges: bytes
content-length: 8281
x-amz-cf-id: GEahfoIePEqOMbyCbmPVbM_Qf9QUTaQmxtX1ZdEN0VvtWEQbWrQ6EQ==
expires: Wed, 19 Feb 2020 20:14:57 GMT

GET
H2 200 python2-540x270.jpg
media.threatpost.com/wp-content/uploads/sites/103/2020/09/03105934/ 50 KB
50 KB 79ms
44ms Image
image/jpeg 2600:9000:20e8:7200:0:5c46:4f40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media.threatpost.com/wp-content/uploads/sites/103/2020/09/03105934/python2-540x270.jpg
Requested by: Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20e8:7200:0:5c46:4f40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 2f0be9d60fc023baccaf662aea974a753e85d849f89d71ab1b7c2e77dbc4ddda

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 05 Sep 2020 17:41:32 GMT
via: 1.1 32e3b86ae254a231182567c0124af893.cloudfront.net (CloudFront), 1.1 c6649c9545bbfa66bc79c9ba552d7a4a.cloudfront.net (CloudFront)
last-modified: Thu, 03 Sep 2020 15:00:23 GMT
server: AmazonS3
age: 340217
etag: "0a1567462f80d06f8d5e7afc184adf81"
x-cache: Hit from cloudfront
content-type: image/jpeg
status: 200
cache-control: max-age=31536000
x-amz-cf-pop: FRA2-C2, TXL52-C1
accept-ranges: bytes
content-length: 50867
x-amz-cf-id: EbezLEpUYkxr-_y5XVCGMV5H9gCD8NKLpn30mCxMl3TztDYopFJcMQ==
expires: Fri, 03 Sep 2021 15:00:19 GMT

GET
H2 200 RATicate-540x270.jpg
media.threatpost.com/wp-content/uploads/sites/103/2020/05/15102448/ 12 KB
13 KB 85ms
50ms Image
image/jpeg 2600:9000:20e8:7200:0:5c46:4f40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media.threatpost.com/wp-content/uploads/sites/103/2020/05/15102448/RATicate-540x270.jpg
Requested by: Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20e8:7200:0:5c46:4f40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: dec1958021b50b0f46e2ead96e79c9d109a0abfa617119a0066319304c5b7901

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 03 Sep 2020 03:37:32 GMT
via: 1.1 1cc446ef4692d8e752b16c07f2f58a59.cloudfront.net (CloudFront), 1.1 c6649c9545bbfa66bc79c9ba552d7a4a.cloudfront.net (CloudFront)
last-modified: Fri, 15 May 2020 14:24:53 GMT
server: AmazonS3
age: 563656
etag: "a45d2d0c6429e64920ebad59ae3305d2"
x-cache: Hit from cloudfront
content-type: image/jpeg
status: 200
cache-control: max-age=31536000
x-amz-cf-pop: FRA53-C1, TXL52-C1
accept-ranges: bytes
content-length: 12500
x-amz-cf-id: eNCrO-Y7Ks7q8fzZYucX0RhL8qGGNQLj3pQbOAz55dGbEeva6ElPNA==
expires: Sat, 15 May 2021 14:24:52 GMT

GET
H2 200 apple-security-540x270.jpg
media.threatpost.com/wp-content/uploads/sites/103/2020/08/31142546/ 9 KB
10 KB 86ms
52ms Image
image/jpeg 2600:9000:20e8:7200:0:5c46:4f40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media.threatpost.com/wp-content/uploads/sites/103/2020/08/31142546/apple-security-540x270.jpg
Requested by: Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20e8:7200:0:5c46:4f40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 12c9acd2dd58cfe3cbab5c7be32c13431018977aafd9f03d3fe3cc05ee379f49

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 02 Sep 2020 12:16:05 GMT
via: 1.1 784dd167d622737126ee2d76985e7d3c.cloudfront.net (CloudFront), 1.1 c6649c9545bbfa66bc79c9ba552d7a4a.cloudfront.net (CloudFront)
last-modified: Mon, 31 Aug 2020 18:25:50 GMT
server: AmazonS3
age: 618944
etag: "eb83ce7ad6a838839160ebb2d6ea2eb9"
x-cache: Hit from cloudfront
content-type: image/jpeg
status: 200
cache-control: max-age=31536000
x-amz-cf-pop: FRA2-C2, TXL52-C1
accept-ranges: bytes
content-length: 9552
x-amz-cf-id: HMINg3Rw2EuFVpxEGVuQ7oLD9yRZUoS8GXT4CRgJOmH8Qltk7vGv-Q==
expires: Tue, 31 Aug 2021 18:25:49 GMT

GET
H2 200 api.js Show response
www.google.com/recaptcha/ 736 B
555 B 20ms
19ms Script
text/javascript 2a00:1450:4001:81a::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api.js?hl=en

Requested by

Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81a::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

b38e3464dee0d0f1007c2c1195c69202c8212455c982d1fddf214b8aeedcb417

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 09 Sep 2020 16:11:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: GSE
x-frame-options: SAMEORIGIN
content-type: text/javascript; charset=UTF-8
status: 200
cache-control: private, max-age=300
cross-origin-resource-policy: cross-origin
content-security-policy: frame-ancestors 'self'
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 463
x-xss-protection: 1; mode=block
expires: Wed, 09 Sep 2020 16:11:48 GMT

GET
H2 200 zero-trust-b_w-64x64.jpg
media.threatpost.com/wp-content/uploads/sites/103/2020/09/07100716/ 3 KB
3 KB 45ms
45ms Image
image/jpeg 2600:9000:20e8:7200:0:5c46:4f40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media.threatpost.com/wp-content/uploads/sites/103/2020/09/07100716/zero-trust-b_w-64x64.jpg
Requested by: Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20e8:7200:0:5c46:4f40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 039f2a12a4fefd4b33bcae31f1f2f17d12cf51f4e6301792ada3885f412a2761

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 07 Sep 2020 14:12:42 GMT
via: 1.1 ec9e3bc729d9c6d55ed32446408ad62f.cloudfront.net (CloudFront), 1.1 c6649c9545bbfa66bc79c9ba552d7a4a.cloudfront.net (CloudFront)
last-modified: Mon, 07 Sep 2020 14:07:21 GMT
server: AmazonS3
age: 179947
etag: "5fb2f76c4c77c7e774eb0dc933ab39f0"
x-cache: Hit from cloudfront
content-type: image/jpeg
status: 200
cache-control: max-age=31536000
x-amz-cf-pop: FRA2-C2, TXL52-C1
accept-ranges: bytes
content-length: 2602
x-amz-cf-id: M1Rx1okmZ2cDcnDa9S3h2Y0lufeORTkzBcPgXIs5raGA3c1oFa6-lQ==
expires: Tue, 07 Sep 2021 14:07:19 GMT

GET
H2 200 social_media-64x64.jpg
media.threatpost.com/wp-content/uploads/sites/103/2019/08/26112855/ 3 KB
3 KB 46ms
45ms Image
image/jpeg 2600:9000:20e8:7200:0:5c46:4f40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media.threatpost.com/wp-content/uploads/sites/103/2019/08/26112855/social_media-64x64.jpg
Requested by: Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20e8:7200:0:5c46:4f40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 791135f98b21bbd99c1cbcd56e2827cab155856c144602a8749a57acaa5aa813

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 04 Sep 2020 17:24:42 GMT
via: 1.1 c90147ea5199ff7ce77981c8da4247c4.cloudfront.net (CloudFront), 1.1 c6649c9545bbfa66bc79c9ba552d7a4a.cloudfront.net (CloudFront)
last-modified: Mon, 26 Aug 2019 15:29:14 GMT
server: AmazonS3
age: 427627
etag: "fcf0de78ef3c45c8f8256c7cec2c35c0"
x-cache: Hit from cloudfront
content-type: image/jpeg
status: 200
cache-control: max-age=31536000
x-amz-cf-pop: FRA53-C1, TXL52-C1
accept-ranges: bytes
content-length: 2834
x-amz-cf-id: FY9fINJewnFdUszXzXf1lvRvaH1iJ7veqT5X56mP4-f8oZyl1Liugg==
expires: Tue, 25 Aug 2020 15:29:11 GMT

GET
H2 200 work-from-home-64x64.jpg
media.threatpost.com/wp-content/uploads/sites/103/2020/03/13163335/ 2 KB
2 KB 46ms
45ms Image
image/jpeg 2600:9000:20e8:7200:0:5c46:4f40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media.threatpost.com/wp-content/uploads/sites/103/2020/03/13163335/work-from-home-64x64.jpg
Requested by: Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20e8:7200:0:5c46:4f40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 3435531b595fb1b2b529346e1df8c979a1fd727f56ea8c0d792316035440cac5

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 10 Jun 2020 20:00:09 GMT
via: 1.1 b454a0b154ae18408006bc2a9abd88ec.cloudfront.net (CloudFront), 1.1 c6649c9545bbfa66bc79c9ba552d7a4a.cloudfront.net (CloudFront)
last-modified: Fri, 13 Mar 2020 20:33:52 GMT
server: AmazonS3
age: 7848700
etag: "fd4942a0704785b24b44d177f4a57d86"
x-cache: Hit from cloudfront
content-type: image/jpeg
status: 200
cache-control: max-age=31536000
x-amz-cf-pop: FRA54, TXL52-C1
accept-ranges: bytes
content-length: 2098
x-amz-cf-id: pFqWvhiOuWJbjyeRhVFXZXyBjoUxKqtUx42c4lb4AXNLArbpDmBmvQ==
expires: Sat, 13 Mar 2021 20:33:49 GMT

GET
H2 200 slideshow-1-64x64.jpeg
media.threatpost.com/wp-content/uploads/sites/103/2018/12/21160507/ 1 KB
2 KB 47ms
46ms Image
image/jpeg 2600:9000:20e8:7200:0:5c46:4f40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media.threatpost.com/wp-content/uploads/sites/103/2018/12/21160507/slideshow-1-64x64.jpeg
Requested by: Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20e8:7200:0:5c46:4f40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 39f437357a2ffa0d788c9fc8563f3af59d73d529060cb407ac639513df958597

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 24 Aug 2020 12:00:44 GMT
via: 1.1 2395e6175733260a159a0b484ed8febd.cloudfront.net (CloudFront), 1.1 c6649c9545bbfa66bc79c9ba552d7a4a.cloudfront.net (CloudFront)
last-modified: Fri, 21 Dec 2018 21:05:10 GMT
server: AmazonS3
age: 1397465
etag: "dec760c6e408812ae4334b4890452c65"
x-cache: Hit from cloudfront
content-type: image/jpeg
status: 200
cache-control: max-age=31536000
x-amz-cf-pop: DUS51-C1, TXL52-C1
accept-ranges: bytes
content-length: 1270
x-amz-cf-id: zO_3ThxghnGMrTse1vcWm3-GvLrUrA94Zx_6TYpqRf0ncUA6jxy7eA==
expires: Sat, 21 Dec 2019 21:05:07 GMT

GET
H2 200 data-leak-64x64.jpg
media.threatpost.com/wp-content/uploads/sites/103/2019/10/21145020/ 2 KB
2 KB 47ms
46ms Image
image/jpeg 2600:9000:20e8:7200:0:5c46:4f40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media.threatpost.com/wp-content/uploads/sites/103/2019/10/21145020/data-leak-64x64.jpg
Requested by: Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20e8:7200:0:5c46:4f40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 7517792de8d4a1319afd85d8c3dcffe799ba5545129a650182e6c4b055302852

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 22 Aug 2020 00:36:18 GMT
via: 1.1 2f194b62c8c43859cbf5af8e53a8d2a7.cloudfront.net (CloudFront), 1.1 c6649c9545bbfa66bc79c9ba552d7a4a.cloudfront.net (CloudFront)
last-modified: Mon, 21 Oct 2019 18:50:23 GMT
server: AmazonS3
age: 1611331
etag: "12bb1aa91531788d81a1791bcbb631f9"
x-cache: Hit from cloudfront
content-type: image/jpeg
status: 200
cache-control: max-age=31536000
x-amz-cf-pop: FRA2-C2, TXL52-C1
accept-ranges: bytes
content-length: 2106
x-amz-cf-id: VTK1WYZJx-HrsctZMdDN83FGYuB_XQahVRzrOxdHrc1KWLhiOJbkGQ==
expires: Tue, 20 Oct 2020 18:50:20 GMT

GET
H/1.1 200
OK liveView.php Show response
live.sekindo.com/live/ 30 KB
9 KB 59ms
26ms Script
text/javascript 185.220.204.204
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to

Full URL: https://live.sekindo.com/live/liveView.php?s=101281&cbuster=%%CACHEBUSTER%%&pubUrl=%%REFERRER_URL_ESC%%&x=[WIDTH]&y=[HEIGHT]&vp_content=plembed173akunvrojp&vp_template=6615&subId=[SUBID_ENCODED]&schain=1.0,1!admetricspro.com,1005,1
Requested by: Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 185.220.204.204 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, GB),
Reverse DNS
Software: nginx /
Resource Hash: 31c322fcf8f745ff255514a08189b08d8a961f53877ddca470d0c09994084ef3

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 09 Sep 2020 16:11:48 GMT
content-encoding: gzip
server: nginx
age: 0
transfer-encoding: chunked
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
access-control-allow-origin: *
cache-control: no-store
content-type: text/javascript; charset=utf-8

GET
H2 200 / Show response
assets.threatpost.com/wp-content/plugins/bwp-minify/min/ 2 KB
1 KB 305ms
305ms Script
application/x-javascript 2600:9000:20e8:ba00:2:9275:3d40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-content/plugins/gravityforms/js/jquery.json.min.js&ver=cf1c8861

Requested by

Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:20e8:ba00:2:9275:3d40:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

172314ff74044b918766ed4763279b5e8798622087c0a2930f59c9d44662213d

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 09 Sep 2020 16:11:48 GMT
content-encoding: gzip
x-amz-cf-pop: TXL52-C1
x-cache: Miss from cloudfront
status: 200
content-length: 926
x-cache-hit: HIT
last-modified: Wed, 09 Sep 2020 08:46:17 GMT
server: nginx
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/x-javascript; charset=utf-8
via: 1.1 c6649c9545bbfa66bc79c9ba552d7a4a.cloudfront.net (CloudFront)
cache-control: max-age=86400
x-debug-auth: off
x-request-host: assets.threatpost.com
x-amz-cf-id: dAT6LqlwQyhYtgaBXKKwoPhSeCss5jrM6GuP0TzVdnWcVbJeKEWSeA==
expires: Thu, 10 Sep 2020 12:48:16 GMT

GET
H/1.1 200
OK gravityforms.min.js Show response
threatpost.com/wp-content/plugins/gravityforms/js/ 34 KB
12 KB 756ms
101ms Script
application/x-javascript 35.173.160.135
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://threatpost.com/wp-content/plugins/gravityforms/js/gravityforms.min.js?ver=2.4.17.15
Requested by: Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-173-160-135.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 3097d0444becd9d089b52b7074072f19201525de874d0775012572fb375b7838

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: public
Date: Wed, 09 Sep 2020 16:11:49 GMT
Content-Encoding: gzip
Last-Modified: Wed, 09 Sep 2020 08:46:17 GMT
Server: nginx
ETag: W/"5f589659-88c2"
Transfer-Encoding: chunked
Content-Type: application/x-javascript
Cache-Control: max-age=604800, public
Connection: close
Expires: Wed, 16 Sep 2020 16:11:49 GMT

GET
H2 200 / Show response
assets.threatpost.com/wp-content/plugins/bwp-minify/min/ 7 KB
3 KB 330ms
324ms Script
application/x-javascript 2600:9000:20e8:ba00:2:9275:3d40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-content/plugins/gravityforms/js/conditional_logic.min.js&ver=cf1c8861

Requested by

Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:20e8:ba00:2:9275:3d40:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

f75166e3f70100b65a6ce1d4128bc15286e92b19a546fa7709f739e9bcfe52c6

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 09 Sep 2020 16:11:49 GMT
content-encoding: gzip
x-amz-cf-pop: TXL52-C1
x-cache: Miss from cloudfront
status: 200
content-length: 2685
x-cache-hit: HIT
last-modified: Wed, 09 Sep 2020 08:46:16 GMT
server: nginx
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/x-javascript; charset=utf-8
via: 1.1 c6649c9545bbfa66bc79c9ba552d7a4a.cloudfront.net (CloudFront)
cache-control: max-age=86400
x-debug-auth: off
x-request-host: assets.threatpost.com
x-amz-cf-id: -GKqoBMJkDEGR0NDt3i1vo7JGni-jdZGdqQ4isSTpmen4ZNoKLYcOA==
expires: Thu, 10 Sep 2020 12:47:58 GMT

GET
H2 200 / Show response
assets.threatpost.com/wp-content/plugins/bwp-minify/min/ 5 KB
2 KB 327ms
321ms Script
application/x-javascript 2600:9000:20e8:ba00:2:9275:3d40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-content/plugins/gravityforms/js/placeholders.jquery.min.js&ver=cf1c8861

Requested by

Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:20e8:ba00:2:9275:3d40:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

d62a7b7ec5313469ebff5c006b9068dc44d6d1c122cf787ffa29a10113b34060

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 09 Sep 2020 16:11:49 GMT
content-encoding: gzip
x-amz-cf-pop: TXL52-C1
x-cache: Miss from cloudfront
status: 200
content-length: 1747
x-cache-hit: HIT
last-modified: Wed, 09 Sep 2020 08:46:16 GMT
server: nginx
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/x-javascript; charset=utf-8
via: 1.1 c6649c9545bbfa66bc79c9ba552d7a4a.cloudfront.net (CloudFront)
cache-control: max-age=86400
x-debug-auth: off
x-request-host: assets.threatpost.com
x-amz-cf-id: ryfQ67f_ZyWXHkEKOkhq6I58KbF-DnSpsSzj24TQVfwVH25KR17VBw==
expires: Thu, 10 Sep 2020 12:47:58 GMT

GET
H3-Q050 200 api.js Show response
www.google.com/recaptcha/ 738 B
900 B 42ms
23ms Script
text/javascript 2a00:1450:4001:81a::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api.js?hl=en&render=explicit&ver=5.4.2

Requested by

Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81a::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

ee8d80d0be74777d3ae8804cb3a4f13ca91205a976c3ad7330f1bf065bd1d1bf

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 09 Sep 2020 16:11:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: GSE
x-frame-options: SAMEORIGIN
content-type: text/javascript; charset=UTF-8
status: 200
cache-control: private, max-age=300
cross-origin-resource-policy: cross-origin
content-security-policy: frame-ancestors 'self'
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 465
x-xss-protection: 1; mode=block
expires: Wed, 09 Sep 2020 16:11:48 GMT

GET
H2 200 / Show response
assets.threatpost.com/wp-content/plugins/bwp-minify/min/ 2 KB
1 KB 328ms
323ms Script
application/x-javascript 2600:9000:20e8:ba00:2:9275:3d40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-includes/js/wp-embed.min.js,wp-content/plugins/akismet/_inc/form.js&ver=cf1c8861

Requested by

Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:20e8:ba00:2:9275:3d40:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

21e46fe44c6929876f5a413c843ae516c0ddfd1aad3e8e33446b7bc0a6781b08

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 09 Sep 2020 16:11:49 GMT
content-encoding: gzip
x-amz-cf-pop: TXL52-C1
x-cache: Miss from cloudfront
status: 200
content-length: 973
x-cache-hit: HIT
last-modified: Wed, 10 Jun 2020 22:05:38 GMT
server: nginx
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/x-javascript; charset=utf-8
via: 1.1 c6649c9545bbfa66bc79c9ba552d7a4a.cloudfront.net (CloudFront)
cache-control: max-age=86400
x-debug-auth: off
x-request-host: assets.threatpost.com
x-amz-cf-id: vzzWvXJ7jsR-FurgNTEmdk0w3q3rVOyXkRzc8uYNd5PLU-fMeLytUQ==
expires: Thu, 10 Sep 2020 12:48:01 GMT

GET
H2 200 b-9a4f7ce-a7f6098c.js Show response
tagan.adlightning.com/math-aids-threatpost/ 61 KB
21 KB 39ms
36ms Script
application/javascript 99.84.156.34
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/math-aids-threatpost/b-9a4f7ce-a7f6098c.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.84.156.34 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-84-156-34.txl52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 0119689800eadf6270855a19b65d74251e7da6be5e4686f36c15bf81281ddb4c

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 07 Sep 2020 01:11:01 GMT
content-encoding: gzip
age: 226848
x-cache: Hit from cloudfront
status: 200
content-length: 20808
x-amz-meta-git_commit: 9a4f7ce
last-modified: Tue, 18 Aug 2020 17:45:57 GMT
server: AmazonS3
etag: "98ae1c21c96b68b5f173604d82c35d5d"
x-amz-version-id: PzdVsYQ0bdCd7Kp..jKBw4vE53Z4BW7z
via: 1.1 df792ea3bbbe656e2f5c7b61aa85cc47.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: TXL52-C1
accept-ranges: bytes
content-type: application/javascript
x-amz-cf-id: eDJNfew2E651KdnYrSH_e9N1ZZq5jVIugLV8RmDTxa5rNcznhhJ4Rw==

GET
H2 200 bl-9a4f7ce-ca40eed9.js Show response
tagan.adlightning.com/math-aids-threatpost/ 79 KB
22 KB 39ms
36ms Script
application/javascript 99.84.156.34
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/math-aids-threatpost/bl-9a4f7ce-ca40eed9.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.84.156.34 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-84-156-34.txl52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 82e2369bfee3725eb4f4ef3af5431637009a89ac42f4e6da6f68e66d3b034788

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 09 Sep 2020 03:12:51 GMT
content-encoding: gzip
age: 46738
x-cache: Hit from cloudfront
status: 200
content-length: 22389
x-amz-meta-git_commit: 9a4f7ce
last-modified: Tue, 08 Sep 2020 22:17:44 GMT
server: AmazonS3
etag: "79e00495b70f820a38b6b36c3f2f8ff5"
x-amz-version-id: F.XN1SsPf_y4x2xIDo65TAplqCsfb9A2
via: 1.1 df792ea3bbbe656e2f5c7b61aa85cc47.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: TXL52-C1
accept-ranges: bytes
content-type: application/javascript
x-amz-cf-id: kjlEaackTYDDU1SOkdbwLhQOmuPrzifTWprZpeZ5bleXhs-hOJFIOA==

GET
H2 200 pubads_impl_2020090201.js Show response
securepubads.g.doubleclick.net/gpt/ 262 KB
92 KB 107ms
54ms Script
text/javascript 216.58.206.2
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020090201.js

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.58.206.2 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s20-in-f2.1e100.net

Software

sffe /

Resource Hash

b4e8f2d73294065f2c0e54cb17bcba8bf7440408b804f9052ac03c0ff9adb398

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

date: Wed, 09 Sep 2020 16:11:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 02 Sep 2020 08:39:38 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 94147
x-xss-protection: 0
expires: Wed, 09 Sep 2020 16:11:48 GMT

GET
H2 200 vendor-list.json Show response
qd.admetricspro.com/js/cmp2/ 199 KB
22 KB 173ms
157ms XHR
application/json 2606:4700:e6::ac40:c31a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://qd.admetricspro.com/js/cmp2/vendor-list.json
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/cmp.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:e6::ac40:c31a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 29257e6f0eaa20a411d881c29d9fdd181a811ec32b5fdd1cb46ec4bd4719861f

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 09 Sep 2020 16:11:48 GMT
content-encoding: br
cf-cache-status: DYNAMIC
last-modified: Wed, 26 Aug 2020 22:56:36 GMT
server: cloudflare
etag: W/"31bad-5adcfbb507100"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
status: 200
content-type: application/json
access-control-allow-origin: *
cache-control: max-age=600
cf-ray: 5d022fec2bc1c2ea-FRA
cf-request-id: 05153c47970000c2ea952e0200000001
expires: Wed, 09 Sep 2020 16:21:48 GMT

GET
H2 200 apstag.js Show response
c.amazon-adsystem.com/aax2/ 102 KB
26 KB 104ms
34ms Script
application/javascript 99.84.153.196
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/aax2/apstag.js
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/engine.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.84.153.196 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-84-153-196.txl52.r.cloudfront.net
Software: Server /
Resource Hash: 8c665507e16736e1323acf89104e508e8cac863d30e8ca5ff5d6ac5303b25277

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 09 Sep 2020 16:00:46 GMT
content-encoding: gzip
server: Server
age: 662
etag: 5a34c79c51b93c8b4601b1808cbdbd04
x-cache: Hit from cloudfront
content-type: application/javascript
status: 200
cache-control: public, max-age=900
x-amz-cf-pop: TXL52-C1
accept-ranges: bytes
timing-allow-origin: *
x-amz-cf-id: Pi7N5FK83P_cBKRBZANyYjfcu00n6AMmyJrWFjBjd1N-wkINO5gPNw==
via: 1.1 2d69f677a4a0e3e7eefdf9d24bd43661.cloudfront.net (CloudFront)

GET
H/1.1 200
OK / Show response
kasperskycontenthub.com/ 0
398 B 438ms
107ms Script
application/javascript 35.173.160.135
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://kasperskycontenthub.com/?dm=ed1f9e435dc885292eab65620c51f3fb&action=load&blogid=103&siteid=1&t=450034006&back=https%3A%2F%2Fthreatpost.com%2Fshlayer-mac-malware-extra-sneakiness%2F156669%2F%3Fweb_view%3Dtrue

Requested by

Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-35-173-160-135.compute-1.amazonaws.com

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Wed, 09 Sep 2020 16:11:49 GMT
X-Content-Type-Options: nosniff
Server: nginx
X-Frame-Options: SAMEORIGIN
Connection: close
Content-Type: application/javascript
x-cache-hit: HIT
Transfer-Encoding: chunked
X-Debug-Auth: off
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Request-Host: kasperskycontenthub.com
X-XSS-Protection: 1; mode=block

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 147 KB
47 KB 37ms
34ms Script
application/javascript 2a00:1450:4001:824::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-PM29HLF

Requested by

Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:824::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

511032aee4997e4c51979d4e35b0fa03ee5259f7cfb58c4081969a258251427f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 09 Sep 2020 16:11:48 GMT
content-encoding: br
vary: Accept-Encoding
status: 200
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 47645
x-xss-protection: 0
last-modified: Wed, 09 Sep 2020 15:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Wed, 09 Sep 2020 16:11:48 GMT

GET
H/1.1 200
OK icons.svg
threatpost.com/wp-content/themes/threatpost-2018//assets/sprite/ 13 KB
5 KB 324ms
109ms Other
image/svg+xml 35.173.160.135
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://threatpost.com/wp-content/themes/threatpost-2018//assets/sprite/icons.svg
Requested by: Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-173-160-135.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 01864580e1f385dc4512aed0de4b324cc1a04812709e7020e857612fc0ce9f4c

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: public
Date: Wed, 09 Sep 2020 16:11:49 GMT
Content-Encoding: gzip
Last-Modified: Wed, 09 Sep 2020 08:46:19 GMT
Server: nginx
ETag: W/"5f58965b-3496"
Transfer-Encoding: chunked
Content-Type: image/svg+xml
Cache-Control: max-age=604800, public
Connection: close
Expires: Wed, 16 Sep 2020 16:11:49 GMT

GET
H/1.1 200
OK icons.svg
threatpost.com/wp-content/themes/threatpost-2018/assets/sprite/ 13 KB
5 KB 322ms
108ms Other
image/svg+xml 35.173.160.135
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/sprite/icons.svg
Requested by: Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-173-160-135.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 01864580e1f385dc4512aed0de4b324cc1a04812709e7020e857612fc0ce9f4c

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: public
Date: Wed, 09 Sep 2020 16:11:49 GMT
Content-Encoding: gzip
Last-Modified: Wed, 09 Sep 2020 08:46:19 GMT
Server: nginx
ETag: W/"5f58965b-3496"
Transfer-Encoding: chunked
Content-Type: image/svg+xml
Cache-Control: max-age=604800, public
Connection: close
Expires: Wed, 16 Sep 2020 16:11:49 GMT

GET
H2 200 recaptcha__en.js Show response
www.gstatic.com/recaptcha/releases/iSHzt4kCrNgSxGUYDFqaZAL9/ 336 KB
132 KB 26ms
6ms Script
text/javascript 2a00:1450:4001:808::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/iSHzt4kCrNgSxGUYDFqaZAL9/recaptcha__en.js

Requested by

Host: www.google.com
URL: https://www.google.com/recaptcha/api.js?hl=en

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

854f7a7915f240546d3950dd2b067466da13c013d04a3f8c790880c58ec61151

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 08 Sep 2020 15:45:21 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Mon, 07 Sep 2020 04:06:55 GMT
server: sffe
age: 87987
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=31536000
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 134800
x-xss-protection: 0
expires: Wed, 08 Sep 2021 15:45:21 GMT

GET
H/1.1 200
OK logo.png
threatpost.com/wp-content/themes/threatpost-2018/assets/images/ 19 KB
19 KB 598ms
100ms Image
image/png 35.173.160.135
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/images/logo.png
Requested by: Host: threatpost.com
URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1599667780
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-173-160-135.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 39af7c1116fb967a330e8770f775e6b5ee871add01ed45c98a1634911cebfb0a

Request headers

Referer: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1599667780
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: public
Date: Wed, 09 Sep 2020 16:11:49 GMT
Last-Modified: Wed, 09 Sep 2020 16:09:39 GMT
Server: nginx
ETag: "5f58fe43-4a32"
Content-Type: image/png
Cache-Control: max-age=604800, public
Connection: close
Accept-Ranges: bytes
Content-Length: 18994
Expires: Wed, 16 Sep 2020 16:11:49 GMT

GET
H/1.1 200
OK mail-plane-light.svg
threatpost.com/wp-content/themes/threatpost-2018/assets/images/ 828 B
722 B 573ms
97ms Image
image/svg+xml 35.173.160.135
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/images/mail-plane-light.svg
Requested by: Host: threatpost.com
URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1599667780
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-173-160-135.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 5a7ed822968963e31d88424c96387ad9f4fd4f4b5a5b581a33f65e3784d162cf

Request headers

Referer: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1599667780
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: public
Date: Wed, 09 Sep 2020 16:11:49 GMT
Content-Encoding: gzip
Last-Modified: Wed, 09 Sep 2020 08:46:19 GMT
Server: nginx
ETag: W/"5f58965b-33c"
Transfer-Encoding: chunked
Content-Type: image/svg+xml
Cache-Control: max-age=604800, public
Connection: close
Expires: Wed, 16 Sep 2020 16:11:49 GMT

GET
H/1.1 200
OK twitter-blue.svg
threatpost.com/wp-content/themes/threatpost-2018/assets/images/ 868 B
847 B 574ms
98ms Image
image/svg+xml 35.173.160.135
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/images/twitter-blue.svg
Requested by: Host: threatpost.com
URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1599667780
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-173-160-135.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 420508fc523520f35de5c851905543294123d7676b5a5668744691f2abe9e730

Request headers

Referer: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1599667780
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: public
Date: Wed, 09 Sep 2020 16:11:49 GMT
Content-Encoding: gzip
Last-Modified: Wed, 09 Sep 2020 16:09:39 GMT
Server: nginx
ETag: W/"5f58fe43-364"
Transfer-Encoding: chunked
Content-Type: image/svg+xml
Cache-Control: max-age=604800, public
Connection: close
Expires: Wed, 16 Sep 2020 16:11:49 GMT

GET
H/1.1 200
OK museosans-700-webfont.woff2
threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/ 20 KB
21 KB 364ms
205ms Font
font/woff2 35.173.160.135
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/museosans-700-webfont.woff2
Requested by: Host: threatpost.com
URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1599667780
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-173-160-135.compute-1.amazonaws.com
Software: nginx /
Resource Hash: ae00ae9c862bc8b8923efd1d9a18befa912678a869d4dd01179a59ed3de731be

Request headers

Origin: https://threatpost.com
Referer: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1599667780
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: public
Date: Wed, 09 Sep 2020 16:11:48 GMT
Last-Modified: Wed, 09 Sep 2020 16:09:39 GMT
Server: nginx
ETag: "5f58fe43-51a4"
Content-Type: font/woff2
Access-Control-Allow-Origin: *
Cache-Control: max-age=31536000, public
Connection: close
Accept-Ranges: bytes
Content-Length: 20900
Expires: Thu, 09 Sep 2021 16:11:48 GMT

GET
H/1.1 200
OK museosans-100-webfont.woff2
threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/ 20 KB
21 KB 375ms
180ms Font
font/woff2 35.173.160.135
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/museosans-100-webfont.woff2
Requested by: Host: threatpost.com
URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1599667780
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-173-160-135.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 06fc565587b8b700936a1677218cb269a6cc31ca5f701eb45461e86a3d54d5c7

Request headers

Origin: https://threatpost.com
Referer: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1599667780
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: public
Date: Wed, 09 Sep 2020 16:11:49 GMT
Last-Modified: Wed, 09 Sep 2020 08:46:19 GMT
Server: nginx
ETag: "5f58965b-50c8"
Content-Type: font/woff2
Access-Control-Allow-Origin: *
Cache-Control: max-age=31536000, public
Connection: close
Accept-Ranges: bytes
Content-Length: 20680
Expires: Thu, 09 Sep 2021 16:11:49 GMT

GET
H/1.1 200
OK museosans-300-webfont.woff2
threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/ 20 KB
21 KB 306ms
102ms Font
font/woff2 35.173.160.135
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/museosans-300-webfont.woff2
Requested by: Host: threatpost.com
URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1599667780
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-173-160-135.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 45ddc09b0ad6ab916bd9a0282070b161045e186fc025303f4aa1aa821fc45ac7

Request headers

Origin: https://threatpost.com
Referer: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1599667780
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: public
Date: Wed, 09 Sep 2020 16:11:49 GMT
Last-Modified: Wed, 09 Sep 2020 08:46:19 GMT
Server: nginx
ETag: "5f58965b-51b8"
Content-Type: font/woff2
Access-Control-Allow-Origin: *
Cache-Control: max-age=31536000, public
Connection: close
Accept-Ranges: bytes
Content-Length: 20920
Expires: Thu, 09 Sep 2021 16:11:49 GMT

GET
H/1.1 200
OK museosans-500-webfont.woff2
threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/ 20 KB
21 KB 307ms
103ms Font
font/woff2 35.173.160.135
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/museosans-500-webfont.woff2
Requested by: Host: threatpost.com
URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1599667780
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-173-160-135.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 2de77164bb9924542e1dea4ee4a0ff27d40b51a3d7939dac7db11a95045c9b7d

Request headers

Origin: https://threatpost.com
Referer: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1599667780
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: public
Date: Wed, 09 Sep 2020 16:11:49 GMT
Last-Modified: Wed, 09 Sep 2020 16:09:39 GMT
Server: nginx
ETag: "5f58fe43-5194"
Content-Type: font/woff2
Access-Control-Allow-Origin: *
Cache-Control: max-age=31536000, public
Connection: close
Accept-Ranges: bytes
Content-Length: 20884
Expires: Thu, 09 Sep 2021 16:11:49 GMT

GET
H/1.1 200
OK museosans-700italic-webfont.woff2
threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/ 15 KB
16 KB 310ms
103ms Font
font/woff2 35.173.160.135
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/museosans-700italic-webfont.woff2
Requested by: Host: threatpost.com
URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1599667780
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-173-160-135.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 859faa9b9ed0990288b2f393a102b1fe2668ac79088b113b6f0beaee521221eb

Request headers

Origin: https://threatpost.com
Referer: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1599667780
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: public
Date: Wed, 09 Sep 2020 16:11:49 GMT
Last-Modified: Wed, 09 Sep 2020 08:46:19 GMT
Server: nginx
ETag: "5f58965b-3dcc"
Content-Type: font/woff2
Access-Control-Allow-Origin: *
Cache-Control: max-age=31536000, public
Connection: close
Accept-Ranges: bytes
Content-Length: 15820
Expires: Thu, 09 Sep 2021 16:11:49 GMT

GET
H/1.1 200
OK museosans-300italic-webfont.woff2
threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/ 23 KB
23 KB 253ms
104ms Font
font/woff2 35.173.160.135
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/museosans-300italic-webfont.woff2
Requested by: Host: threatpost.com
URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1599667780
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-173-160-135.compute-1.amazonaws.com
Software: nginx /
Resource Hash: f8a2b5b62eb722c3379b30cf0cc58d3176ee6be48036d6ad2aa838d2029c4189

Request headers

Origin: https://threatpost.com
Referer: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1599667780
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: public
Date: Wed, 09 Sep 2020 16:11:49 GMT
Last-Modified: Wed, 09 Sep 2020 08:46:19 GMT
Server: nginx
ETag: "5f58965b-5bac"
Content-Type: font/woff2
Access-Control-Allow-Origin: *
Cache-Control: max-age=31536000, public
Connection: close
Accept-Ranges: bytes
Content-Length: 23468
Expires: Thu, 09 Sep 2021 16:11:49 GMT

GET
H/1.1 200
OK liveView.php Show response
live.sekindo.com/live/ Frame 9723 2 KB
1 KB 23ms
22ms Script
text/javascript 185.220.204.204
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to

Full URL: https://live.sekindo.com/live/liveView.php?s=101281&cbuster=%%CACHEBUSTER%%&pubUrl=%%REFERRER_URL_ESC%%&x=[WIDTH]&y=[HEIGHT]&vp_content=plembed173akunvrojp&vp_template=6615&subId=[SUBID_ENCODED]&schain=1.0,1!admetricspro.com,1005,1&cbuster=1599667908&pubUrlAuto=https%3A%2F%2Fthreatpost.com%2Fshlayer-mac-malware-extra-sneakiness%2F156669%2F%3Fweb_view%3Dtrue&videoType=flow&floatWidth=320&floatHeight=180&floatDirection=br&floatVerticalOffset=10&floatHorizontalOffset=10&floatCloseBtn=1&flowMode=both&flowCloseButtonPosition=right
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/live/liveView.php?s=101281&cbuster=%%CACHEBUSTER%%&pubUrl=%%REFERRER_URL_ESC%%&x=[WIDTH]&y=[HEIGHT]&vp_content=plembed173akunvrojp&vp_template=6615&subId=[SUBID_ENCODED]&schain=1.0,1!admetricspro.com,1005,1
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 185.220.204.204 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, GB),
Reverse DNS
Software: nginx /
Resource Hash: e118bb3b3ab039801c7adf8dc9fc41bee66096475206a1717e9f098e5a43b469

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 09 Sep 2020 16:11:48 GMT
content-encoding: gzip
server: nginx
age: 0
transfer-encoding: chunked
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
access-control-allow-origin: *
cache-control: no-store
content-type: text/javascript; charset=utf-8

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ 19 B
712 B 67ms
23ms XHR
application/json 37.252.172.36
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.172.36 , Ascension Island, ASN29990 (ASN-APPNEX, US),

Reverse DNS

692.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

Software

nginx/1.17.9 /

Resource Hash

0c09c070833c786cb25be38bc30992b30bad578f817dbc9e34beacd8b8ea44c5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Wed, 09 Sep 2020 16:11:48 GMT
X-Proxy-Origin: 185.217.171.12; 185.217.171.12; 692.bm-nginx-loadbalancer.mgmt.fra1; *.adnxs.com; 37.252.172.229:80
AN-X-Request-Uuid: b3113162-22bc-46d4-a9a7-e9ac956bcb9c
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://threatpost.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json; charset=utf-8
Content-Length: 19
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 arj Show response
teachingaids-d.openx.net/w/1.0/ 174 B
560 B 268ms
232ms XHR
application/json 35.244.159.8
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://teachingaids-d.openx.net/w/1.0/arj?ju=https%3A%2F%2Fthreatpost.com%2Fshlayer-mac-malware-extra-sneakiness%2F156669%2F%3Fweb_view%3Dtrue&ch=UTF-8&res=1600x1200x24&ifr=false&tz=-120&tws=1600x1200&be=1&bc=hb_pb_3.0.2&dddid=caceccfc-cf78-476b-a020-422c9aacc7e2%2Ccaceccfc-cf78-476b-a020-422c9aacc7e2%2C6f37fa96-72d2-43eb-9fde-b3b4af2ab980%2C7614133f-f30a-476c-93c8-b6a0914b4c7d%2C7614133f-f30a-476c-93c8-b6a0914b4c7d&nocache=1599667908916&gdpr=0&x_gdpr_f=1&pubcid=9f9bf4b1-f00e-4fd9-a616-ea810960aa06&schain=1.0%2C1!admetricspro.com%2C1005%2C1%2C%2C%2C&aus=728x90%2C970x250%2C970x90%7C728x90%2C970x250%2C970x90%7C300x250%2C336x280%7C300x250%2C300x600%7C300x250%2C300x600&divIds=div-gpt-ad-6794670-2%2Cdiv-gpt-ad-6794670-2%2Cdiv-gpt-ad-6794670-3%2Cdiv-gpt-ad-6794670-5%2Cdiv-gpt-ad-6794670-5&auid=540932704%2C540932709%2C540932713%2C540932715%2C540932720
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.159.8 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/16.193.0 /
Resource Hash: 003dea087f7ccec2e6468f02be66548dc63b148e0e22e898b457d5735fc5b185

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Wed, 09 Sep 2020 16:11:49 GMT
content-encoding: gzip
server: OXGW/16.193.0
status: 200
vary: Accept, Accept-Encoding
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: https://threatpost.com
cache-control: private, max-age=0, no-cache
access-control-allow-credentials: true
content-type: application/json
alt-svc: clear
content-length: 165
via: 1.1 google
expires: Mon, 26 Jul 1997 05:00:00 GMT

POST
H/1.1 200
OK bid Show response
ap.lijit.com/rtb/ 47 B
723 B 105ms
71ms XHR
application/json 72.251.249.9
VOXEL-DOT-NET

General

Check archive.org

Show headers Download Go to

Full URL: https://ap.lijit.com/rtb/bid?src=prebid_prebid_3.26.0
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 72.251.249.9 Amsterdam, Netherlands, ASN29791 (VOXEL-DOT-NET, US),
Reverse DNS
Software: nginx /
Resource Hash: 037f0569583539cc02e38c7a1dcb9a1f28d7de1ddee4cad3c26612c89d7c56c6

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

Date: Wed, 09 Sep 2020 16:11:49 GMT
Content-Encoding: gzip
Server: nginx
Vary: Accept-Encoding, User-Agent
Access-Control-Allow-Methods: GET, POST, DELETE, PUT
Content-Type: application/json
Access-Control-Allow-Origin: https://threatpost.com
Access-Control-Allow-Credentials: true
X-Sovrn-Pod: ad_ap3ams1
Access-Control-Allow-Headers: X-Requested-With, Content-Type
Content-Length: 65

GET
H2

200

ADTECH;apid=1A2a527996-f2b7-11ea-bc35-12795fd23bd8;cfp=1;rndc=1599667908;v=2;cmd=bid;cors=yes;alias=582565d4588e9bc;misc=1599667908918 Show response
adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166606/0/0/
Redirect Chain

https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166606/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=582565d4588e9bc;misc=1599667908918;
https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166606/0/0/ADTECH;cfp=1;rndc=1599667908;v=2;cmd=bid;cors=yes;alias=582565d4588e9bc;misc=1599667908918
https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166606/0/0/ADTECH;apid=1A2a527996-f2b7-11ea-bc35-12795fd23bd8;cfp=1;rndc=1599667908;v=2;cmd=bid;cors=yes;alias=582565d4588e9bc;misc=15...

1 KB
1 KB

158ms
157ms

XHR
application/json

2606:2800:233:97b6:26be:138a:cba8:bb01
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166606/0/0/ADTECH;apid=1A2a527996-f2b7-11ea-bc35-12795fd23bd8;cfp=1;rndc=1599667908;v=2;cmd=bid;cors=yes;alias=582565d4588e9bc;misc=1599667908918
Requested by: Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:233:97b6:26be:138a:cba8:bb01 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: Adtech Adserver /
Resource Hash: bab2f390df5c0f89d0b511da9790e6b6a4fd6daa3706a535e14a9cc1174fc5d4

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 09 Sep 2020 16:11:49 GMT
server: Adtech Adserver
status: 200
access-control-allow-methods: POST,GET,HEAD,OPTIONS
p3p: CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
access-control-allow-origin: https://threatpost.com
cache-control: no-store, no-cache
access-control-allow-credentials: true
content-type: application/json
content-length: 1225
expires: Mon, 15 Jun 1998 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 09 Sep 2020 16:11:49 GMT
server: nginx
status: 302
location: https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166606/0/0/ADTECH;apid=1A2a527996-f2b7-11ea-bc35-12795fd23bd8;cfp=1;rndc=1599667908;v=2;cmd=bid;cors=yes;alias=582565d4588e9bc;misc=1599667908918
access-control-allow-methods: POST,GET,HEAD,OPTIONS
p3p: CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
access-control-allow-origin: https://threatpost.com
cache-control: no-store, no-cache
access-control-allow-credentials: true
content-length: 0
expires: Mon, 15 Jun 1998 00:00:00 GMT

GET
H2

200

ADTECH;apid=1A2a4dbde8-f2b7-11ea-94b5-1273d078354a;cfp=1;rndc=1599667908;v=2;cmd=bid;cors=yes;alias=590109fcd6afeb7;misc=1599667908918 Show response
adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166847/0/0/
Redirect Chain

https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166847/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=590109fcd6afeb7;misc=1599667908918;
https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166847/0/0/ADTECH;cfp=1;rndc=1599667908;v=2;cmd=bid;cors=yes;alias=590109fcd6afeb7;misc=1599667908918
https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166847/0/0/ADTECH;apid=1A2a4dbde8-f2b7-11ea-94b5-1273d078354a;cfp=1;rndc=1599667908;v=2;cmd=bid;cors=yes;alias=590109fcd6afeb7;misc=15...

1 KB
1 KB

209ms
208ms

XHR
application/json

2606:2800:233:97b6:26be:138a:cba8:bb01
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166847/0/0/ADTECH;apid=1A2a4dbde8-f2b7-11ea-94b5-1273d078354a;cfp=1;rndc=1599667908;v=2;cmd=bid;cors=yes;alias=590109fcd6afeb7;misc=1599667908918
Requested by: Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:233:97b6:26be:138a:cba8:bb01 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: Adtech Adserver /
Resource Hash: 296654789dcafc623692f600b55d486d3e5428f3671fc145c29527f67f4023ef

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 09 Sep 2020 16:11:49 GMT
server: Adtech Adserver
status: 200
access-control-allow-methods: POST,GET,HEAD,OPTIONS
p3p: CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
access-control-allow-origin: https://threatpost.com
cache-control: no-store, no-cache
access-control-allow-credentials: true
content-type: application/json
content-length: 1224
expires: Mon, 15 Jun 1998 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 09 Sep 2020 16:11:49 GMT
server: nginx
status: 302
location: https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166847/0/0/ADTECH;apid=1A2a4dbde8-f2b7-11ea-94b5-1273d078354a;cfp=1;rndc=1599667908;v=2;cmd=bid;cors=yes;alias=590109fcd6afeb7;misc=1599667908918
access-control-allow-methods: POST,GET,HEAD,OPTIONS
p3p: CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
access-control-allow-origin: https://threatpost.com
cache-control: no-store, no-cache
access-control-allow-credentials: true
content-length: 0
expires: Mon, 15 Jun 1998 00:00:00 GMT

GET
H2

200

ADTECH;apid=1A2a5093ce-f2b7-11ea-9e2d-1222202f268e;cfp=1;rndc=1599667908;v=2;cmd=bid;cors=yes;alias=6097b41367b053b;misc=1599667908918 Show response
adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166615/0/0/
Redirect Chain

https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166615/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=6097b41367b053b;misc=1599667908918;
https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166615/0/0/ADTECH;cfp=1;rndc=1599667908;v=2;cmd=bid;cors=yes;alias=6097b41367b053b;misc=1599667908918
https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166615/0/0/ADTECH;apid=1A2a5093ce-f2b7-11ea-9e2d-1222202f268e;cfp=1;rndc=1599667908;v=2;cmd=bid;cors=yes;alias=6097b41367b053b;misc=15...

1 KB
1 KB

146ms
146ms

XHR
application/json

2606:2800:233:97b6:26be:138a:cba8:bb01
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166615/0/0/ADTECH;apid=1A2a5093ce-f2b7-11ea-9e2d-1222202f268e;cfp=1;rndc=1599667908;v=2;cmd=bid;cors=yes;alias=6097b41367b053b;misc=1599667908918
Requested by: Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:233:97b6:26be:138a:cba8:bb01 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: Adtech Adserver /
Resource Hash: 9da97c6ff0eae2f1f8447d8e41f2f66336636eac52235e5326966c4bbf34fc42

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 09 Sep 2020 16:11:49 GMT
server: Adtech Adserver
status: 200
access-control-allow-methods: POST,GET,HEAD,OPTIONS
p3p: CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
access-control-allow-origin: https://threatpost.com
cache-control: no-store, no-cache
access-control-allow-credentials: true
content-type: application/json
content-length: 1225
expires: Mon, 15 Jun 1998 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 09 Sep 2020 16:11:49 GMT
server: nginx
status: 302
location: https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166615/0/0/ADTECH;apid=1A2a5093ce-f2b7-11ea-9e2d-1222202f268e;cfp=1;rndc=1599667908;v=2;cmd=bid;cors=yes;alias=6097b41367b053b;misc=1599667908918
access-control-allow-methods: POST,GET,HEAD,OPTIONS
p3p: CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
access-control-allow-origin: https://threatpost.com
cache-control: no-store, no-cache
access-control-allow-credentials: true
content-length: 0
expires: Mon, 15 Jun 1998 00:00:00 GMT

GET
H2

200

ADTECH;apid=1A2a4db208-f2b7-11ea-9d06-126145921f52;cfp=1;rndc=1599667908;v=2;cmd=bid;cors=yes;alias=61b055084dd159;misc=1599667908918 Show response
adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166612/0/0/
Redirect Chain

https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166612/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=61b055084dd159;misc=1599667908918;
https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166612/0/0/ADTECH;cfp=1;rndc=1599667908;v=2;cmd=bid;cors=yes;alias=61b055084dd159;misc=1599667908918
https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166612/0/0/ADTECH;apid=1A2a4db208-f2b7-11ea-9d06-126145921f52;cfp=1;rndc=1599667908;v=2;cmd=bid;cors=yes;alias=61b055084dd159;misc=159...

1 KB
1 KB

163ms
163ms

XHR
application/json

2606:2800:233:97b6:26be:138a:cba8:bb01
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166612/0/0/ADTECH;apid=1A2a4db208-f2b7-11ea-9d06-126145921f52;cfp=1;rndc=1599667908;v=2;cmd=bid;cors=yes;alias=61b055084dd159;misc=1599667908918
Requested by: Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:233:97b6:26be:138a:cba8:bb01 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: Adtech Adserver /
Resource Hash: fcc21658c6ad7aefdb5d9411a7b01cb5d9d1f5c2296dc2b26c07446219443c83

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 09 Sep 2020 16:11:49 GMT
server: Adtech Adserver
status: 200
access-control-allow-methods: POST,GET,HEAD,OPTIONS
p3p: CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
access-control-allow-origin: https://threatpost.com
cache-control: no-store, no-cache
access-control-allow-credentials: true
content-type: application/json
content-length: 1225
expires: Mon, 15 Jun 1998 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 09 Sep 2020 16:11:49 GMT
server: nginx
status: 302
location: https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166612/0/0/ADTECH;apid=1A2a4db208-f2b7-11ea-9d06-126145921f52;cfp=1;rndc=1599667908;v=2;cmd=bid;cors=yes;alias=61b055084dd159;misc=1599667908918
access-control-allow-methods: POST,GET,HEAD,OPTIONS
p3p: CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
access-control-allow-origin: https://threatpost.com
cache-control: no-store, no-cache
access-control-allow-credentials: true
content-length: 0
expires: Mon, 15 Jun 1998 00:00:00 GMT

GET
H2

200

ADTECH;apid=1A2a50d852-f2b7-11ea-8e19-12e1ea48904a;cfp=1;rndc=1599667908;v=2;cmd=bid;cors=yes;alias=62aa5d911b7933d;misc=1599667908918 Show response
adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166617/0/0/
Redirect Chain

https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166617/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=62aa5d911b7933d;misc=1599667908918;
https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166617/0/0/ADTECH;cfp=1;rndc=1599667908;v=2;cmd=bid;cors=yes;alias=62aa5d911b7933d;misc=1599667908918
https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166617/0/0/ADTECH;apid=1A2a50d852-f2b7-11ea-8e19-12e1ea48904a;cfp=1;rndc=1599667908;v=2;cmd=bid;cors=yes;alias=62aa5d911b7933d;misc=15...

1 KB
1 KB

194ms
194ms

XHR
application/json

2606:2800:233:97b6:26be:138a:cba8:bb01
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166617/0/0/ADTECH;apid=1A2a50d852-f2b7-11ea-8e19-12e1ea48904a;cfp=1;rndc=1599667908;v=2;cmd=bid;cors=yes;alias=62aa5d911b7933d;misc=1599667908918
Requested by: Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:233:97b6:26be:138a:cba8:bb01 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: Adtech Adserver /
Resource Hash: 24df50eaac2cd2446fdaab1d483c62afd09d70245bcae6e50d381f7d97656350

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 09 Sep 2020 16:11:49 GMT
server: Adtech Adserver
status: 200
access-control-allow-methods: POST,GET,HEAD,OPTIONS
p3p: CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
access-control-allow-origin: https://threatpost.com
cache-control: no-store, no-cache
access-control-allow-credentials: true
content-type: application/json
content-length: 1225
expires: Mon, 15 Jun 1998 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 09 Sep 2020 16:11:49 GMT
server: nginx
status: 302
location: https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166617/0/0/ADTECH;apid=1A2a50d852-f2b7-11ea-8e19-12e1ea48904a;cfp=1;rndc=1599667908;v=2;cmd=bid;cors=yes;alias=62aa5d911b7933d;misc=1599667908918
access-control-allow-methods: POST,GET,HEAD,OPTIONS
p3p: CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
access-control-allow-origin: https://threatpost.com
cache-control: no-store, no-cache
access-control-allow-credentials: true
content-length: 0
expires: Mon, 15 Jun 1998 00:00:00 GMT

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ 19 B
711 B 65ms
23ms XHR
application/json 37.252.172.36
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.172.36 , Ascension Island, ASN29990 (ASN-APPNEX, US),

Reverse DNS

692.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

Software

nginx/1.17.9 /

Resource Hash

0c09c070833c786cb25be38bc30992b30bad578f817dbc9e34beacd8b8ea44c5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Wed, 09 Sep 2020 16:11:48 GMT
X-Proxy-Origin: 185.217.171.12; 185.217.171.12; 692.bm-nginx-loadbalancer.mgmt.fra1; *.adnxs.com; 37.252.173.90:80
AN-X-Request-Uuid: a615536f-f81a-449e-8768-9585afe21e4c
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://threatpost.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json; charset=utf-8
Content-Length: 19
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 200 auction Show response
tlx.3lift.com/header/ 19 B
310 B 94ms
35ms XHR
application/json 35.156.68.202
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://tlx.3lift.com/header/auction?lib=prebid&v=3.26.0&referrer=https%3A%2F%2Fthreatpost.com%2Fshlayer-mac-malware-extra-sneakiness%2F156669%2F%3Fweb_view%3Dtrue&tmax=1200&gdpr=false

Requested by

Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

35.156.68.202 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-35-156-68-202.eu-central-1.compute.amazonaws.com

Software

Resource Hash

0535c3bb3a17e4ac0fb7d29214d2181275662129dc2bdd2a89c35934e9fc5ba5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Wed, 09 Sep 2020 16:11:49 GMT
x-auction-status: 12, 12, 12
status: 200
content-type: application/json; charset=utf-8
access-control-allow-origin: https://threatpost.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-length: 19
x-xss-protection: 0
expires: Thu, 15 Oct 1992 20:10:00 GMT

GET
H/1.1 200
OK fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 263 B
2 KB 166ms
99ms XHR
application/json 69.173.144.143
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=19254&site_id=300372&zone_id=1509502&size_id=2&alt_size_ids=55%2C57&p_pos=atf&gdpr=0&rp_schain=1.0,1!admetricspro.com,1005,1,,,&rf=https%3A%2F%2Fthreatpost.com%2Fshlayer-mac-malware-extra-sneakiness%2F156669%2F%3Fweb_view%3Dtrue&tk_flint=pbjs_lite_v3.26.0&x_source.tid=caceccfc-cf78-476b-a020-422c9aacc7e2&p_screen_res=1600x1200&rp_floor=0.01&rp_secure=1&slots=1&rand=0.5473564370024158
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_GCM
Server: 69.173.144.143 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.16.0 /
Resource Hash: 0e422661b869922bc94c19d58ec76e34207c45dc912bec8f3b21d63dfd7ba63b

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Wed, 09 Sep 2020 16:11:49 GMT
Server: nginx/1.16.0
Vary: Accept-Encoding
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin: https://threatpost.com
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json
Keep-Alive: timeout=5
Content-Length: 263
Expires: Wed, 17 Sep 1975 21:32:10 GMT

GET
H/1.1 200
OK fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 241 B
2 KB 159ms
92ms XHR
application/json 69.173.144.143
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=19254&site_id=300372&zone_id=1509502&size_id=15&alt_size_ids=16&p_pos=atf&gdpr=0&rp_schain=1.0,1!admetricspro.com,1005,1,,,&rf=https%3A%2F%2Fthreatpost.com%2Fshlayer-mac-malware-extra-sneakiness%2F156669%2F%3Fweb_view%3Dtrue&tk_flint=pbjs_lite_v3.26.0&x_source.tid=6f37fa96-72d2-43eb-9fde-b3b4af2ab980&p_screen_res=1600x1200&rp_floor=0.01&rp_secure=1&slots=1&rand=0.5944435291157524
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_GCM
Server: 69.173.144.143 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.16.0 /
Resource Hash: 83fdaf5f46b5914739cd14bbe81a1545c9db87c59200288b013e2f99aa5425ae

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Wed, 09 Sep 2020 16:11:49 GMT
Server: nginx/1.16.0
Vary: Accept-Encoding
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin: https://threatpost.com
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json
Keep-Alive: timeout=5
Content-Length: 241
Expires: Wed, 17 Sep 1975 21:32:10 GMT

GET
H/1.1 200
OK fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 261 B
2 KB 161ms
94ms XHR
application/json 69.173.144.143
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=19254&site_id=300372&zone_id=1509506&size_id=15&alt_size_ids=10&p_pos=atf&gdpr=0&rp_schain=1.0,1!admetricspro.com,1005,1,,,&rf=https%3A%2F%2Fthreatpost.com%2Fshlayer-mac-malware-extra-sneakiness%2F156669%2F%3Fweb_view%3Dtrue&tk_flint=pbjs_lite_v3.26.0&x_source.tid=7614133f-f30a-476c-93c8-b6a0914b4c7d&p_screen_res=1600x1200&rp_floor=0.01&rp_secure=1&slots=1&rand=0.4175208205421126
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_GCM
Server: 69.173.144.143 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.16.0 /
Resource Hash: e429fa4e9c6c63472ae233e4d5f6f34cb762578b4d6691835c15ae30b559f6d1

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Wed, 09 Sep 2020 16:11:49 GMT
Server: nginx/1.16.0
Vary: Accept-Encoding
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin: https://threatpost.com
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json
Keep-Alive: timeout=5
Content-Length: 261
Expires: Wed, 17 Sep 1975 21:32:10 GMT

GET
H/1.1 200
OK fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 261 B
2 KB 178ms
111ms XHR
application/json 69.173.144.143
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=19254&site_id=300372&zone_id=1509502&size_id=15&alt_size_ids=10&p_pos=atf&gdpr=0&rp_schain=1.0,1!admetricspro.com,1005,1,,,&rf=https%3A%2F%2Fthreatpost.com%2Fshlayer-mac-malware-extra-sneakiness%2F156669%2F%3Fweb_view%3Dtrue&tk_flint=pbjs_lite_v3.26.0&x_source.tid=7614133f-f30a-476c-93c8-b6a0914b4c7d&p_screen_res=1600x1200&rp_floor=0.01&rp_secure=1&slots=1&rand=0.17567311144244435
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_GCM
Server: 69.173.144.143 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.16.0 /
Resource Hash: 102de457101f323f21b172f40c5840f77fd693dc80f672de32562a884e9c8ccb

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Wed, 09 Sep 2020 16:11:49 GMT
Server: nginx/1.16.0
Vary: Accept-Encoding
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin: https://threatpost.com
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json
Keep-Alive: timeout=5
Content-Length: 261
Expires: Wed, 17 Sep 1975 21:32:10 GMT

GET
H/1.1 200
OK mail-plane-large-dark.svg
threatpost.com/wp-content/themes/threatpost-2018/assets/images/ 812 B
722 B 287ms
96ms Image
image/svg+xml 35.173.160.135
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/images/mail-plane-large-dark.svg
Requested by: Host: threatpost.com
URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1599667780
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-173-160-135.compute-1.amazonaws.com
Software: nginx /
Resource Hash: a9d2b2df99c1a115d5394c70a898d8801092208dc582f8bd6fb01b35c30d6b22

Request headers

Referer: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1599667780
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: public
Date: Wed, 09 Sep 2020 16:11:49 GMT
Content-Encoding: gzip
Last-Modified: Wed, 09 Sep 2020 08:46:19 GMT
Server: nginx
ETag: W/"5f58965b-32c"
Transfer-Encoding: chunked
Content-Type: image/svg+xml
Cache-Control: max-age=604800, public
Connection: close
Expires: Wed, 16 Sep 2020 16:11:49 GMT

GET
H/1.1 200
OK logo-white.png
threatpost.com/wp-content/themes/threatpost-2018/assets/images/ 10 KB
10 KB 1326ms
106ms Image
image/png 35.173.160.135
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/images/logo-white.png
Requested by: Host: threatpost.com
URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1599667780
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-173-160-135.compute-1.amazonaws.com
Software: nginx /
Resource Hash: e4058d4ee9da1ceaddfa91ddb63650ba67285f1bbfee487d9dfe648bced669a0

Request headers

Referer: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1599667780
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: public
Date: Wed, 09 Sep 2020 16:11:50 GMT
Last-Modified: Wed, 09 Sep 2020 16:09:39 GMT
Server: nginx
ETag: "5f58fe43-260a"
Content-Type: image/png
Cache-Control: max-age=604800, public
Connection: close
Accept-Ranges: bytes
Content-Length: 9738
Expires: Wed, 16 Sep 2020 16:11:50 GMT

POST
H2 200 adreq Show response
ads.servenobid.com/ 5 KB
3 KB 97ms
35ms XHR
application/json 52.212.5.193
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.servenobid.com/adreq?cb=10310
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.212.5.193 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-212-5-193.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 325025896d87b56f70344e031303c8aca70da2631b14a35798ec45d5d3dfadfa

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

date: Wed, 09 Sep 2020 16:11:49 GMT
content-encoding: gzip
amp-access-control-allow-source-origin: *
status: 200
vary: accept-encoding
content-type: application/json
access-control-allow-origin: https://threatpost.com
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
access-control-allow-credentials: true

POST
H2 204 translator Show response
hbopenbid.pubmatic.com/ 0
115 B 101ms
69ms XHR
text/plain 185.64.189.112
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.189.112 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

status: 204
date: Wed, 09 Sep 2020 16:11:49 GMT
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
access-control-allow-origin: https://threatpost.com

GET
H/1.1 200
OK cygnus Show response
as-sec.casalemedia.com/ 25 B
673 B 193ms
147ms XHR
application/json 23.210.249.164
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://as-sec.casalemedia.com/cygnus?s=438654&v=7.2&r=%7B%22id%22%3A%2245d7f66469acc2a%22%2C%22imp%22%3A%5B%7B%22id%22%3A%2246ad2ac5f2850c4%22%2C%22ext%22%3A%7B%22siteID%22%3A%22438654%22%2C%22sid%22%3A%22728x90%22%7D%2C%22banner%22%3A%7B%22w%22%3A728%2C%22h%22%3A90%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%22473518d49f88908%22%2C%22ext%22%3A%7B%22siteID%22%3A%22438649%22%2C%22sid%22%3A%22300x250%22%7D%2C%22banner%22%3A%7B%22w%22%3A300%2C%22h%22%3A250%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%224872db97d5d3955%22%2C%22ext%22%3A%7B%22siteID%22%3A%22438650%22%2C%22sid%22%3A%22300x250%22%7D%2C%22banner%22%3A%7B%22w%22%3A300%2C%22h%22%3A250%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%2246ad2ac5f2850c4%22%2C%22ext%22%3A%7B%22siteID%22%3A%22438654%22%2C%22sid%22%3A%22970x250%22%7D%2C%22banner%22%3A%7B%22w%22%3A970%2C%22h%22%3A250%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%2246ad2ac5f2850c4%22%2C%22ext%22%3A%7B%22siteID%22%3A%22438654%22%2C%22sid%22%3A%22970x90%22%7D%2C%22banner%22%3A%7B%22w%22%3A970%2C%22h%22%3A90%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%22473518d49f88908%22%2C%22ext%22%3A%7B%22siteID%22%3A%22438649%22%2C%22sid%22%3A%22336x280%22%7D%2C%22banner%22%3A%7B%22w%22%3A336%2C%22h%22%3A280%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%224872db97d5d3955%22%2C%22ext%22%3A%7B%22siteID%22%3A%22438650%22%2C%22sid%22%3A%22300x600%22%7D%2C%22banner%22%3A%7B%22w%22%3A300%2C%22h%22%3A600%2C%22topframe%22%3A1%7D%7D%5D%2C%22site%22%3A%7B%22page%22%3A%22https%3A%2F%2Fthreatpost.com%2Fshlayer-mac-malware-extra-sneakiness%2F156669%2F%3Fweb_view%3Dtrue%22%7D%2C%22ext%22%3A%7B%22source%22%3A%22prebid%22%7D%2C%22source%22%3A%7B%22ext%22%3A%7B%22schain%22%3A%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22admetricspro.com%22%2C%22sid%22%3A%221005%22%2C%22hp%22%3A1%7D%5D%7D%7D%7D%2C%22regs%22%3A%7B%22ext%22%3A%7B%22gdpr%22%3A0%7D%7D%2C%22user%22%3A%7B%22ext%22%3A%7B%22consent%22%3A%22%22%7D%7D%7D&ac=j&sd=1
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.210.249.164 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-249-164.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 7d612c9f3ff74a635e6e38f0e709e2e8ca2c49cbe24c44f3e067fec8451c881d

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Wed, 09 Sep 2020 16:11:49 GMT
Content-Encoding: gzip
Server: Apache
Vary: Accept-Encoding
Content-Type: application/json
Access-Control-Allow-Origin: https://threatpost.com
Cache-Control: max-age=0, no-cache, no-store
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 45
Expires: Wed, 09 Sep 2020 16:11:49 GMT

POST
H2 200 v2 Show response
e.serverbid.com/api/ 711 B
984 B 288ms
104ms XHR
application/json 167.172.1.14
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://e.serverbid.com/api/v2
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 167.172.1.14 , United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: f4b064d961dd5c30917481f9cf22f400d352737e7dac10d70e574877eef1e8ea

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

status: 200
date: Wed, 09 Sep 2020 16:11:48 GMT
access-control-allow-credentials: true
access-control-allow-origin: https://threatpost.com
content-length: 711
vary: Origin
content-type: application/json

POST
H2 200 c Show response
prebid.a-mo.net/a/ 768 B
800 B 412ms
211ms XHR
application/json 34.237.157.170
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.a-mo.net/a/c
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.237.157.170 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-237-157-170.compute-1.amazonaws.com
Software: Cowboy /
Resource Hash: 7e52121828e29520878c88a7f014d5733ce03f8756225f860911a22378b07a22

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

date: Wed, 09 Sep 2020 16:11:49 GMT
content-encoding: gzip
server: Cowboy
status: 200
vary: origin, accept-encoding
content-type: application/json; charset=utf-8
access-control-allow-origin: https://threatpost.com
cache-control: max-age=0, private, must-revalidate
access-control-allow-credentials: true
content-length: 333

GET
H2 200 bid Show response
c.amazon-adsystem.com/e/dtb/ 23 B
371 B 83ms
82ms XHR
text/javascript 99.84.153.196
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/e/dtb/bid?src=600&u=https%3A%2F%2Fthreatpost.com%2Fshlayer-mac-malware-extra-sneakiness%2F156669%2F%3Fweb_view%3Dtrue&pid=ctblMYzxcbhLS&cb=0&ws=1600x1200&v=7.53.01&t=1200&slots=%5B%7B%22sd%22%3A%220%22%2C%22s%22%3A%5B%22728x90%22%2C%22970x250%22%2C%22970x90%22%5D%2C%22sn%22%3A%22%2F21707124336%2FThreatPost-970x250-ATF%22%7D%2C%7B%22sd%22%3A%221%22%2C%22s%22%3A%5B%22300x250%22%2C%22336x280%22%5D%2C%22sn%22%3A%22%2F21707124336%2FThreatPost-300x250-ATF%22%7D%2C%7B%22sd%22%3A%222%22%2C%22s%22%3A%5B%22300x250%22%2C%22300x600%22%5D%2C%22sn%22%3A%22%2F21707124336%2FThreatPost-300x600-ATF%22%7D%2C%7B%22sd%22%3A%223%22%2C%22s%22%3A%5B%222x2%22%5D%2C%22sn%22%3A%22%2F21707124336%2FThreatPost-2x2-Skin%22%7D%5D&pubid=cb8cfc89-e83e-44aa-a3a2-ff78eda781ef&gdpre=0&gdprl=%7B%22status%22%3A%22tcfv2-success%22%7D
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.84.153.196 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-84-153-196.txl52.r.cloudfront.net
Software: Server /
Resource Hash: 745a085b52b8371ec6705413fca70a28c6d8bff0db480e6b124bd08c54e95ef8

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 09 Sep 2020 16:11:49 GMT
via: 1.1 2d69f677a4a0e3e7eefdf9d24bd43661.cloudfront.net (CloudFront)
server: Server
x-amz-cf-pop: TXL52-C1
status: 200
vary: User-Agent
x-cache: Miss from cloudfront
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: https://threatpost.com
access-control-allow-credentials: true
timing-allow-origin: *
content-length: 23
x-amz-cf-id: AOvFHknMKyu71FrMpx9z_NX5xaUg6GPz2LOJs_JhZ6qRqGXMEnivnA==

GET
H2 200 aps_csm.js Show response
c.amazon-adsystem.com/bao-csm/aps-comm/ 6 KB
3 KB 95ms
32ms XHR
application/javascript 99.84.153.196
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/bao-csm/aps-comm/aps_csm.js
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.84.153.196 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-84-153-196.txl52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 09 Sep 2020 11:31:07 GMT
content-encoding: gzip
vary: Accept-Encoding,Origin
age: 16843
x-cache: Hit from cloudfront
status: 200
access-control-allow-origin: *
last-modified: Wed, 09 Sep 2020 11:16:19 GMT
server: AmazonS3
etag: W/"a4d296427fc806b21335359e398c025c"
access-control-max-age: 3000
access-control-allow-methods: GET
content-type: application/javascript
via: 1.1 df792ea3bbbe656e2f5c7b61aa85cc47.cloudfront.net (CloudFront)
cache-control: public, max-age=86400
x-amz-cf-pop: TXL52-C1
x-amz-cf-id: 132dp7eVXYTC3eyI64rg90LDY_C9sb03_IlSFKGzEhI5tsGxqYZTqQ==

GET
H/1.1 200
OK iab_consent_sdk.v1.0.js Show response
live.sekindo.com/content/ClientDetections/ Frame 9723 19 KB
6 KB 17ms
15ms Script
application/javascript 185.220.204.204
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to

Full URL: https://live.sekindo.com/content/ClientDetections/iab_consent_sdk.v1.0.js
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/live/liveView.php?s=101281&cbuster=%%CACHEBUSTER%%&pubUrl=%%REFERRER_URL_ESC%%&x=[WIDTH]&y=[HEIGHT]&vp_content=plembed173akunvrojp&vp_template=6615&subId=[SUBID_ENCODED]&schain=1.0,1!admetricspro.com,1005,1&cbuster=1599667908&pubUrlAuto=https%3A%2F%2Fthreatpost.com%2Fshlayer-mac-malware-extra-sneakiness%2F156669%2F%3Fweb_view%3Dtrue&videoType=flow&floatWidth=320&floatHeight=180&floatDirection=br&floatVerticalOffset=10&floatHorizontalOffset=10&floatCloseBtn=1&flowMode=both&flowCloseButtonPosition=right
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 185.220.204.204 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, GB),
Reverse DNS
Software: nginx /
Resource Hash: a3336e3373c170b40764f5a62d121335bec4243b0034e561937194dfe2e413fd

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 09 Sep 2020 16:11:48 GMT
content-encoding: gzip
last-modified: Wed, 12 Feb 2020 15:01:36 GMT
server: nginx
etag: W/"5e441350-4be0"
transfer-encoding: chunked
content-type: application/javascript
cache-control: max-age=31536000, public
expires: Thu, 09 Sep 2021 16:11:48 GMT

GET
H/1.1 200
OK DetectGDPR2.v1.1.js Show response
live.sekindo.com/content/ClientDetections/ Frame 9723 9 KB
3 KB 34ms
16ms Script
application/javascript 185.220.204.204
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to

Full URL: https://live.sekindo.com/content/ClientDetections/DetectGDPR2.v1.1.js
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/live/liveView.php?s=101281&cbuster=%%CACHEBUSTER%%&pubUrl=%%REFERRER_URL_ESC%%&x=[WIDTH]&y=[HEIGHT]&vp_content=plembed173akunvrojp&vp_template=6615&subId=[SUBID_ENCODED]&schain=1.0,1!admetricspro.com,1005,1&cbuster=1599667908&pubUrlAuto=https%3A%2F%2Fthreatpost.com%2Fshlayer-mac-malware-extra-sneakiness%2F156669%2F%3Fweb_view%3Dtrue&videoType=flow&floatWidth=320&floatHeight=180&floatDirection=br&floatVerticalOffset=10&floatHorizontalOffset=10&floatCloseBtn=1&flowMode=both&flowCloseButtonPosition=right
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 185.220.204.204 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, GB),
Reverse DNS
Software: nginx /
Resource Hash: 0cf25abe73b03e246c0a820c825a1f433e36949c2cf456ce889d86e8dd9ec427

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 09 Sep 2020 16:11:48 GMT
content-encoding: gzip
last-modified: Wed, 08 Jul 2020 16:36:53 GMT
server: nginx
etag: W/"5f05f625-225b"
transfer-encoding: chunked
content-type: application/javascript
cache-control: max-age=31536000, public
expires: Thu, 09 Sep 2021 16:11:48 GMT

GET
H/1.1 200
OK DetectGDPR.v1.1.js Show response
live.sekindo.com/content/ClientDetections/ Frame 9723 8 KB
3 KB 45ms
15ms Script
application/javascript 185.220.204.204
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to

Full URL: https://live.sekindo.com/content/ClientDetections/DetectGDPR.v1.1.js
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/live/liveView.php?s=101281&cbuster=%%CACHEBUSTER%%&pubUrl=%%REFERRER_URL_ESC%%&x=[WIDTH]&y=[HEIGHT]&vp_content=plembed173akunvrojp&vp_template=6615&subId=[SUBID_ENCODED]&schain=1.0,1!admetricspro.com,1005,1&cbuster=1599667908&pubUrlAuto=https%3A%2F%2Fthreatpost.com%2Fshlayer-mac-malware-extra-sneakiness%2F156669%2F%3Fweb_view%3Dtrue&videoType=flow&floatWidth=320&floatHeight=180&floatDirection=br&floatVerticalOffset=10&floatHorizontalOffset=10&floatCloseBtn=1&flowMode=both&flowCloseButtonPosition=right
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 185.220.204.204 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, GB),
Reverse DNS
Software: nginx /
Resource Hash: f40e3d5b91387e92272b6d46fc83ce21041f130a29316d7216d3a1793d46c4f3

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 09 Sep 2020 16:11:49 GMT
content-encoding: gzip
last-modified: Wed, 08 Jul 2020 16:36:52 GMT
server: nginx
etag: W/"5f05f624-1ec4"
transfer-encoding: chunked
content-type: application/javascript
cache-control: max-age=31536000, public
expires: Thu, 09 Sep 2021 16:11:49 GMT

GET
H/1.1 200
OK hls.0.12.4_2.min.js Show response
live.sekindo.com/content/video/hls/ Frame 9723 256 KB
86 KB 63ms
33ms Script
application/javascript 185.220.204.204
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to

Full URL: https://live.sekindo.com/content/video/hls/hls.0.12.4_2.min.js
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/live/liveView.php?s=101281&cbuster=%%CACHEBUSTER%%&pubUrl=%%REFERRER_URL_ESC%%&x=[WIDTH]&y=[HEIGHT]&vp_content=plembed173akunvrojp&vp_template=6615&subId=[SUBID_ENCODED]&schain=1.0,1!admetricspro.com,1005,1&cbuster=1599667908&pubUrlAuto=https%3A%2F%2Fthreatpost.com%2Fshlayer-mac-malware-extra-sneakiness%2F156669%2F%3Fweb_view%3Dtrue&videoType=flow&floatWidth=320&floatHeight=180&floatDirection=br&floatVerticalOffset=10&floatHorizontalOffset=10&floatCloseBtn=1&flowMode=both&flowCloseButtonPosition=right
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 185.220.204.204 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, GB),
Reverse DNS
Software: nginx /
Resource Hash: 13ab06913444b6e3b4139e5487813073f11e082878ae8a5bf5213fdc6f95f5e0

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 09 Sep 2020 16:11:48 GMT
content-encoding: gzip
last-modified: Thu, 13 Aug 2020 08:36:05 GMT
server: nginx
etag: W/"5f34fb75-3ff27"
transfer-encoding: chunked
content-type: application/javascript
cache-control: max-age=31536000, public
expires: Thu, 09 Sep 2021 16:11:48 GMT

GET
H/1.1 200
OK prebidVid.3.19.0_9.min.js Show response
live.sekindo.com/content/prebid/ Frame 9723 296 KB
109 KB 56ms
24ms Script
application/javascript 185.220.204.204
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to

Full URL: https://live.sekindo.com/content/prebid/prebidVid.3.19.0_9.min.js
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/live/liveView.php?s=101281&cbuster=%%CACHEBUSTER%%&pubUrl=%%REFERRER_URL_ESC%%&x=[WIDTH]&y=[HEIGHT]&vp_content=plembed173akunvrojp&vp_template=6615&subId=[SUBID_ENCODED]&schain=1.0,1!admetricspro.com,1005,1&cbuster=1599667908&pubUrlAuto=https%3A%2F%2Fthreatpost.com%2Fshlayer-mac-malware-extra-sneakiness%2F156669%2F%3Fweb_view%3Dtrue&videoType=flow&floatWidth=320&floatHeight=180&floatDirection=br&floatVerticalOffset=10&floatHorizontalOffset=10&floatCloseBtn=1&flowMode=both&flowCloseButtonPosition=right
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 185.220.204.204 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, GB),
Reverse DNS
Software: nginx /
Resource Hash: 7860ef37e85676dcb81a99d7e5d6453bdacdf9d35aa45517a9ba9ea25bbd4c85

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 09 Sep 2020 16:11:48 GMT
content-encoding: gzip
last-modified: Thu, 16 Jul 2020 14:28:49 GMT
server: nginx
etag: W/"5f106421-4a003"
transfer-encoding: chunked
content-type: application/javascript
cache-control: max-age=31536000, public
expires: Thu, 09 Sep 2021 16:11:48 GMT

GET
H/1.1 200
OK liveVideo.php Show response
live.sekindo.com/live/ Frame 9723 460 KB
129 KB 79ms
45ms Script
text/html 185.220.204.204
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to

Full URL: https://live.sekindo.com/live/liveVideo.php?vpaidManager=sekindo&s=58057&ri=6C69766553746174737C736B317B54307D7B64323032302D30392D30395F31397D7B7331323334383830387D7B4335387D7B53644768795A5746306347397A6443356A6232303D7D7B626368726F6D657D7B716465736B746F707D7B6F6D61636F73787D7B583330307D7B593235307D7B66317D7B4C363631357DFEFE&userIpAddr=185.217.171.12&userUA=Mozilla%2F5.0+%28Macintosh%3B+Intel+Mac+OS+X+10_14_5%29+AppleWebKit%2F537.36+%28KHTML%2C+like+Gecko%29+Chrome%2F83.0.4103.61+Safari%2F537.36&debugInformation=&isWePassGdpr=0&schain=1.0%2C1%21admetricspro.com%2C1005%2C1&noViewableMidrollPolicy=vary&isDoublePreroll=1&autoSkipVideoSec=30&c2pWaitTime=10&csuuid=5f58fec4dc913&debugInfo=12348808_&debugPlayerSession=&pubUrlDEMO=&sta=12348808&showLogo=0&clkUrl=&plMult=-1&schedule=eyJwcmVfcm9sbCI6MSwibWlkX3JvbGwiOltdLCJnYXAiOiJhdXRvIn0%3D&content=plembed173akunvrojp&secondaryContent=&x=300&y=250&pubUrl=https%3A%2F%2Fthreatpost.com%2Fshlayer-mac-malware-extra-sneakiness%2F156669%2F%3Fweb_view%3Dtrue&contentNum=1&flow_closeBtn=1&flowCloseTimeout=0&flow_closeButtonPosition=right&flow_direction=br&flow_horizontalOffset=10&flow_bottomOffset=10&impGap=2&flow_width=320&flow_height=180&videoType=flow&gdpr=1&gdprConsent=&contentFeedId=&geoLati=52.069&geoLong=5.1024&vpTemplate=6615&flowMode=both&isRealPreroll=0&playerApiId=&isApp=0&ccpa=0&ccpaConsent=
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/live/liveView.php?s=101281&cbuster=%%CACHEBUSTER%%&pubUrl=%%REFERRER_URL_ESC%%&x=[WIDTH]&y=[HEIGHT]&vp_content=plembed173akunvrojp&vp_template=6615&subId=[SUBID_ENCODED]&schain=1.0,1!admetricspro.com,1005,1&cbuster=1599667908&pubUrlAuto=https%3A%2F%2Fthreatpost.com%2Fshlayer-mac-malware-extra-sneakiness%2F156669%2F%3Fweb_view%3Dtrue&videoType=flow&floatWidth=320&floatHeight=180&floatDirection=br&floatVerticalOffset=10&floatHorizontalOffset=10&floatCloseBtn=1&flowMode=both&flowCloseButtonPosition=right
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 185.220.204.204 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, GB),
Reverse DNS
Software: nginx /
Resource Hash: e9343095d5a3b8883a9be95812215933651b4915961f4b4d6e116206c8a03590

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 09 Sep 2020 16:11:48 GMT
content-encoding: gzip
server: nginx
transfer-encoding: chunked
content-type: text/html; charset=UTF-8

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 45 KB
18 KB 6ms
5ms Script
text/javascript 2a00:1450:4001:825::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PM29HLF

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:825::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

1fbd06d98ff87713eb030669571c929ab75539f05252f04ae1df807c28b20e95

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 19 Aug 2020 20:46:40 GMT
server: Golfe2
age: 3369
date: Wed, 09 Sep 2020 15:15:40 GMT
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=7200
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 18323
expires: Wed, 09 Sep 2020 17:15:40 GMT

GET
H2 200 quant.js Show response
secure.quantserve.com/ 22 KB
8 KB 27ms
9ms Script
application/x-javascript 2620:116:800d:21:5a23:9c4e:e774:96c1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.quantserve.com/quant.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PM29HLF

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2620:116:800d:21:5a23:9c4e:e774:96c1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

8130c2c72afad9d94581ef93aaa00524093103c47c71fce52f606d5ff693c3ce

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 09 Sep 2020 16:11:49 GMT
content-encoding: gzip
last-modified: Wed, 09-Sep-2020 16:11:49 GMT
etag: M0-2a172724
vary: Accept-Encoding
content-type: application/x-javascript
status: 200
cache-control: private, no-transform, max-age=604800
strict-transport-security: max-age=86400
content-length: 8060
expires: Wed, 16 Sep 2020 16:11:49 GMT

GET
H2 200 uwt.js Show response
static.ads-twitter.com/ 5 KB
2 KB 21ms
21ms Script
application/javascript 151.101.112.157
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://static.ads-twitter.com/uwt.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PM29HLF
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.112.157 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 8247f4332667950989fe6bf790f87723343db2ec83d975503e9c5dc13a6eb5dc

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 09 Sep 2020 16:11:49 GMT
content-encoding: gzip
age: 67173
x-cache: HIT
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
status: 200
content-length: 1958
x-served-by: cache-hhn4062-HHN
last-modified: Mon, 10 Aug 2020 18:10:59 GMT
x-timer: S1599667909.045484,VS0,VE0
etag: "a4cc3f907681b24a3efd540acd5d2996+gzip"
vary: Accept-Encoding,Host
content-type: application/javascript; charset=utf-8
via: 1.1 varnish
cache-control: no-cache
accept-ranges: bytes

POST
H3-Q050 200 collect Show response
www.google-analytics.com/j/ 2 B
64 B 13ms
13ms XHR
text/plain 2a00:1450:4001:824::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j85&aip=1&a=625129160&t=pageview&_s=1&dl=https%3A%2F%2Fthreatpost.com%2Fshlayer-mac-malware-extra-sneakiness%2F156669%2F%3Fweb_view%3Dtrue&ul=en-us&de=UTF-8&dt=Shlayer%20Mac%20Malware%20Returns%20with%20Extra%20Sneakiness%20%7C%20Threatpost&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YEBAAEABAAAAAC~&jid=900257833&gjid=1931998919&cid=1262107814.1599667909&tid=UA-35676203-21&_gid=175036470.1599667909&_r=1&gtm=2wg8q1PM29HLF&z=777567772

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:824::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Wed, 09 Sep 2020 16:11:49 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
status: 200
content-type: text/plain
access-control-allow-origin: https://threatpost.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 collect
www.google-analytics.com/ 35 B
62 B 6ms
5ms Image
image/gif 2a00:1450:4001:824::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j85&aip=1&a=625129160&t=event&ni=0&_s=1&dl=https%3A%2F%2Fthreatpost.com%2Fshlayer-mac-malware-extra-sneakiness%2F156669%2F%3Fweb_view%3Dtrue&ul=en-us&de=UTF-8&dt=Shlayer%20Mac%20Malware%20Returns%20with%20Extra%20Sneakiness%20%7C%20Threatpost&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=VISIBILITY&ea=elementVisibility%20%2F%20%5BHeader%5D%20%2F%20Social%20Networks%20View&_u=YEDAAEABAAAAAC~&jid=&gjid=&cid=1262107814.1599667909&tid=UA-35676203-21&_gid=175036470.1599667909&gtm=2wg8q1PM29HLF&z=1747565418

Requested by

Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:824::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 08 Sep 2020 17:42:09 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 80980
status: 200
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2 200 rules-p-_7kVx0t9Jqj90.js Show response
rules.quantcount.com/ 3 B
358 B 439ms
410ms Script
application/x-javascript 2600:9000:20e8:9400:6:44e3:f8c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://rules.quantcount.com/rules-p-_7kVx0t9Jqj90.js
Requested by: Host: secure.quantserve.com
URL: https://secure.quantserve.com/quant.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20e8:9400:6:44e3:f8c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 09 Sep 2020 16:07:53 GMT
via: 1.1 e90965fc09a647100bac5d68d2d591f6.cloudfront.net (CloudFront)
last-modified: Fri, 03 Mar 2017 23:52:35 GMT
server: AmazonS3
age: 237
etag: "8a80554c91d9fca8acb82f023de02f11"
x-cache: Error from cloudfront
content-type: application/x-javascript
status: 200
cache-control: max-age=300
x-amz-cf-pop: TXL52-C1
accept-ranges: bytes
content-length: 3
x-amz-cf-id: bFwAEby6IQhXnbTUq2TeNumXAcx-PSq9BMmHttqC8KM-BpSO99Rqbw==

GET
H2 200 adsct
t.co/i/ 43 B
171 B 134ms
133ms Image
image/gif 104.244.42.133
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://t.co/i/adsct?type=javascript&version=1.1.0&p_id=Twitter&p_user_id=0&txn_id=ntt0j&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0&tw_document_href=https%3A%2F%2Fthreatpost.com%2Fshlayer-mac-malware-extra-sneakiness%2F156669%2F%3Fweb_view%3Dtrue

Requested by

Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

104.244.42.133 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=0
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 09 Sep 2020 16:11:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
status: 200, 200 OK
x-twitter-response-tags: BouncerCompliant
content-length: 65
x-xss-protection: 0
x-response-time: 114
pragma: no-cache
last-modified: Wed, 09 Sep 2020 16:11:49 GMT
server: tsa_o
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=0
content-type: image/gif;charset=utf-8
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash: 7a58062b01212dfe168c5fdd3fb559cc
x-transaction: 0056786d006cea4d
expires: Tue, 31 Mar 1981 05:00:00 GMT

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 4 B
86 B 15ms
14ms XHR
text/plain 2a00:1450:400c:c06::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j85&tid=UA-35676203-21&cid=1262107814.1599667909&jid=900257833&gjid=1931998919&_gid=175036470.1599667909&_u=YEBAAEAAAAAAAC~&z=523973043

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c06::9c Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
date: Wed, 09 Sep 2020 16:11:49 GMT
status: 200
content-type: text/plain
access-control-allow-origin: https://threatpost.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 ga-audiences
www.google.com/ads/ 42 B
276 B 19ms
18ms Image
image/gif 2a00:1450:4001:81a::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j85&tid=UA-35676203-21&cid=1262107814.1599667909&jid=900257833&_u=YEBAAEAAAAAAAC~&z=1292158018

Requested by

Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81a::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 09 Sep 2020 16:11:49 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.de/ads/ 42 B
106 B 18ms
17ms Image
image/gif 2a00:1450:4001:817::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j85&tid=UA-35676203-21&cid=1262107814.1599667909&jid=900257833&_u=YEBAAEAAAAAAAC~&z=1292158018

Requested by

Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:817::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 09 Sep 2020 16:11:49 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK primisslate.css
live.sekindo.com/content/video/css/ 17 KB
5 KB 16ms
16ms Stylesheet
text/css 185.220.204.204
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to

Full URL: https://live.sekindo.com/content/video/css/primisslate.css
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 185.220.204.204 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, GB),
Reverse DNS
Software: nginx /
Resource Hash: 4f7cd55655bafca4db9b67255125ed52cd91d21b1727e9f28f71219aa1341de5

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 09 Sep 2020 16:11:48 GMT
content-encoding: gzip
last-modified: Tue, 18 Aug 2020 10:07:25 GMT
server: nginx
etag: W/"5f3ba85d-45c8"
transfer-encoding: chunked
content-type: text/css

GET
H2 200 apstag.js Show response
c.amazon-adsystem.com/aax2/ Frame 9723 102 KB
26 KB 34ms
34ms Script
application/javascript 99.84.153.196
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/aax2/apstag.js
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/live/liveVideo.php?vpaidManager=sekindo&s=58057&ri=6C69766553746174737C736B317B54307D7B64323032302D30392D30395F31397D7B7331323334383830387D7B4335387D7B53644768795A5746306347397A6443356A6232303D7D7B626368726F6D657D7B716465736B746F707D7B6F6D61636F73787D7B583330307D7B593235307D7B66317D7B4C363631357DFEFE&userIpAddr=185.217.171.12&userUA=Mozilla%2F5.0+%28Macintosh%3B+Intel+Mac+OS+X+10_14_5%29+AppleWebKit%2F537.36+%28KHTML%2C+like+Gecko%29+Chrome%2F83.0.4103.61+Safari%2F537.36&debugInformation=&isWePassGdpr=0&schain=1.0%2C1%21admetricspro.com%2C1005%2C1&noViewableMidrollPolicy=vary&isDoublePreroll=1&autoSkipVideoSec=30&c2pWaitTime=10&csuuid=5f58fec4dc913&debugInfo=12348808_&debugPlayerSession=&pubUrlDEMO=&sta=12348808&showLogo=0&clkUrl=&plMult=-1&schedule=eyJwcmVfcm9sbCI6MSwibWlkX3JvbGwiOltdLCJnYXAiOiJhdXRvIn0%3D&content=plembed173akunvrojp&secondaryContent=&x=300&y=250&pubUrl=https%3A%2F%2Fthreatpost.com%2Fshlayer-mac-malware-extra-sneakiness%2F156669%2F%3Fweb_view%3Dtrue&contentNum=1&flow_closeBtn=1&flowCloseTimeout=0&flow_closeButtonPosition=right&flow_direction=br&flow_horizontalOffset=10&flow_bottomOffset=10&impGap=2&flow_width=320&flow_height=180&videoType=flow&gdpr=1&gdprConsent=&contentFeedId=&geoLati=52.069&geoLong=5.1024&vpTemplate=6615&flowMode=both&isRealPreroll=0&playerApiId=&isApp=0&ccpa=0&ccpaConsent=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.84.153.196 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-84-153-196.txl52.r.cloudfront.net
Software: Server /
Resource Hash: 8c665507e16736e1323acf89104e508e8cac863d30e8ca5ff5d6ac5303b25277

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 09 Sep 2020 16:00:46 GMT
content-encoding: gzip
server: Server
age: 663
etag: 5a34c79c51b93c8b4601b1808cbdbd04
x-cache: Hit from cloudfront
content-type: application/javascript
status: 200
cache-control: public, max-age=900
x-amz-cf-pop: TXL52-C1
accept-ranges: bytes
timing-allow-origin: *
x-amz-cf-id: V6mP0c_Q6OkVbodAUHYRCbiYAfQ8b5EXl0euHDRHHewEllzt_lbsLA==
via: 1.1 2d69f677a4a0e3e7eefdf9d24bd43661.cloudfront.net (CloudFront)

GET
H2 200 css
fonts.googleapis.com/ 2 KB
669 B 15ms
15ms Stylesheet
text/css 2a00:1450:4001:820::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto&display=swap

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:820::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

00d4fbacbadc6ecbd73be323ec77febf3d856ce00dc5334d06462a315c7da8e7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
status: 200
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Wed, 09 Sep 2020 14:12:45 GMT
server: ESF
date: Wed, 09 Sep 2020 16:11:49 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Wed, 09 Sep 2020 16:11:49 GMT

GET
H/1.1 200
OK user_sync.html
ads.pubmatic.com/AdServer/js/ Frame B188 0
0 66ms
21ms Document
text/html 23.210.249.92
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=159196&userIdMacro=PM_UID&gdpr=1&gdpr_consent=&predirect=https%3A%2F%2Flive.sekindo.com%2Flive%2FliveCS.php%3Fsource%3Dexternal%26pixel%3D%26advId%3D91%26advUuid%3DPM_UID%26gdpr%3D1%26gdpr_consent%3D
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.210.249.92 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-249-92.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash

Request headers

Host: ads.pubmatic.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Response headers

Last-Modified: Sat, 01 Aug 2020 14:58:40 GMT
ETag: "1300708-1f7d-5abd2241d66f9"
Server: Apache/2.2.15 (CentOS)
Accept-Ranges: bytes
Content-Encoding: gzip
P3P: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
Content-Length: 2655
Content-Type: text/html; charset=UTF-8
Cache-Control: max-age=71117
Expires: Thu, 10 Sep 2020 11:57:06 GMT
Date: Wed, 09 Sep 2020 16:11:49 GMT
Connection: keep-alive
Vary: Accept-Encoding

GET
H/1.1

200
OK

liveCS.php
live.sekindo.com/live/ Frame AB1F
Redirect Chain

https://sync.search.spotxchange.com/partner?adv_id=8805&redir=https%3A%2F%2Flive.sekindo.com%2Flive%2FliveCS.php%3Fsource%3Dexternal%26pixel%3D%26advId%3D94%26advUuid%3D%24SPOTX_USER_ID
https://sync.search.spotxchange.com/partner?adv_id=8805&redir=https%3A%2F%2Flive.sekindo.com%2Flive%2FliveCS.php%3Fsource%3Dexternal%26pixel%3D%26advId%3D94%26advUuid%3D%24SPOTX_USER_ID&__user_chec...
https://live.sekindo.com/live/liveCS.php?source=external&pixel=&advId=94&advUuid=2a65efb9-f2b7-11ea-a685-125b01370e06

0
0

19ms
19ms

Document
text/html

185.220.204.204
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to

Full URL: https://live.sekindo.com/live/liveCS.php?source=external&pixel=&advId=94&advUuid=2a65efb9-f2b7-11ea-a685-125b01370e06
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 185.220.204.204 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, GB),
Reverse DNS
Software: nginx /
Resource Hash

Request headers

Host: live.sekindo.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Response headers

server: nginx
date: Wed, 09 Sep 2020 16:11:48 GMT
content-type: text/html; charset=utf-8
transfer-encoding: chunked
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
cache-control: no-store
pragma: no-cache
age: 0
content-encoding: gzip

Redirect headers

Server: nginx
Date: Wed, 09 Sep 2020 16:11:49 GMT
Content-Type: text/plain
Content-Length: 0
Connection: keep-alive
Set-Cookie: audience=2a65efb9-f2b7-11ea-a685-125b01370e06; expires=Thu, 09-Sep-2021 17:18:29 GMT; path=/; domain=.spotxchange.com; SameSite=none; Secure
Location: https://live.sekindo.com/live/liveCS.php?source=external&pixel=&advId=94&advUuid=2a65efb9-f2b7-11ea-a685-125b01370e06
X-fe: 92
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: false
Cache-Control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0

GET
H/1.1

200
OK

liveCS.php
live.sekindo.com/live/ Frame 2290
Redirect Chain

https://u.openx.net/w/1.0/cm?id=476b50d3-5ccf-49a1-89b8-1ddf8ea18042&r=https%3A%2F%2Flive.sekindo.com%2Flive%2FliveCS.php%3Fsource%3Dexternal%26pixel%3D%26advId%3D98%26advUuid%3D
https://u.openx.net/w/1.0/cm?cc=1&id=476b50d3-5ccf-49a1-89b8-1ddf8ea18042&r=https%3A%2F%2Flive.sekindo.com%2Flive%2FliveCS.php%3Fsource%3Dexternal%26pixel%3D%26advId%3D98%26advUuid%3D
https://live.sekindo.com/live/liveCS.php?source=external&pixel=&advId=98&advUuid=1f9eecb3-8f60-4d84-900f-4add1cfbd175

0
0

19ms
19ms

Document
text/html

185.220.204.204
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to

Full URL: https://live.sekindo.com/live/liveCS.php?source=external&pixel=&advId=98&advUuid=1f9eecb3-8f60-4d84-900f-4add1cfbd175
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 185.220.204.204 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, GB),
Reverse DNS
Software: nginx /
Resource Hash

Request headers

Host: live.sekindo.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Response headers

server: nginx
date: Wed, 09 Sep 2020 16:11:48 GMT
content-type: text/html; charset=utf-8
transfer-encoding: chunked
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
cache-control: no-store
pragma: no-cache
age: 0
content-encoding: gzip

Redirect headers

status: 302
vary: Accept, Accept-Encoding
set-cookie: i=3b97355a-6aa1-4a80-8ebc-14169494a19d|1599667909; Version=1; Expires=Thu, 09-Sep-2021 16:11:49 GMT; Max-Age=31536000; Secure; Domain=.openx.net; Path=/; SameSite=None
server: OXGW/16.193.0
p3p: CP="CUR ADM OUR NOR STA NID"
location: https://live.sekindo.com/live/liveCS.php?source=external&pixel=&advId=98&advUuid=1f9eecb3-8f60-4d84-900f-4add1cfbd175
date: Wed, 09 Sep 2020 16:11:49 GMT
content-type: text/html
content-length: 0
content-encoding: gzip
via: 1.1 google
alt-svc: clear

GET
H/1.1 200
OK placeHolder.png
live.sekindo.com/content/video/splayer/assets/ 23 KB
24 KB 21ms
16ms Image
image/png 185.220.204.204
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://live.sekindo.com/content/video/splayer/assets/placeHolder.png
Requested by: Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 185.220.204.204 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, GB),
Reverse DNS
Software: nginx /
Resource Hash: 76102878c1198de858725194952ba1c6b35bdee0f870cc6a124e93d17385e64e

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 09 Sep 2020 16:11:48 GMT
last-modified: Sun, 11 Jun 2017 08:04:06 GMT
server: nginx
etag: "593cf976-5dbf"
content-type: image/png
cache-control: no-cache, private
accept-ranges: bytes
content-length: 23999
expires: Wed, 09 Sep 2020 16:11:47 GMT

GET
H/1.1 200
OK vid5f508425c816b126612114.jpg
video.sekindo.com/uploads/cn7/video/users/converted/24485/video1523972806/ 18 KB
18 KB 99ms
28ms Image
image/jpeg 45.83.41.102
CLOUDWEBMANAGE-IL-FR

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://video.sekindo.com/uploads/cn7/video/users/converted/24485/video1523972806/vid5f508425c816b126612114.jpg?cbuster=1599112231

Requested by

Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

45.83.41.102 Frankfurt am Main, Germany, ASN204548 (CLOUDWEBMANAGE-IL-FR, GB),

Reverse DNS

Software

Tengine /

Resource Hash

ff6c025882c724280e86dc4c5e881a2f7d7dfc9a0903f7915a786c72c292bd33

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Wed, 09 Sep 2020 16:11:25 GMT
last-modified: Sun, 06 Sep 2020 22:32:33 GMT
Server: Tengine
etag: "5f556381-4677"
X-Cache-Status: HIT
Strict-Transport-Security: max-age=31536000
Content-Type: image/jpeg
cache-control: max-age=315360000
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=25
Content-Length: 18039
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H/1.1 200
OK vid5f5103ba20f5c612345332.jpg
video.sekindo.com/uploads/cn7/video/users/converted/28530/video_5d5baf9fe4c32389620327/ 19 KB
19 KB 127ms
28ms Image
image/jpeg 45.83.41.102
CLOUDWEBMANAGE-IL-FR

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://video.sekindo.com/uploads/cn7/video/users/converted/28530/video_5d5baf9fe4c32389620327/vid5f5103ba20f5c612345332.jpg?cbuster=1599144893

Requested by

Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

45.83.41.102 Frankfurt am Main, Germany, ASN204548 (CLOUDWEBMANAGE-IL-FR, GB),

Reverse DNS

Software

Tengine /

Resource Hash

cb65884c6b89265ff4cf3bf3bcac834481909f7820336106b4deb451d86a42d5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Wed, 09 Sep 2020 16:11:25 GMT
last-modified: Sun, 06 Sep 2020 22:17:19 GMT
Server: Tengine
etag: "5f555fef-4b94"
X-Cache-Status: HIT
Strict-Transport-Security: max-age=31536000
Content-Type: image/jpeg
cache-control: max-age=315360000
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=25
Content-Length: 19348
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H/1.1 200
OK vid5f56661407f73930554340.jpg
video.sekindo.com/uploads/cn24/video/users/converted/28530/video_5d5baf9fe4c32389620327/ 11 KB
11 KB 166ms
37ms Image
image/jpeg 45.83.41.102
CLOUDWEBMANAGE-IL-FR

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://video.sekindo.com/uploads/cn24/video/users/converted/28530/video_5d5baf9fe4c32389620327/vid5f56661407f73930554340.jpg?cbuster=1599497754

Requested by

Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

45.83.41.102 Frankfurt am Main, Germany, ASN204548 (CLOUDWEBMANAGE-IL-FR, GB),

Reverse DNS

Software

Tengine /

Resource Hash

6e4710b4f9dca47ff9fcdeddbd2ab7716c46a80de168faa31b0acc1db000be4d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Wed, 09 Sep 2020 16:11:25 GMT
last-modified: Mon, 07 Sep 2020 17:39:13 GMT
Server: Tengine
etag: "5f567041-2b4b"
X-Cache-Status: HIT
Strict-Transport-Security: max-age=31536000
Content-Type: image/jpeg
cache-control: max-age=315360000
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=25
Content-Length: 11083
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H/1.1 200
OK vid5f5103b38a336667271711.jpg
video.sekindo.com/uploads/cn6/video/users/converted/28530/video_5d5baf9fe4c32389620327/ 17 KB
18 KB 194ms
26ms Image
image/jpeg 45.83.41.102
CLOUDWEBMANAGE-IL-FR

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://video.sekindo.com/uploads/cn6/video/users/converted/28530/video_5d5baf9fe4c32389620327/vid5f5103b38a336667271711.jpg?cbuster=1599144888

Requested by

Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

45.83.41.102 Frankfurt am Main, Germany, ASN204548 (CLOUDWEBMANAGE-IL-FR, GB),

Reverse DNS

Software

Tengine /

Resource Hash

8c7a87a79fab9f43ce2b5e90052a8d51ecc432f6c92af48da3a4bd5a24d5e88e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Wed, 09 Sep 2020 16:11:25 GMT
last-modified: Sun, 06 Sep 2020 22:10:40 GMT
Server: Tengine
etag: "5f555e60-44ef"
X-Cache-Status: HIT
Strict-Transport-Security: max-age=31536000
Content-Type: image/jpeg
cache-control: max-age=315360000
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=25
Content-Length: 17647
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H/1.1 200
OK vid5f52647d21815393148559.jpg
video.sekindo.com/uploads/cn6/video/users/converted/28530/video_5d5baf9fe4c32389620327/ 21 KB
21 KB 221ms
26ms Image
image/jpeg 45.83.41.102
CLOUDWEBMANAGE-IL-FR

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://video.sekindo.com/uploads/cn6/video/users/converted/28530/video_5d5baf9fe4c32389620327/vid5f52647d21815393148559.jpg?cbuster=1599235203

Requested by

Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

45.83.41.102 Frankfurt am Main, Germany, ASN204548 (CLOUDWEBMANAGE-IL-FR, GB),

Reverse DNS

Software

Tengine /

Resource Hash

dbaa26fcd90cc0e6600d298a590c502a30d2d1bf3acda3b38ed2bf2aad71b0b3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Wed, 09 Sep 2020 16:11:25 GMT
last-modified: Sun, 06 Sep 2020 21:37:27 GMT
Server: Tengine
etag: "5f555697-52e1"
X-Cache-Status: HIT
Strict-Transport-Security: max-age=31536000
Content-Type: image/jpeg
cache-control: max-age=315360000
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=25
Content-Length: 21217
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H/1.1 200
OK vid5f577aa7da196607473161.jpg
video.sekindo.com/uploads/cn23/video/users/converted/28530/video_5d5baf9fe4c32389620327/ 30 KB
31 KB 231ms
25ms Image
image/jpeg 45.83.41.102
CLOUDWEBMANAGE-IL-FR

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://video.sekindo.com/uploads/cn23/video/users/converted/28530/video_5d5baf9fe4c32389620327/vid5f577aa7da196607473161.jpg?cbuster=1599568556

Requested by

Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

45.83.41.102 Frankfurt am Main, Germany, ASN204548 (CLOUDWEBMANAGE-IL-FR, GB),

Reverse DNS

Software

Tengine /

Resource Hash

27fb8b952323e75440813cce206abda7235fc414d55cf3422c0d2bc00fdaa833

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Wed, 09 Sep 2020 16:11:25 GMT
last-modified: Tue, 08 Sep 2020 13:07:16 GMT
Server: Tengine
etag: "5f578204-78c2"
X-Cache-Status: HIT
Strict-Transport-Security: max-age=31536000
Content-Type: image/jpeg
cache-control: max-age=315360000
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=25
Content-Length: 30914
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H/1.1 200
OK vid5f5264705d3dc579033875.jpg
video.sekindo.com/uploads/cn7/video/users/converted/28530/video_5d5baf9fe4c32389620327/ 24 KB
24 KB 178ms
24ms Image
image/jpeg 45.83.41.102
CLOUDWEBMANAGE-IL-FR

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://video.sekindo.com/uploads/cn7/video/users/converted/28530/video_5d5baf9fe4c32389620327/vid5f5264705d3dc579033875.jpg?cbuster=1599235188

Requested by

Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

45.83.41.102 Frankfurt am Main, Germany, ASN204548 (CLOUDWEBMANAGE-IL-FR, GB),

Reverse DNS

Software

Tengine /

Resource Hash

07ee8492749e3102e7ff5f6fd9583f90ac50bad0608d734528e22c2038323250

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Wed, 09 Sep 2020 16:11:25 GMT
last-modified: Sun, 06 Sep 2020 21:43:59 GMT
Server: Tengine
etag: "5f55581f-5eb5"
X-Cache-Status: HIT
Strict-Transport-Security: max-age=31536000
Content-Type: image/jpeg
cache-control: max-age=315360000
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=25
Content-Length: 24245
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H/1.1 200
OK vid5f5103ad9bea7452777933.jpg
video.sekindo.com/uploads/cn6/video/users/converted/28530/video_5d5baf9fe4c32389620327/ 14 KB
14 KB 175ms
23ms Image
image/jpeg 45.83.41.102
CLOUDWEBMANAGE-IL-FR

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://video.sekindo.com/uploads/cn6/video/users/converted/28530/video_5d5baf9fe4c32389620327/vid5f5103ad9bea7452777933.jpg?cbuster=1599144881

Requested by

Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

45.83.41.102 Frankfurt am Main, Germany, ASN204548 (CLOUDWEBMANAGE-IL-FR, GB),

Reverse DNS

Software

Tengine /

Resource Hash

d2e5434d730440add973e3d2c835b65c44e5be6f59180398b4ba620698085ace

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Wed, 09 Sep 2020 16:11:25 GMT
last-modified: Sun, 06 Sep 2020 22:10:34 GMT
Server: Tengine
etag: "5f555e5a-3605"
X-Cache-Status: HIT
Strict-Transport-Security: max-age=31536000
Content-Type: image/jpeg
cache-control: max-age=315360000
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=25
Content-Length: 13829
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H/1.1 200
OK vid5f532a9dcdd63439876908.jpg
video.sekindo.com/uploads/cn7/video/users/converted/24485/video1523972806/ 22 KB
22 KB 161ms
24ms Image
image/jpeg 45.83.41.102
CLOUDWEBMANAGE-IL-FR

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://video.sekindo.com/uploads/cn7/video/users/converted/24485/video1523972806/vid5f532a9dcdd63439876908.jpg?cbuster=1599285918

Requested by

Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

45.83.41.102 Frankfurt am Main, Germany, ASN204548 (CLOUDWEBMANAGE-IL-FR, GB),

Reverse DNS

Software

Tengine /

Resource Hash

21d98ae2b4353492ffe5c29d1425e6b499793f8d3af3e3b362c7720ba981420e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Wed, 09 Sep 2020 16:11:25 GMT
last-modified: Sun, 06 Sep 2020 21:25:42 GMT
Server: Tengine
etag: "5f5553d6-5623"
X-Cache-Status: HIT
Strict-Transport-Security: max-age=31536000
Content-Type: image/jpeg
cache-control: max-age=315360000
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=25
Content-Length: 22051
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2

200

sync
x.bidswitch.net/ul_cb/ Frame 9723
Redirect Chain

https://x.bidswitch.net/sync?ssp=sekindo&user_id=5f58fec4dc913&custom_data=5f58fec4dc913&gdpr=1&gdpr_consent=
https://x.bidswitch.net/ul_cb/sync?ssp=sekindo&user_id=5f58fec4dc913&custom_data=5f58fec4dc913&gdpr=1&gdpr_consent=

43 B
412 B

24ms
23ms

Image
image/gif

18.194.69.213
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://x.bidswitch.net/ul_cb/sync?ssp=sekindo&user_id=5f58fec4dc913&custom_data=5f58fec4dc913&gdpr=1&gdpr_consent=
Requested by: Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.194.69.213 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-194-69-213.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 200
date: Wed, 09 Sep 2020 16:11:49 GMT
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif
content-length: 43
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"

Redirect headers

status: 302
date: Wed, 09 Sep 2020 16:11:49 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 0
location: https://x.bidswitch.net/ul_cb/sync?ssp=sekindo&user_id=5f58fec4dc913&custom_data=5f58fec4dc913&gdpr=1&gdpr_consent=
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"

GET
H/1.1

200
OK

liveCS.php
live.sekindo.com/live/ Frame 9723
Redirect Chain

https://csync.loopme.me/?redirect=https%3A%2F%2Flive.sekindo.com%2Flive%2FliveCS.php%3Fsource%3Dexternal%26pixel%3D%26advId%3D93%26advUuid%3D%7Bdevice_id%7D
https://live.sekindo.com/live/liveCS.php?source=external&pixel=&advId=93&advUuid=44fefe1d-a1b2-4ea1-9404-df71604e4d7e

0
321 B

23ms
23ms

Image
text/html

185.220.204.204
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://live.sekindo.com/live/liveCS.php?source=external&pixel=&advId=93&advUuid=44fefe1d-a1b2-4ea1-9404-df71604e4d7e
Requested by: Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 185.220.204.204 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, GB),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 09 Sep 2020 16:11:49 GMT
content-encoding: gzip
server: nginx
age: 0
transfer-encoding: chunked
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
cache-control: no-store
content-type: text/html; charset=utf-8

Redirect headers

status: 307
date: Wed, 09 Sep 2020 16:11:49 GMT
content-length: 0
location: https://live.sekindo.com/live/liveCS.php?source=external&pixel=&advId=93&advUuid=44fefe1d-a1b2-4ea1-9404-df71604e4d7e

GET
H2 200 KFOmCnqEu92Fr1Mu4mxKKTU1Kg.woff2
fonts.gstatic.com/s/roboto/v20/ 11 KB
11 KB 6ms
5ms Font
font/woff2 2a00:1450:4001:819::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v20/KFOmCnqEu92Fr1Mu4mxKKTU1Kg.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:819::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5d1bc9b443f3f81fa4b4ad4634c1bb9702194c1898e3a9de0ab5e2cdc0e9f479

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://threatpost.com
Referer: https://fonts.googleapis.com/css?family=Roboto&display=swap
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 07 Sep 2020 09:03:54 GMT
x-content-type-options: nosniff
last-modified: Wed, 24 Jul 2019 01:18:50 GMT
server: sffe
age: 198475
status: 200
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11016
x-xss-protection: 0
expires: Tue, 07 Sep 2021 09:03:54 GMT

GET
H/1.1 200
OK liveView.php Show response
live.sekindo.com/live/ Frame 9723 61 KB
3 KB 95ms
94ms XHR
application/json 185.220.204.204
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to

Full URL: https://live.sekindo.com/live/liveView.php?s=58057&vid_vastTimeout=-1&vid_vastType=3&vid_playerVer=3.1.0&vid_viewabilityState=1&vid_content_url=https%3A%2F%2Fvideo.sekindo.com%2Fuploads%2Fcn7%2Fvideo%2Fusers%2Fconverted%2F24485%2Fvideo1523972806%2Fvid5f508425c816b126612114.mp4&vid_content_id=988715&vid_content_desc=IPO+Market+Is+Wide+Open+Says+Renaissance+Capital+Chairman&vid_content_title=IPO+Market+Is+Wide+Open+Says+Renaissance+Capital+Chairman&vid_content_duration=419&debugInformation=&x=320&y=180&pubUrl=https%3A%2F%2Fthreatpost.com%2Fshlayer-mac-malware-extra-sneakiness%2F156669%2F%3Fweb_view%3Dtrue&ri=6C69766553746174737C736B317B54307D7B64323032302D30392D30395F31397D7B7331323334383830387D7B4335387D7B53644768795A5746306347397A6443356A6232303D7D7B626368726F6D657D7B716465736B746F707D7B6F6D61636F73787D7B583330307D7B593235307D7B66317D7B4C363631357DFEFE&isApp=0&geoLati=52.069&geoLong=5.1024&userIpAddr=185.217.171.12&userUA=Mozilla%2F5.0+%28Macintosh%3B+Intel+Mac+OS+X+10_14_5%29+AppleWebKit%2F537.36+%28KHTML%2C+like+Gecko%29+Chrome%2F83.0.4103.61+Safari%2F537.36&schain=1.0%2C1%21admetricspro.com%2C1005%2C1&csuuid=5f58fec4dc913&cbuster=1599667909252&gdpr=1&gdprConsent=&isWePassGdpr=0
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/live/liveVideo.php?vpaidManager=sekindo&s=58057&ri=6C69766553746174737C736B317B54307D7B64323032302D30392D30395F31397D7B7331323334383830387D7B4335387D7B53644768795A5746306347397A6443356A6232303D7D7B626368726F6D657D7B716465736B746F707D7B6F6D61636F73787D7B583330307D7B593235307D7B66317D7B4C363631357DFEFE&userIpAddr=185.217.171.12&userUA=Mozilla%2F5.0+%28Macintosh%3B+Intel+Mac+OS+X+10_14_5%29+AppleWebKit%2F537.36+%28KHTML%2C+like+Gecko%29+Chrome%2F83.0.4103.61+Safari%2F537.36&debugInformation=&isWePassGdpr=0&schain=1.0%2C1%21admetricspro.com%2C1005%2C1&noViewableMidrollPolicy=vary&isDoublePreroll=1&autoSkipVideoSec=30&c2pWaitTime=10&csuuid=5f58fec4dc913&debugInfo=12348808_&debugPlayerSession=&pubUrlDEMO=&sta=12348808&showLogo=0&clkUrl=&plMult=-1&schedule=eyJwcmVfcm9sbCI6MSwibWlkX3JvbGwiOltdLCJnYXAiOiJhdXRvIn0%3D&content=plembed173akunvrojp&secondaryContent=&x=300&y=250&pubUrl=https%3A%2F%2Fthreatpost.com%2Fshlayer-mac-malware-extra-sneakiness%2F156669%2F%3Fweb_view%3Dtrue&contentNum=1&flow_closeBtn=1&flowCloseTimeout=0&flow_closeButtonPosition=right&flow_direction=br&flow_horizontalOffset=10&flow_bottomOffset=10&impGap=2&flow_width=320&flow_height=180&videoType=flow&gdpr=1&gdprConsent=&contentFeedId=&geoLati=52.069&geoLong=5.1024&vpTemplate=6615&flowMode=both&isRealPreroll=0&playerApiId=&isApp=0&ccpa=0&ccpaConsent=
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 185.220.204.204 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, GB),
Reverse DNS
Software: nginx /
Resource Hash: e34739060ab19db58c951a309f81d2089133f4cb989934421ca46ee5eb619806

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 09 Sep 2020 16:11:48 GMT
content-encoding: gzip
server: nginx
age: 0
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
access-control-allow-origin: https://threatpost.com
cache-control: no-store
access-control-allow-credentials: true
content-type: application/json; charset=utf-8
content-length: 2735

GET
H/1.1 200
OK liveView.php Show response
live.sekindo.com/live/ Frame 9723 23 KB
2 KB 41ms
41ms XHR
application/json 185.220.204.204
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to

Full URL: https://live.sekindo.com/live/liveView.php?s=58057&vid_vastTimeout=-1&vid_vastType=3&vid_playerVer=3.1.0&vid_viewabilityState=0&vid_content_url=https%3A%2F%2Fvideo.sekindo.com%2Fuploads%2Fcn7%2Fvideo%2Fusers%2Fconverted%2F24485%2Fvideo1523972806%2Fvid5f508425c816b126612114.mp4&vid_content_id=988715&vid_content_desc=IPO+Market+Is+Wide+Open+Says+Renaissance+Capital+Chairman&vid_content_title=IPO+Market+Is+Wide+Open+Says+Renaissance+Capital+Chairman&vid_content_duration=419&debugInformation=&x=320&y=180&pubUrl=https%3A%2F%2Fthreatpost.com%2Fshlayer-mac-malware-extra-sneakiness%2F156669%2F%3Fweb_view%3Dtrue&ri=6C69766553746174737C736B317B54307D7B64323032302D30392D30395F31397D7B7331323334383830387D7B4335387D7B53644768795A5746306347397A6443356A6232303D7D7B626368726F6D657D7B716465736B746F707D7B6F6D61636F73787D7B583330307D7B593235307D7B66317D7B4C363631357DFEFE&isApp=0&geoLati=52.069&geoLong=5.1024&userIpAddr=185.217.171.12&userUA=Mozilla%2F5.0+%28Macintosh%3B+Intel+Mac+OS+X+10_14_5%29+AppleWebKit%2F537.36+%28KHTML%2C+like+Gecko%29+Chrome%2F83.0.4103.61+Safari%2F537.36&schain=1.0%2C1%21admetricspro.com%2C1005%2C1&csuuid=5f58fec4dc913&cbuster=1599667909253&gdpr=1&gdprConsent=&isWePassGdpr=0
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/live/liveVideo.php?vpaidManager=sekindo&s=58057&ri=6C69766553746174737C736B317B54307D7B64323032302D30392D30395F31397D7B7331323334383830387D7B4335387D7B53644768795A5746306347397A6443356A6232303D7D7B626368726F6D657D7B716465736B746F707D7B6F6D61636F73787D7B583330307D7B593235307D7B66317D7B4C363631357DFEFE&userIpAddr=185.217.171.12&userUA=Mozilla%2F5.0+%28Macintosh%3B+Intel+Mac+OS+X+10_14_5%29+AppleWebKit%2F537.36+%28KHTML%2C+like+Gecko%29+Chrome%2F83.0.4103.61+Safari%2F537.36&debugInformation=&isWePassGdpr=0&schain=1.0%2C1%21admetricspro.com%2C1005%2C1&noViewableMidrollPolicy=vary&isDoublePreroll=1&autoSkipVideoSec=30&c2pWaitTime=10&csuuid=5f58fec4dc913&debugInfo=12348808_&debugPlayerSession=&pubUrlDEMO=&sta=12348808&showLogo=0&clkUrl=&plMult=-1&schedule=eyJwcmVfcm9sbCI6MSwibWlkX3JvbGwiOltdLCJnYXAiOiJhdXRvIn0%3D&content=plembed173akunvrojp&secondaryContent=&x=300&y=250&pubUrl=https%3A%2F%2Fthreatpost.com%2Fshlayer-mac-malware-extra-sneakiness%2F156669%2F%3Fweb_view%3Dtrue&contentNum=1&flow_closeBtn=1&flowCloseTimeout=0&flow_closeButtonPosition=right&flow_direction=br&flow_horizontalOffset=10&flow_bottomOffset=10&impGap=2&flow_width=320&flow_height=180&videoType=flow&gdpr=1&gdprConsent=&contentFeedId=&geoLati=52.069&geoLong=5.1024&vpTemplate=6615&flowMode=both&isRealPreroll=0&playerApiId=&isApp=0&ccpa=0&ccpaConsent=
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 185.220.204.204 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, GB),
Reverse DNS
Software: nginx /
Resource Hash: 7b3a6824b29805651d57c590d42543e6f1b575917fb2977a23e15229beb0fdf4

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 09 Sep 2020 16:11:48 GMT
content-encoding: gzip
server: nginx
age: 0
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
access-control-allow-origin: https://threatpost.com
cache-control: no-store
access-control-allow-credentials: true
content-type: application/json; charset=utf-8
content-length: 1728

GET
H2 200 aps_csm.js Show response
c.amazon-adsystem.com/bao-csm/aps-comm/ Frame 9723 6 KB
3 KB 32ms
32ms XHR
application/javascript 99.84.153.196
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/bao-csm/aps-comm/aps_csm.js
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.84.153.196 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-84-153-196.txl52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 09 Sep 2020 11:31:07 GMT
content-encoding: gzip
vary: Accept-Encoding,Origin
age: 16843
x-cache: Hit from cloudfront
status: 200
access-control-allow-origin: *
last-modified: Wed, 09 Sep 2020 11:16:19 GMT
server: AmazonS3
etag: W/"a4d296427fc806b21335359e398c025c"
access-control-max-age: 3000
access-control-allow-methods: GET
content-type: application/javascript
via: 1.1 df792ea3bbbe656e2f5c7b61aa85cc47.cloudfront.net (CloudFront)
cache-control: public, max-age=86400
x-amz-cf-pop: TXL52-C1
x-amz-cf-id: fDDPHrv15nXqMALx-2WWsIpTCx5hnWD4wPkEMMFp06ZcMnKyetyb1Q==

POST
H2 204 translator Show response
hbopenbid.pubmatic.com/ Frame 9723 0
59 B 38ms
38ms XHR
text/plain 185.64.189.112
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/content/prebid/prebidVid.3.19.0_9.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.189.112 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

status: 204
date: Wed, 09 Sep 2020 16:11:49 GMT
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
access-control-allow-origin: https://threatpost.com

POST
H/1.1 204
No Content openrtb Show response
ads.adaptv.advertising.com/rtb/ Frame 9723 0
215 B 371ms
35ms XHR
application/json 18.197.185.70
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.adaptv.advertising.com/rtb/openrtb?ext_id=TeachingAidsLLC
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/content/prebid/prebidVid.3.19.0_9.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.197.185.70 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-197-185-70.eu-central-1.compute.amazonaws.com
Software: adaptv/1.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://threatpost.com
access-control-allow-credentials: true
server: adaptv/1.0
Connection: keep-alive
content-length: 0
content-type: application/json

GET
H/1.1 200
OK liveView.php
live.sekindo.com/live/ 43 B
437 B 22ms
22ms Image
image/gif 185.220.204.204
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://live.sekindo.com/live/liveView.php?njs=1&ito=1&vid_event=6&serverTime=1599667909&vid_playerVer=3.1.0&s=58057&sta=12381421&x=320&y=180&msta=12348808&vid_vastType=3&vid_viewabilityState=0&vid_passDomain=threatpost.com&subId=threatpost.com&debugInformation=&isApp=0&userIpAddr=185.217.171.12&userUA=Mozilla%2F5.0%20%28Macintosh%3B%20Intel%20Mac%20OS%20X%2010_14_5%29%20AppleWebKit%2F537.36%20%28KHTML%2C%20like%20Gecko%29%20Chrome%2F83.0.4103.61%20Safari%2F537.36&csuuid=5f58fec4dc913&rvn=${VP_RVN_MACRO}&attemptMultiplier=10&contentFileId=0&mediaPlayListId=0&mediaListId=0&cbuster=1599667909303&gdpr=1&gdprConsent=&isWePassGdpr=0&ccpa=0&ccpaConsent=&uid=SekindoSPlayer5f58fec5149c6&pubUrl=https%3A%2F%2Fthreatpost.com%2Fshlayer-mac-malware-extra-sneakiness%2F156669%2F%3Fweb_view%3Dtrue&floatStatus=true
Requested by: Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 185.220.204.204 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, GB),
Reverse DNS
Software: nginx /
Resource Hash: 42b976597a2d977d0e300f6d06bc903db389e5c112d33c1c8c249690a522d9f2

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 09 Sep 2020 16:11:49 GMT
server: nginx
age: 0
transfer-encoding: chunked
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
access-control-allow-origin: *
cache-control: max-age=315360000
content-disposition: inline; filename="pixel.gif"
content-type: image/gif
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 integrator.js Show response
adservice.google.de/adsid/ 109 B
316 B 15ms
14ms Script
application/javascript 2a00:1450:4001:814::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=threatpost.com

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:814::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 09 Sep 2020 16:11:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status: 200
cache-control: private, no-cache, no-store
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 104
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 109 B
316 B 15ms
15ms Script
application/javascript 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=threatpost.com

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 09 Sep 2020 16:11:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status: 200
cache-control: private, no-cache, no-store
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 104
x-xss-protection: 0

GET
H3-Q050 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 150 KB
19 KB 509ms
480ms XHR
text/plain 216.58.206.2
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=2293265400039676&correlator=161053472922969&output=ldjh&impl=fifs&vrg=2020090201&gdpr=0&tfua=0&tfcd=0&guci=1.2.0.0.2.2.0.0&sc=1&sfv=1-0-37&ecs=20200909&iu_parts=21707124336%2CThreatPost-970x250-ATF%2CThreatPost-300x250-ATF%2CThreatPost-300x600-ATF%2CThreatPost-2x2-Skin&enc_prev_ius=%2F0%2F1%2C%2F0%2F2%2C%2F0%2F3%2C%2F0%2F4&prev_iu_szs=728x90%7C970x250%7C970x90%2C300x250%7C336x280%2C300x250%7C300x600%2C2x2&prev_scp=amznbid%3D2%26amznp%3D2%7Camznbid%3D2%26amznp%3D2%7Camznbid%3D2%26amznp%3D2%26hb_adid_nobid%3D630bbcc4f0db2bf%26hb_bidder_nobid%3Dnobid%26dyn_bids%3D0.01%26hb_adid%3D630bbcc4f0db2bf%26hb_bidder%3Dnobid%7Camznbid%3D2%26amznp%3D2&eri=1&cust_params=urlhost%3Dhttps%253A%252F%252Fthreatpost.com%252F%26urlpath%3D%252Fshlayer-mac-malware-extra-sneakiness%252F156669%252F%26urlquery%3Dgoogfc%26contentid%3D156669%26category%3Deditors-picks%26contenttags%3Danti-evasion%252Cfake-adobe-flash-installer%252Cgoogle-search%252Cintego%252Cmac-malware%252Cmalware-analysis%252Cnew-version%252Cpoisoned-search-results%252Cshlayer%252Cstealth&cookie_enabled=1&bc=31&abxe=1&lmt=1599667909&dt=1599667909420&dlt=1599667907873&idt=584&frm=20&biw=1600&bih=1200&oid=3&adxs=436%2C1082%2C1082%2C0&adys=10%2C257%2C1544%2C0&adks=1015519800%2C654286612%2C375389812%2C3385906655&ucis=1%7C2%7C3%7C4&ifi=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fthreatpost.com%2Fshlayer-mac-malware-extra-sneakiness%2F156669%2F%3Fweb_view%3Dtrue&dssz=43&icsg=167823875&std=0&vis=1&dmc=8&scr_x=0&scr_y=0&psz=728x90%7C300x250%7C300x250%7C1600x2&msz=728x90%7C300x250%7C300x250%7C1600x2&ga_vid=1262107814.1599667909&ga_sid=1599667909&ga_hid=625129160&fws=0%2C0%2C0%2C0&ohw=0%2C0%2C0%2C0

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020090201.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

216.58.206.2 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s20-in-f2.1e100.net

Software

cafe /

Resource Hash

829bd5abf5ca1bbe4c76b65c46350dd124a4e41139f83c8fef0edf1a890c329d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 09 Sep 2020 16:11:49 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 19037
x-xss-protection: 0
google-lineitem-id: -1,-1,-1,5283645110
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -1,-1,-1,138301519116
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://threatpost.com
access-control-expose-headers: x-google-amp-ad-validated-version
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 container.html
5214586febd538a8a28723ff5f414638.safeframe.googlesyndication.com/safeframe/1-0-37/html/ 0
0 73ms
39ms Other
text/html 2a00:1450:4001:815::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://5214586febd538a8a28723ff5f414638.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:815::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

GET
H2 200 container.html
tpc.googlesyndication.com/safeframe/1-0-37/html/ 0
0 26ms
6ms Other
text/html 2a00:1450:4001:820::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://tpc.googlesyndication.com/safeframe/1-0-37/html/container.html
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:820::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

GET
H3-Q050 200 recaptcha__en.js Show response
www.gstatic.com/recaptcha/releases/iSHzt4kCrNgSxGUYDFqaZAL9/ 336 KB
132 KB 30ms
14ms Script
text/javascript 2a00:1450:4001:808::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/iSHzt4kCrNgSxGUYDFqaZAL9/recaptcha__en.js

Requested by

Host: www.google.com
URL: https://www.google.com/recaptcha/api.js?hl=en&render=explicit&ver=5.4.2

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

854f7a7915f240546d3950dd2b067466da13c013d04a3f8c790880c58ec61151

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 08 Sep 2020 15:45:21 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Mon, 07 Sep 2020 04:06:55 GMT
server: sffe
age: 87988
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=31536000
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 134800
x-xss-protection: 0
expires: Wed, 08 Sep 2021 15:45:21 GMT

GET
H2 200 flipboard.svg
assets.threatpost.com/wp-content/plugins/kaspersky-social-sharing/assets/img/ 236 B
566 B 304ms
304ms Image
image/svg+xml 2600:9000:20e8:ba00:2:9275:3d40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets.threatpost.com/wp-content/plugins/kaspersky-social-sharing/assets/img/flipboard.svg
Requested by: Host: assets.threatpost.com
URL: https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-includes/css/dist/block-library/style.min.css,wp-content/plugins/wds-rss-builder/includes/css/select2.min.css,wp-content/plugins/wds-rss-builder/includes/css/wds-rss.css,wp-content/plugins/honeypot-comments/public/assets/css/public.css,wp-content/plugins/kspr_twitter_pullquote/css/style.css,wp-content/plugins/pullquote-shortcode/css/pullquote-shortcode.css,wp-content/plugins/kaspersky-social-sharing/assets/css/style.css,wp-content/plugins/kaspersky-social-sharing/assets/css/custom.css&ver=cf1c8861
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20e8:ba00:2:9275:3d40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: 506d565f94cecbb486394c545a96e8459217f8d045496b511e8c815142abfc70

Request headers

Referer: https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-includes/css/dist/block-library/style.min.css,wp-content/plugins/wds-rss-builder/includes/css/select2.min.css,wp-content/plugins/wds-rss-builder/includes/css/wds-rss.css,wp-content/plugins/honeypot-comments/public/assets/css/public.css,wp-content/plugins/kspr_twitter_pullquote/css/style.css,wp-content/plugins/pullquote-shortcode/css/pullquote-shortcode.css,wp-content/plugins/kaspersky-social-sharing/assets/css/style.css,wp-content/plugins/kaspersky-social-sharing/assets/css/custom.css&ver=cf1c8861
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: public
date: Wed, 09 Sep 2020 16:11:49 GMT
content-encoding: gzip
last-modified: Wed, 09 Sep 2020 08:46:18 GMT
server: nginx
x-amz-cf-pop: TXL52-C1
etag: W/"5f58965a-ec"
x-cache: Miss from cloudfront
content-type: image/svg+xml
status: 200
cache-control: max-age=604800, public
x-amz-cf-id: pQct0FjpvbE5yQjykVGeStbFkoI2KDMCw3yKhOZd7-Spq9Bx8_01Dg==
via: 1.1 c6649c9545bbfa66bc79c9ba552d7a4a.cloudfront.net (CloudFront)
expires: Wed, 16 Sep 2020 16:11:49 GMT

GET
H2 200 fontawesome-webfont.woff2
assets.threatpost.com/wp-content/plugins/kaspersky-social-sharing/assets/fonts/ 75 KB
76 KB 435ms
403ms Font
font/woff2 2600:9000:20e8:ba00:2:9275:3d40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.threatpost.com/wp-content/plugins/kaspersky-social-sharing/assets/fonts/fontawesome-webfont.woff2?v=4.7.0
Requested by: Host: assets.threatpost.com
URL: https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-includes/css/dist/block-library/style.min.css,wp-content/plugins/wds-rss-builder/includes/css/select2.min.css,wp-content/plugins/wds-rss-builder/includes/css/wds-rss.css,wp-content/plugins/honeypot-comments/public/assets/css/public.css,wp-content/plugins/kspr_twitter_pullquote/css/style.css,wp-content/plugins/pullquote-shortcode/css/pullquote-shortcode.css,wp-content/plugins/kaspersky-social-sharing/assets/css/style.css,wp-content/plugins/kaspersky-social-sharing/assets/css/custom.css&ver=cf1c8861
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20e8:ba00:2:9275:3d40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: 2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe

Request headers

Origin: https://threatpost.com
Referer: https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-includes/css/dist/block-library/style.min.css,wp-content/plugins/wds-rss-builder/includes/css/select2.min.css,wp-content/plugins/wds-rss-builder/includes/css/wds-rss.css,wp-content/plugins/honeypot-comments/public/assets/css/public.css,wp-content/plugins/kspr_twitter_pullquote/css/style.css,wp-content/plugins/pullquote-shortcode/css/pullquote-shortcode.css,wp-content/plugins/kaspersky-social-sharing/assets/css/style.css,wp-content/plugins/kaspersky-social-sharing/assets/css/custom.css&ver=cf1c8861
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 09 Sep 2020 16:11:49 GMT
via: 1.1 21b99afa310f2ff34977f80506fb1672.cloudfront.net (CloudFront)
x-amz-cf-pop: TXL52-C1
x-cache: Miss from cloudfront
status: 200
content-length: 77160
pragma: public
last-modified: Wed, 09 Sep 2020 08:46:20 GMT
server: nginx
etag: "5f58965c-12d68"
content-type: font/woff2
access-control-allow-origin: *
cache-control: max-age=31536000, public
accept-ranges: bytes
x-amz-cf-id: gFC7b3qcT5xRQtQmg27dL9alrC25-31U_ZnRhCot6XXkH1opP4kldw==
expires: Thu, 09 Sep 2021 16:11:49 GMT

GET
H2 200 adsct Show response
analytics.twitter.com/i/ 31 B
282 B 146ms
145ms Script
application/javascript 104.244.42.195
TWITTER

General

Check archive.org

Show headers Download Go to

Full URL

https://analytics.twitter.com/i/adsct?type=javascript&version=1.1.0&p_id=Twitter&p_user_id=0&txn_id=ntt0j&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0&tpx_cb=twttr.conversion.loadPixels&tw_document_href=https%3A%2F%2Fthreatpost.com%2Fshlayer-mac-malware-extra-sneakiness%2F156669%2F%3Fweb_view%3Dtrue

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

104.244.42.195 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

df3e003cc30e9bdd0313100e8ee5d468070b4b34d11ad355f276a356d4b9c7bf

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 09 Sep 2020 16:11:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
status: 200, 200 OK
x-twitter-response-tags: BouncerCompliant
strict-transport-security: max-age=631138519
content-length: 57
x-xss-protection: 0
x-response-time: 124
pragma: no-cache
last-modified: Wed, 09 Sep 2020 16:11:49 GMT
server: tsa_o
x-frame-options: SAMEORIGIN
content-type: application/javascript;charset=utf-8
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash: 72f8b12475ef1cbec2f84cdc3685ffcf
x-transaction: 00a3d98400f161cc
expires: Tue, 31 Mar 1981 05:00:00 GMT

GET
H3-Q050 200 anchor
www.google.com/recaptcha/api2/ Frame DA26 0
0 28ms
28ms Document
text/html 2a00:1450:4001:81a::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/anchor?ar=1&k=6Lfgf_8SAAAAADYbQAnKFOk7cvnWbkqo6y57-4-U&co=aHR0cHM6Ly90aHJlYXRwb3N0LmNvbTo0NDM.&hl=en&v=iSHzt4kCrNgSxGUYDFqaZAL9&theme=standard&size=normal&cb=c47wb3b29qg

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81a::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-dCGBqa5G9+JbpIm4droilQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: www.google.com
:scheme: https
:path: /recaptcha/api2/anchor?ar=1&k=6Lfgf_8SAAAAADYbQAnKFOk7cvnWbkqo6y57-4-U&co=aHR0cHM6Ly90aHJlYXRwb3N0LmNvbTo0NDM.&hl=en&v=iSHzt4kCrNgSxGUYDFqaZAL9&theme=standard&size=normal&cb=c47wb3b29qg
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Response headers

status: 200
content-type: text/html; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: Mon, 01 Jan 1990 00:00:00 GMT
date: Wed, 09 Sep 2020 16:11:49 GMT
content-security-policy: script-src 'report-sample' 'nonce-dCGBqa5G9+JbpIm4droilQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 10614
server: GSE
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 / Show response
graph.facebook.com/ 82 B
491 B 45ms
30ms XHR
application/json 2a03:2880:f01c:800e:face:b00c:0:2
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://graph.facebook.com/?id=https%3A%2F%2Fthreatpost.com%2Fshlayer-mac-malware-extra-sneakiness%2F156669%2F

Requested by

Host: threatpost.com
URL: https://threatpost.com/wp-includes/js/jquery/jquery.js?ver=1.12.4-wp

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:800e:face:b00c:0:2 , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

1554f794a0cc095ee381dee0971f1d1a8a9aaa55c743103e24913f07e18ec6b5

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload

Request headers

Accept: application/json, text/javascript, */*; q=0.01
Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=15552000; preload
etag: "18d473d4e6c8864964840ba010bee2d3d0c74b27"
status: 200
x-fb-rev: 1002636611
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 82
pragma: no-cache
x-fb-debug: R56aBSjq45t4WCeWzQ15lgmV+3fSq22VUmd8RhETEwdBAv3RbWwKZShszHBL7IJZ9Tw7gQ47ItOMPFyzFd9cqQ==
x-fb-trace-id: FRcEeRN8a6C
date: Wed, 09 Sep 2020 16:11:49 GMT
content-type: application/json
access-control-allow-origin: *
x-fb-request-id: AVorNApuCtuY8pW2GY79mDm
cache-control: private, no-cache, no-store, must-revalidate
facebook-api-version: v3.1
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 404 share
www.linkedin.com/countserv/count/ 0
0 176ms
157ms Script
text/html 2620:1ec:21::14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.linkedin.com/countserv/count/share?url=https%3A%2F%2Fthreatpost.com%2Fshlayer-mac-malware-extra-sneakiness%2F156669%2F&format=jsonp&callback=jQuery112407222480012086168_1599667908523&_=1599667908524
Requested by: Host: threatpost.com
URL: https://threatpost.com/wp-includes/js/jquery/jquery.js?ver=1.12.4-wp
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

GET
H2 200 info.json Show response
www.reddit.com/api/ 102 B
1 KB 451ms
144ms XHR
application/json 199.232.53.140
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://www.reddit.com/api/info.json?url=https%3A%2F%2Fthreatpost.com%2Fshlayer-mac-malware-extra-sneakiness%2F156669%2F

Requested by

Host: threatpost.com
URL: https://threatpost.com/wp-includes/js/jquery/jquery.js?ver=1.12.4-wp

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

199.232.53.140 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

snooserv /

Resource Hash

f4f2c0a4763f01ee2b13b4f8189e6fd5f32bd704d71fed8d0f11883de9724198

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept: application/json, text/javascript, */*; q=0.01
Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 09 Sep 2020 16:11:50 GMT
via: 1.1 varnish
x-content-type-options: nosniff
status: 200
content-length: 102
x-xss-protection: 1; mode=block
x-ua-compatible: IE=edge
x-moose: majestic
server: snooserv
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
access-control-expose-headers: X-Moose
cache-control: private, s-maxage=0, max-age=0, must-revalidate, no-store, max-age=0, must-revalidate
accept-ranges: bytes
expires: -1

GET
H2 200 pixel;r=1345541345;source=gtm;rf=0;uh=65ce955d6ae6;a=p-_7kVx0t9Jqj90;url=https%3A%2F%2Fthreatpost.com%2Fshlayer-mac-malware-extra-sneakiness%2F156669%2F%3Fweb_view%3Dtrue;fpan=1;fpa=P0-1858010673-1...
pixel.quantserve.com/ 35 B
371 B 10ms
8ms Image
image/gif 2620:116:800d:21:5a23:9c4e:e774:96c1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pixel.quantserve.com/pixel;r=1345541345;source=gtm;rf=0;uh=65ce955d6ae6;a=p-_7kVx0t9Jqj90;url=https%3A%2F%2Fthreatpost.com%2Fshlayer-mac-malware-extra-sneakiness%2F156669%2F%3Fweb_view%3Dtrue;fpan=1;fpa=P0-1858010673-1599667909578;ns=0;ce=1;qjs=1;qv=35f667c6-20200713111428;cm=;gdpr=0;ref=;d=threatpost.com;je=0;sr=1600x1200x24;enc=n;dst=1;et=1599667909578;tzo=-120;ogl=image.https%3A%2F%2Fmedia%252Ethreatpost%252Ecom%2Fwp-content%2Fuploads%2Fsites%2F103%2F2020%2F01%2F22100148%2Ftroja%2Ctype.article%2Ctitle.Shlayer%20Mac%20Malware%20Returns%20with%20Extra%20Sneakiness%2Cdescription.Spreading%20via%20poisoned%20Google%20search%20results%252C%20this%20new%20version%20of%20Mac's%20No%252E%201%20th%2Curl.https%3A%2F%2Fthreatpost%252Ecom%2Fshlayer-mac-malware-extra-sneakiness%2F156669%2F

Requested by

Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2620:116:800d:21:5a23:9c4e:e774:96c1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 09 Sep 2020 16:11:49 GMT
strict-transport-security: max-age=86400
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
status: 200
cache-control: private, no-cache, no-store, proxy-revalidate
content-type: image/gif
content-length: 35
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H3-Q050 200 anchor
www.google.com/recaptcha/api2/ Frame 66C1 0
0 24ms
23ms Document
text/html 2a00:1450:4001:81a::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LehhAETAAAAAAcsm2ZGDsLCqyGhesy4Yn43WNBe&co=aHR0cHM6Ly90aHJlYXRwb3N0LmNvbTo0NDM.&hl=en&v=iSHzt4kCrNgSxGUYDFqaZAL9&theme=light&size=normal&cb=oexqizclw0sz

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81a::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-Quc+ZBf7sPgyJISI543xNA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: www.google.com
:scheme: https
:path: /recaptcha/api2/anchor?ar=1&k=6LehhAETAAAAAAcsm2ZGDsLCqyGhesy4Yn43WNBe&co=aHR0cHM6Ly90aHJlYXRwb3N0LmNvbTo0NDM.&hl=en&v=iSHzt4kCrNgSxGUYDFqaZAL9&theme=light&size=normal&cb=oexqizclw0sz
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Response headers

status: 200
content-type: text/html; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: Mon, 01 Jan 1990 00:00:00 GMT
date: Wed, 09 Sep 2020 16:11:49 GMT
content-security-policy: script-src 'report-sample' 'nonce-Quc+ZBf7sPgyJISI543xNA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 11703
server: GSE
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

POST
H/1.1 204
No Content openrtb Show response
ads.adaptv.advertising.com/rtb/ Frame 9723 0
215 B 35ms
35ms XHR
application/json 18.197.185.70
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.adaptv.advertising.com/rtb/openrtb?ext_id=TeachingAidsLLC
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/content/prebid/prebidVid.3.19.0_9.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.197.185.70 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-197-185-70.eu-central-1.compute.amazonaws.com
Software: adaptv/1.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://threatpost.com
access-control-allow-credentials: true
server: adaptv/1.0
Connection: keep-alive
content-length: 0
content-type: application/json

GET
H2 200 avjp Show response
teachingaids-d.openx.net/v/1.0/ Frame 9723 92 B
286 B 200ms
200ms XHR
application/json 35.244.159.8
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://teachingaids-d.openx.net/v/1.0/avjp?ju=https%3A%2F%2Fthreatpost.com%2Fshlayer-mac-malware-extra-sneakiness%2F156669%2F%3Fweb_view%3Dtrue&ch=UTF-8&res=1600x1200x24&ifr=true&tz=-120&tws=1600x1200&be=1&bc=hb_pb_3.0.2&dddid=1f83cd9c-4f69-4922-a4dc-31945776cb86&nocache=1599667909757&gdpr_consent=&gdpr=1&schain=1.0,1!admetricspro.com,1005,1,,,&skip=1&auid=540882778&vwd=320&vht=180
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/content/prebid/prebidVid.3.19.0_9.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.159.8 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/16.193.0 /
Resource Hash: 004e5faf0bf890f61697daeede9f21826affd1137fb2cb58eaf4719937a04a14

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Wed, 09 Sep 2020 16:11:49 GMT
via: 1.1 google
server: OXGW/16.193.0
status: 200
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: https://threatpost.com
cache-control: private, max-age=0, no-cache
access-control-allow-credentials: true
content-type: application/json
alt-svc: clear
content-length: 92
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H/1.1 200
OK cygnus Show response
as-sec.casalemedia.com/ Frame 9723 24 B
672 B 112ms
112ms XHR
application/json 23.210.249.164
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://as-sec.casalemedia.com/cygnus?s=435870&v=8.1&r={%22id%22:%2295bf33d5ace984%22,%22imp%22:[{%22id%22:%221068a8533779b7d%22,%22ext%22:{%22siteID%22:%22435870%22,%22sid%22:%22320x180%22},%22bidfloor%22:2,%22bidfloorcur%22:%22USD%22,%22video%22:{%22mimes%22:[%22video/mp4%22,%22application/javascript%22,%22video/webm%22],%22minduration%22:1,%22maxduration%22:200,%22api%22:[1,2],%22protocols%22:[1,2,3,4,5,6],%22linearity%22:1,%22startdelay%22:0,%22skip%22:1,%22w%22:320,%22h%22:180,%22placement%22:1}},{%22id%22:%22114f621cf872d64%22,%22ext%22:{%22siteID%22:%22435871%22,%22sid%22:%22320x180%22},%22bidfloor%22:2,%22bidfloorcur%22:%22USD%22,%22video%22:{%22mimes%22:[%22video/mp4%22,%22application/javascript%22,%22video/webm%22],%22minduration%22:1,%22maxduration%22:200,%22api%22:[1,2],%22protocols%22:[1,2,3,4,5,6],%22linearity%22:1,%22startdelay%22:0,%22skip%22:1,%22w%22:320,%22h%22:180,%22placement%22:1}}],%22site%22:{%22page%22:%22https%3A%2F%2Fthreatpost.com%2Fshlayer-mac-malware-extra-sneakiness%2F156669%2F%3Fweb_view%3Dtrue%22},%22ext%22:{%22source%22:%22prebid%22},%22source%22:{%22ext%22:{%22schain%22:{%22ver%22:%221.0%22,%22complete%22:1,%22nodes%22:[{%22asi%22:%22admetricspro.com%22,%22sid%22:%221005%22,%22hp%22:1}]}}},%22regs%22:{%22ext%22:{%22gdpr%22:1}},%22user%22:{%22ext%22:{%22consent%22:%22%22}}}&ac=j&sd=1&nf=1
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/content/prebid/prebidVid.3.19.0_9.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.210.249.164 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-249-164.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b78dafcf7a545a97b8d466e4be39ad8d59d30078e95e9aa36132f8f39747eccb

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Wed, 09 Sep 2020 16:11:49 GMT
Content-Encoding: gzip
Server: Apache
Vary: Accept-Encoding
Content-Type: application/json
Access-Control-Allow-Origin: https://threatpost.com
Cache-Control: max-age=0, no-cache, no-store
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 44
Expires: Wed, 09 Sep 2020 16:11:49 GMT

POST
H2 204 translator Show response
hbopenbid.pubmatic.com/ Frame 9723 0
59 B 19ms
19ms XHR
text/plain 185.64.189.112
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/content/prebid/prebidVid.3.19.0_9.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.189.112 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

status: 204
date: Wed, 09 Sep 2020 16:11:49 GMT
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
access-control-allow-origin: https://threatpost.com

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ Frame 9723 19 B
712 B 24ms
24ms XHR
application/json 37.252.172.36
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: live.sekindo.com
URL: https://live.sekindo.com/content/prebid/prebidVid.3.19.0_9.min.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.172.36 , Ascension Island, ASN29990 (ASN-APPNEX, US),

Reverse DNS

692.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

Software

nginx/1.17.9 /

Resource Hash

0c09c070833c786cb25be38bc30992b30bad578f817dbc9e34beacd8b8ea44c5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Wed, 09 Sep 2020 16:11:49 GMT
X-Proxy-Origin: 185.217.171.12; 185.217.171.12; 692.bm-nginx-loadbalancer.mgmt.fra1; *.adnxs.com; 37.252.172.201:80
AN-X-Request-Uuid: 3d66d938-07bf-4113-a501-57a37177a244
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://threatpost.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json; charset=utf-8
Content-Length: 19
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3-Q050 200 bframe
www.google.com/recaptcha/api2/ Frame 0F83 0
0 18ms
18ms Document
text/html 2a00:1450:4001:81a::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/bframe?hl=en&v=iSHzt4kCrNgSxGUYDFqaZAL9&k=6Lfgf_8SAAAAADYbQAnKFOk7cvnWbkqo6y57-4-U&cb=70qjetetlru

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81a::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-HlQwiQbYPT/y1geVHvSBLQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: www.google.com
:scheme: https
:path: /recaptcha/api2/bframe?hl=en&v=iSHzt4kCrNgSxGUYDFqaZAL9&k=6Lfgf_8SAAAAADYbQAnKFOk7cvnWbkqo6y57-4-U&cb=70qjetetlru
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Response headers

status: 200
content-type: text/html; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: Mon, 01 Jan 1990 00:00:00 GMT
date: Wed, 09 Sep 2020 16:11:49 GMT
content-security-policy: script-src 'report-sample' 'nonce-HlQwiQbYPT/y1geVHvSBLQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 1175
server: GSE
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-Q050 200 bframe
www.google.com/recaptcha/api2/ Frame 4670 0
0 19ms
19ms Document
text/html 2a00:1450:4001:81a::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/bframe?hl=en&v=iSHzt4kCrNgSxGUYDFqaZAL9&k=6LehhAETAAAAAAcsm2ZGDsLCqyGhesy4Yn43WNBe&cb=s2zoqg5fto7l

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81a::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-sT14k9wy952eUU/ee5zr4A' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: www.google.com
:scheme: https
:path: /recaptcha/api2/bframe?hl=en&v=iSHzt4kCrNgSxGUYDFqaZAL9&k=6LehhAETAAAAAAcsm2ZGDsLCqyGhesy4Yn43WNBe&cb=s2zoqg5fto7l
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Response headers

status: 200
content-type: text/html; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: Mon, 01 Jan 1990 00:00:00 GMT
date: Wed, 09 Sep 2020 16:11:49 GMT
content-security-policy: script-src 'report-sample' 'nonce-sT14k9wy952eUU/ee5zr4A' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 1170
server: GSE
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

POST
H2 200 tag
math-aids-threatpost-tagan.adlightning.com/ 0
427 B 107ms
30ms Other
text/plain 99.84.156.60
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://math-aids-threatpost-tagan.adlightning.com/tag?s=bl&d=eyJzaXRlSWQiOiJtYXRoLWFpZHMtdGhyZWF0cG9zdCIsInVybCI6Imh0dHBzOi8vdGhyZWF0cG9zdC5jb20vc2hsYXllci1tYWMtbWFsd2FyZS1leHRyYS1zbmVha2luZXNzLzE1NjY2OS8%2Fd2ViX3ZpZXc9dHJ1ZSIsImFkVW5pdCI6Ii8yMTcwNzEyNDMzNi9UaHJlYXRQb3N0LTk3MHgyNTAtQVRGXzAiLCJhZFNlcnZlckRldGFpbHMiOnsiYWR2ZXJ0aXNlcklkIjoiNDU5NDU1OTc1MiIsImNhbXBhaWduSWQiOiIyNjU0MDI1MDM5IiwiY3JlYXRpdmVJZCI6IjEzODMwMTUzNDE5OCIsImxpbmVpdGVtSWQiOiI1Mjc2MDQ3MzgyIiwiYWRTZXJ2ZXIiOiJkZnAifSwid2lkdGgiOjcyOCwiaGVpZ2h0Ijo5MCwid3YiOiIxLjAuMCs5YTRmN2NlIiwiYnYiOiIxLjAuMCs5YTRmN2NlIiwidGFnTWFya3VwIjoiPGlmcmFtZSBpZD1cImdvb2dsZV9hZHNfaWZyYW1lXy8yMTcwNzEyNDMzNi9UaHJlYXRQb3N0LTk3MHgyNTAtQVRGXzBcIiB0aXRsZT1cIjNyZCBwYXJ0eSBhZCBjb250ZW50XCIgbmFtZT1cImdvb2dsZV9hZHNfaWZyYW1lXy8yMTcwNzEyNDMzNi9UaHJlYXRQb3N0LTk3MHgyNTAtQVRGXzBcIiB3aWR0aD1cIjk3MFwiIGhlaWdodD1cIjI1MFwiIHNjcm9sbGluZz1cIm5vXCIgbWFyZ2lud2lkdGg9XCIwXCIgbWFyZ2luaGVpZ2h0PVwiMFwiIGZyYW1lYm9yZGVyPVwiMFwiIHNyY2RvYz1cIlwiIHNhbmRib3g9XCJhbGxvdy1mb3JtcyBhbGxvdy1wb3B1cHMgYWxsb3ctcG9wdXBzLXRvLWVzY2FwZS1zYW5kYm94IGFsbG93LXBvaW50ZXItbG9jayBhbGxvdy1zYW1lLW9yaWdpbiBhbGxvdy1zY3JpcHRzIGFsbG93LXRvcC1uYXZpZ2F0aW9uLWJ5LXVzZXItYWN0aXZhdGlvblwiIHN0eWxlPVwiYm9yZGVyOiAwcHg7IHZlcnRpY2FsLWFsaWduOiBib3R0b207XCI%2BPC9pZnJhbWU%2BPCEtLSBJRlJBTUUgSU5ORVIgQ09OVEVOVCAtLT4iLCJibGFja2xpc3REYXRhIjp7ImFjdGlvbiI6MTAsImFjdGlvbkRldGFpbHMiOiJuZXdjaGljLmNvbSIsInJlcG9ydE1hcmt1cCI6dHJ1ZSwiaXRlbXMiOlt7Imhvc3RuYW1lIjoibmV3Y2hpYy5jb20iLCJ0b2tlbiI6IiIsImFjdGlvbiI6MTB9XSwibWFya3VwIjoiPCFkb2N0eXBlIGh0bWw%2BPGh0bWwgYW1wNGFkcyBjbGFzcz1pLWFtcGh0bWwtaW5hYm94IGktYW1waHRtbC1sYXlvdXQgaS1hbXBodG1sLW5vLWJvaWxlcnBsYXRlPjxoZWFkPjxtZXRhIG5hbWU9XCJyZWZlcnJlclwiIGNvbnRlbnQ9XCJvcmlnaW5cIj48bWV0YSBodHRwLWVxdWl2PUNvbnRlbnQtU2VjdXJpdHktUG9saWN5IGNvbnRlbnQ9XCJzY3JpcHQtc3JjIGh0dHBzOi8vY2RuLmFtcHByb2plY3Qub3JnLztvYmplY3Qtc3JjICdub25lJztjaGlsZC1zcmMgYmxvYjo7ZnJhbWUtc3JjICdub25lJ1wiPjxtZXRhIGNoYXJzZXQ9dXRmLTg%2BPHN0eWxlIGFtcC1ydW50aW1lIGktYW1waHRtbC12ZXJzaW9uPTAxMjAwODI0MjMwMTAwMD5odG1se292ZXJmbG93LXg6aGlkZGVuIWltcG9ydGFudH1odG1sLmktYW1waHRtbC1maWV7aGVpZ2h0OjEwMCUhaW1wb3J0YW50O3dpZHRoOjEwMCUhaW1wb3J0YW50fWh0bWw6bm90KFthbXA0YWRzXSksaHRtbDpub3QoW2FtcDRhZHNdKSBib2R5e2hlaWdodDphdXRvIWltcG9ydGFudH1odG1sOm5vdChbYW1wNGFkc10pIGJvZHl7bWFyZ2luOjAhaW1wb3J0YW50fWJvZHl7LXdlYmtpdC10ZXh0LXNpemUtYWRqdXN0OjEwMCU7LW1vei10ZXh0LXNpemUtYWRqdXN0OjEwMCU7LW1zLXRleHQtc2l6ZS1hZGp1c3Q6MTAwJTt0ZXh0LXNpemUtYWRqdXN0OjEwMCV9aHRtbC5pLWFtcGh0bWwtc2luZ2xlZG9jLmktYW1waHRtbC1lbWJlZGRlZHstbXMtdG91Y2gtYWN0aW9uOnBhbi15O3RvdWNoLWFjdGlvbjpwYW4teX1odG1sLmktYW1waHRtbC1maWU%2BYm9keSxodG1sLmktYW1waHRtbC1zaW5nbGVkb2M%2BYm9keXtvdmVyZmxvdzp2aXNpYmxlIWltcG9ydGFudH1odG1sLmktYW1waHRtbC1maWU6bm90KC5pLWFtcGh0bWwtaW5hYm94KT5ib2R5LGh0bWwuaS1hbXBodG1sLXNpbmdsZWRvYzpub3QoLmktYW1waHRtbC1pbmFib3gpPmJvZHl7cG9zaXRpb246cmVsYXRpdmUhaW1wb3J0YW50fWh0bWwuaS1hbXBodG1sLXdlYnZpZXc%2BYm9keXtvdmVyZmxvdy14OmhpZGRlbiFpbXBvcnRhbnQ7b3ZlcmZsb3cteTp2aXNpYmxlIWltcG9ydGFudDttaW4taGVpZ2h0OjEwMHZoIWltcG9ydGFudH1odG1sLmktYW1waHRtbC1pb3MtZW1iZWQtbGVnYWN5PmJvZHl7b3ZlcmZsb3cteDpoaWRkZW4haW1wb3J0YW50O292ZXJmbG93LXk6YXV0byFpbXBvcnRhbnQ7cG9zaXRpb246YWJzb2x1dGUhaW1wb3J0YW50fWh0bWwuaS1hbXBodG1sLWlvcy1lbWJlZHtvdmVyZmxvdy15OmF1dG8haW1wb3J0YW50O3Bvc2l0aW9uOnN0YXRpY30jaS1hbXBodG1sLXdyYXBwZXJ7b3ZlcmZsb3cteDpoaWRkZW4haW1wb3J0YW50O292ZXJmbG93LXk6YXV0byFpbXBvcnRhbnQ7cG9zaXRpb246YWJzb2x1dGUhaW1wb3J0YW50O3RvcDowIWltcG9ydGFudDtsZWZ0OjAhaW1wb3J0YW50O3JpZ2h0OjAhaW1wb3J0YW50O2JvdHRvbTowIWltcG9ydGFudDttYXJnaW46MCFpbXBvcnRhbnQ7ZGlzcGxheTpibG9jayFpbXBvcnRhbnR9aHRtbC5pLWFtcGh0bWwtaW9zLWVtYmVkLmktYW1waHRtbC1pb3Mtb3ZlcnNjcm9sbCxodG1sLmktYW1waHRtbC1pb3MtZW1iZWQuaS1hbXBodG1sLWlvcy1vdmVyc2Nyb2xsPiNpLWFtcGh0bWwtd3JhcHBlcnstd2Via2l0LW92ZXJmbG93LXNjcm9sbGluZzp0b3VjaCFpbXBvcnRhbnR9I2ktYW1waHRtbC13cmFwcGVyPmJvZHl7cG9zaXRpb246cmVsYXRpdmUhaW1wb3J0YW50O2JvcmRlci10b3A6MXB4IHNvbGlkIHRyYW5zcGFyZW50IWltcG9ydGFudH0jaS1hbXBodG1sLXdyYXBwZXIrYm9keXt2aXNpYmlsaXR5OnZpc2libGV9I2ktYW1waHRtbC13cmFwcGVyK2JvZHkgLmktYW1waHRtbC1saWdodGJveC1lbGVtZW50LCNpLWFtcGh0bWwtd3JhcHBlcitib2R5W2ktYW1waHRtbC1saWdodGJveF17dmlzaWJpbGl0eTpoaWRkZW59I2ktYW1waHRtbC13cmFwcGVyK2JvZHlbaS1hbXBodG1sLWxpZ2h0Ym94XSAuaS1hbXBodG1sLWxpZ2h0Ym94LWVsZW1lbnR7dmlzaWJpbGl0eTp2aXNpYmxlfSNpLWFtcGh0bWwtd3JhcHBlci5pLWFtcGh0bWwtc2Nyb2xsLWRpc2FibGVkLC5pLWFtcGh0bWwtc2Nyb2xsLWRpc2FibGVke292ZXJmbG93LXg6aGlkZGVuIWltcG9ydGFudDtvdmVyZmxvdy15OmhpZGRlbiFpbXBvcnRhbnR9YW1wLWluc3RhZ3JhbXtwYWRkaW5nOjU0cHggMHB4IDBweCFpbXBvcnRhbnQ7YmFja2dyb3VuZC1jb2xvcjojZmZmfWFtcC1pZnJhbWUgaWZyYW1le2JveC1zaXppbmc6Ym9yZGVyLWJveCFpbXBvcnRhbnR9W2FtcC1hY2Nlc3NdW2FtcC1hY2Nlc3MtaGlkZV17ZGlzcGxheTpub25lfVtzdWJzY3JpcHRpb25zLWRpYWxvZ10sYm9keTpub3QoLmktYW1waHRtbC1zdWJzLXJlYWR5KSBbc3Vic2NyaXB0aW9ucy1hY3Rpb25dLGJvZHk6bm90KC5pLWFtcGh0bWwtc3Vicy1yZWFkeSkgW3N1YnNjcmlwdGlvbnMtc2VjdGlvbl17ZGlzcGxheTpub25lIWltcG9ydGFudH1hbXAtZXhwZXJpbWVudCxhbXAtbGl2ZS1saXN0Plt1cGRhdGVde2Rpc3BsYXk6bm9uZX0uaS1hbXBodG1sLWphbmstbWV0ZXJ7cG9zaXRpb246Zml4ZWQ7YmFja2dyb3VuZC1jb2xvcjpyZ2JhKDIzMiw3Miw5NSwwLjUpO2JvdHRvbTowO3JpZ2h0OjA7Y29sb3I6I2ZmZjtmb250LXNpemU6MTZweDt6LWluZGV4OjEwMDA7cGFkZGluZzo1cHh9YW1wLWxpc3RbcmVzaXphYmxlLWNoaWxkcmVuXT4uaS1hbXBodG1sLWxvYWRpbmctY29udGFpbmVyLmFtcC1oaWRkZW57ZGlzcGxheTpub25lIWltcG9ydGFudH1hbXAtbGlzdCBbZmV0Y2gtZXJyb3JdLGFtcC1saXN0W2xvYWQtbW9yZV0gW2xvYWQtbW9yZS1idXR0b25dLGFtcC1saXN0W2xvYWQtbW9yZV0gW2xvYWQtbW9yZS1lbmRdLGFtcC1saXN0W2xvYWQtbW9yZV0gW2xvYWQtbW9yZS1mYWlsZWRdLGFtcC1saXN0W2xvYWQtbW9yZV0gW2xvYWQtbW9yZS1sb2FkaW5nXXtkaXNwbGF5Om5vbmV9YW1wLWxpc3RbZGlmZmFibGVdIGRpdltyb2xlPWxpc3Rde2Rpc3BsYXk6YmxvY2t9YW1wLXN0b3J5LXBhZ2UsYW1wLXN0b3J5W3N0YW5kYWxvbmVde21pbi1oZWlnaHQ6MXB4IWltcG9ydGFudDtkaXNwbGF5OmJsb2NrIWltcG9ydGFudDtoZWlnaHQ6MTAwJSFpbXBvcnRhbnQ7bWFyZ2luOjAhaW1wb3J0YW50O3BhZGRpbmc6MCFpbXBvcnRhbnQ7b3ZlcmZsb3c6aGlkZGVuIWltcG9ydGFudDt3aWR0aDoxMDAlIWltcG9ydGFudH1hbXAtc3Rvcnlbc3RhbmRhbG9uZV17YmFja2dyb3VuZC1jb2xvcjojMjAyMTI1IWltcG9ydGFudDtwb3NpdGlvbjpyZWxhdGl2ZSFpbXBvcnRhbnR9YW1wLXN0b3J5LXBhZ2V7YmFja2dyb3VuZC1jb2xvcjojNzU3NTc1fWFtcC1zdG9yeSAuYW1wLWFjdGl2ZT5kaXYsYW1wLXN0b3J5IC5pLWFtcGh0bWwtbG9hZGVyLWJhY2tncm91bmR7ZGlzcGxheTpub25lIWltcG9ydGFudH1hbXAtc3RvcnktcGFnZTpub3QoOmZpcnN0LW9mLXR5cGUpOm5vdChbZGlzdGFuY2VdKTpub3QoW2FjdGl2ZV0pe3RyYW5zZm9ybTp0cmFuc2xhdGVZKDEwMDB2aCkhaW1wb3J0YW50fWFtcC1hdXRvY29tcGxldGV7cG9zaXRpb246cmVsYXRpdmUhaW1wb3J0YW50O2Rpc3BsYXk6aW5saW5lLWJsb2NrIWltcG9ydGFudH1hbXAtYXV0b2NvbXBsZXRlPmlucHV0LGFtcC1hdXRvY29tcGxldGU%2BdGV4dGFyZWF7cGFkZGluZzowLjVyZW07Ym9yZGVyOjFweCBzb2xpZCByZ2JhKDAsMCwwLDAuMzMpfS5pLWFtcGh0bWwtYXV0b2NvbXBsZXRlLXJlc3VsdHMsYW1wLWF1dG9jb21wbGV0ZT5pbnB1dCxhbXAtYXV0b2NvbXBsZXRlPnRleHRhcmVhe2ZvbnQtc2l6ZToxcmVtO2xpbmUtaGVpZ2h0OjEuNXJlbX1bYW1wLWZ4Xj1mbHktaW5de3Zpc2liaWxpdHk6aGlkZGVufWFtcC1zY3JpcHRbbm9kb21de3Bvc2l0aW9uOmZpeGVkIWltcG9ydGFudDt0b3A6MCFpbXBvcnRhbnQ7d2lkdGg6MXB4IWltcG9ydGFudDtoZWlnaHQ6MXB4IWltcG9ydGFudDtvdmVyZmxvdzpoaWRkZW4haW1wb3J0YW50O3Zpc2liaWxpdHk6aGlkZGVufVxuLyojIHNvdXJjZVVSTD0vY3NzL2FtcGRvYy5jc3MqL1toaWRkZW5de2Rpc3BsYXk6bm9uZSFpbXBvcnRhbnR9LmktYW1waHRtbC1lbGVtZW50e2Rpc3BsYXk6aW5saW5lLWJsb2NrfS5pLWFtcGh0bWwtYmx1cnJ5LXBsYWNlaG9sZGVye3RyYW5zaXRpb246b3BhY2l0eSAwLjNzIGN1YmljLWJlemllcigwLjAsMC4wLDAuMiwxKSFpbXBvcnRhbnQ7cG9pbnRlci1ldmVudHM6bm9uZX1bbGF5b3V0PW5vZGlzcGxheV06bm90KC5pLWFtcGh0bWwtZWxlbWVudCl7ZGlzcGxheTpub25lIWltcG9ydGFudH0uaS1hbXBodG1sLWxheW91dC1maXhlZCxbbGF5b3V0PWZpeGVkXVt3aWR0aF1baGVpZ2h0XTpub3QoLmktYW1waHRtbC1sYXlvdXQtZml4ZWQpe2Rpc3BsYXk6aW5saW5lLWJsb2NrO3Bvc2l0aW9uOnJlbGF0aXZlfS5pLWFtcGh0bWwtbGF5b3V0LXJlc3BvbnNpdmUsW2xheW91dD1yZXNwb25zaXZlXVt3aWR0aF1baGVpZ2h0XTpub3QoLmktYW1waHRtbC1sYXlvdXQtcmVzcG9uc2l2ZSksW3dpZHRoXVtoZWlnaHRdW2hlaWdodHNdOm5vdChbbGF5b3V0XSk6bm90KC5pLWFtcGh0bWwtbGF5b3V0LXJlc3BvbnNpdmUpLFt3aWR0aF1baGVpZ2h0XVtzaXplc106bm90KFtsYXlvdXRdKTpub3QoLmktYW1waHRtbC1sYXlvdXQtcmVzcG9uc2l2ZSl7ZGlzcGxheTpibG9jaztwb3NpdGlvbjpyZWxhdGl2ZX0uaS1hbXBodG1sLWxheW91dC1pbnRyaW5zaWMsW2xheW91dD1pbnRyaW5zaWNdW3dpZHRoXVtoZWlnaHRdOm5vdCguaS1hbXBodG1sLWxheW91dC1pbnRyaW5zaWMpe2Rpc3BsYXk6aW5saW5lLWJsb2NrO3Bvc2l0aW9uOnJlbGF0aXZlO21heC13aWR0aDoxMDAlfS5pLWFtcGh0bWwtbGF5b3V0LWludHJpbnNpYyAuaS1hbXBodG1sLXNpemVye21heC13aWR0aDoxMDAlfS5pLWFtcGh0bWwtaW50cmluc2ljLXNpemVye21heC13aWR0aDoxMDAlO2Rpc3BsYXk6YmxvY2shaW1wb3J0YW50fS5pLWFtcGh0bWwtbGF5b3V0LWNvbnRhaW5lci&i=1-8&t=adltag_kevkyyx2_N28l834c9R&r=1c031d4bd52aedf9e7995ea20454bf9&c=math-aids-threatpost&z=1
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/b-9a4f7ce-a7f6098c.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.84.156.60 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-84-156-60.txl52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Wed, 09 Sep 2020 03:19:23 GMT
via: 1.1 5cf5bc69324ade55eebb5e539fa6c2fa.cloudfront.net (CloudFront)
age: 46348
x-cache: Error from cloudfront
status: 200
content-length: 0
last-modified: Mon, 15 Jun 2020 18:35:10 GMT
server: AmazonS3
etag: "d41d8cd98f00b204e9800998ecf8427e"
access-control-max-age: 3000
access-control-allow-methods: GET
x-amz-version-id: D2POxJleIt92FyXaxSi7iRHuNLtujALh
access-control-allow-origin: *
x-amz-cf-pop: TXL52-C1
accept-ranges: bytes
content-type: text/plain
x-amz-cf-id: wUA_bxm2MceXMMz_R47Vh4_QEZDNinxrv-WUerqohILV8OG5c3w6EA==

POST
H2 200 tag
math-aids-threatpost-tagan.adlightning.com/ 0
427 B 118ms
42ms Other
text/plain 99.84.156.60
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://math-aids-threatpost-tagan.adlightning.com/tag?s=bl&d=wuaS1hbXBodG1sLWxheW91dC1maXhlZC1oZWlnaHQsW2xheW91dD1jb250YWluZXJdLFtsYXlvdXQ9Zml4ZWQtaGVpZ2h0XVtoZWlnaHRdOm5vdCguaS1hbXBodG1sLWxheW91dC1maXhlZC1oZWlnaHQpe2Rpc3BsYXk6YmxvY2s7cG9zaXRpb246cmVsYXRpdmV9LmktYW1waHRtbC1sYXlvdXQtZmlsbCxbbGF5b3V0PWZpbGxdOm5vdCguaS1hbXBodG1sLWxheW91dC1maWxsKXtkaXNwbGF5OmJsb2NrO292ZXJmbG93OmhpZGRlbiFpbXBvcnRhbnQ7cG9zaXRpb246YWJzb2x1dGU7dG9wOjA7bGVmdDowO2JvdHRvbTowO3JpZ2h0OjB9LmktYW1waHRtbC1sYXlvdXQtZmxleC1pdGVtLFtsYXlvdXQ9ZmxleC1pdGVtXTpub3QoLmktYW1waHRtbC1sYXlvdXQtZmxleC1pdGVtKXtkaXNwbGF5OmJsb2NrO3Bvc2l0aW9uOnJlbGF0aXZlOy1tcy1mbGV4OjEgMSBhdXRvO2ZsZXg6MSAxIGF1dG99LmktYW1waHRtbC1sYXlvdXQtZmx1aWR7cG9zaXRpb246cmVsYXRpdmV9LmktYW1waHRtbC1sYXlvdXQtc2l6ZS1kZWZpbmVke292ZXJmbG93OmhpZGRlbiFpbXBvcnRhbnR9LmktYW1waHRtbC1sYXlvdXQtYXdhaXRpbmctc2l6ZXtwb3NpdGlvbjphYnNvbHV0ZSFpbXBvcnRhbnQ7dG9wOmF1dG8haW1wb3J0YW50O2JvdHRvbTphdXRvIWltcG9ydGFudH1pLWFtcGh0bWwtc2l6ZXJ7ZGlzcGxheTpibG9jayFpbXBvcnRhbnR9LmktYW1waHRtbC1ibHVycnktcGxhY2Vob2xkZXIsLmktYW1waHRtbC1maWxsLWNvbnRlbnR7ZGlzcGxheTpibG9jaztoZWlnaHQ6MDttYXgtaGVpZ2h0OjEwMCU7bWF4LXdpZHRoOjEwMCU7bWluLWhlaWdodDoxMDAlO21pbi13aWR0aDoxMDAlO3dpZHRoOjA7bWFyZ2luOmF1dG99LmktYW1waHRtbC1sYXlvdXQtc2l6ZS1kZWZpbmVkIC5pLWFtcGh0bWwtZmlsbC1jb250ZW50e3Bvc2l0aW9uOmFic29sdXRlO3RvcDowO2xlZnQ6MDtib3R0b206MDtyaWdodDowfS5pLWFtcGh0bWwtcmVwbGFjZWQtY29udGVudCwuaS1hbXBodG1sLXNjcmVlbi1yZWFkZXJ7cGFkZGluZzowIWltcG9ydGFudDtib3JkZXI6bm9uZSFpbXBvcnRhbnR9LmktYW1waHRtbC1zY3JlZW4tcmVhZGVye3Bvc2l0aW9uOmZpeGVkIWltcG9ydGFudDt0b3A6MHB4IWltcG9ydGFudDtsZWZ0OjBweCFpbXBvcnRhbnQ7d2lkdGg6NHB4IWltcG9ydGFudDtoZWlnaHQ6NHB4IWltcG9ydGFudDtvcGFjaXR5OjAhaW1wb3J0YW50O292ZXJmbG93OmhpZGRlbiFpbXBvcnRhbnQ7bWFyZ2luOjAhaW1wb3J0YW50O2Rpc3BsYXk6YmxvY2shaW1wb3J0YW50O3Zpc2liaWxpdHk6dmlzaWJsZSFpbXBvcnRhbnR9LmktYW1waHRtbC1zY3JlZW4tcmVhZGVyfi5pLWFtcGh0bWwtc2NyZWVuLXJlYWRlcntsZWZ0OjhweCFpbXBvcnRhbnR9LmktYW1waHRtbC1zY3JlZW4tcmVhZGVyfi5pLWFtcGh0bWwtc2NyZWVuLXJlYWRlcn4uaS1hbXBodG1sLXNjcmVlbi1yZWFkZXJ7bGVmdDoxMnB4IWltcG9ydGFudH0uaS1hbXBodG1sLXNjcmVlbi1yZWFkZXJ%2BLmktYW1waHRtbC1zY3JlZW4tcmVhZGVyfi5pLWFtcGh0bWwtc2NyZWVuLXJlYWRlcn4uaS1hbXBodG1sLXNjcmVlbi1yZWFkZXJ7bGVmdDoxNnB4IWltcG9ydGFudH0uaS1hbXBodG1sLXVucmVzb2x2ZWR7cG9zaXRpb246cmVsYXRpdmU7b3ZlcmZsb3c6aGlkZGVuIWltcG9ydGFudH0uaS1hbXBodG1sLXNlbGVjdC1kaXNhYmxlZHstd2Via2l0LXVzZXItc2VsZWN0Om5vbmUhaW1wb3J0YW50Oy1tb3otdXNlci1zZWxlY3Q6bm9uZSFpbXBvcnRhbnQ7LW1zLXVzZXItc2VsZWN0Om5vbmUhaW1wb3J0YW50O3VzZXItc2VsZWN0Om5vbmUhaW1wb3J0YW50fS5pLWFtcGh0bWwtbm90YnVpbHQsW2xheW91dF06bm90KC5pLWFtcGh0bWwtZWxlbWVudCksW3dpZHRoXVtoZWlnaHRdW2hlaWdodHNdOm5vdChbbGF5b3V0XSk6bm90KC5pLWFtcGh0bWwtZWxlbWVudCksW3dpZHRoXVtoZWlnaHRdW3NpemVzXTpub3QoW2xheW91dF0pOm5vdCguaS1hbXBodG1sLWVsZW1lbnQpe3Bvc2l0aW9uOnJlbGF0aXZlO292ZXJmbG93OmhpZGRlbiFpbXBvcnRhbnQ7Y29sb3I6dHJhbnNwYXJlbnQhaW1wb3J0YW50fS5pLWFtcGh0bWwtbm90YnVpbHQ6bm90KC5pLWFtcGh0bWwtbGF5b3V0LWNvbnRhaW5lcik%2BKixbbGF5b3V0XTpub3QoW2xheW91dD1jb250YWluZXJdKTpub3QoLmktYW1waHRtbC1lbGVtZW50KT4qLFt3aWR0aF1baGVpZ2h0XVtoZWlnaHRzXTpub3QoW2xheW91dF0pOm5vdCguaS1hbXBodG1sLWVsZW1lbnQpPiosW3dpZHRoXVtoZWlnaHRdW3NpemVzXTpub3QoW2xheW91dF0pOm5vdCguaS1hbXBodG1sLWVsZW1lbnQpPip7ZGlzcGxheTpub25lfS5pLWFtcGh0bWwtbm90YnVpbHQ6bm90KC5pLWFtcGh0bWwtbGF5b3V0LWNvbnRhaW5lciksW2xheW91dF06bm90KFtsYXlvdXQ9Y29udGFpbmVyXSk6bm90KC5pLWFtcGh0bWwtZWxlbWVudCksW3dpZHRoXVtoZWlnaHRdW2hlaWdodHNdOm5vdChbbGF5b3V0XSk6bm90KC5pLWFtcGh0bWwtZWxlbWVudCksW3dpZHRoXVtoZWlnaHRdW3NpemVzXTpub3QoW2xheW91dF0pOm5vdCguaS1hbXBodG1sLWVsZW1lbnQpe2NvbG9yOnRyYW5zcGFyZW50IWltcG9ydGFudDtsaW5lLWhlaWdodDowIWltcG9ydGFudH0uaS1hbXBodG1sLWdob3N0e3Zpc2liaWxpdHk6aGlkZGVuIWltcG9ydGFudH0uaS1hbXBodG1sLWVsZW1lbnQ%2BW3BsYWNlaG9sZGVyXSxbbGF5b3V0XTpub3QoLmktYW1waHRtbC1lbGVtZW50KT5bcGxhY2Vob2xkZXJdLFt3aWR0aF1baGVpZ2h0XVtoZWlnaHRzXTpub3QoW2xheW91dF0pOm5vdCguaS1hbXBodG1sLWVsZW1lbnQpPltwbGFjZWhvbGRlcl0sW3dpZHRoXVtoZWlnaHRdW3NpemVzXTpub3QoW2xheW91dF0pOm5vdCguaS1hbXBodG1sLWVsZW1lbnQpPltwbGFjZWhvbGRlcl17ZGlzcGxheTpibG9ja30uaS1hbXBodG1sLWVsZW1lbnQ%2BW3BsYWNlaG9sZGVyXS5hbXAtaGlkZGVuLC5pLWFtcGh0bWwtZWxlbWVudD5bcGxhY2Vob2xkZXJdLmhpZGRlbnt2aXNpYmlsaXR5OmhpZGRlbn0uaS1hbXBodG1sLWVsZW1lbnQ6bm90KC5hbXAtbm90c3VwcG9ydGVkKT5bZmFsbGJhY2tdLC5pLWFtcGh0bWwtbGF5b3V0LWNvbnRhaW5lcj5bcGxhY2Vob2xkZXJdLmFtcC1oaWRkZW4sLmktYW1waHRtbC1sYXlvdXQtY29udGFpbmVyPltwbGFjZWhvbGRlcl0uaGlkZGVue2Rpc3BsYXk6bm9uZX0uaS1hbXBodG1sLWxheW91dC1zaXplLWRlZmluZWQ%2BW2ZhbGxiYWNrXSwuaS1hbXBodG1sLWxheW91dC1zaXplLWRlZmluZWQ%2BW3BsYWNlaG9sZGVyXXtwb3NpdGlvbjphYnNvbHV0ZSFpbXBvcnRhbnQ7dG9wOjAhaW1wb3J0YW50O2xlZnQ6MCFpbXBvcnRhbnQ7cmlnaHQ6MCFpbXBvcnRhbnQ7Ym90dG9tOjAhaW1wb3J0YW50O3otaW5kZXg6MX0uaS1hbXBodG1sLW5vdGJ1aWx0PltwbGFjZWhvbGRlcl17ZGlzcGxheTpibG9jayFpbXBvcnRhbnR9LmktYW1waHRtbC1oaWRkZW4tYnktbWVkaWEtcXVlcnl7ZGlzcGxheTpub25lIWltcG9ydGFudH0uaS1hbXBodG1sLWVsZW1lbnQtZXJyb3J7YmFja2dyb3VuZDpyZWQhaW1wb3J0YW50O2NvbG9yOiNmZmYhaW1wb3J0YW50O3Bvc2l0aW9uOnJlbGF0aXZlIWltcG9ydGFudH0uaS1hbXBodG1sLWVsZW1lbnQtZXJyb3I6YmVmb3Jle2NvbnRlbnQ6YXR0cihlcnJvci1tZXNzYWdlKX1pLWFtcC1zY3JvbGwtY29udGFpbmVyLGktYW1waHRtbC1zY3JvbGwtY29udGFpbmVye3Bvc2l0aW9uOmFic29sdXRlO3RvcDowO2xlZnQ6MDtyaWdodDowO2JvdHRvbTowO2Rpc3BsYXk6YmxvY2t9aS1hbXAtc2Nyb2xsLWNvbnRhaW5lci5hbXAtYWN0aXZlLGktYW1waHRtbC1zY3JvbGwtY29udGFpbmVyLmFtcC1hY3RpdmV7b3ZlcmZsb3c6YXV0bzstd2Via2l0LW92ZXJmbG93LXNjcm9sbGluZzp0b3VjaH0uaS1hbXBodG1sLWxvYWRpbmctY29udGFpbmVye2Rpc3BsYXk6YmxvY2shaW1wb3J0YW50O3BvaW50ZXItZXZlbnRzOm5vbmU7ei1pbmRleDoxfS5pLWFtcGh0bWwtbm90YnVpbHQ%2BLmktYW1waHRtbC1sb2FkaW5nLWNvbnRhaW5lcntkaXNwbGF5OmJsb2NrIWltcG9ydGFudH0uaS1hbXBodG1sLWxvYWRpbmctY29udGFpbmVyLmFtcC1oaWRkZW57dmlzaWJpbGl0eTpoaWRkZW59LmktYW1waHRtbC1lbGVtZW50PltvdmVyZmxvd117Y3Vyc29yOnBvaW50ZXI7cG9zaXRpb246cmVsYXRpdmU7ei1pbmRleDoyO3Zpc2liaWxpdHk6aGlkZGVuO2Rpc3BsYXk6aW5pdGlhbDtsaW5lLWhlaWdodDpub3JtYWx9LmktYW1waHRtbC1lbGVtZW50PltvdmVyZmxvd10uYW1wLXZpc2libGV7dmlzaWJpbGl0eTp2aXNpYmxlfXRlbXBsYXRle2Rpc3BsYXk6bm9uZSFpbXBvcnRhbnR9LmFtcC1ib3JkZXItYm94LC5hbXAtYm9yZGVyLWJveCAqLC5hbXAtYm9yZGVyLWJveCA6YWZ0ZXIsLmFtcC1ib3JkZXItYm94IDpiZWZvcmV7Ym94LXNpemluZzpib3JkZXItYm94fWFtcC1waXhlbHtkaXNwbGF5Om5vbmUhaW1wb3J0YW50fWFtcC1hbmFseXRpY3MsYW1wLWF1dG8tYWRzLGFtcC1zdG9yeS1hdXRvLWFkc3twb3NpdGlvbjpmaXhlZCFpbXBvcnRhbnQ7dG9wOjAhaW1wb3J0YW50O3dpZHRoOjFweCFpbXBvcnRhbnQ7aGVpZ2h0OjFweCFpbXBvcnRhbnQ7b3ZlcmZsb3c6aGlkZGVuIWltcG9ydGFudDt2aXNpYmlsaXR5OmhpZGRlbn1odG1sLmktYW1waHRtbC1maWU%2BYW1wLWFuYWx5dGljc3twb3NpdGlvbjppbml0aWFsIWltcG9ydGFudH1bdmlzaWJsZS13aGVuLWludmFsaWRdOm5vdCgudmlzaWJsZSksZm9ybSBbc3VibWl0LWVycm9yXSxmb3JtIFtzdWJtaXQtc3VjY2Vzc10sZm9ybSBbc3VibWl0dGluZ117ZGlzcGxheTpub25lfWFtcC1hY2NvcmRpb257ZGlzcGxheTpibG9jayFpbXBvcnRhbnR9YW1wLWFjY29yZGlvbj5zZWN0aW9ue2Zsb2F0Om5vbmUhaW1wb3J0YW50fWFtcC1hY2NvcmRpb24%2Bc2VjdGlvbj4qe2Zsb2F0Om5vbmUhaW1wb3J0YW50O2Rpc3BsYXk6YmxvY2shaW1wb3J0YW50O292ZXJmbG93OmhpZGRlbiFpbXBvcnRhbnQ7cG9zaXRpb246cmVsYXRpdmUhaW1wb3J0YW50fWFtcC1hY2NvcmRpb24sYW1wLWFjY29yZGlvbj5zZWN0aW9ue21hcmdpbjowfWFtcC1hY2NvcmRpb24%2Bc2VjdGlvbj46bGFzdC1jaGlsZHtkaXNwbGF5Om5vbmUhaW1wb3J0YW50fWFtcC1hY2NvcmRpb24%2Bc2VjdGlvbltleHBhbmRlZF0%2BOmxhc3QtY2hpbGR7ZGlzcGxheTpibG9jayFpbXBvcnRhbnR9XG4vKiMgc291cmNlVVJMPS9jc3MvYW1wc2hhcmVkLmNzcyovaHRtbC5pLWFtcGh0bWwtaW5hYm94e3dpZHRoOjEwMCUhaW1wb3J0YW50O2hlaWdodDoxMDAlIWltcG9ydGFudH1odG1sLmktYW1waHRtbC1pbmFib3g%2BYm9keXtwb3NpdGlvbjppbml0aWFsIWltcG9ydGFudH08L3N0eWxlPjxtZXRhIGNvbnRlbnQ9XCJ3aWR0aD1kZXZpY2Utd2lkdGgsbWluaW11bS1zY2FsZT0xLGluaXRpYWwtc2NhbGU9MVwiIG5hbWU9dmlld3BvcnQ%2BPG1ldGEgY29udGVudD1cInZlbmRvcj1kb3VibGVjbGljayx0eXBlPWltcHJlc3Npb24taWQsdmFsdWU9Q0pPWWhxeTczT3NDRlpRSWl3b2R3Y2NGZ0FcIiBuYW1lPWFtcDRhZHMtaWQ%2BPGxpbmsgYXM9c2NyaXB0IGhyZWY9aHR0cHM6Ly9jZG4uYW1wcHJvamVjdC5vcmcvcnR2LzAxMjAwODI0MjMwMTAwMC9hbXA0YWRzLXYwLmpzIHJlbD1wcmVsb2FkPjxzY3JpcHQgYXN5bmMgc3JjPWh0dHBzOi8vY2RuLmFtcHByb2plY3Qub3JnL3J0di8wMTIwMDgyNDIzMDEwMDAvYW1wNGFkcy12MC5qcz48L3NjcmlwdD48c2NyaXB0IGFzeW5jIGN1c3RvbS1lbGVtZW50PWFtcC1hZC1leGl0IHNyYz1odHRwczovL2Nkbi5hbXBwcm9qZWN0Lm9yZy9ydHYvMDEyMDA4MjQyMzAxMDAwL3YwL2FtcC1hZC1leGl0LTAuMS5qcz48L3NjcmlwdD48c2NyaXB0IGFzeW5jIGN1c3RvbS1lbGVtZW50PWFtcC1hbmFseXRpY3Mgc3JjPWh0dHBzOi8vY2RuLmFtcHByb2plY3Qub3JnL3J0di8wMTIwMDgyNDIzMDEwMDAvdjAvYW1wLWFuYWx5dGljcy0wLjEuanM%2BPC9zY3JpcHQ%2BPHNjcmlwdCBhc3luYyBjdXN0b20tZWxlbWVudD1hbXAtZml0LXRleHQgc3JjPWh0dHBzOi8vY2RuLmFtcHByb2pl&i=2-8&t=adltag_kevkyyx2_N28l834c9R&r=1c031d4bd52aedf9e7995ea20454bf9&c=math-aids-threatpost&z=1
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/b-9a4f7ce-a7f6098c.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.84.156.60 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-84-156-60.txl52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Wed, 09 Sep 2020 03:19:23 GMT
via: 1.1 5cf5bc69324ade55eebb5e539fa6c2fa.cloudfront.net (CloudFront)
age: 46348
x-cache: Error from cloudfront
status: 200
content-length: 0
last-modified: Mon, 15 Jun 2020 18:35:10 GMT
server: AmazonS3
etag: "d41d8cd98f00b204e9800998ecf8427e"
access-control-max-age: 3000
access-control-allow-methods: GET
x-amz-version-id: D2POxJleIt92FyXaxSi7iRHuNLtujALh
access-control-allow-origin: *
x-amz-cf-pop: TXL52-C1
accept-ranges: bytes
content-type: text/plain
x-amz-cf-id: ZdBw1m9q7Gs9uZWSuBOGi_wOFSiHUN4Ljm2j_occZ6lID4447apv9g==

POST
H2 200 tag
math-aids-threatpost-tagan.adlightning.com/ 0
427 B 120ms
45ms Other
text/plain 99.84.156.60
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://math-aids-threatpost-tagan.adlightning.com/tag?s=bl&d=Y3Qub3JnL3J0di8wMTIwMDgyNDIzMDEwMDAvdjAvYW1wLWZpdC10ZXh0LTAuMS5qcz48L3NjcmlwdD48c2NyaXB0IGFzeW5jIGN1c3RvbS1lbGVtZW50PWFtcC1mb3JtIHNyYz1odHRwczovL2Nkbi5hbXBwcm9qZWN0Lm9yZy9ydHYvMDEyMDA4MjQyMzAxMDAwL3YwL2FtcC1mb3JtLTAuMS5qcz48L3NjcmlwdD48c3R5bGUgYW1wLWN1c3RvbT5hIHsgY29sb3I6ICMwMDAwMDAgfWJvZHkgeyBtYXJnaW46IDA7IGJhY2tncm91bmQ6IHRyYW5zcGFyZW50OyB9I2dvb2dsZV9pbWFnZV9kaXYge2hlaWdodDogMjUwcHg7d2lkdGg6IDk3MHB4O292ZXJmbG93OmhpZGRlbjtwb3NpdGlvbjpyZWxhdGl2ZX1odG1sLCBib2R5IHt3aWR0aDoxMDAlO2hlaWdodDoxMDAlO31ib2R5IHtkaXNwbGF5OnRhYmxlO3RleHQtYWxpZ246Y2VudGVyO30jZ29vZ2xlX2NlbnRlcl9kaXYge2Rpc3BsYXk6dGFibGUtY2VsbDt2ZXJ0aWNhbC1hbGlnbjptaWRkbGU7fSNnb29nbGVfaW1hZ2VfZGl2IHtkaXNwbGF5OmlubGluZS1ibG9jazt9LmFiZ2Mge3Bvc2l0aW9uOmFic29sdXRlO3otaW5kZXg6MjE0NzQ4MzY0NjtyaWdodDowO3RvcDowO30uYWJnYyBhbXAtaW1nLCAuYWJnYyBpbWcge2Rpc3BsYXk6YmxvY2s7fS5hYmdzIHtwb3NpdGlvbjphYnNvbHV0ZTstd2Via2l0LXRyYW5zZm9ybTp0cmFuc2xhdGVYKDc2cHgpO3RyYW5zZm9ybTp0cmFuc2xhdGVYKDc2cHgpO3JpZ2h0OjE2cHg7dG9wOjA7fS5hYmdjcCB7cG9zaXRpb246YWJzb2x1dGU7cmlnaHQ6MDt0b3A6MDt3aWR0aDozMXB4O2hlaWdodDoxNXB4O3BhZGRpbmctbGVmdDoxMHB4O3BhZGRpbmctYm90dG9tOjEwcHg7fS5hYmdiIHtwb3NpdGlvbjpyZWxhdGl2ZTttYXJnaW4tcmlnaHQ6MTZweDt0b3A6MDt9LmFiZ2M6aG92ZXIgLmFiZ3Mgey13ZWJraXQtdHJhbnNmb3JtOm5vbmU7dHJhbnNmb3JtOm5vbmU7fS5jYmIge2Rpc3BsYXk6IGJsb2NrO3Bvc2l0aW9uOiBhYnNvbHV0ZTtyaWdodDowO3RvcDowO2N1cnNvcjogcG9pbnRlcjtoZWlnaHQ6IDE1cHg7d2lkdGg6IDE1cHg7ei1pbmRleDogOTAyMDtwYWRkaW5nLWxlZnQ6MTZweDt9LmJ0biB7ZGlzcGxheTogaW5saW5lLWJsb2NrO2JvcmRlci1yYWRpdXM6IDJweDstbW96LWJveC1zaXppbmc6IGJvcmRlci1ib3g7LXdlYmtpdC1ib3gtc2l6aW5nOiBib3JkZXItYm94O2JveC1zaXppbmc6IGJvcmRlci1ib3g7Ym94LXNoYWRvdzogMHB4IDBweCAycHggcmdiYSgwLDAsMCwwLjEyKSwgMHB4IDFweCAzcHggcmdiYSgwLDAsMCwwLjI2KTtjdXJzb3I6IHBvaW50ZXI7Zm9udC1zaXplOiAwLjdlbTttYXJnaW46IDAgMXB4IDAuNGVtIDFweDt9QG1lZGlhIChtYXgtd2lkdGg6IDM3NXB4KSBhbmQgKG1pbi1oZWlnaHQ6IDEwMHB4KSB7LmJ0biB7ZGlzcGxheTogYmxvY2s7d2lkdGg6IDkwJTttYXgtd2lkdGg6IDI0MHB4O21hcmdpbi1sZWZ0OiBhdXRvO21hcmdpbi1yaWdodDogYXV0bzt9fSNzcHYxIGFtcC1maXQtdGV4dD5kaXYgey13ZWJraXQtanVzdGlmeS1jb250ZW50OiBmbGV4LXN0YXJ0O2p1c3RpZnktY29udGVudDogZmxleC1zdGFydDt9LmptLnNoICNzcHYxIGFtcC1maXQtdGV4dD5kaXYgey13ZWJraXQtanVzdGlmeS1jb250ZW50OiBjZW50ZXI7anVzdGlmeS1jb250ZW50OiBjZW50ZXI7fS5qdCAucG4gYW1wLWZpdC10ZXh0PmRpdiB7LXdlYmtpdC1qdXN0aWZ5LWNvbnRlbnQ6IGZsZXgtc3RhcnQ7anVzdGlmeS1jb250ZW50OiBmbGV4LXN0YXJ0O30uYnRuID4gc3BhbiB7ZGlzcGxheTogaW5saW5lLWJsb2NrO3BhZGRpbmc6IDAuNWVtIDAuNmVtO2xpbmUtaGVpZ2h0OiAxZW07fSNzYnRuIHtiYWNrZ3JvdW5kLWNvbG9yOiAjRkZGRkZGO2NvbG9yOiAjOUU5RUE2O3RleHQtZGVjb3JhdGlvbjogbm9uZTt9I3NidG46aG92ZXIsI3NidG46YWN0aXZlIHtiYWNrZ3JvdW5kLWNvbG9yOiAjRjVGNUY1O30jcmJ0biB7YmFja2dyb3VuZC1jb2xvcjogcmdiKDY2LDEzMywyNDUpO2NvbG9yOiB3aGl0ZTt9I3JidG46aG92ZXIsI3JidG46YWN0aXZlIHtiYWNrZ3JvdW5kLWNvbG9yOiAjMzI3NUU1O30jbXRhIHtwb3NpdGlvbjphYnNvbHV0ZTt0b3A6IDA7bGVmdDogMDtmb250LWZhbWlseTogQXJpYWwsIHNhbnMtc2VyaWY7Zm9udC1zaXplOiAxMnB4O2ZvbnQtd2VpZ2h0OiA0MDA7bGluZS1oZWlnaHQ6IDFlbTt9I210YSBpbnB1dFt0eXBlPVwicmFkaW9cIl0ge2Rpc3BsYXk6IG5vbmU7fSNtdGEgLnBuIHtyaWdodDogLTk3MHB4O3RvcDogLTI1MHB4O3dpZHRoOjk3MHB4O2hlaWdodDoyNTBweDtwb3NpdGlvbjogYWJzb2x1dGU7LW1vei1ib3gtc2l6aW5nOiBib3JkZXItYm94Oy13ZWJraXQtYm94LXNpemluZzogYm9yZGVyLWJveDtib3gtc2l6aW5nOiBib3JkZXItYm94O2JhY2tncm91bmQtY29sb3I6ICNGQUZBRkE7dGV4dC1hbGlnbjogY2VudGVyO30jc3B2MiB7ZGlzcGxheTogLXdlYmtpdC1mbGV4O2Rpc3BsYXk6IGZsZXg7LXdlYmtpdC1qdXN0aWZ5LWNvbnRlbnQ6IGZsZXgtc3RhcnQ7anVzdGlmeS1jb250ZW50OiBmbGV4LXN0YXJ0Oy13ZWJraXQtZmxleC13cmFwOiBub3dyYXA7ZmxleC13cmFwOiBub3dyYXA7b3ZlcmZsb3c6IGhpZGRlbjtiYWNrZ3JvdW5kLWNvbG9yOiAjRkFGQUZBO2ZvbnQtc2l6ZTogMDt9LnNoICNzcHYyIHstd2Via2l0LWZsZXgtZGlyZWN0aW9uOiByb3c7ZmxleC1kaXJlY3Rpb246IHJvdzstd2Via2l0LWp1c3RpZnktY29udGVudDogY2VudGVyO2p1c3RpZnktY29udGVudDogY2VudGVyO30uc2guc3IgI3NwdjIgey13ZWJraXQtanVzdGlmeS1jb250ZW50OiBmbGV4LXN0YXJ0O2p1c3RpZnktY29udGVudDogZmxleC1zdGFydDt9Lmp0LnN2ICNzcHYyIHstd2Via2l0LWp1c3RpZnktY29udGVudDogZmxleC1zdGFydDtqdXN0aWZ5LWNvbnRlbnQ6IGZsZXgtc3RhcnQ7LXdlYmtpdC1hbGlnbi1pdGVtczogY2VudGVyO2FsaWduLWl0ZW1zOiBjZW50ZXI7fSNzcHYyICogey1tb3otYm94LXNpemluZzogYm9yZGVyLWJveDstd2Via2l0LWJveC1zaXppbmc6IGJvcmRlci1ib3g7Ym94LXNpemluZzogYm9yZGVyLWJveDt9I3NwcjE6Y2hlY2tlZCB%2BICNjYmIsI3NwcjI6Y2hlY2tlZCB%2BICNjYmIsI3NwcjM6Y2hlY2tlZCB%2BICNjYmJ7ZGlzcGxheTogbm9uZTt9I3NwdjMge29wYWNpdHk6MTt9LmFtcC1hbmltYXRlICNzcHY0IHtvcGFjaXR5OjA7dHJhbnNpdGlvbjogb3BhY2l0eSAwLjVzIGxpbmVhciAyLjVzO30uYW1wLWFuaW1hdGUgICNzcHYzIGFtcC1maXQtdGV4dCB7b3BhY2l0eToxO3RyYW5zaXRpb246IG9wYWNpdHkgMC41cyBsaW5lYXIgMnM7fSNzcHIzOmNoZWNrZWQgfiAjc3B2MyBhbXAtZml0LXRleHQge29wYWNpdHk6MH0jc3ByMzpjaGVja2VkIH4gI3NwdjQge29wYWNpdHk6MTt9I3NwcjE6Y2hlY2tlZCB%2BICNzcHYxLCNzcHIyOmNoZWNrZWQgfiAjc3B2Miwjc3ByMzpjaGVja2VkIH4gI3NwdjMsI3NwcjM6Y2hlY2tlZCB%2BICNzcHY0e3JpZ2h0OiAwcHg7dG9wOiAwcHg7fS5jbG9zZSB7cG9zaXRpb246IGFic29sdXRlO3RvcDogMnB4O2NvbG9yOiBibGFjaztmb250LXNpemU6IDE1cHg7bGluZS1oZWlnaHQ6IDE1cHg7b3BhY2l0eTogMC41O2hlaWdodDogMTVweDt3aWR0aDogMTVweDt1c2VyLXNlbGVjdDogbm9uZTtjdXJzb3I6IHBvaW50ZXI7fVtkaXI9XCJydGxcIl0gLmNsb3NlIHt0cmFuc2Zvcm06IHNjYWxlWCgtMSk7fS5jdCBzdmcge2JvcmRlcjogMDttYXJnaW46IDAgMCAtMC40NWVtIDA7ZGlzcGxheTogaW5saW5lLWJsb2NrO2hlaWdodDogMS4zOGVtO29wYWNpdHk6IDAuNDt9LmN0IHtkaXNwbGF5OiBpbmxpbmUtYmxvY2s7bGluZS1oZWlnaHQ6IDEuMjhlbTtjb2xvcjogcmdiYSgwLDAsMCwwLjQpO3RleHQtYWxpZ246Y2VudGVyO3BhZGRpbmc6IDAuM2VtO30uZmN0IHtwYWRkaW5nOiAxZW07fSNwY3Qge2Rpc3BsYXk6IGJsb2NrO2ZvbnQtd2VpZ2h0OiBib2xkO3BhZGRpbmc6IDFlbSAwLjNlbTt9I3RpIHt3aWR0aDogOTcwcHg7fSNidG5zIHt3aWR0aDogOTcwcHg7fS5mbCB7d2lkdGg6IDk3MHB4O2hlaWdodDoyNTBweDt9I3NpIHtwb3NpdGlvbjogcmVsYXRpdmU7ZGlzcGxheTogaW5saW5lLWJsb2NrO21hcmdpbi1ib3R0b206IC0wLjE1ZW07aGVpZ2h0OiAxZW07d2lkdGg6IDFlbTtvcGFjaXR5OiAwLjQ7fS5zYiB7ZmxleC1zaHJpbms6IDA7aGVpZ2h0OiA1MHB4O30uc28ge3Bvc2l0aW9uOiByZWxhdGl2ZTt6LWluZGV4OiA5MTEwO292ZXJmbG93OiBoaWRkZW47ZGlzcGxheTogaW5saW5lLWJsb2NrO3BhZGRpbmc6IDFweCA1cHg7d2lkdGg6IDk2cHg7aGVpZ2h0OiA1MHB4O2JvcmRlcjogMXB4IHNvbGlkICNFMEUwRTA7YmFja2dyb3VuZC1jb2xvcjogI0ZGRkZGRjtjdXJzb3I6IHBvaW50ZXI7fS5zbzpob3Zlciwuc286YWN0aXZlIHtiYWNrZ3JvdW5kLWNvbG9yOiAjRjVGNUY1O30uc28gZGl2IHtkaXNwbGF5OiAtd2Via2l0LWZsZXg7ZGlzcGxheTogZmxleDstd2Via2l0LWFsaWduLWl0ZW1zOiBjZW50ZXI7YWxpZ24taXRlbXM6IGNlbnRlcjstd2Via2l0LWp1c3RpZnktY29udGVudDogY2VudGVyO2p1c3RpZnktY29udGVudDogY2VudGVyO3dpZHRoOiAxMDAlO2hlaWdodDogMTAwJTt9LnNvIHNwYW4ge2NvbG9yOiAjNDI4NUY0O2ZvbnQtZmFtaWx5OiBBcmlhbCwgc2Fucy1zZXJpZjt0ZXh0LWFsaWduOiBjZW50ZXI7Zm9udC1zaXplOiAxMnB4O2xpbmUtaGVpZ2h0OiAxNHB4O3doaXRlLXNwYWNlOiBub3JtYWw7fUBtZWRpYSAobWluLWhlaWdodDogNTRweCkgey5zaC5zcyAuc28sLnN2IC5zbyB7Ym94LXNoYWRvdzogMHB4IDBweCAycHggcmdiYSgwLDAsMCwwLjEyKSwgMHB4IDFweCAzcHggcmdiYSgwLDAsMCwwLjI2KTtib3JkZXI6IG5vbmU7fX0uc2ggLnNvIHttYXJnaW4tbGVmdDogLTFweDtib3gtc2hhZG93OiBub25lO30uc2ggLnNvOmZpcnN0LWNoaWxkIHttYXJnaW4tbGVmdDogMDt9LnNoLnNzIC5zbyB7bWFyZ2luLWxlZnQ6IDhweDt9LnNoLnNzIC5zbzpmaXJzdC1jaGlsZCB7bWFyZ2luLWxlZnQ6IDA7fS5zaC5qdCAuc2Ige21hcmdpbi10b3A6IDhweDt9LnN2IC5zbywuc2guc3MgLnNvIHtib3JkZXItcmFkaXVzOiAycHg7fTwvc3R5bGU%2BPC9oZWFkPjxib2R5IGNsYXNzPWFtcC1hbmltYXRlPjxkaXYgaWQ9Z29vZ2xlX2NlbnRlcl9kaXY%2BPGRpdiBpZD1nb29nbGVfaW1hZ2VfZGl2PjxhIGhyZWY9XCJodHRwczovL2dvb2dsZWFkcy5nLmRvdWJsZWNsaWNrLm5ldC9hY2xrP3NhPWwmYW1wO2FpPUNOYU1oeGY1WVg5T2hJSlNSckFUQmo1ZUFDUGlVMEs5ZHVxQzBqSmtNdi1FZUVBRWcwWWZTSUdDUmhJQ0FfQmVnQWZHRF9aVUR5QUVDNEFJQXFBTUJ5QU1JcWdUX0FVX1E5X3N3TGp4MW1idUkteEdULUJEN2x2YkptWFFQY05xWnhTT1RSRkhiMlphTURpVkdsVU5ReFdJaHIwc3VoaGxOVnUzZHBMNjJ4aWtqMlYydy1kN2dyTXk3SWxKWkxDRDYtZHE0dWJmQ2p5eDFkQmdVVFBSMlFxRUZkRmU3RFh0TmowQWYxMzFPTE9NYUlVMk5Wb01vcklMTDlNSVNBdl84RWxabEh2QUwwb29ucVBGWTVUMHNVMmFlRWxWQTBoOVl5UTJWWGliaGFMSG5IY2NrVHdxbkdVc3ZUNHZRZkhRNUwzSTZZUzU3d3JqX1FfODltbnQ2RndaUXkteF9KaWlGQXJ3TzZXQkE0eElxMGU5N0hMQ0lheEF1QldIeG1fRXhsWGRGQkVVSXBTU295SDNxYTMzdlVKRzd6Z294VFJLU0NlbGdKdTVDOHBla0tnNnQxc0FFcElpUGpiVUM0QVFCb0FZQ2dBZmV3THQ5cUFlT3podW9COVhKRzZnSGs5Z2JxQWU2QnFnSDhOa2JxQWZ5MlJ1b0I2YS1HNmdIN05VYnFBZnowUnVvQi16Vkc2Z0hsdGdicUFmQzJodllCd0hTQ0FrSWdPR0FRQkFCR0IzeUNCdGhaSGd0YzNWaWMzbHVMVGN5TmpNMU56TTBORFk0TURRd056aXhDVkVaRTB2cHJPTGRnQW9EbUFzQnlBc0IyQk1NJmFtcDthZT0xJmFtcDtudW09MSZhbXA7Y2lkPUNBQVNQZVJvT1YtNnBKTE9SRnNhZEp4YUlULWN1WjBuakdYZjh3RWFyc0JqazhQRFM1WnluaDBnTHY3Y3JHUGhvaXIyNUZ0eVh2VnhaRFBBZmszbGhMSSZhbXA7c2lnPUFPRDY0XzJxVWNiaG14cEJQelljZ0hPb2x4cEw2X1ZLdGcmYW1wO2NsaW&i=3-8&t=adltag_kevkyyx2_N28l834c9R&r=1c031d4bd52aedf9e7995ea20454bf9&c=math-aids-threatpost&z=1
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/b-9a4f7ce-a7f6098c.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.84.156.60 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-84-156-60.txl52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Wed, 09 Sep 2020 03:19:23 GMT
via: 1.1 5cf5bc69324ade55eebb5e539fa6c2fa.cloudfront.net (CloudFront)
age: 46348
x-cache: Error from cloudfront
status: 200
content-length: 0
last-modified: Mon, 15 Jun 2020 18:35:10 GMT
server: AmazonS3
etag: "d41d8cd98f00b204e9800998ecf8427e"
access-control-max-age: 3000
access-control-allow-methods: GET
x-amz-version-id: D2POxJleIt92FyXaxSi7iRHuNLtujALh
access-control-allow-origin: *
x-amz-cf-pop: TXL52-C1
accept-ranges: bytes
content-type: text/plain
x-amz-cf-id: ryu2Ford0dvpoJOUsVPmBQ3KhwJ22OBOEpKVbHOgFA2lGzj1xIYGjQ==

POST
H2 200 tag
math-aids-threatpost-tagan.adlightning.com/ 0
428 B 123ms
47ms Other
text/plain 99.84.156.60
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://math-aids-threatpost-tagan.adlightning.com/tag?s=bl&d=VudD1jYS1wdWItOTY4NTczNDQ0NTQ3NjgxNCZhbXA7bng9Q0xJQ0tfWCZhbXA7bnk9Q0xJQ0tfWSZhbXA7bmI9MiZhbXA7YWR1cmw9aHR0cHM6Ly93d3cubmV3Y2hpYy5jb20vdGhlbWUtd29tZW4tdC0zNDA5MDUvJTNGY2xlYW5TcWwlM0QxJTI2dXRtX3NvdXJjZSUzRGdvb2dsZSUyNnV0bV9tZWRpdW0lM0RjcGNfYWRzMiUyNnV0bV9jYW1wYWlnbiUzRGNuZXctd3Mtbi1jbDA5MDUtd29yLWF1MTQtOTclMjZ1dG1fY29udGVudCUzRGxlZXIlMjZ1dG1fZGVzaWduJTNEJTI2YWRfaWQlM0Q0NTY3MDY0NjQ4NzklMjZnY2xpZCUzREVBSWFJUW9iQ2hNSWs1aUdyTHZjNndJVmxBaUxDaDNCeHdXQUVBRVlBU0FBRWdLcC1mRF9Cd0VcIiBpZD1hdzAgb249XCJ0YXA6ZXhpdC1hcGkuZXhpdCh0YXJnZXQ9JiMzOTtsYW5kaW5nUGFnZSYjMzk7LF9uYj0mIzM5OzImIzM5OylcIiB0YXJnZXQ9X2JsYW5rPjxhbXAtaW1nIGFsdCBjbGFzcz1cImltZ19hZCBpLWFtcGh0bWwtbGF5b3V0LWZpeGVkIGktYW1waHRtbC1sYXlvdXQtc2l6ZS1kZWZpbmVkXCIgaGVpZ2h0PTI1MCBpLWFtcGh0bWwtbGF5b3V0PWZpeGVkIGktYW1waHRtbC1zc3Igc3JjPVwiaHR0cHM6Ly90cGMuZ29vZ2xlc3luZGljYXRpb24uY29tL3NpbWdhZC81Mjg4NzMxMjE0MjIzMjQ2NDE0P3NxcD00c3FQeVFRN1Fqa3FOeEFCSFFBQXRFSWdBU2dCTUFrNEEwRHdrd2xZQVdCZmNBS0FBUUdJQVFHZEFRQUFnRC1vQVFHd0FZQ3Q0Z1M0QVZfRkFTMnluVDQmYW1wO3JzPUFPZ2E0cW0wUlRXUm54UExwdUE5YnB5TDlpLTU2V3VEQWdcIiBzdHlsZT13aWR0aDo5NzBweDtoZWlnaHQ6MjUwcHg7IHdpZHRoPTk3MD48aW1nIGFsdCBjbGFzcz1cImktYW1waHRtbC1maWxsLWNvbnRlbnQgaS1hbXBodG1sLXJlcGxhY2VkLWNvbnRlbnRcIiBkZWNvZGluZz1hc3luYyBzcmM9XCJodHRwczovL3RwYy5nb29nbGVzeW5kaWNhdGlvbi5jb20vc2ltZ2FkLzUyODg3MzEyMTQyMjMyNDY0MTQ%2Fc3FwPTRzcVB5UVE3UWprcU54QUJIUUFBdEVJZ0FTZ0JNQWs0QTBEd2t3bFlBV0JmY0FLQUFRR0lBUUdkQVFBQWdELW9BUUd3QVlDdDRnUzRBVl9GQVMyeW5UNCZhbXA7cnM9QU9nYTRxbTBSVFdSbnhQTHB1QTlicHlMOWktNTZXdURBZ1wiPjwvYW1wLWltZz48L2E%2BPGFtcC1waXhlbCBjbGFzcz1cImktYW1waHRtbC1sYXlvdXQtZml4ZWQgaS1hbXBodG1sLWxheW91dC1zaXplLWRlZmluZWRcIiBpLWFtcGh0bWwtbGF5b3V0PWZpeGVkIHJlZmVycmVycG9saWN5PW5vLXJlZmVycmVyIHNyYz0vL3d3dy5nb29nbGUuY29tL3BhZ2VhZC9kcnQvdWkgc3R5bGU9d2lkdGg6MXB4O2hlaWdodDoxcHg7PjwvYW1wLXBpeGVsPjxkaXYgYXJpYS1oaWRkZW49dHJ1ZSBjbGFzcz1cImFiZ2MgYWJnZiBwZW5cIiBkaXI9bHRyIGlkPWFiZ2M%2BPGRpdiBjbGFzcz1cImFiZ2NwIHBlYVwiIGlkPWFiZ2NwPjxkaXYgY2xhc3M9YWJncyBpZD1hYmdzPjxhIGNsYXNzPWFiZ2wgaHJlZj1cImh0dHBzOi8vYWRzc2V0dGluZ3MuZ29vZ2xlLmNvbS93aHl0aGlzYWQ%2FcmVhc29ucz1BQjNhZkdFQUFBVWdXMXRiVzI1MWJHd3NXekV3WFN4dWRXeHNMRzUxYkd3c2JuVnNiQ3hiSWpreU5UQXlJbDFkTEZ0dWRXeHNMQ0pvZEhSd2N6b3ZMMmR2YjJkc1pXRmtjeTVuTG1SdmRXSnNaV05zYVdOckxtNWxkQzl3WVdkbFlXUXZZMjl1ZG1WeWMybHZiaThfWVdrOVEwNWhUV2g0WmpWWldEbFBhRWxLVTFKeVFWUkNhalZsUVVOUWFWVXdTemxrZFhGRE1HcEthMDEyTFVWbFJVRkZaekJaWmxOSlIwTlNhRWxEUVY5Q1pXZEJaa2RFWDFwVlJIbEJSVU0wUVVsQmNVRk5RbmxCVFVseFoxUmZRVlZmVVRsZmMzZE1hbmd4YldKMVNTMTRSMVF0UWtRM2JIWmlTbTFZVVZCalRuRmFlRk5QVkZKR1NHSXlXbUZOUkdsV1IyeFZUbEY0VjBsb2NqQnpkV2hvYkU1V2RUTmtjRXcyTW5ocGEyb3lWakozTFdRM1ozSk5lVGRKYkVwYVRFTkVOaTFrY1RSMVltWkRhbmw0TVdSQ1oxVlVVRkl5VVhGRlJtUkdaVGRFV0hST2FqQkJaakV6TVU5TVQwMWhTVlV5VGxadlRXOXlTVXhNT1UxSlUwRjJYemhGYkZwc1NIWkJUREJ2YjI1eFVFWlpOVlF3YzFVeVlXVkZiRlpCTUdnNVdYbFJNbFpZYVdKb1lVeElia2hqWTJ0VWQzRnVSMVZ6ZGxRMGRsRm1TRkUxVEROSk5sbFROVGQzY21wZlVWODRPVzF1ZERaR2QxcFJlUzE0WDBwcGFVWkJjbmRQTmxkQ1FUUjRTWEV3WlRrM1NFeERTV0Y0UVhWQ1YwaDRiVjlGZUd4WVpFWkNSVlZKY0ZOVGIzbElNM0ZoTXpOMlZVcEhOM3BuYjNoVVVrdFRRMlZzWjBwMU5VTTRjR1ZyUzJjMmRERnpRVVZ3U1dsUWFtSlZRelJCVVVKdlFWbERaMEZtWlhkTWREbHhRV1ZQZW1oMWIwSTVXRXBITm1kSWF6bG5ZbkZCWlRaQ2NXZElPRTVyWW5GQlpua3lVblZ2UWpaaExVYzJaMGczVGxWaWNVRm1lakJTZFc5Q0xYcFdSelpuU0d4MFoySnhRV1pETW1oMldVSjNTRk5EUVd0SlowOUhRVkZDUVVKSFFqTjVRMEowYUZwSVozUmpNMVpwWXpOc2RVeFVZM2xPYWsweFRucE5NRTVFV1RSTlJGRjNUbnBwZUVOV1JWcEZNSFp3Y2s5TVpHZEJiMFJ0UVhOQ2VVRnpRakpDVFUxY2RUQXdNalp6YVdkb1BYVXRXVVJqWDJweWRFSk5YSFV3TURJMlkybGtQVU5CVVZOUWQwTk9TWEpNVFhkb2NHMWFXRWxhWkhGRlNuVlFVWFJCYWpsSlkxRm5VRTVGUlhSSlFXSkxVMVF4YUcxSVNGZHdRbVJ4ZFdjMWQxaEhVRmQyU1VZM2RYWndNbkZXY0hoeVNsOXJkM1ZMYTJOTExVeE9keUlzVzI1MWJHd3NiblZzYkN4dWRXeHNMQ0pvZEhSd2N6b3ZMMlJwYzNCc1lYbGhaSE10Wm05eWJXRjBjeTVuYjI5bmJHVjFjMlZ5WTI5dWRHVnVkQzVqYjIwdllXUnpMM0J5WlhacFpYY3ZZMjl1ZEdWdWRDNXFjejlqYkdsbGJuUTlkM1JoWEhVd01ESTJiMkptZFhOallYUmxaRU4xYzNSdmJXVnlTV1E5T0RZek56VTNORFV6T1Z4MU1EQXlObU55WldGMGFYWmxTV1E5TkRVMk56QTJORFkwT0RjNVhIVXdNREkyZG1WeWMybHZia2xrUFRCY2RUQXdNalpoWkVkeWIzVndRM0psWVhScGRtVkpaRDAwTVRrd05UTTNOamczTmpKY2RUQXdNalpvZEcxc1VHRnlaVzUwU1dROWNISmxkaTB3WEhVd01ESTJhR1ZwWjJoMFBUSTFNRngxTURBeU5uZHBaSFJvUFRrM01GeDFNREF5Tm5OcFp6MUJRMmxXUWw5NU5EVlZiR1k0VDNKMFJVRXhZVmc0WDJsNlNVSnBTMTlNYkZKM0lsMHNiblZzYkN4dWRXeHNMREVzSWxGRVNuWndYMEUxVms4MFNYVnhRekJxU210TlJVcE1WWGhOVFdSSFQwOUtNbTR3YVVNeU5XeGtNazV2WVZkTmRWa3lPWFJSYUdScVdWTXhkMlJYU1hSUFZGazBUbFJqZWs1RVVUQk9WRkV6VG1wbmVFNUZaMGRYUVVwM1FWRWlMQ0kzT1RJMk1qWXlNamt3SWwxZFhTeGJNU3d4TERGZFhRU0ZNdnVpSmlGQzB3bmtpN2thMEpnNWtkbWxweWpBNVNfZWdqN2xPamRMMHhNQUdyand5Y1RPSU5FRjZZUjROa1VTNGhYMEEybkxueWNHY3VVS1JlbVJORk1ZdlB1MnhxUjBlX3N4OW95ckhGckE2UVJVRU5VVnVhZ1FFLTVldXNtY2gwanJ5Y2hQTmxQRFF5cVgwWEhtTVhlTmJ5YlVCbmpIOUVrWXNOc2RkVTVrajdJbjdxbWYtdkl3Xzh3TEJvRnBocjJGSUxkTXE5dXBmaHhYRl8zYkR2U09rd0w4bGlGcnpEekVDYkZPeGZNS1A0ekFnNUdpNGRjWEhyc2Rtc056bFF2Q3MwQS11bHJaMkFHVFFsc3lRYW5kdjRlcUdGYWJXcG9CWXVtdEl0bGUtSTdYZmlJR2Y4bzl0Wjh5cnZCNXUtYTA0TEJzUERFNzZaVzlXeDgsaURBWktUbmtqU2dpODctaG9iR3ppdyZhbXA7c291cmNlPWRpc3BsYXlcIiBpZD1hYmdsIHRhcmdldD1fYmxhbms%2BPGFtcC1pbWcgY2xhc3M9XCJpLWFtcGh0bWwtbGF5b3V0LWZpeGVkIGktYW1waHRtbC1sYXlvdXQtc2l6ZS1kZWZpbmVkXCIgaGVpZ2h0PTE1IGktYW1waHRtbC1sYXlvdXQ9Zml4ZWQgaS1hbXBodG1sLXNzciBzcmM9aHR0cHM6Ly90cGMuZ29vZ2xlc3luZGljYXRpb24uY29tL3BhZ2VhZC9pbWFnZXMvYWRjaG9pY2VzL2VuLnBuZyBzdHlsZT13aWR0aDo3NXB4O2hlaWdodDoxNXB4OyB3aWR0aD03NT48aW1nIGNsYXNzPVwiaS1hbXBodG1sLWZpbGwtY29udGVudCBpLWFtcGh0bWwtcmVwbGFjZWQtY29udGVudFwiIGRlY29kaW5nPWFzeW5jIHNyYz1odHRwczovL3RwYy5nb29nbGVzeW5kaWNhdGlvbi5jb20vcGFnZWFkL2ltYWdlcy9hZGNob2ljZXMvZW4ucG5nPjwvYW1wLWltZz48L2E%2BPC9kaXY%2BPGRpdiBjbGFzcz1hYmdiIGlkPWFiZ2I%2BPGEgaHJlZj1cImh0dHBzOi8vYWRzc2V0dGluZ3MuZ29vZ2xlLmNvbS93aHl0aGlzYWQ%2FcmVhc29ucz1BQjNhZkdFQUFBVWdXMXRiVzI1MWJHd3NXekV3WFN4dWRXeHNMRzUxYkd3c2JuVnNiQ3hiSWpreU5UQXlJbDFkTEZ0dWRXeHNMQ0pvZEhSd2N6b3ZMMmR2YjJkc1pXRmtjeTVuTG1SdmRXSnNaV05zYVdOckxtNWxkQzl3WVdkbFlXUXZZMjl1ZG1WeWMybHZiaThfWVdrOVEwNWhUV2g0WmpWWldEbFBhRWxLVTFKeVFWUkNhalZsUVVOUWFWVXdTemxrZFhGRE1HcEthMDEyTFVWbFJVRkZaekJaWmxOSlIwTlNhRWxEUVY5Q1pXZEJaa2RFWDFwVlJIbEJSVU0wUVVsQmNVRk5RbmxCVFVseFoxUmZRVlZmVVRsZmMzZE1hbmd4YldKMVNTMTRSMVF0UWtRM2JIWmlTbTFZVVZCalRuRmFlRk5QVkZKR1NHSXlXbUZOUkdsV1IyeFZUbEY0VjBsb2NqQnpkV2hvYkU1V2RUTmtjRXcyTW5ocGEyb3lWakozTFdRM1ozSk5lVGRKYkVwYVRFTkVOaTFrY1RSMVltWkRhbmw0TVdSQ1oxVlVVRkl5VVhGRlJtUkdaVGRFV0hST2FqQkJaakV6TVU5TVQwMWhTVlV5VGxadlRXOXlTVXhNT1UxSlUwRjJYemhGYkZwc1NIWkJUREJ2YjI1eFVFWlpOVlF3YzFVeVlXVkZiRlpCTUdnNVdYbFJNbFpZYVdKb1lVeElia2hqWTJ0VWQzRnVSMVZ6ZGxRMGRsRm1TRkUxVEROSk5sbFROVGQzY21wZlVWODRPVzF1ZERaR2QxcFJlUzE0WDBwcGFVWkJjbmRQTmxkQ1FUUjRTWEV3WlRrM1NFeERTV0Y0UVhWQ1YwaDRiVjlGZUd4WVpFWkNSVlZKY0ZOVGIzbElNM0ZoTXpOMlZVcEhOM3BuYjNoVVVrdFRRMlZzWjBwMU5VTTRjR1ZyUzJjMmRERnpRVVZ3U1dsUWFtSlZRelJCVVVKdlFWbERaMEZtWlhkTWREbHhRV1ZQZW1oMWIwSTVXRXBITm1kSWF6bG5ZbkZCWlRaQ2NXZElPRTVyWW5GQlpua3lVblZ2UWpaaExVYzJaMGczVGxWaWNVRm1lakJTZFc5Q0xYcFdSelpuU0d4MFoySnhRV1pETW1oMldVSjNTRk5EUVd0SlowOUhRVkZDUVVKSFFqTjVRMEowYUZwSVozUmpNMVpwWXpOc2RVeFVZM2xPYWsweFRucE5NRTVFV1RSTlJGRjNUbnBwZUVOV1JWcEZNSFp3Y2s5TVpHZEJiMFJ0UVhOQ2VVRnpRakpDVFUxY2RUQXdNalp6YVdkb1BYVXRXVVJqWDJweWRFSk5YSFV3TURJMlkybGtQVU5CVVZOUWQwTk9TWEpNVFhkb2NHMWFXRWxhWkhGRlNuVlFVWFJCYWpsSlkxRm5VRTVGUlhSSlFXSkxVMVF4YUcxSVNGZHdRbVJ4ZFdjMWQxaEhVRmQyU1VZM2RYWndNbkZXY0hoeVNsOXJkM1ZMYTJOTExVeE9keUlzVzI1MWJHd3NiblZzYkN4dWRXeHNMQ0pvZEhSd2N6b3ZMMlJwYzNCc1lYbGhaSE10Wm05eWJXRjBjeTVuYjI5bmJHVjFjMlZ5WTI5dWRHVnVkQzVqYjIwdllXUnpMM0J5WlhacFpYY3ZZMjl1ZEdWdWRDNXFjejlqYkdsbGJuUTlkM1JoWEhVd01ESTJiMkptZFhOallYUmxaRU4xYzNSdmJXVnlTV1E5T0RZek56VTNORFV6T1Z4MU1EQXlObU55WldGMGFYWmxTV1E5TkRVMk56QTJORFkwT0RjNVhIVXdNREkyZG1WeWMybHZia2xrUFRCY2RUQXdNalpoWkVkeWIzVndRM0psWVhScGRtVkpaRDAwTVRrd05UTTNOamczTmpKY2RUQXdNalpvZEcxc1VHRnlaVzUwU1dROWNISmxkaTB3WEhVd01ESTJhR1ZwWjJoMFBUSTFNRngxTURBeU5uZHBaSFJvUFRrM01GeDFNREF5Tm5OcFp6MUJRMmxXUWw5NU5EVlZiR1k0VDNKMFJVRXhZVmc0WDJsNlNVSnBTMTlNYkZKM0lsMHNiblZzYkN4dWRXeHNMREVzSWxGRVNuWndYMEUxVms4MFNYVnhRekJxU210TlJVcE1WWGhOVFdSSFQwOUtNbTR3YVVNeU5XeGtNazV2WVZkTmRWa3lPWFJSYUdScVdWTXhkMlJYU1hSUFZGazBUbFJqZWs1RVVUQk9WRkV6VG1wbmVFNUZaMGRYUVVwM1FWRWlMQ0kzT1RJMk1qWXlNamt3SWwxZFhTeGJNU3d4TERGZFhRU0ZNdnVpSmlGQzB3bmtpN2thMEpnNWtkbWxweWpBNVNfZWdqN2xPamRMMHhNQUdyand5Y1RPSU5FRjZZ&i=4-8&t=adltag_kevkyyx2_N28l834c9R&r=1c031d4bd52aedf9e7995ea20454bf9&c=math-aids-threatpost&z=1
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/b-9a4f7ce-a7f6098c.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.84.156.60 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-84-156-60.txl52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Wed, 09 Sep 2020 03:19:23 GMT
via: 1.1 5cf5bc69324ade55eebb5e539fa6c2fa.cloudfront.net (CloudFront)
age: 46348
x-cache: Error from cloudfront
status: 200
content-length: 0
last-modified: Mon, 15 Jun 2020 18:35:10 GMT
server: AmazonS3
etag: "d41d8cd98f00b204e9800998ecf8427e"
access-control-max-age: 3000
access-control-allow-methods: GET
x-amz-version-id: D2POxJleIt92FyXaxSi7iRHuNLtujALh
access-control-allow-origin: *
x-amz-cf-pop: TXL52-C1
accept-ranges: bytes
content-type: text/plain
x-amz-cf-id: XQMpZEMKh8WayQ94mIzodgnqycn9ppYZyB3BZgS44SwINFTTizu-vg==

POST
H2 200 tag
math-aids-threatpost-tagan.adlightning.com/ 0
427 B 124ms
49ms Other
text/plain 99.84.156.60
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://math-aids-threatpost-tagan.adlightning.com/tag?s=bl&d=UjROa1VTNGhYMEEybkxueWNHY3VVS1JlbVJORk1ZdlB1MnhxUjBlX3N4OW95ckhGckE2UVJVRU5VVnVhZ1FFLTVldXNtY2gwanJ5Y2hQTmxQRFF5cVgwWEhtTVhlTmJ5YlVCbmpIOUVrWXNOc2RkVTVrajdJbjdxbWYtdkl3Xzh3TEJvRnBocjJGSUxkTXE5dXBmaHhYRl8zYkR2U09rd0w4bGlGcnpEekVDYkZPeGZNS1A0ekFnNUdpNGRjWEhyc2Rtc056bFF2Q3MwQS11bHJaMkFHVFFsc3lRYW5kdjRlcUdGYWJXcG9CWXVtdEl0bGUtSTdYZmlJR2Y4bzl0Wjh5cnZCNXUtYTA0TEJzUERFNzZaVzlXeDgsaURBWktUbmtqU2dpODctaG9iR3ppdyZhbXA7c291cmNlPWRpc3BsYXlcIiB0YXJnZXQ9X2JsYW5rPjxhbXAtaW1nIGNsYXNzPVwiaS1hbXBodG1sLWxheW91dC1maXhlZCBpLWFtcGh0bWwtbGF5b3V0LXNpemUtZGVmaW5lZFwiIGhlaWdodD0xNSBpLWFtcGh0bWwtbGF5b3V0PWZpeGVkIGktYW1waHRtbC1zc3Igc3JjPWh0dHBzOi8vdHBjLmdvb2dsZXN5bmRpY2F0aW9uLmNvbS9wYWdlYWQvaW1hZ2VzL2FkY2hvaWNlcy9pY29uLnBuZyBzdHlsZT13aWR0aDoxNXB4O2hlaWdodDoxNXB4OyB3aWR0aD0xNT48aW1nIGNsYXNzPVwiaS1hbXBodG1sLWZpbGwtY29udGVudCBpLWFtcGh0bWwtcmVwbGFjZWQtY29udGVudFwiIGRlY29kaW5nPWFzeW5jIHNyYz1odHRwczovL3RwYy5nb29nbGVzeW5kaWNhdGlvbi5jb20vcGFnZWFkL2ltYWdlcy9hZGNob2ljZXMvaWNvbi5wbmc%2BPC9hbXAtaW1nPjwvYT48L2Rpdj48L2Rpdj48YW1wLWFuYWx5dGljcyBjbGFzcz1cImktYW1waHRtbC1sYXlvdXQtZml4ZWQgaS1hbXBodG1sLWxheW91dC1zaXplLWRlZmluZWRcIiBpLWFtcGh0bWwtbGF5b3V0PWZpeGVkIHN0eWxlPXdpZHRoOjFweDtoZWlnaHQ6MXB4OyB0cmlnZ2VyPWltbWVkaWF0ZT48c2NyaXB0IHR5cGU9YXBwbGljYXRpb24vanNvbj57XCJyZXF1ZXN0c1wiOiB7XCJyZXBvcnROb0xhYmVsSW5zdGFuY2VcIjogXCJodHRwczovL2dvb2dsZWFkcy5nLmRvdWJsZWNsaWNrLm5ldC9wYWdlYWQvY29udmVyc2lvbi8%2FYWk9Q05hTWh4ZjVZWDlPaElKU1JyQVRCajVlQUNQaVUwSzlkdXFDMGpKa012LUVlRUFFZzBZZlNJR0NSaElDQV9CZWdBZkdEX1pVRHlBRUM0QUlBcUFNQnlBTUlxZ1RfQVVfUTlfc3dMangxbWJ1SS14R1QtQkQ3bHZiSm1YUVBjTnFaeFNPVFJGSGIyWmFNRGlWR2xVTlF4V0locjBzdWhobE5WdTNkcEw2Mnhpa2oyVjJ3LWQ3Z3JNeTdJbEpaTENENi1kcTR1YmZDanl4MWRCZ1VUUFIyUXFFRmRGZTdEWHROajBBZjEzMU9MT01hSVUyTlZvTW9ySUxMOU1JU0F2XzhFbFpsSHZBTDBvb25xUEZZNVQwc1UyYWVFbFZBMGg5WXlRMlZYaWJoYUxIbkhjY2tUd3FuR1VzdlQ0dlFmSFE1TDNJNllTNTd3cmpfUV84OW1udDZGd1pReS14X0ppaUZBcndPNldCQTR4SXEwZTk3SExDSWF4QXVCV0h4bV9FeGxYZEZCRVVJcFNTb3lIM3FhMzN2VUpHN3pnb3hUUktTQ2VsZ0p1NUM4cGVrS2c2dDFzQUVwSWlQamJVQzRBUUJvQVlDZ0FmZXdMdDlxQWVPemh1b0I5WEpHNmdIazlnYnFBZTZCcWdIOE5rYnFBZnkyUnVvQjZhLUc2Z0g3TlVicUFmejBSdW9CLXpWRzZnSGx0Z2JxQWZDMmh2WUJ3SFNDQWtJZ09HQVFCQUJHQjN5Q0J0aFpIZ3RjM1ZpYzNsdUxUY3lOak0xTnpNME5EWTRNRFF3TnppeENWRVpFMHZwck9MZGdBb0RtQXNCeUFzQjJCTU0mc2lnaD11LVlEY19qcnRCTSZjaWQ9Q0FRU1B3Q05JckxNd2hwbVpYSVpkcUVKdVBRdEFqOUljUWdQTkVFdElBYktTVDFobUhIV3BCZHF1ZzV3WEdQV3ZJRjd1dnAycVZweHJKX2t3dUtrY0stTE53JmNpZD1DQVFTUHdDTklyTE13aHBtWlhJWmRxRUp1UFF0QWo5SWNRZ1BORUV0SUFiS1NUMWhtSEhXcEJkcXVnNXdYR1BXdklGN3V2cDJxVnB4ckpfa3d1S2tjSy1MTncmbGFiZWw9JHtsYWJlbH1cIixcInJlcG9ydExhYmVsSW5zdGFuY2VcIjogXCJodHRwczovL2dvb2dsZWFkcy5nLmRvdWJsZWNsaWNrLm5ldC9wYWdlYWQvY29udmVyc2lvbi8%2FYWk9Q05hTWh4ZjVZWDlPaElKU1JyQVRCajVlQUNQaVUwSzlkdXFDMGpKa012LUVlRUFFZzBZZlNJR0NSaElDQV9CZWdBZkdEX1pVRHlBRUM0QUlBcUFNQnlBTUlxZ1RfQVVfUTlfc3dMangxbWJ1SS14R1QtQkQ3bHZiSm1YUVBjTnFaeFNPVFJGSGIyWmFNRGlWR2xVTlF4V0locjBzdWhobE5WdTNkcEw2Mnhpa2oyVjJ3LWQ3Z3JNeTdJbEpaTENENi1kcTR1YmZDanl4MWRCZ1VUUFIyUXFFRmRGZTdEWHROajBBZjEzMU9MT01hSVUyTlZvTW9ySUxMOU1JU0F2XzhFbFpsSHZBTDBvb25xUEZZNVQwc1UyYWVFbFZBMGg5WXlRMlZYaWJoYUxIbkhjY2tUd3FuR1VzdlQ0dlFmSFE1TDNJNllTNTd3cmpfUV84OW1udDZGd1pReS14X0ppaUZBcndPNldCQTR4SXEwZTk3SExDSWF4QXVCV0h4bV9FeGxYZEZCRVVJcFNTb3lIM3FhMzN2VUpHN3pnb3hUUktTQ2VsZ0p1NUM4cGVrS2c2dDFzQUVwSWlQamJVQzRBUUJvQVlDZ0FmZXdMdDlxQWVPemh1b0I5WEpHNmdIazlnYnFBZTZCcWdIOE5rYnFBZnkyUnVvQjZhLUc2Z0g3TlVicUFmejBSdW9CLXpWRzZnSGx0Z2JxQWZDMmh2WUJ3SFNDQWtJZ09HQVFCQUJHQjN5Q0J0aFpIZ3RjM1ZpYzNsdUxUY3lOak0xTnpNME5EWTRNRFF3TnppeENWRVpFMHZwck9MZGdBb0RtQXNCeUFzQjJCTU0mc2lnaD11LVlEY19qcnRCTSZjaWQ9Q0FRU1B3Q05JckxNd2hwbVpYSVpkcUVKdVBRdEFqOUljUWdQTkVFdElBYktTVDFobUhIV3BCZHF1ZzV3WEdQV3ZJRjd1dnAycVZweHJKX2t3dUtrY0stTE53JmNpZD1DQVFTUHdDTklyTE13aHBtWlhJWmRxRUp1UFF0QWo5SWNRZ1BORUV0SUFiS1NUMWhtSEhXcEJkcXVnNXdYR1BXdklGN3V2cDJxVnB4ckpfa3d1S2tjSy1MTncmbGFiZWw9JHtsYWJlbH0mbGFiZWxfaW5zdGFuY2U9JHtsYWJlbEluc3RhbmNlfSZjYnQ9UURKdnBfQTVWTzRJdXFDMGpKa01FSkxVeE1NZEdPT0oybjBpQzI1bGQyTm9hV011WTI5dFFoZGpZUzF3ZFdJdE9UWTROVGN6TkRRME5UUTNOamd4TkVnR1dBSndBUVwifSxcInRyYW5zcG9ydFwiOiB7XCJiZWFjb25cIjogZmFsc2UsXCJ4aHJwb3N0XCI6IGZhbHNlLFwiaW1hZ2VcIjogdHJ1ZX0sXCJ0cmlnZ2Vyc1wiOiB7XCJ0cmFja011dGVcIjoge1wib25cIjogXCJjbGlja1wiLFwic2VsZWN0b3JcIjogXCJsYWJlbFtmb3I9J3NwcjEnXVwiLFwicmVxdWVzdFwiOiBcInJlcG9ydE5vTGFiZWxJbnN0YW5jZVwifSxcInRyYWNrUmVwb3J0QWRcIjoge1wib25cIjogXCJjbGlja1wiLFwic2VsZWN0b3JcIjogXCJsYWJlbFtmb3I9J3NwcjInXVwiLFwicmVxdWVzdFwiOiBcInJlcG9ydExhYmVsSW5zdGFuY2VcIn0sXCJ0cmFja1N1cnZleVJlc3BvbnNlXCI6IHtcIm9uXCI6IFwiY2xpY2tcIixcInNlbGVjdG9yXCI6IFwibGFiZWxbZm9yPSdzcHIzJ11cIixcInJlcXVlc3RcIjogXCJyZXBvcnRMYWJlbEluc3RhbmNlXCJ9LFwidHJhY2tXaHlUaGlzQWRcIjoge1wib25cIjogXCJjbGlja1wiLFwic2VsZWN0b3JcIjogXCIjc2J0blwiLFwicmVxdWVzdFwiOiBcInJlcG9ydExhYmVsSW5zdGFuY2VcIn19fTwvc2NyaXB0PjwvYW1wLWFuYWx5dGljcz48Zm9ybSBhY3Rpb249Ly9nLmNvIGNsYXNzPVwic2ggc3MganQgYW1wLWFuaW1hdGUgYWJnZiBwZW5cIiBpZD1tdGEgdGFyZ2V0PV9ibGFuaz48aW5wdXQgaWQ9c3ByMCBuYW1lPWEgdHlwZT1yYWRpbz48aW5wdXQgaWQ9c3ByMSBuYW1lPWEgdHlwZT1yYWRpbz48aW5wdXQgaWQ9c3ByMiBuYW1lPWEgdHlwZT1yYWRpbz48aW5wdXQgaWQ9c3ByMyBuYW1lPWEgdHlwZT1yYWRpbz48bGFiZWwgY2xhc3M9XCJjYmIgcGVhXCIgZGF0YS12YXJzLWxhYmVsPXVzZXJfZmVlZGJhY2tfbWVudV9pbnRlcmFjdGlvbiBmb3I9c3ByMSBpZD1jYmI%2BPHN2ZyBoZWlnaHQ9MTUgd2lkdGg9MTUgeG1sbnM9Ly93d3cudzMub3JnLzIwMDAvc3ZnPjxwYXRoIGQ9TTAsMGwxNSwwbDAsMTVsLTE1LDBaIGZpbGw9I2NkY2NjYz48L3BhdGg%2BPHBhdGggZD1NMy4yNSwzLjI1bDguNSw4LjVNMTEuNzUsMy4yNWwtOC41LDguNSBzdHJva2U9IzAwYWVjZCBzdHJva2Utd2lkdGg9MS4yNT48L3BhdGg%2BPC9zdmc%2BPC9sYWJlbD48ZGl2IGNsYXNzPVwicG4gYWJnZlwiIGlkPXNwdjE%2BPGFtcC1maXQtdGV4dCBjbGFzcz1cImZsIGktYW1waHRtbC1sYXlvdXQtcmVzcG9uc2l2ZSBpLWFtcGh0bWwtbGF5b3V0LXNpemUtZGVmaW5lZFwiIGhlaWdodD0yNTAgaS1hbXBodG1sLWxheW91dD1yZXNwb25zaXZlIGxheW91dD1yZXNwb25zaXZlIG1heC1mb250LXNpemU9MjAgbWluLWZvbnQtc2l6ZT04IHdpZHRoPTk3MD48aS1hbXBodG1sLXNpemVyIHN0eWxlPWRpc3BsYXk6YmxvY2s7cGFkZGluZy10b3A6MjUuNzczMiU7PjwvaS1hbXBodG1sLXNpemVyPjxkaXYgY2xhc3M9Y2xvc2UgaWQ9bWVudS1kaXNtaXNzPjxsYWJlbCBmb3I9c3ByMD48c3ZnIHZpZXdib3g9XCIwIDAgMjQgMjRcIj48cGF0aCBjbGFzcz1uYXRpdmUtYXJyb3cgZD1cIk0yMCAxMUg3LjgzbDUuNTktNS41OUwxMiA0bC04IDggOCA4IDEuNDEtMS40MUw3LjgzIDEzSDIwdi0yelwiPjwvcGF0aD48L3N2Zz48L2xhYmVsPjwvZGl2PjxkaXYgaWQ9dGk%2BPHNwYW4gY2xhc3M9Y3Q%2BQWRzIGJ5IDxzdmcgZmlsbD0jMDAwMDAwIHZpZXdib3g9XCIwIDAgNjAgMjRcIiB4bWxucz1odHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2Zz48cGF0aCBkPVwiTTcuNSAxNi4yOWMtNC4wNyAwLTcuNDktMy4zMS03LjQ5LTcuMzhTMy40MyAxLjUzIDcuNSAxLjUzYzIuMjUgMCAzLjg1Ljg4IDUuMDYgMi4wM2wtMS40MiAxLjQyYy0uODctLjgxLTIuMDQtMS40NC0zLjY0LTEuNDQtMi45NyAwLTUuMjkgMi40LTUuMjkgNS4zN3MyLjMyIDUuMzcgNS4yOSA1LjM3YzEuOTMgMCAzLjAzLS43NyAzLjczLTEuNDguNTgtLjU4Ljk1LTEuNCAxLjEtMi41NEg3LjVWOC4yNGg2Ljc5Yy4wNy4zNi4xMS43OS4xMSAxLjI2IDAgMS41MS0uNDEgMy4zOS0xLjc1IDQuNzItMS4zIDEuMzUtMi45NSAyLjA3LTUuMTUgMi4wN3ptMTcuNzUtNC43NmMwIDIuNzQtMi4xMyA0Ljc1LTQuNzUgNC43NXMtNC43NS0yLjAyLTQuNzUtNC43NWMwLTIuNzUgMi4xMy00Ljc1IDQuNzUtNC43NXM0Ljc1IDIgNC43NSA0Ljc1em0tMi4wOCAwYzAtMS43MS0xLjI0LTIuODgtMi42Ny0yLjg4cy0yLjY3IDEuMTctMi42NyAyLjg4YzAgMS42OSAxLjI0IDIuODggMi42NyAyLjg4czIuNjctMS4xOCAyLjY3LTIuODh6bTEzLjA4IDBjMCAyLjc0LTIuMTMgNC43NS00Ljc1IDQuNzVzLTQuNzUtMi4wMi00Ljc1LTQuNzVjMC0yLjc1IDIuMTMtNC43NSA0Ljc1LTQuNzVzNC43NSAyIDQuNzUgNC43NXptLTIuMDggMGMwLTEuNzEtMS4yNC0yLjg4LTIuNjctMi44OHMtMi42NyAxLjE3LTIuNjcgMi44OGMwIDEuNjkgMS4yNCAyLjg4IDIuNjcgMi44OHMyLjY3LTEuMTggMi42Ny0yLjg4em0xMi41OC00LjQ2djguNTNjMCAzLjUxLTIuMDcgNC45NS00LjUyIDQuOTUtMi4zIDAtMy42OS0xLjU1LTQuMjEtMi44MWwxLjgyLS43NmMuMzIuNzcgMS4xMiAxLjY5IDIuMzkgMS42OSAxLjU3IDAgMi41NC0uOTcgMi41NC0yLjc5di0uNjhoLS4wN2MtLjQ3LjU4LTEuMzcgMS4wOC0yLjUgMS4wOC0yLjM4IDAtNC41Ni0yLjA3LTQuNTYtNC43NCAwLTIuNjggMi4xOC00Ljc3IDQuNTYtNC43NyAxLjEzIDAgMi4wMy41IDIuNSAxLjA2aC4wN3YtLjc2aDEuOTh6bS0xLjg0IDQuNDhjMC0xLjY3LTEuMTItMi45LTIuNTQtMi45LTEuNDQgMC0yLjY1IDEuMjItMi42NSAyLjkgMCAxLjY2IDEuMjEgMi44NiAyLjY1IDIuODYgMS40My4wMSAyLjU0LTEuMiAyLjU0LTIuODZ6bTUuODktOS41MlYxNmgtMi4wOVYyLjAzaDIuMDl6bTguNDkgMTEuMDdsMS42MiAxLjA4Yy0uNTIuNzctMS43OCAyLjExLTMuOTYgMi4xMS0yLjcgMC00LjcyLTIuMDktNC43Mi00Ljc1IDAtMi44MyAyLjAzLTQuNzUgNC40OC00Ljc1IDIuNDcgMCAzLjY3IDEuOTYgNC4wNyAzLjAybC4yMi41NC02LjM2IDIuNjNjLjQ5Ljk1IDEuMjQgMS40NCAyLjMgMS40NCAxLjA3IDAgMS44MS0uNTMgMi4zNS0xLjMyem0tNC45OS0xLjcxbDQuMjUtMS43NmMtLjIzLS41OS0uOTQtMS4wMS0xLjc2LTEu&i=5-8&t=adltag_kevkyyx2_N28l834c9R&r=1c031d4bd52aedf9e7995ea20454bf9&c=math-aids-threatpost&z=1
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/b-9a4f7ce-a7f6098c.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.84.156.60 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-84-156-60.txl52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Wed, 09 Sep 2020 03:19:23 GMT
via: 1.1 5cf5bc69324ade55eebb5e539fa6c2fa.cloudfront.net (CloudFront)
age: 46348
x-cache: Error from cloudfront
status: 200
content-length: 0
last-modified: Mon, 15 Jun 2020 18:35:10 GMT
server: AmazonS3
etag: "d41d8cd98f00b204e9800998ecf8427e"
access-control-max-age: 3000
access-control-allow-methods: GET
x-amz-version-id: D2POxJleIt92FyXaxSi7iRHuNLtujALh
access-control-allow-origin: *
x-amz-cf-pop: TXL52-C1
accept-ranges: bytes
content-type: text/plain
x-amz-cf-id: PMZLZMEcvkEc-S5QEjN3NO1Bc7l5e_mh9pbdqMyL9YphUwet6ym19g==

POST
H2 200 tag
math-aids-threatpost-tagan.adlightning.com/ 0
426 B 131ms
57ms Other
text/plain 99.84.156.60
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://math-aids-threatpost-tagan.adlightning.com/tag?s=bl&d=MDEtMS4wNiAwLTIuNTQuOTMtMi40OSAyLjc3elwiPjwvcGF0aD48cGF0aCBkPVwiTTAgMGg2MnYyNEgwelwiIGZpbGw9bm9uZT48L3BhdGg%2BPC9zdmc%2BPC9zcGFuPjwvZGl2PjxkaXYgaWQ9YnRucz48bGFiZWwgZGF0YS12YXJzLWxhYmVsPXVzZXJfZmVlZGJhY2tfbWVudV9vcHRpb24gZGF0YS12YXJzLWxhYmVsLWluc3RhbmNlPTEgZm9yPXNwcjI%2BPGEgY2xhc3M9YnRuIGlkPXJidG4%2BPHNwYW4%2BU2VuZCBmZWVkYmFjazwvc3Bhbj48L2E%2BPC9sYWJlbD48bGFiZWw%2BPGEgY2xhc3M9YnRuIGRhdGEtdmFycy1sYWJlbD1jbG9zZWJ1dHRvbl93aHl0aGlzYWRfY2xpY2sgZGF0YS12YXJzLWxhYmVsLWluc3RhbmNlPTEgaHJlZj1cImh0dHBzOi8vYWRzc2V0dGluZ3MuZ29vZ2xlLmNvbS93aHl0aGlzYWQ%2FcmVhc29ucz1BQjNhZkdFQUFBVWdXMXRiVzI1MWJHd3NXekV3WFN4dWRXeHNMRzUxYkd3c2JuVnNiQ3hiSWpreU5UQXlJbDFkTEZ0dWRXeHNMQ0pvZEhSd2N6b3ZMMmR2YjJkc1pXRmtjeTVuTG1SdmRXSnNaV05zYVdOckxtNWxkQzl3WVdkbFlXUXZZMjl1ZG1WeWMybHZiaThfWVdrOVEwNWhUV2g0WmpWWldEbFBhRWxLVTFKeVFWUkNhalZsUVVOUWFWVXdTemxrZFhGRE1HcEthMDEyTFVWbFJVRkZaekJaWmxOSlIwTlNhRWxEUVY5Q1pXZEJaa2RFWDFwVlJIbEJSVU0wUVVsQmNVRk5RbmxCVFVseFoxUmZRVlZmVVRsZmMzZE1hbmd4YldKMVNTMTRSMVF0UWtRM2JIWmlTbTFZVVZCalRuRmFlRk5QVkZKR1NHSXlXbUZOUkdsV1IyeFZUbEY0VjBsb2NqQnpkV2hvYkU1V2RUTmtjRXcyTW5ocGEyb3lWakozTFdRM1ozSk5lVGRKYkVwYVRFTkVOaTFrY1RSMVltWkRhbmw0TVdSQ1oxVlVVRkl5VVhGRlJtUkdaVGRFV0hST2FqQkJaakV6TVU5TVQwMWhTVlV5VGxadlRXOXlTVXhNT1UxSlUwRjJYemhGYkZwc1NIWkJUREJ2YjI1eFVFWlpOVlF3YzFVeVlXVkZiRlpCTUdnNVdYbFJNbFpZYVdKb1lVeElia2hqWTJ0VWQzRnVSMVZ6ZGxRMGRsRm1TRkUxVEROSk5sbFROVGQzY21wZlVWODRPVzF1ZERaR2QxcFJlUzE0WDBwcGFVWkJjbmRQTmxkQ1FUUjRTWEV3WlRrM1NFeERTV0Y0UVhWQ1YwaDRiVjlGZUd4WVpFWkNSVlZKY0ZOVGIzbElNM0ZoTXpOMlZVcEhOM3BuYjNoVVVrdFRRMlZzWjBwMU5VTTRjR1ZyUzJjMmRERnpRVVZ3U1dsUWFtSlZRelJCVVVKdlFWbERaMEZtWlhkTWREbHhRV1ZQZW1oMWIwSTVXRXBITm1kSWF6bG5ZbkZCWlRaQ2NXZElPRTVyWW5GQlpua3lVblZ2UWpaaExVYzJaMGczVGxWaWNVRm1lakJTZFc5Q0xYcFdSelpuU0d4MFoySnhRV1pETW1oMldVSjNTRk5EUVd0SlowOUhRVkZDUVVKSFFqTjVRMEowYUZwSVozUmpNMVpwWXpOc2RVeFVZM2xPYWsweFRucE5NRTVFV1RSTlJGRjNUbnBwZUVOV1JWcEZNSFp3Y2s5TVpHZEJiMFJ0UVhOQ2VVRnpRakpDVFUxY2RUQXdNalp6YVdkb1BYVXRXVVJqWDJweWRFSk5YSFV3TURJMlkybGtQVU5CVVZOUWQwTk9TWEpNVFhkb2NHMWFXRWxhWkhGRlNuVlFVWFJCYWpsSlkxRm5VRTVGUlhSSlFXSkxVMVF4YUcxSVNGZHdRbVJ4ZFdjMWQxaEhVRmQyU1VZM2RYWndNbkZXY0hoeVNsOXJkM1ZMYTJOTExVeE9keUlzVzI1MWJHd3NiblZzYkN4dWRXeHNMQ0pvZEhSd2N6b3ZMMlJwYzNCc1lYbGhaSE10Wm05eWJXRjBjeTVuYjI5bmJHVjFjMlZ5WTI5dWRHVnVkQzVqYjIwdllXUnpMM0J5WlhacFpYY3ZZMjl1ZEdWdWRDNXFjejlqYkdsbGJuUTlkM1JoWEhVd01ESTJiMkptZFhOallYUmxaRU4xYzNSdmJXVnlTV1E5T0RZek56VTNORFV6T1Z4MU1EQXlObU55WldGMGFYWmxTV1E5TkRVMk56QTJORFkwT0RjNVhIVXdNREkyZG1WeWMybHZia2xrUFRCY2RUQXdNalpoWkVkeWIzVndRM0psWVhScGRtVkpaRDAwTVRrd05UTTNOamczTmpKY2RUQXdNalpvZEcxc1VHRnlaVzUwU1dROWNISmxkaTB3WEhVd01ESTJhR1ZwWjJoMFBUSTFNRngxTURBeU5uZHBaSFJvUFRrM01GeDFNREF5Tm5OcFp6MUJRMmxXUWw5NU5EVlZiR1k0VDNKMFJVRXhZVmc0WDJsNlNVSnBTMTlNYkZKM0lsMHNiblZzYkN4dWRXeHNMREVzSWxGRVNuWndYMEUxVms4MFNYVnhRekJxU210TlJVcE1WWGhOVFdSSFQwOUtNbTR3YVVNeU5XeGtNazV2WVZkTmRWa3lPWFJSYUdScVdWTXhkMlJYU1hSUFZGazBUbFJqZWs1RVVUQk9WRkV6VG1wbmVFNUZaMGRYUVVwM1FWRWlMQ0kzT1RJMk1qWXlNamt3SWwxZFhTeGJNU3d4TERGZFhRU0ZNdnVpSmlGQzB3bmtpN2thMEpnNWtkbWxweWpBNVNfZWdqN2xPamRMMHhNQUdyand5Y1RPSU5FRjZZUjROa1VTNGhYMEEybkxueWNHY3VVS1JlbVJORk1ZdlB1MnhxUjBlX3N4OW95ckhGckE2UVJVRU5VVnVhZ1FFLTVldXNtY2gwanJ5Y2hQTmxQRFF5cVgwWEhtTVhlTmJ5YlVCbmpIOUVrWXNOc2RkVTVrajdJbjdxbWYtdkl3Xzh3TEJvRnBocjJGSUxkTXE5dXBmaHhYRl8zYkR2U09rd0w4bGlGcnpEekVDYkZPeGZNS1A0ekFnNUdpNGRjWEhyc2Rtc056bFF2Q3MwQS11bHJaMkFHVFFsc3lRYW5kdjRlcUdGYWJXcG9CWXVtdEl0bGUtSTdYZmlJR2Y4bzl0Wjh5cnZCNXUtYTA0TEJzUERFNzZaVzlXeDgsaURBWktUbmtqU2dpODctaG9iR3ppdyZhbXA7c291cmNlPWRpc3BsYXlcIiBpZD1zYnRuIHRhcmdldD1fYmxhbms%2BPHNwYW4%2BV2h5IHRoaXMgYWQ%2FwqA8c3ZnIGZpbGw9IzAwMDAwMCBpZD1zaSB2aWV3Ym94PVwiMCAwIDE2IDE2XCIgeG1sbnM9Ly93d3cudzMub3JnLzIwMDAvc3ZnPjxjaXJjbGUgY3g9NiBjeT02IHI9MC42Nz48L2NpcmNsZT48cGF0aCBkPU00LjIsMTEuM1EzLjMsMTEuOCwzLjMsMTAuNzVMMy4zLDQuMVEzLjMsMy4xLDQuMywzLjVMMTAuNCw3LjBRMTIuMCw3LjUsMTAuNCw4LjBMNi42NSwxMC4wTDYuNjUsNy43NWEwLjY1LDAuNjUsMCwxLDAsLTEuMywwTDUuMzUsMTAuNzVhMC45LDAuOSwwLDAsMCwxLjMsMC44TDEyLjcsOC4yUTEzLjcsNy41LDEyLjcsNi43TDMuMywxLjZRMi4yLDEuMywxLjgsMi41TDEuOCwxMi41UTIuMiwxMy45LDMuMywxMy4zTDQuOCwxMi41QTAuMywwLjMsMCwxLDAsNC4yLDExLjNaPjwvcGF0aD48L3N2Zz48L3NwYW4%2BPC9hPjwvbGFiZWw%2BPC9kaXY%2BPC9hbXAtZml0LXRleHQ%2BPC9kaXY%2BPGRpdiBjbGFzcz1cInBuIGFiZ2ZcIiBpZD1zcHYyPjxsYWJlbCBjbGFzcz1cInNiIHNvXCIgZGF0YS12YXJzLWxhYmVsPW11dGVfc3VydmV5X29wdGlvbiBkYXRhLXZhcnMtbGFiZWwtaW5zdGFuY2U9OCBmb3I9c3ByMz48ZGl2PjxzcGFuPkFkIHdhcyBpbmFwcHJvcHJpYXRlPC9zcGFuPjwvZGl2PjwvbGFiZWw%2BPGxhYmVsIGNsYXNzPVwic2Igc29cIiBkYXRhLXZhcnMtbGFiZWw9bXV0ZV9zdXJ2ZXlfb3B0aW9uIGRhdGEtdmFycy1sYWJlbC1pbnN0YW5jZT0yIGZvcj1zcHIzPjxkaXY%2BPHNwYW4%2BU2VlbiB0aGlzIGFkIG11bHRpcGxlIHRpbWVzPC9zcGFuPjwvZGl2PjwvbGFiZWw%2BPGxhYmVsIGNsYXNzPVwic2Igc29cIiBkYXRhLXZhcnMtbGFiZWw9bXV0ZV9zdXJ2ZXlfb3B0aW9uIGRhdGEtdmFycy1sYWJlbC1pbnN0YW5jZT03IGZvcj1zcHIzPjxkaXY%2BPHNwYW4%2BTm90IGludGVyZXN0ZWQgaW4gdGhpcyBhZDwvc3Bhbj48L2Rpdj48L2xhYmVsPjxsYWJlbCBjbGFzcz1cInNiIHNvXCIgZGF0YS12YXJzLWxhYmVsPW11dGVfc3VydmV5X29wdGlvbiBkYXRhLXZhcnMtbGFiZWwtaW5zdGFuY2U9MyBmb3I9c3ByMz48ZGl2PjxzcGFuPkFkIGNvdmVyZWQgY29udGVudDwvc3Bhbj48L2Rpdj48L2xhYmVsPjwvZGl2PjxkaXYgY2xhc3M9XCJwbiBhYmdmXCIgaWQ9c3B2Mz48YW1wLWZpdC10ZXh0IGNsYXNzPVwiZmwgaS1hbXBodG1sLWxheW91dC1yZXNwb25zaXZlIGktYW1waHRtbC1sYXlvdXQtc2l6ZS1kZWZpbmVkXCIgaGVpZ2h0PTI1MCBpLWFtcGh0bWwtbGF5b3V0PXJlc3BvbnNpdmUgbGF5b3V0PXJlc3BvbnNpdmUgbWF4LWZvbnQtc2l6ZT0xNyBtaW4tZm9udC1zaXplPTggd2lkdGg9OTcwPjxpLWFtcGh0bWwtc2l6ZXIgc3R5bGU9ZGlzcGxheTpibG9jaztwYWRkaW5nLXRvcDoyNS43NzMyJTs%2BPC9pLWFtcGh0bWwtc2l6ZXI%2BPHNwYW4gaWQ9cGN0PlRoYW5rcy4gRmVlZGJhY2sgaW1wcm92ZXMgR29vZ2xlIGFkczwvc3Bhbj48L2FtcC1maXQtdGV4dD48L2Rpdj48ZGl2IGNsYXNzPVwicG4gYWJnZlwiIGlkPXNwdjQ%2BPGFtcC1maXQtdGV4dCBjbGFzcz1cImZsIGktYW1waHRtbC1sYXlvdXQtcmVzcG9uc2l2ZSBpLWFtcGh0bWwtbGF5b3V0LXNpemUtZGVmaW5lZFwiIGhlaWdodD0yNTAgaS1hbXBodG1sLWxheW91dD1yZXNwb25zaXZlIGxheW91dD1yZXNwb25zaXZlIG1heC1mb250LXNpemU9MjAgbWluLWZvbnQtc2l6ZT04IHdpZHRoPTk3MD48aS1hbXBodG1sLXNpemVyIHN0eWxlPWRpc3BsYXk6YmxvY2s7cGFkZGluZy10b3A6MjUuNzczMiU7PjwvaS1hbXBodG1sLXNpemVyPjxzcGFuIGNsYXNzPVwiY3QgZmN0XCI%2BQWQgY2xvc2VkIGJ5IDxzdmcgZmlsbD0jMDAwMDAwIHZpZXdib3g9XCIwIDAgNjAgMjRcIiB4bWxucz1odHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2Zz48cGF0aCBkPVwiTTcuNSAxNi4yOWMtNC4wNyAwLTcuNDktMy4zMS03LjQ5LTcuMzhTMy40MyAxLjUzIDcuNSAxLjUzYzIuMjUgMCAzLjg1Ljg4IDUuMDYgMi4wM2wtMS40MiAxLjQyYy0uODctLjgxLTIuMDQtMS40NC0zLjY0LTEuNDQtMi45NyAwLTUuMjkgMi40LTUuMjkgNS4zN3MyLjMyIDUuMzcgNS4yOSA1LjM3YzEuOTMgMCAzLjAzLS43NyAzLjczLTEuNDguNTgtLjU4Ljk1LTEuNCAxLjEtMi41NEg3LjVWOC4yNGg2Ljc5Yy4wNy4zNi4xMS43OS4xMSAxLjI2IDAgMS41MS0uNDEgMy4zOS0xLjc1IDQuNzItMS4zIDEuMzUtMi45NSAyLjA3LTUuMTUgMi4wN3ptMTcuNzUtNC43NmMwIDIuNzQtMi4xMyA0Ljc1LTQuNzUgNC43NXMtNC43NS0yLjAyLTQuNzUtNC43NWMwLTIuNzUgMi4xMy00Ljc1IDQuNzUtNC43NXM0Ljc1IDIgNC43NSA0Ljc1em0tMi4wOCAwYzAtMS43MS0xLjI0LTIuODgtMi42Ny0yLjg4cy0yLjY3IDEuMTctMi42NyAyLjg4YzAgMS42OSAxLjI0IDIuODggMi42NyAyLjg4czIuNjctMS4xOCAyLjY3LTIuODh6bTEzLjA4IDBjMCAyLjc0LTIuMTMgNC43NS00Ljc1IDQuNzVzLTQuNzUtMi4wMi00Ljc1LTQuNzVjMC0yLjc1IDIuMTMtNC43NSA0Ljc1LTQuNzVzNC43NSAyIDQuNzUgNC43NXptLTIuMDggMGMwLTEuNzEtMS4yNC0yLjg4LTIuNjctMi44OHMtMi42NyAxLjE3LTIuNjcgMi44OGMwIDEuNjkgMS4yNCAyLjg4IDIuNjcgMi44OHMyLjY3LTEuMTggMi42Ny0yLjg4em0xMi41OC00LjQ2djguNTNjMCAzLjUxLTIuMDcgNC45NS00LjUyIDQuOTUtMi4zIDAtMy42OS0xLjU1LTQuMjEtMi44MWwxLjgyLS43NmMuMzIuNzcgMS4xMiAxLjY5IDIuMzkgMS42OSAxLjU3IDAgMi41NC0uOTcgMi41NC0yLjc5di0uNjhoLS4wN2MtLjQ3LjU4LTEuMzcgMS4wOC0yLjUgMS4wOC0yLjM4IDAtNC41Ni0yLjA3LTQuNTYtNC43NCAwLTIuNjggMi4xOC00Ljc3IDQuNTYtNC43NyAxLjEzIDAgMi4wMy41IDIuNSAxLjA2aC4wN3YtLjc2aDEuOTh6bS0xLjg0IDQuNDhjMC0xLjY3LTEuMTItMi45LTIuNTQtMi45LTEuNDQgMC0yLjY1IDEuMjItMi42NSAyLjkgMCAxLjY2IDEuMjEgMi44NiAyLjY1IDIuODYgMS40My4wMSAyLjU0LTEuMiAyLjU0LTIuODZ6bTUuODktOS41MlYxNmgtMi4wOVYyLjAzaDIuMDl6bTguNDkgMTEuMDdsMS42MiAxLjA4Yy0uNTIuNzctMS43OCAyLjExLTMuOTYgMi4xMS0yLjcgMC00LjcyLTIuMDktNC43Mi00Ljc1IDAtMi44MyAyLjAzLTQuNzUgNC40OC00Ljc1IDIuNDcgMCAzLjY3IDEuOTYgNC4wNyAzLjAybC4yMi41NC02LjM2IDIuNjNjLjQ5Ljk1IDEuMjQgMS40NCAyLjMgMS40NCAxLjA3IDAgMS44MS0uNTMgMi4zNS0xLjMyem0tNC45OS0xLjcxbDQuMjUtMS43NmMtLjIzLS41OS0uOTQtMS4wMS0xLjc2LTEuMDEtMS4wNiAwLTIuNTQuOTMtMi40OSAyLjc3elwiPjwvcGF0aD48cGF0aCBkPVwiTTAgMGg2MnYyNEgwelwiIGZpbGw9bm9uZT48L3BhdGg%2BPC9zdmc%2BPC9zcGFuPjwvYW1wLWZpdC10ZXh0PjwvZGl2PjwvZm9ybT48L2Rpdj48L2Rpdj48&i=6-8&t=adltag_kevkyyx2_N28l834c9R&r=1c031d4bd52aedf9e7995ea20454bf9&c=math-aids-threatpost&z=1
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/b-9a4f7ce-a7f6098c.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.84.156.60 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-84-156-60.txl52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Wed, 09 Sep 2020 03:19:23 GMT
via: 1.1 5cf5bc69324ade55eebb5e539fa6c2fa.cloudfront.net (CloudFront)
age: 46348
x-cache: Error from cloudfront
status: 200
content-length: 0
last-modified: Mon, 15 Jun 2020 18:35:10 GMT
server: AmazonS3
etag: "d41d8cd98f00b204e9800998ecf8427e"
access-control-max-age: 3000
access-control-allow-methods: GET
x-amz-version-id: D2POxJleIt92FyXaxSi7iRHuNLtujALh
access-control-allow-origin: *
x-amz-cf-pop: TXL52-C1
accept-ranges: bytes
content-type: text/plain
x-amz-cf-id: 2ZRV1B21NaXqv2iP293r-Pmg_fPqPqJtapUHJ0iqOD0QPQGbM1AB7A==

POST
H2 200 tag
math-aids-threatpost-tagan.adlightning.com/ 0
428 B 59ms
47ms Other
text/plain 99.84.156.60
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://math-aids-threatpost-tagan.adlightning.com/tag?s=bl&d=L2Rpdj48YW1wLWFuYWx5dGljcyBjbGFzcz1cImktYW1waHRtbC1sYXlvdXQtZml4ZWQgaS1hbXBodG1sLWxheW91dC1zaXplLWRlZmluZWRcIiBpLWFtcGh0bWwtbGF5b3V0PWZpeGVkIHN0eWxlPXdpZHRoOjFweDtoZWlnaHQ6MXB4OyB0cmlnZ2VyPWltbWVkaWF0ZT48c2NyaXB0IHR5cGU9YXBwbGljYXRpb24vanNvbj57XCJ0cmFuc3BvcnRcIjoge1wiYmVhY29uXCI6IGZhbHNlLCBcInhocnBvc3RcIjogZmFsc2V9LFwicmVxdWVzdHNcIjoge1widmlzaWJpbGl0eTFcIjogXCJodHRwczovL3BhZ2VhZDIuZ29vZ2xlc3luZGljYXRpb24uY29tL3Bjcy9hY3RpdmV2aWV3P3hhaT1BS0FPanN2WXZCN0w2ZS1hRUVQSURpTzJ5bXhSNERVTmgtTDBsMHBTNFFXSHBORXVnTGhRYmxkelB2eEdhWG1hU282NUtSMlYyc1luRkxodWpGaERtSi1ON2hRcGhLc1VXMVhwek9pczZDalhSaE52TVFxS2UzQjRLSHVzUllST0dBJnNhaT1BTWZsLVlTZEJCYVhHWlA4b3ZsenI0NDVjUjZadTJHYk9tWS1taU9jby1wNGRhWkhwLWdFblJfRUtydElVd3hNc2JZZWNOb0w0S3I1bFJab0dOTUx4WjB3aVJJaWx6SUZncEp6OFNVN05MQnZxaHRPQTdCQWVHdHZvYWQ0YVM5VmpqVjMmc2lnPUNnMEFyS0pTekFvdjhIa2pMNTZDRUFFJmNpZD1DQUFTUGVSb09WLTZwSkxPUkZzYWRKeGFJVC1jdVowbmpHWGY4d0VhcnNCams4UERTNVp5bmgwZ0x2N2NyR1Bob2lyMjVGdHlYdlZ4WkRQQWZrM2xoTEkmaWQ9YW1waW0mbz0ke2VsZW1lbnRYfSwke2VsZW1lbnRZfSZkPSR7ZWxlbWVudFdpZHRofSwke2VsZW1lbnRIZWlnaHR9JnNzPSR7c2NyZWVuV2lkdGh9LCR7c2NyZWVuSGVpZ2h0fSZicz0ke3ZpZXdwb3J0V2lkdGh9LCR7dmlld3BvcnRIZWlnaHR9Jm1jdnQ9JHttYXhDb250aW51b3VzVmlzaWJsZVRpbWV9Jm10b3M9MCwwLDAsJHttYXhDb250aW51b3VzVmlzaWJsZVRpbWV9LCR7bWF4Q29udGludW91c1Zpc2libGVUaW1lfSZ0b3M9MCwwLDAsJHt0b3RhbFZpc2libGVUaW1lfSwwJnRmcz0ke2ZpcnN0U2VlblRpbWV9JnRscz0ke2xhc3RTZWVuVGltZX0mZz0ke21pblZpc2libGVQZXJjZW50YWdlfSZoPSR7bWF4VmlzaWJsZVBlcmNlbnRhZ2V9JnR0PSR7dG90YWxUaW1lfSZyPXYmYXZtcz1hbXBhJmFkaz0xMDE1NTE5ODAwXCJ9LFwidHJpZ2dlcnNcIjoge1wiY29udGludW91c1Zpc2libGVcIjoge1wib25cIjogXCJ2aXNpYmxlXCIsXCJyZXF1ZXN0XCI6IFtcInZpc2liaWxpdHkxXCJdLFwicGFyZW50UG9zdE1lc3NhZ2VcIjogXCJpbXByZXNzaW9uLXZpZXdhYmxlXCIsXCJ2aXNpYmlsaXR5U3BlY1wiOiB7XCJzZWxlY3RvclwiOiBcIjpyb290XCIsXCJ2aXNpYmxlUGVyY2VudGFnZU1pblwiOiAzMCxcImNvbnRpbnVvdXNUaW1lTWluXCI6IDEwMDB9fSxcInZpc2liaWxpdHlDaGFuZ2VkXCI6IHtcIm9uXCI6IFwidmlzaWJsZVwiLFwicGFyZW50UG9zdE1lc3NhZ2VcIjogXCJ2aXNpYmlsaXR5LWNoYW5nZWQtJHtpbnRlcnNlY3Rpb25SYXRpb31cIixcInZpc2liaWxpdHlTcGVjXCI6IHtcInJlcGVhdFwiOiB0cnVlLFwic2VsZWN0b3JcIjogXCI6cm9vdFwiLFwidmlzaWJsZVBlcmNlbnRhZ2VUaHJlc2hvbGRzXCI6IFtbMCwwXSxbMCw1XSxbNSwxMF0sWzEwLDE1XSxbMTUsMjBdLFsyMCwyNV0sWzI1LDMwXSxbMzAsMzVdLFszNSw0MF0sWzQwLDQ1XSxbNDUsNTBdLFs1MCw1NV0sWzU1LDYwXSxbNjAsNjVdLFs2NSw3MF0sWzcwLDc1XSxbNzUsODBdLFs4MCw4NV0sWzg1LDkwXSxbOTAsOTVdLFs5NSwxMDBdLFsxMDAsMTAwXV19fSxcImluaUxvYWRcIjoge1wib25cIjogXCJpbmktbG9hZFwiLFwicGFyZW50UG9zdE1lc3NhZ2VcIjogXCJ7XFxcImNcXFwiOlxcXCJzZmNoYW5uZWwxXFxcIixcXFwicFxcXCI6XFxcIntcXFxcXFxcInVpZFxcXFxcXFwiOlxcXFxcXFwiMVxcXFxcXFwiLFxcXFxcXFwid2lkdGhcXFxcXFxcIjoke3Njcm9sbFdpZHRofSxcXFxcXFxcImhlaWdodFxcXFxcXFwiOiR7c2Nyb2xsSGVpZ2h0fX1cXFwiLFxcXCJzXFxcIjpcXFwiY3JlYXRpdmVfZ2VvbWV0cnlfdXBkYXRlXFxcIn1cXG5cIn19fTwvc2NyaXB0PjwvYW1wLWFuYWx5dGljcz48YW1wLWFuYWx5dGljcyBjbGFzcz1cImktYW1waHRtbC1sYXlvdXQtZml4ZWQgaS1hbXBodG1sLWxheW91dC1zaXplLWRlZmluZWRcIiBpLWFtcGh0bWwtbGF5b3V0PWZpeGVkIHN0eWxlPXdpZHRoOjFweDtoZWlnaHQ6MXB4OyB0cmlnZ2VyPWltbWVkaWF0ZT48c2NyaXB0IHR5cGU9YXBwbGljYXRpb24vanNvbj57XCJ0cmFuc3BvcnRcIjoge1wiYmVhY29uXCI6IHRydWUsIFwieGhycG9zdFwiOiBmYWxzZX0sXCJyZXF1ZXN0c1wiOiB7XCJhbXBlb3NcIjogXCJodHRwczovL3BhZ2VhZDIuZ29vZ2xlc3luZGljYXRpb24uY29tL3Bjcy9hY3RpdmV2aWV3P3hhaT1BS0FPanN2WXZCN0w2ZS1hRUVQSURpTzJ5bXhSNERVTmgtTDBsMHBTNFFXSHBORXVnTGhRYmxkelB2eEdhWG1hU282NUtSMlYyc1luRkxodWpGaERtSi1ON2hRcGhLc1VXMVhwek9pczZDalhSaE52TVFxS2UzQjRLSHVzUllST0dBJnNhaT1BTWZsLVlTZEJCYVhHWlA4b3ZsenI0NDVjUjZadTJHYk9tWS1taU9jby1wNGRhWkhwLWdFblJfRUtydElVd3hNc2JZZWNOb0w0S3I1bFJab0dOTUx4WjB3aVJJaWx6SUZncEp6OFNVN05MQnZxaHRPQTdCQWVHdHZvYWQ0YVM5VmpqVjMmc2lnPUNnMEFyS0pTekFvdjhIa2pMNTZDRUFFJmNpZD1DQUFTUGVSb09WLTZwSkxPUkZzYWRKeGFJVC1jdVowbmpHWGY4d0VhcnNCams4UERTNVp5bmgwZ0x2N2NyR1Bob2lyMjVGdHlYdlZ4WkRQQWZrM2xoTEkmaWQ9YW1wZW9zJm89JHtlbGVtZW50WH0sJHtlbGVtZW50WX0mZD0ke2VsZW1lbnRXaWR0aH0sJHtlbGVtZW50SGVpZ2h0fSZzcz0ke3NjcmVlbldpZHRofSwke3NjcmVlbkhlaWdodH0mYnM9JHt2aWV3cG9ydFdpZHRofSwke3ZpZXdwb3J0SGVpZ2h0fSZtY3Z0PSR7bWF4Q29udGludW91c1Zpc2libGVUaW1lfSZtdG9zPTAsMCwwLCR7bWF4Q29udGludW91c1Zpc2libGVUaW1lfSwke21heENvbnRpbnVvdXNWaXNpYmxlVGltZX0mdG9zPTAsMCwwLCR7dG90YWxWaXNpYmxlVGltZX0sMCZ0ZnM9JHtmaXJzdFNlZW5UaW1lfSZ0bHM9JHtsYXN0U2VlblRpbWV9Jmc9JHttaW5WaXNpYmxlUGVyY2VudGFnZX0maD0ke21heFZpc2libGVQZXJjZW50YWdlfSZwdD0ke3BhZ2VMb2FkVGltZX0mdHQ9JHt0b3RhbFRpbWV9JnJwdD0ke25hdlRpbWluZyhuYXZpZ2F0aW9uU3RhcnQsbG9hZEV2ZW50U3RhcnQpfSZyc3Q9JHtuYXZUaW1pbmcobmF2aWdhdGlvblN0YXJ0KX0mcj1kZSZpc2Q9JHtpbml0aWFsU2Nyb2xsRGVwdGh9Jm1zZD0ke21heFNjcm9sbERlcHRofSZhdm1zPWFtcGFcIn0sXCJ0cmlnZ2Vyc1wiOiB7XCJlbmRPZlNlc3Npb25cIjoge1wib25cIjogXCJ2aXNpYmxlXCIsXCJyZXF1ZXN0XCI6IFwiYW1wZW9zXCIsXCJ2aXNpYmlsaXR5U3BlY1wiOiB7XCJyZXBvcnRXaGVuXCI6IFwiZG9jdW1lbnRFeGl0XCIsXCJzZWxlY3RvclwiOiBcIjpyb290XCIsXCJ2aXNpYmxlUGVyY2VudGFnZU1pblwiOiAzMH19fX08L3NjcmlwdD48L2FtcC1hbmFseXRpY3M%2BPGFtcC1waXhlbCBhbGxvdy1zc3ItaW1nIGNsYXNzPVwiaS1hbXBodG1sLWxheW91dC1maXhlZCBpLWFtcGh0bWwtbGF5b3V0LXNpemUtZGVmaW5lZFwiIGktYW1waHRtbC1sYXlvdXQ9Zml4ZWQgaS1hbXBodG1sLXNzciBzcmM9XCIvL3d3dy5nb29nbGUuY29tL2Fkcy9tZWFzdXJlbWVudC9sP2ViY2lkPUFMaDdDYVFWQl9wMkkwVThCQk90dFJzWXVDTWI3TGxjY3h2bUhETzZHcmxjX2Z0UGh3eWxWaTJWUDl4UzNEcV9veXpNMUpQYnMwQ0tcIiBzdHlsZT13aWR0aDoxcHg7aGVpZ2h0OjFweDs%2BPGltZyBzcmM9XCIvL3d3dy5nb29nbGUuY29tL2Fkcy9tZWFzdXJlbWVudC9sP2ViY2lkPUFMaDdDYVFWQl9wMkkwVThCQk90dFJzWXVDTWI3TGxjY3h2bUhETzZHcmxjX2Z0UGh3eWxWaTJWUDl4UzNEcV9veXpNMUpQYnMwQ0tcIj48L2FtcC1waXhlbD48ZGl2IHN0eWxlPVwiYm90dG9tOjA7cmlnaHQ6MDt3aWR0aDo5NzBweDtoZWlnaHQ6MjUwcHg7YmFja2dyb3VuZDppbml0aWFsO3Bvc2l0aW9uOmFic29sdXRlO21heC13aWR0aDoxMDAlO21heC1oZWlnaHQ6MTAwJTtwb2ludGVyLWV2ZW50czpub25lO2ltYWdlLXJlbmRlcmluZzpwaXhlbGF0ZWQ7ei1pbmRleDoyMTQ3NDgzNjQ3O2JhY2tncm91bmQtaW1hZ2U6dXJsKCYjMzk7ZGF0YTppbWFnZS9wbmc7YmFzZTY0LGlWQk9SdzBLR2dvQUFBQU5TVWhFVWdBQUFDc0FBQUFXQkFNQUFBQ3JsM2lBQUFBQUJsQk1WRVVBQUFEK0FjaVdtWnpXQUFBQUFuUlNUbE1BQXBpZHJCUUFBQUI0U1VSQlZCalRiWkdKRGNBZ0RBT1BEYnovdEtYNW9ZMFFCdFVjSm9YL1dsNWI5N3AySVB1cUdMa3pCNnZWWm5OSU5oT3E2VjVGNTJEajdtQm5rdVJIa2lycHlrMDRYK2hnNnlTN0xFaHZCRWwzSFRIMTNEUzNMcGxCcHIrVGRuYzRYcG1kWVhpb0UzdzZHRzI4aVpXNjJlN0wwZit5dWZBQUhIY0ZrYWlVcys4QUFBQUFTVVZPUks1Q1lJST0mIzM5Oyk7XCI%2BPC9kaXY%2BPGFtcC1waXhlbCBhbGxvdy1zc3ItaW1nIGNsYXNzPVwiaS1hbXBodG1sLWxheW91dC1maXhlZCBpLWFtcGh0bWwtbGF5b3V0LXNpemUtZGVmaW5lZFwiIGktYW1waHRtbC1sYXlvdXQ9Zml4ZWQgaS1hbXBodG1sLXNzciBzcmM9XCJodHRwczovL3NlY3VyZXB1YmFkcy5nLmRvdWJsZWNsaWNrLm5ldC9wYWdlYWQvYWR2aWV3P2FpPUM5NTMweGY1WVg5T2hJSlNSckFUQmo1ZUFDUGlVMEs5ZHVxQzBqSmtNdi1FZUVBRWcwWWZTSUdDUmhJQ0FfQmVnQWZHRF9aVUR5QUVDNEFJQXFBTUJ5QU1JcWdUOEFVX1E5X3N3TGp4MW1idUkteEdULUJEN2x2YkptWFFQY05xWnhTT1RSRkhiMlphTURpVkdsVU5ReFdJaHIwc3VoaGxOVnUzZHBMNjJ4aWtqMlYydy1kN2dyTXk3SWxKWkxDRDYtZHE0dWJmQ2p5eDFkQmdVVFBSMlFxRUZkRmU3RFh0TmowQWYxMzFPTE9NYUlVMk5Wb01vcklMTDlNSVNBdl84RWxabEh2QUwwb29ucVBGWTVUMHNVMmFlRWxWQTBoOVl5UTJWWGliaGFMSG5IY2NrVHdxbkdVc3ZUNHZRZkhRNUwzSTZZUzU3d3JqX1FfODltbnQ2RndaUXkteF9KaWlGQXJ3TzZXQkE0eElxMGU5N0hMQ0lheEF1QldIeG1fRXhsWGRGQkVVSXBTU295SDNxYTMzdlVKRzd6a2d6UTRCZXR4cFlnaDEyUzFMLWtzQUVwSWlQamJVQzRBUUJrZ1VFQ0FRWUFaSUZCQWdGR0FTZ0JnS0FCOTdBdTMyb0I0N09HNmdIMWNrYnFBZVQyQnVvQjdvR3FBZncyUnVvQl9MWkc2Z0hwcjRicUFmczFSdllCd0h5QndRUTI2OE8wZ2dKQ0lEaGdFQVFBUmdkOGdnYllXUjRMWE4xWW5ONWJpMDNNall6TlRjek5EUTJPREEwTURjNGdBb0R5QXNCMkJNTSZhbXA7c2lnaD01c1VZRVpkX0NTYyZhbXA7dHBkPUFHV2hKbXNDd2tkQmRRSjJnU05kbXJMVjJTdWo1Um1lc1hMcEVFNVkzYkRvVlpLS2pRXCIgc3R5bGU9d2lkdGg6MXB4O2hlaWdodDoxcHg7PjxpbWcgc3JjPVwiaHR0cHM6Ly9zZWN1cmVwdWJhZHMuZy5kb3VibGVjbGljay5uZXQvcGFnZWFkL2Fkdmlldz9haT1DOTUzMHhmNVlYOU9oSUpTUnJBVEJqNWVBQ1BpVTBLOWR1cUMwakprTXYtRWVFQUVnMFlmU0lHQ1JoSUNBX0JlZ0FmR0RfWlVEeUFFQzRBSUFxQU1CeUFNSXFnVDhBVV9ROV9zd0xqeDFtYnVJLXhHVC1CRDdsdmJKbVhRUGNOcVp4U09UUkZIYjJaYU1EaVZHbFVOUXhXSWhyMHN1aGhsTlZ1M2RwTDYyeGlrajJWMnctZDdnck15N0lsSlpMQ0Q2LWRxNHViZkNqeXgxZEJnVVRQUjJRcUVGZEZlN0RYdE5qMEFmMTMxT0xPTWFJVTJOVm9Nb3JJTEw5TUlTQXZfOEVsWmxIdkFMMG9vbnFQRlk1VDBzVTJhZUVsVkEwaDlZeVEyVlhpYmhhTEhuSGNja1R3cW5HVXN2VDR2UWZIUTVMM0k2WVM1N3dyal9RXzg5bW50NkZ3WlF5LXhfSmlpRkFyd082V0JBNHhJcTBlOTdITENJYXhBdUJXSHhtX0V4bFhkRkJFVUlwU1NveUgzcWEzM3ZVSkc3emtnelE0QmV0eHBZZ2gxMlMxTC1rc0FFcElpUGpiVUM0QVFCa2dVRUNBUVlBWklGQkFnRkdBU2dCZ0tBQjk3QXUzMm9CNDdPRzZnSDFja2JxQWVUMkJ1b0I3b0dxQWZ3MlJ1b0JfTFpHNmdIcHI0YnFBZnMxUnZZQndIeUJ3UVEy&i=7-8&t=adltag_kevkyyx2_N28l834c9R&r=1c031d4bd52aedf9e7995ea20454bf9&c=math-aids-threatpost&z=1
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/b-9a4f7ce-a7f6098c.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.84.156.60 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-84-156-60.txl52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Wed, 09 Sep 2020 03:19:23 GMT
via: 1.1 5cf5bc69324ade55eebb5e539fa6c2fa.cloudfront.net (CloudFront)
age: 46348
x-cache: Error from cloudfront
status: 200
content-length: 0
last-modified: Mon, 15 Jun 2020 18:35:10 GMT
server: AmazonS3
etag: "d41d8cd98f00b204e9800998ecf8427e"
access-control-max-age: 3000
access-control-allow-methods: GET
x-amz-version-id: D2POxJleIt92FyXaxSi7iRHuNLtujALh
access-control-allow-origin: *
x-amz-cf-pop: TXL52-C1
accept-ranges: bytes
content-type: text/plain
x-amz-cf-id: ptf8C5sKZT_przCpInfQ_exxnIGaGlNfMu1k8QJQbXs-9TXTSSGqlQ==

POST
H2 200 tag
math-aids-threatpost-tagan.adlightning.com/ 0
427 B 59ms
48ms Other
text/plain 99.84.156.60
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://math-aids-threatpost-tagan.adlightning.com/tag?s=bl&d=NjhPMGdnSkNJRGhnRUFRQVJnZDhnZ2JZV1I0TFhOMVluTjViaTAzTWpZek5UY3pORFEyT0RBME1EYzRnQW9EeUFzQjJCTU0mYW1wO3NpZ2g9NXNVWUVaZF9DU2MmYW1wO3RwZD1BR1doSm1zQ3drZEJkUUoyZ1NOZG1yTFYyU3VqNVJtZXNYTHBFRTVZM2JEb1ZaS0tqUVwiPjwvYW1wLXBpeGVsPjxhbXAtYWQtZXhpdCBjbGFzcz1pLWFtcGh0bWwtbGF5b3V0LWNvbnRhaW5lciBpLWFtcGh0bWwtbGF5b3V0PWNvbnRhaW5lciBpZD1leGl0LWFwaT48c2NyaXB0IHR5cGU9YXBwbGljYXRpb24vanNvbj57XCJmaWx0ZXJzXCI6e30sXCJvcHRpb25zXCI6e1wic3RhcnRUaW1pbmdFdmVudFwiOlwibmF2aWdhdGlvblN0YXJ0XCJ9LFwidGFyZ2V0c1wiOntcImxhbmRpbmdQYWdlXCI6e1wiZmlsdGVyc1wiOltdLFwiZmluYWxVcmxcIjpcImh0dHBzOi8vd3d3Lm5ld2NoaWMuY29tL3RoZW1lLXdvbWVuLXQtMzQwOTA1Lz9jbGVhblNxbD0xXFx1MDAyNnV0bV9zb3VyY2U9Z29vZ2xlXFx1MDAyNnV0bV9tZWRpdW09Y3BjX2FkczJcXHUwMDI2dXRtX2NhbXBhaWduPWNuZXctd3Mtbi1jbDA5MDUtd29yLWF1MTQtOTdcXHUwMDI2dXRtX2NvbnRlbnQ9bGVlclxcdTAwMjZ1dG1fZGVzaWduPVxcdTAwMjZhZF9pZD00NTY3MDY0NjQ4NzlcXHUwMDI2Z2NsaWQ9RUFJYUlRb2JDaE1JazVpR3JMdmM2d0lWbEFpTENoM0J4d1dBRUFFWUFTQUFFZ0twLWZEX0J3RVwiLFwidHJhY2tpbmdVcmxzXCI6W1wiaHR0cHM6Ly9nb29nbGVhZHMuZy5kb3VibGVjbGljay5uZXQvYWNsaz9zYT1sXFx1MDAyNmFpPUNOYU1oeGY1WVg5T2hJSlNSckFUQmo1ZUFDUGlVMEs5ZHVxQzBqSmtNdi1FZUVBRWcwWWZTSUdDUmhJQ0FfQmVnQWZHRF9aVUR5QUVDNEFJQXFBTUJ5QU1JcWdUX0FVX1E5X3N3TGp4MW1idUkteEdULUJEN2x2YkptWFFQY05xWnhTT1RSRkhiMlphTURpVkdsVU5ReFdJaHIwc3VoaGxOVnUzZHBMNjJ4aWtqMlYydy1kN2dyTXk3SWxKWkxDRDYtZHE0dWJmQ2p5eDFkQmdVVFBSMlFxRUZkRmU3RFh0TmowQWYxMzFPTE9NYUlVMk5Wb01vcklMTDlNSVNBdl84RWxabEh2QUwwb29ucVBGWTVUMHNVMmFlRWxWQTBoOVl5UTJWWGliaGFMSG5IY2NrVHdxbkdVc3ZUNHZRZkhRNUwzSTZZUzU3d3JqX1FfODltbnQ2RndaUXkteF9KaWlGQXJ3TzZXQkE0eElxMGU5N0hMQ0lheEF1QldIeG1fRXhsWGRGQkVVSXBTU295SDNxYTMzdlVKRzd6Z294VFJLU0NlbGdKdTVDOHBla0tnNnQxc0FFcElpUGpiVUM0QVFCb0FZQ2dBZmV3THQ5cUFlT3podW9COVhKRzZnSGs5Z2JxQWU2QnFnSDhOa2JxQWZ5MlJ1b0I2YS1HNmdIN05VYnFBZnowUnVvQi16Vkc2Z0hsdGdicUFmQzJodllCd0hTQ0FrSWdPR0FRQkFCR0IzeUNCdGhaSGd0YzNWaWMzbHVMVGN5TmpNMU56TTBORFk0TURRd056aXhDVkVaRTB2cHJPTGRnQW9EbUFzQnlBc0IyQk1NXFx1MDAyNmFlPTFcXHUwMDI2bnVtPTFcXHUwMDI2Y2lkPUNBQVNQZVJvT1YtNnBKTE9SRnNhZEp4YUlULWN1WjBuakdYZjh3RWFyc0JqazhQRFM1WnluaDBnTHY3Y3JHUGhvaXIyNUZ0eVh2VnhaRFBBZmszbGhMSVxcdTAwMjZzaWc9QU9ENjRfMnFVY2JobXhwQlB6WWNnSE9vbHhwTDZfVkt0Z1xcdTAwMjZjbGllbnQ9Y2EtcHViLTk2ODU3MzQ0NDU0NzY4MTRcXHUwMDI2bmI9X25iXFx1MDAyNm54PUNMSUNLX1hcXHUwMDI2bnk9Q0xJQ0tfWVxcdTAwMjZhY3Q9MVxcdTAwMjZyaT0xXFx1MDAyNmFkdXJsPWh0dHBzOi8vd3d3Lm5ld2NoaWMuY29tL3RoZW1lLXdvbWVuLXQtMzQwOTA1LyUzRmNsZWFuU3FsJTNEMSUyNnV0bV9zb3VyY2UlM0Rnb29nbGUlMjZ1dG1fbWVkaXVtJTNEY3BjX2FkczIlMjZ1dG1fY2FtcGFpZ24lM0RjbmV3LXdzLW4tY2wwOTA1LXdvci1hdTE0LTk3JTI2dXRtX2NvbnRlbnQlM0RsZWVyJTI2dXRtX2Rlc2lnbiUzRCUyNmFkX2lkJTNENDU2NzA2NDY0ODc5JTI2Z2NsaWQlM0RFQUlhSVFvYkNoTUlrNWlHckx2YzZ3SVZsQWlMQ2gzQnh3V0FFQUVZQVNBQUVnS3AtZkRfQndFXCJdLFwidmFyc1wiOntcIl9uYlwiOntcImRlZmF1bHRWYWx1ZVwiOlwiXCIsXCJpZnJhbWVUcmFuc3BvcnRTaWduYWxcIjpcIlwifX19fX08L3NjcmlwdD48L2FtcC1hZC1leGl0PjwvYm9keT48L2h0bWw%2BIiwibWV0aG9kQmxvY2tlZCI6ImluaXRpYWxERlAtd3JpdGUifSwiYmxvY2tlZCI6dHJ1ZSwiY2FsbFN0YWNrIjoiRXJyb3JcbiAgICBhdCBhQyAoaHR0cHM6Ly90YWdhbi5hZGxpZ2h0bmluZy5jb20vbWF0aC1haWRzLXRocmVhdHBvc3QvYi05YTRmN2NlLWE3ZjYwOThjLmpzOjE6MjAyNzApXG4gICAgYXQgYU0gKGh0dHBzOi8vdGFnYW4uYWRsaWdodG5pbmcuY29tL21hdGgtYWlkcy10aHJlYXRwb3N0L2ItOWE0ZjdjZS1hN2Y2MDk4Yy5qczoxOjIzODI4KVxuICAgIGF0IEhUTUxEb2N1bWVudC48YW5vbnltb3VzPiAoaHR0cHM6Ly90YWdhbi5hZGxpZ2h0bmluZy5jb20vbWF0aC1haWRzLXRocmVhdHBvc3Qvb3AuanM6MToyMzMzOClcbiAgICBhdCBVdiAoaHR0cHM6Ly9zZWN1cmVwdWJhZHMuZy5kb3VibGVjbGljay5uZXQvZ3B0L3B1YmFkc19pbXBsXzIwMjAwOTAyMDEuanM6NjoyMDM0NTUpXG4gICAgYXQgdHcubCAoaHR0cHM6Ly9zZWN1cmVwdWJhZHMuZy5kb3VibGVjbGljay5uZXQvZ3B0L3B1YmFkc19pbXBsXzIwMjAwOTAyMDEuanM6NjoyMDk2NjUpXG4gICAgYXQgbXcgKGh0dHBzOi8vc2VjdXJlcHViYWRzLmcuZG91YmxlY2xpY2submV0L2dwdC9wdWJhZHNfaW1wbF8yMDIwMDkwMjAxLmpzOjY6MjA2NzUzKVxuICAgIGF0IHd3LmogKGh0dHBzOi8vc2VjdXJlcHViYWRzLmcuZG91YmxlY2xpY2submV0L2dwdC9wdWJhZHNfaW1wbF8yMDIwMDkwMjAxLmpzOjY6MjExMTk3KVxuICAgIGF0IEVjLmwgKGh0dHBzOi8vc2VjdXJlcHViYWRzLmcuZG91YmxlY2xpY2submV0L2dwdC9wdWJhZHNfaW1wbF8yMDIwMDkwMjAxLmpzOjY6MTMzNTI4KVxuICAgIGF0IEdjIChodHRwczovL3NlY3VyZXB1YmFkcy5nLmRvdWJsZWNsaWNrLm5ldC9ncHQvcHViYWRzX2ltcGxfMjAyMDA5MDIwMS5qczo2OjEyODkxKVxuICAgIGF0IEljLm5leHQgKGh0dHBzOi8vc2VjdXJlcHViYWRzLmcuZG91YmxlY2xpY2submV0L2dwdC9wdWJhZHNfaW1wbF8yMDIwMDkwMjAxLmpzOjY6MTMxODMpIn0%3D&i=8-8&t=adltag_kevkyyx2_N28l834c9R&r=1c031d4bd52aedf9e7995ea20454bf9&c=math-aids-threatpost&z=1
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/b-9a4f7ce-a7f6098c.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.84.156.60 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-84-156-60.txl52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Wed, 09 Sep 2020 03:19:23 GMT
via: 1.1 5cf5bc69324ade55eebb5e539fa6c2fa.cloudfront.net (CloudFront)
age: 46348
x-cache: Error from cloudfront
status: 200
content-length: 0
last-modified: Mon, 15 Jun 2020 18:35:10 GMT
server: AmazonS3
etag: "d41d8cd98f00b204e9800998ecf8427e"
access-control-max-age: 3000
access-control-allow-methods: GET
x-amz-version-id: D2POxJleIt92FyXaxSi7iRHuNLtujALh
access-control-allow-origin: *
x-amz-cf-pop: TXL52-C1
accept-ranges: bytes
content-type: text/plain
x-amz-cf-id: oz2E89DQjt5-mKHSIdSeJBWJZOmCBqoetiEzdE1LZbfhfd5fPtGE5Q==

GET
H2 200 bl-9a4f7ce-ca40eed9.js Show response
tagan.adlightning.com/math-aids-threatpost/ Frame EFC4 79 KB
22 KB 36ms
35ms Script
application/javascript 99.84.156.34
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/math-aids-threatpost/bl-9a4f7ce-ca40eed9.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.84.156.34 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-84-156-34.txl52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 82e2369bfee3725eb4f4ef3af5431637009a89ac42f4e6da6f68e66d3b034788

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 09 Sep 2020 03:12:51 GMT
content-encoding: gzip
age: 46740
x-cache: Hit from cloudfront
status: 200
content-length: 22389
x-amz-meta-git_commit: 9a4f7ce
last-modified: Tue, 08 Sep 2020 22:17:44 GMT
server: AmazonS3
etag: "79e00495b70f820a38b6b36c3f2f8ff5"
x-amz-version-id: F.XN1SsPf_y4x2xIDo65TAplqCsfb9A2
via: 1.1 df792ea3bbbe656e2f5c7b61aa85cc47.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: TXL52-C1
accept-ranges: bytes
content-type: application/javascript
x-amz-cf-id: b-vKbWUlnTpOHevezHChUpfNfdF-B2hgQ0XJVH7S749NtXZuHoCN-Q==

GET
H2 200 b-9a4f7ce-a7f6098c.js Show response
tagan.adlightning.com/math-aids-threatpost/ Frame EFC4 61 KB
21 KB 41ms
41ms Script
application/javascript 99.84.156.34
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/math-aids-threatpost/b-9a4f7ce-a7f6098c.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.84.156.34 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-84-156-34.txl52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 0119689800eadf6270855a19b65d74251e7da6be5e4686f36c15bf81281ddb4c

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 07 Sep 2020 01:11:01 GMT
content-encoding: gzip
age: 226850
x-cache: Hit from cloudfront
status: 200
content-length: 20808
x-amz-meta-git_commit: 9a4f7ce
last-modified: Tue, 18 Aug 2020 17:45:57 GMT
server: AmazonS3
etag: "98ae1c21c96b68b5f173604d82c35d5d"
x-amz-version-id: PzdVsYQ0bdCd7Kp..jKBw4vE53Z4BW7z
via: 1.1 df792ea3bbbe656e2f5c7b61aa85cc47.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: TXL52-C1
accept-ranges: bytes
content-type: application/javascript
x-amz-cf-id: VptU-3Ye3sJv_FkgfVE1crTvIMuJ8hoVuc7gAydky_EIXynWj6ildw==

POST
H2 200 tag
math-aids-threatpost-tagan.adlightning.com/ 0
428 B 61ms
50ms Other
text/plain 99.84.156.60
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://math-aids-threatpost-tagan.adlightning.com/tag?s=bl&d=eyJzaXRlSWQiOiJtYXRoLWFpZHMtdGhyZWF0cG9zdCIsInVybCI6Imh0dHBzOi8vdGhyZWF0cG9zdC5jb20vc2hsYXllci1tYWMtbWFsd2FyZS1leHRyYS1zbmVha2luZXNzLzE1NjY2OS8%2Fd2ViX3ZpZXc9dHJ1ZSIsImFkVW5pdCI6Ii8yMTcwNzEyNDMzNi9UaHJlYXRQb3N0LTMwMHg2MDAtQVRGXzAiLCJhZFNlcnZlckRldGFpbHMiOnsiYWR2ZXJ0aXNlcklkIjoiNDU5NDU1OTc1MiIsImNhbXBhaWduSWQiOiIyNjU0MDI1MDM5IiwiY3JlYXRpdmVJZCI6IjEzODMwMTEzMDEzMyIsImxpbmVpdGVtSWQiOiI1Mjc1NjY4OTA3IiwiYWRTZXJ2ZXIiOiJkZnAifSwid2lkdGgiOjMwMCwiaGVpZ2h0IjoyNTAsInd2IjoiMS4wLjArOWE0ZjdjZSIsImJ2IjoiMS4wLjArOWE0ZjdjZSIsInRhZ01hcmt1cCI6IjxpZnJhbWUgaWQ9XCJnb29nbGVfYWRzX2lmcmFtZV8vMjE3MDcxMjQzMzYvVGhyZWF0UG9zdC0zMDB4NjAwLUFURl8wXCIgdGl0bGU9XCIzcmQgcGFydHkgYWQgY29udGVudFwiIG5hbWU9XCJnb29nbGVfYWRzX2lmcmFtZV8vMjE3MDcxMjQzMzYvVGhyZWF0UG9zdC0zMDB4NjAwLUFURl8wXCIgd2lkdGg9XCIzMDBcIiBoZWlnaHQ9XCI2MDBcIiBzY3JvbGxpbmc9XCJub1wiIG1hcmdpbndpZHRoPVwiMFwiIG1hcmdpbmhlaWdodD1cIjBcIiBmcmFtZWJvcmRlcj1cIjBcIiBzcmNkb2M9XCJcIiBzYW5kYm94PVwiYWxsb3ctZm9ybXMgYWxsb3ctcG9wdXBzIGFsbG93LXBvcHVwcy10by1lc2NhcGUtc2FuZGJveCBhbGxvdy1wb2ludGVyLWxvY2sgYWxsb3ctc2FtZS1vcmlnaW4gYWxsb3ctc2NyaXB0cyBhbGxvdy10b3AtbmF2aWdhdGlvbi1ieS11c2VyLWFjdGl2YXRpb25cIiBzdHlsZT1cImJvcmRlcjogMHB4OyB2ZXJ0aWNhbC1hbGlnbjogYm90dG9tO1wiPjwvaWZyYW1lPjwhLS0gSUZSQU1FIElOTkVSIENPTlRFTlQgLS0%2BIiwiYmxhY2tsaXN0RGF0YSI6eyJhY3Rpb24iOjEwLCJhY3Rpb25EZXRhaWxzIjoibmV3Y2hpYy5jb20iLCJyZXBvcnRNYXJrdXAiOnRydWUsIml0ZW1zIjpbeyJob3N0bmFtZSI6Im5ld2NoaWMuY29tIiwidG9rZW4iOiIiLCJhY3Rpb24iOjEwfV0sIm1hcmt1cCI6IjwhZG9jdHlwZSBodG1sPjxodG1sIGFtcDRhZHMgY2xhc3M9aS1hbXBodG1sLWluYWJveCBpLWFtcGh0bWwtbGF5b3V0IGktYW1waHRtbC1uby1ib2lsZXJwbGF0ZT48aGVhZD48bWV0YSBuYW1lPVwicmVmZXJyZXJcIiBjb250ZW50PVwib3JpZ2luXCI%2BPG1ldGEgaHR0cC1lcXVpdj1Db250ZW50LVNlY3VyaXR5LVBvbGljeSBjb250ZW50PVwic2NyaXB0LXNyYyBodHRwczovL2Nkbi5hbXBwcm9qZWN0Lm9yZy87b2JqZWN0LXNyYyAnbm9uZSc7Y2hpbGQtc3JjIGJsb2I6O2ZyYW1lLXNyYyAnbm9uZSdcIj48bWV0YSBjaGFyc2V0PXV0Zi04PjxzdHlsZSBhbXAtcnVudGltZSBpLWFtcGh0bWwtdmVyc2lvbj0wMTIwMDgyNDIzMDEwMDA%2BaHRtbHtvdmVyZmxvdy14OmhpZGRlbiFpbXBvcnRhbnR9aHRtbC5pLWFtcGh0bWwtZmlle2hlaWdodDoxMDAlIWltcG9ydGFudDt3aWR0aDoxMDAlIWltcG9ydGFudH1odG1sOm5vdChbYW1wNGFkc10pLGh0bWw6bm90KFthbXA0YWRzXSkgYm9keXtoZWlnaHQ6YXV0byFpbXBvcnRhbnR9aHRtbDpub3QoW2FtcDRhZHNdKSBib2R5e21hcmdpbjowIWltcG9ydGFudH1ib2R5ey13ZWJraXQtdGV4dC1zaXplLWFkanVzdDoxMDAlOy1tb3otdGV4dC1zaXplLWFkanVzdDoxMDAlOy1tcy10ZXh0LXNpemUtYWRqdXN0OjEwMCU7dGV4dC1zaXplLWFkanVzdDoxMDAlfWh0bWwuaS1hbXBodG1sLXNpbmdsZWRvYy5pLWFtcGh0bWwtZW1iZWRkZWR7LW1zLXRvdWNoLWFjdGlvbjpwYW4teTt0b3VjaC1hY3Rpb246cGFuLXl9aHRtbC5pLWFtcGh0bWwtZmllPmJvZHksaHRtbC5pLWFtcGh0bWwtc2luZ2xlZG9jPmJvZHl7b3ZlcmZsb3c6dmlzaWJsZSFpbXBvcnRhbnR9aHRtbC5pLWFtcGh0bWwtZmllOm5vdCguaS1hbXBodG1sLWluYWJveCk%2BYm9keSxodG1sLmktYW1waHRtbC1zaW5nbGVkb2M6bm90KC5pLWFtcGh0bWwtaW5hYm94KT5ib2R5e3Bvc2l0aW9uOnJlbGF0aXZlIWltcG9ydGFudH1odG1sLmktYW1waHRtbC13ZWJ2aWV3PmJvZHl7b3ZlcmZsb3cteDpoaWRkZW4haW1wb3J0YW50O292ZXJmbG93LXk6dmlzaWJsZSFpbXBvcnRhbnQ7bWluLWhlaWdodDoxMDB2aCFpbXBvcnRhbnR9aHRtbC5pLWFtcGh0bWwtaW9zLWVtYmVkLWxlZ2FjeT5ib2R5e292ZXJmbG93LXg6aGlkZGVuIWltcG9ydGFudDtvdmVyZmxvdy15OmF1dG8haW1wb3J0YW50O3Bvc2l0aW9uOmFic29sdXRlIWltcG9ydGFudH1odG1sLmktYW1waHRtbC1pb3MtZW1iZWR7b3ZlcmZsb3cteTphdXRvIWltcG9ydGFudDtwb3NpdGlvbjpzdGF0aWN9I2ktYW1waHRtbC13cmFwcGVye292ZXJmbG93LXg6aGlkZGVuIWltcG9ydGFudDtvdmVyZmxvdy15OmF1dG8haW1wb3J0YW50O3Bvc2l0aW9uOmFic29sdXRlIWltcG9ydGFudDt0b3A6MCFpbXBvcnRhbnQ7bGVmdDowIWltcG9ydGFudDtyaWdodDowIWltcG9ydGFudDtib3R0b206MCFpbXBvcnRhbnQ7bWFyZ2luOjAhaW1wb3J0YW50O2Rpc3BsYXk6YmxvY2shaW1wb3J0YW50fWh0bWwuaS1hbXBodG1sLWlvcy1lbWJlZC5pLWFtcGh0bWwtaW9zLW92ZXJzY3JvbGwsaHRtbC5pLWFtcGh0bWwtaW9zLWVtYmVkLmktYW1waHRtbC1pb3Mtb3ZlcnNjcm9sbD4jaS1hbXBodG1sLXdyYXBwZXJ7LXdlYmtpdC1vdmVyZmxvdy1zY3JvbGxpbmc6dG91Y2ghaW1wb3J0YW50fSNpLWFtcGh0bWwtd3JhcHBlcj5ib2R5e3Bvc2l0aW9uOnJlbGF0aXZlIWltcG9ydGFudDtib3JkZXItdG9wOjFweCBzb2xpZCB0cmFuc3BhcmVudCFpbXBvcnRhbnR9I2ktYW1waHRtbC13cmFwcGVyK2JvZHl7dmlzaWJpbGl0eTp2aXNpYmxlfSNpLWFtcGh0bWwtd3JhcHBlcitib2R5IC5pLWFtcGh0bWwtbGlnaHRib3gtZWxlbWVudCwjaS1hbXBodG1sLXdyYXBwZXIrYm9keVtpLWFtcGh0bWwtbGlnaHRib3hde3Zpc2liaWxpdHk6aGlkZGVufSNpLWFtcGh0bWwtd3JhcHBlcitib2R5W2ktYW1waHRtbC1saWdodGJveF0gLmktYW1waHRtbC1saWdodGJveC1lbGVtZW50e3Zpc2liaWxpdHk6dmlzaWJsZX0jaS1hbXBodG1sLXdyYXBwZXIuaS1hbXBodG1sLXNjcm9sbC1kaXNhYmxlZCwuaS1hbXBodG1sLXNjcm9sbC1kaXNhYmxlZHtvdmVyZmxvdy14OmhpZGRlbiFpbXBvcnRhbnQ7b3ZlcmZsb3cteTpoaWRkZW4haW1wb3J0YW50fWFtcC1pbnN0YWdyYW17cGFkZGluZzo1NHB4IDBweCAwcHghaW1wb3J0YW50O2JhY2tncm91bmQtY29sb3I6I2ZmZn1hbXAtaWZyYW1lIGlmcmFtZXtib3gtc2l6aW5nOmJvcmRlci1ib3ghaW1wb3J0YW50fVthbXAtYWNjZXNzXVthbXAtYWNjZXNzLWhpZGVde2Rpc3BsYXk6bm9uZX1bc3Vic2NyaXB0aW9ucy1kaWFsb2ddLGJvZHk6bm90KC5pLWFtcGh0bWwtc3Vicy1yZWFkeSkgW3N1YnNjcmlwdGlvbnMtYWN0aW9uXSxib2R5Om5vdCguaS1hbXBodG1sLXN1YnMtcmVhZHkpIFtzdWJzY3JpcHRpb25zLXNlY3Rpb25de2Rpc3BsYXk6bm9uZSFpbXBvcnRhbnR9YW1wLWV4cGVyaW1lbnQsYW1wLWxpdmUtbGlzdD5bdXBkYXRlXXtkaXNwbGF5Om5vbmV9LmktYW1waHRtbC1qYW5rLW1ldGVye3Bvc2l0aW9uOmZpeGVkO2JhY2tncm91bmQtY29sb3I6cmdiYSgyMzIsNzIsOTUsMC41KTtib3R0b206MDtyaWdodDowO2NvbG9yOiNmZmY7Zm9udC1zaXplOjE2cHg7ei1pbmRleDoxMDAwO3BhZGRpbmc6NXB4fWFtcC1saXN0W3Jlc2l6YWJsZS1jaGlsZHJlbl0%2BLmktYW1waHRtbC1sb2FkaW5nLWNvbnRhaW5lci5hbXAtaGlkZGVue2Rpc3BsYXk6bm9uZSFpbXBvcnRhbnR9YW1wLWxpc3QgW2ZldGNoLWVycm9yXSxhbXAtbGlzdFtsb2FkLW1vcmVdIFtsb2FkLW1vcmUtYnV0dG9uXSxhbXAtbGlzdFtsb2FkLW1vcmVdIFtsb2FkLW1vcmUtZW5kXSxhbXAtbGlzdFtsb2FkLW1vcmVdIFtsb2FkLW1vcmUtZmFpbGVkXSxhbXAtbGlzdFtsb2FkLW1vcmVdIFtsb2FkLW1vcmUtbG9hZGluZ117ZGlzcGxheTpub25lfWFtcC1saXN0W2RpZmZhYmxlXSBkaXZbcm9sZT1saXN0XXtkaXNwbGF5OmJsb2NrfWFtcC1zdG9yeS1wYWdlLGFtcC1zdG9yeVtzdGFuZGFsb25lXXttaW4taGVpZ2h0OjFweCFpbXBvcnRhbnQ7ZGlzcGxheTpibG9jayFpbXBvcnRhbnQ7aGVpZ2h0OjEwMCUhaW1wb3J0YW50O21hcmdpbjowIWltcG9ydGFudDtwYWRkaW5nOjAhaW1wb3J0YW50O292ZXJmbG93OmhpZGRlbiFpbXBvcnRhbnQ7d2lkdGg6MTAwJSFpbXBvcnRhbnR9YW1wLXN0b3J5W3N0YW5kYWxvbmVde2JhY2tncm91bmQtY29sb3I6IzIwMjEyNSFpbXBvcnRhbnQ7cG9zaXRpb246cmVsYXRpdmUhaW1wb3J0YW50fWFtcC1zdG9yeS1wYWdle2JhY2tncm91bmQtY29sb3I6Izc1NzU3NX1hbXAtc3RvcnkgLmFtcC1hY3RpdmU%2BZGl2LGFtcC1zdG9yeSAuaS1hbXBodG1sLWxvYWRlci1iYWNrZ3JvdW5ke2Rpc3BsYXk6bm9uZSFpbXBvcnRhbnR9YW1wLXN0b3J5LXBhZ2U6bm90KDpmaXJzdC1vZi10eXBlKTpub3QoW2Rpc3RhbmNlXSk6bm90KFthY3RpdmVdKXt0cmFuc2Zvcm06dHJhbnNsYXRlWSgxMDAwdmgpIWltcG9ydGFudH1hbXAtYXV0b2NvbXBsZXRle3Bvc2l0aW9uOnJlbGF0aXZlIWltcG9ydGFudDtkaXNwbGF5OmlubGluZS1ibG9jayFpbXBvcnRhbnR9YW1wLWF1dG9jb21wbGV0ZT5pbnB1dCxhbXAtYXV0b2NvbXBsZXRlPnRleHRhcmVhe3BhZGRpbmc6MC41cmVtO2JvcmRlcjoxcHggc29saWQgcmdiYSgwLDAsMCwwLjMzKX0uaS1hbXBodG1sLWF1dG9jb21wbGV0ZS1yZXN1bHRzLGFtcC1hdXRvY29tcGxldGU%2BaW5wdXQsYW1wLWF1dG9jb21wbGV0ZT50ZXh0YXJlYXtmb250LXNpemU6MXJlbTtsaW5lLWhlaWdodDoxLjVyZW19W2FtcC1meF49Zmx5LWluXXt2aXNpYmlsaXR5OmhpZGRlbn1hbXAtc2NyaXB0W25vZG9tXXtwb3NpdGlvbjpmaXhlZCFpbXBvcnRhbnQ7dG9wOjAhaW1wb3J0YW50O3dpZHRoOjFweCFpbXBvcnRhbnQ7aGVpZ2h0OjFweCFpbXBvcnRhbnQ7b3ZlcmZsb3c6aGlkZGVuIWltcG9ydGFudDt2aXNpYmlsaXR5OmhpZGRlbn1cbi8qIyBzb3VyY2VVUkw9L2Nzcy9hbXBkb2MuY3NzKi9baGlkZGVuXXtkaXNwbGF5Om5vbmUhaW1wb3J0YW50fS5pLWFtcGh0bWwtZWxlbWVudHtkaXNwbGF5OmlubGluZS1ibG9ja30uaS1hbXBodG1sLWJsdXJyeS1wbGFjZWhvbGRlcnt0cmFuc2l0aW9uOm9wYWNpdHkgMC4zcyBjdWJpYy1iZXppZXIoMC4wLDAuMCwwLjIsMSkhaW1wb3J0YW50O3BvaW50ZXItZXZlbnRzOm5vbmV9W2xheW91dD1ub2Rpc3BsYXldOm5vdCguaS1hbXBodG1sLWVsZW1lbnQpe2Rpc3BsYXk6bm9uZSFpbXBvcnRhbnR9LmktYW1waHRtbC1sYXlvdXQtZml4ZWQsW2xheW91dD1maXhlZF1bd2lkdGhdW2hlaWdodF06bm90KC5pLWFtcGh0bWwtbGF5b3V0LWZpeGVkKXtkaXNwbGF5OmlubGluZS1ibG9jaztwb3NpdGlvbjpyZWxhdGl2ZX0uaS1hbXBodG1sLWxheW91dC1yZXNwb25zaXZlLFtsYXlvdXQ9cmVzcG9uc2l2ZV1bd2lkdGhdW2hlaWdodF06bm90KC5pLWFtcGh0bWwtbGF5b3V0LXJlc3BvbnNpdmUpLFt3aWR0aF1baGVpZ2h0XVtoZWlnaHRzXTpub3QoW2xheW91dF0pOm5vdCguaS1hbXBodG1sLWxheW91dC1yZXNwb25zaXZlKSxbd2lkdGhdW2hlaWdodF1bc2l6ZXNdOm5vdChbbGF5b3V0XSk6bm90KC5pLWFtcGh0bWwtbGF5b3V0LXJlc3BvbnNpdmUpe2Rpc3BsYXk6YmxvY2s7cG9zaXRpb246cmVsYXRpdmV9LmktYW1waHRtbC1sYXlvdXQtaW50cmluc2ljLFtsYXlvdXQ9aW50cmluc2ljXVt3aWR0aF1baGVpZ2h0XTpub3QoLmktYW1waHRtbC1sYXlvdXQtaW50cmluc2ljKXtkaXNwbGF5OmlubGluZS1ibG9jaztwb3NpdGlvbjpyZWxhdGl2ZTttYXgtd2lkdGg6MTAwJX0uaS1hbXBodG1sLWxheW91dC1pbnRyaW5zaWMgLmktYW1waHRtbC1zaXplcnttYXgtd2lkdGg6MTAwJX0uaS1hbXBodG1sLWludHJpbnNpYy1zaXplcnttYXgtd2lkdGg6MTAwJTtkaXNwbGF5OmJsb2NrIWltcG9ydGFudH0uaS1hbXBodG1sLWxheW91dC1jb250YWluZXIs&i=1-8&t=adltag_kevkyyz5_Qf69PlSTwVm&r=b7d67488abfc790ba4d38e91589f323&c=math-aids-threatpost&z=1
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/b-9a4f7ce-a7f6098c.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.84.156.60 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-84-156-60.txl52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Wed, 09 Sep 2020 03:19:23 GMT
via: 1.1 5cf5bc69324ade55eebb5e539fa6c2fa.cloudfront.net (CloudFront)
age: 46348
x-cache: Error from cloudfront
status: 200
content-length: 0
last-modified: Mon, 15 Jun 2020 18:35:10 GMT
server: AmazonS3
etag: "d41d8cd98f00b204e9800998ecf8427e"
access-control-max-age: 3000
access-control-allow-methods: GET
x-amz-version-id: D2POxJleIt92FyXaxSi7iRHuNLtujALh
access-control-allow-origin: *
x-amz-cf-pop: TXL52-C1
accept-ranges: bytes
content-type: text/plain
x-amz-cf-id: SDhvp9hAYsEQupS4vuaHwpZZwUlk4V4GhQSTKuXgdr4pfIDmxAj21Q==

POST
H2 200 tag
math-aids-threatpost-tagan.adlightning.com/ 0
427 B 62ms
51ms Other
text/plain 99.84.156.60
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://math-aids-threatpost-tagan.adlightning.com/tag?s=bl&d=LmktYW1waHRtbC1sYXlvdXQtZml4ZWQtaGVpZ2h0LFtsYXlvdXQ9Y29udGFpbmVyXSxbbGF5b3V0PWZpeGVkLWhlaWdodF1baGVpZ2h0XTpub3QoLmktYW1waHRtbC1sYXlvdXQtZml4ZWQtaGVpZ2h0KXtkaXNwbGF5OmJsb2NrO3Bvc2l0aW9uOnJlbGF0aXZlfS5pLWFtcGh0bWwtbGF5b3V0LWZpbGwsW2xheW91dD1maWxsXTpub3QoLmktYW1waHRtbC1sYXlvdXQtZmlsbCl7ZGlzcGxheTpibG9jaztvdmVyZmxvdzpoaWRkZW4haW1wb3J0YW50O3Bvc2l0aW9uOmFic29sdXRlO3RvcDowO2xlZnQ6MDtib3R0b206MDtyaWdodDowfS5pLWFtcGh0bWwtbGF5b3V0LWZsZXgtaXRlbSxbbGF5b3V0PWZsZXgtaXRlbV06bm90KC5pLWFtcGh0bWwtbGF5b3V0LWZsZXgtaXRlbSl7ZGlzcGxheTpibG9jaztwb3NpdGlvbjpyZWxhdGl2ZTstbXMtZmxleDoxIDEgYXV0bztmbGV4OjEgMSBhdXRvfS5pLWFtcGh0bWwtbGF5b3V0LWZsdWlke3Bvc2l0aW9uOnJlbGF0aXZlfS5pLWFtcGh0bWwtbGF5b3V0LXNpemUtZGVmaW5lZHtvdmVyZmxvdzpoaWRkZW4haW1wb3J0YW50fS5pLWFtcGh0bWwtbGF5b3V0LWF3YWl0aW5nLXNpemV7cG9zaXRpb246YWJzb2x1dGUhaW1wb3J0YW50O3RvcDphdXRvIWltcG9ydGFudDtib3R0b206YXV0byFpbXBvcnRhbnR9aS1hbXBodG1sLXNpemVye2Rpc3BsYXk6YmxvY2shaW1wb3J0YW50fS5pLWFtcGh0bWwtYmx1cnJ5LXBsYWNlaG9sZGVyLC5pLWFtcGh0bWwtZmlsbC1jb250ZW50e2Rpc3BsYXk6YmxvY2s7aGVpZ2h0OjA7bWF4LWhlaWdodDoxMDAlO21heC13aWR0aDoxMDAlO21pbi1oZWlnaHQ6MTAwJTttaW4td2lkdGg6MTAwJTt3aWR0aDowO21hcmdpbjphdXRvfS5pLWFtcGh0bWwtbGF5b3V0LXNpemUtZGVmaW5lZCAuaS1hbXBodG1sLWZpbGwtY29udGVudHtwb3NpdGlvbjphYnNvbHV0ZTt0b3A6MDtsZWZ0OjA7Ym90dG9tOjA7cmlnaHQ6MH0uaS1hbXBodG1sLXJlcGxhY2VkLWNvbnRlbnQsLmktYW1waHRtbC1zY3JlZW4tcmVhZGVye3BhZGRpbmc6MCFpbXBvcnRhbnQ7Ym9yZGVyOm5vbmUhaW1wb3J0YW50fS5pLWFtcGh0bWwtc2NyZWVuLXJlYWRlcntwb3NpdGlvbjpmaXhlZCFpbXBvcnRhbnQ7dG9wOjBweCFpbXBvcnRhbnQ7bGVmdDowcHghaW1wb3J0YW50O3dpZHRoOjRweCFpbXBvcnRhbnQ7aGVpZ2h0OjRweCFpbXBvcnRhbnQ7b3BhY2l0eTowIWltcG9ydGFudDtvdmVyZmxvdzpoaWRkZW4haW1wb3J0YW50O21hcmdpbjowIWltcG9ydGFudDtkaXNwbGF5OmJsb2NrIWltcG9ydGFudDt2aXNpYmlsaXR5OnZpc2libGUhaW1wb3J0YW50fS5pLWFtcGh0bWwtc2NyZWVuLXJlYWRlcn4uaS1hbXBodG1sLXNjcmVlbi1yZWFkZXJ7bGVmdDo4cHghaW1wb3J0YW50fS5pLWFtcGh0bWwtc2NyZWVuLXJlYWRlcn4uaS1hbXBodG1sLXNjcmVlbi1yZWFkZXJ%2BLmktYW1waHRtbC1zY3JlZW4tcmVhZGVye2xlZnQ6MTJweCFpbXBvcnRhbnR9LmktYW1waHRtbC1zY3JlZW4tcmVhZGVyfi5pLWFtcGh0bWwtc2NyZWVuLXJlYWRlcn4uaS1hbXBodG1sLXNjcmVlbi1yZWFkZXJ%2BLmktYW1waHRtbC1zY3JlZW4tcmVhZGVye2xlZnQ6MTZweCFpbXBvcnRhbnR9LmktYW1waHRtbC11bnJlc29sdmVke3Bvc2l0aW9uOnJlbGF0aXZlO292ZXJmbG93OmhpZGRlbiFpbXBvcnRhbnR9LmktYW1waHRtbC1zZWxlY3QtZGlzYWJsZWR7LXdlYmtpdC11c2VyLXNlbGVjdDpub25lIWltcG9ydGFudDstbW96LXVzZXItc2VsZWN0Om5vbmUhaW1wb3J0YW50Oy1tcy11c2VyLXNlbGVjdDpub25lIWltcG9ydGFudDt1c2VyLXNlbGVjdDpub25lIWltcG9ydGFudH0uaS1hbXBodG1sLW5vdGJ1aWx0LFtsYXlvdXRdOm5vdCguaS1hbXBodG1sLWVsZW1lbnQpLFt3aWR0aF1baGVpZ2h0XVtoZWlnaHRzXTpub3QoW2xheW91dF0pOm5vdCguaS1hbXBodG1sLWVsZW1lbnQpLFt3aWR0aF1baGVpZ2h0XVtzaXplc106bm90KFtsYXlvdXRdKTpub3QoLmktYW1waHRtbC1lbGVtZW50KXtwb3NpdGlvbjpyZWxhdGl2ZTtvdmVyZmxvdzpoaWRkZW4haW1wb3J0YW50O2NvbG9yOnRyYW5zcGFyZW50IWltcG9ydGFudH0uaS1hbXBodG1sLW5vdGJ1aWx0Om5vdCguaS1hbXBodG1sLWxheW91dC1jb250YWluZXIpPiosW2xheW91dF06bm90KFtsYXlvdXQ9Y29udGFpbmVyXSk6bm90KC5pLWFtcGh0bWwtZWxlbWVudCk%2BKixbd2lkdGhdW2hlaWdodF1baGVpZ2h0c106bm90KFtsYXlvdXRdKTpub3QoLmktYW1waHRtbC1lbGVtZW50KT4qLFt3aWR0aF1baGVpZ2h0XVtzaXplc106bm90KFtsYXlvdXRdKTpub3QoLmktYW1waHRtbC1lbGVtZW50KT4qe2Rpc3BsYXk6bm9uZX0uaS1hbXBodG1sLW5vdGJ1aWx0Om5vdCguaS1hbXBodG1sLWxheW91dC1jb250YWluZXIpLFtsYXlvdXRdOm5vdChbbGF5b3V0PWNvbnRhaW5lcl0pOm5vdCguaS1hbXBodG1sLWVsZW1lbnQpLFt3aWR0aF1baGVpZ2h0XVtoZWlnaHRzXTpub3QoW2xheW91dF0pOm5vdCguaS1hbXBodG1sLWVsZW1lbnQpLFt3aWR0aF1baGVpZ2h0XVtzaXplc106bm90KFtsYXlvdXRdKTpub3QoLmktYW1waHRtbC1lbGVtZW50KXtjb2xvcjp0cmFuc3BhcmVudCFpbXBvcnRhbnQ7bGluZS1oZWlnaHQ6MCFpbXBvcnRhbnR9LmktYW1waHRtbC1naG9zdHt2aXNpYmlsaXR5OmhpZGRlbiFpbXBvcnRhbnR9LmktYW1waHRtbC1lbGVtZW50PltwbGFjZWhvbGRlcl0sW2xheW91dF06bm90KC5pLWFtcGh0bWwtZWxlbWVudCk%2BW3BsYWNlaG9sZGVyXSxbd2lkdGhdW2hlaWdodF1baGVpZ2h0c106bm90KFtsYXlvdXRdKTpub3QoLmktYW1waHRtbC1lbGVtZW50KT5bcGxhY2Vob2xkZXJdLFt3aWR0aF1baGVpZ2h0XVtzaXplc106bm90KFtsYXlvdXRdKTpub3QoLmktYW1waHRtbC1lbGVtZW50KT5bcGxhY2Vob2xkZXJde2Rpc3BsYXk6YmxvY2t9LmktYW1waHRtbC1lbGVtZW50PltwbGFjZWhvbGRlcl0uYW1wLWhpZGRlbiwuaS1hbXBodG1sLWVsZW1lbnQ%2BW3BsYWNlaG9sZGVyXS5oaWRkZW57dmlzaWJpbGl0eTpoaWRkZW59LmktYW1waHRtbC1lbGVtZW50Om5vdCguYW1wLW5vdHN1cHBvcnRlZCk%2BW2ZhbGxiYWNrXSwuaS1hbXBodG1sLWxheW91dC1jb250YWluZXI%2BW3BsYWNlaG9sZGVyXS5hbXAtaGlkZGVuLC5pLWFtcGh0bWwtbGF5b3V0LWNvbnRhaW5lcj5bcGxhY2Vob2xkZXJdLmhpZGRlbntkaXNwbGF5Om5vbmV9LmktYW1waHRtbC1sYXlvdXQtc2l6ZS1kZWZpbmVkPltmYWxsYmFja10sLmktYW1waHRtbC1sYXlvdXQtc2l6ZS1kZWZpbmVkPltwbGFjZWhvbGRlcl17cG9zaXRpb246YWJzb2x1dGUhaW1wb3J0YW50O3RvcDowIWltcG9ydGFudDtsZWZ0OjAhaW1wb3J0YW50O3JpZ2h0OjAhaW1wb3J0YW50O2JvdHRvbTowIWltcG9ydGFudDt6LWluZGV4OjF9LmktYW1waHRtbC1ub3RidWlsdD5bcGxhY2Vob2xkZXJde2Rpc3BsYXk6YmxvY2shaW1wb3J0YW50fS5pLWFtcGh0bWwtaGlkZGVuLWJ5LW1lZGlhLXF1ZXJ5e2Rpc3BsYXk6bm9uZSFpbXBvcnRhbnR9LmktYW1waHRtbC1lbGVtZW50LWVycm9ye2JhY2tncm91bmQ6cmVkIWltcG9ydGFudDtjb2xvcjojZmZmIWltcG9ydGFudDtwb3NpdGlvbjpyZWxhdGl2ZSFpbXBvcnRhbnR9LmktYW1waHRtbC1lbGVtZW50LWVycm9yOmJlZm9yZXtjb250ZW50OmF0dHIoZXJyb3ItbWVzc2FnZSl9aS1hbXAtc2Nyb2xsLWNvbnRhaW5lcixpLWFtcGh0bWwtc2Nyb2xsLWNvbnRhaW5lcntwb3NpdGlvbjphYnNvbHV0ZTt0b3A6MDtsZWZ0OjA7cmlnaHQ6MDtib3R0b206MDtkaXNwbGF5OmJsb2NrfWktYW1wLXNjcm9sbC1jb250YWluZXIuYW1wLWFjdGl2ZSxpLWFtcGh0bWwtc2Nyb2xsLWNvbnRhaW5lci5hbXAtYWN0aXZle292ZXJmbG93OmF1dG87LXdlYmtpdC1vdmVyZmxvdy1zY3JvbGxpbmc6dG91Y2h9LmktYW1waHRtbC1sb2FkaW5nLWNvbnRhaW5lcntkaXNwbGF5OmJsb2NrIWltcG9ydGFudDtwb2ludGVyLWV2ZW50czpub25lO3otaW5kZXg6MX0uaS1hbXBodG1sLW5vdGJ1aWx0Pi5pLWFtcGh0bWwtbG9hZGluZy1jb250YWluZXJ7ZGlzcGxheTpibG9jayFpbXBvcnRhbnR9LmktYW1waHRtbC1sb2FkaW5nLWNvbnRhaW5lci5hbXAtaGlkZGVue3Zpc2liaWxpdHk6aGlkZGVufS5pLWFtcGh0bWwtZWxlbWVudD5bb3ZlcmZsb3dde2N1cnNvcjpwb2ludGVyO3Bvc2l0aW9uOnJlbGF0aXZlO3otaW5kZXg6Mjt2aXNpYmlsaXR5OmhpZGRlbjtkaXNwbGF5OmluaXRpYWw7bGluZS1oZWlnaHQ6bm9ybWFsfS5pLWFtcGh0bWwtZWxlbWVudD5bb3ZlcmZsb3ddLmFtcC12aXNpYmxle3Zpc2liaWxpdHk6dmlzaWJsZX10ZW1wbGF0ZXtkaXNwbGF5Om5vbmUhaW1wb3J0YW50fS5hbXAtYm9yZGVyLWJveCwuYW1wLWJvcmRlci1ib3ggKiwuYW1wLWJvcmRlci1ib3ggOmFmdGVyLC5hbXAtYm9yZGVyLWJveCA6YmVmb3Jle2JveC1zaXppbmc6Ym9yZGVyLWJveH1hbXAtcGl4ZWx7ZGlzcGxheTpub25lIWltcG9ydGFudH1hbXAtYW5hbHl0aWNzLGFtcC1hdXRvLWFkcyxhbXAtc3RvcnktYXV0by1hZHN7cG9zaXRpb246Zml4ZWQhaW1wb3J0YW50O3RvcDowIWltcG9ydGFudDt3aWR0aDoxcHghaW1wb3J0YW50O2hlaWdodDoxcHghaW1wb3J0YW50O292ZXJmbG93OmhpZGRlbiFpbXBvcnRhbnQ7dmlzaWJpbGl0eTpoaWRkZW59aHRtbC5pLWFtcGh0bWwtZmllPmFtcC1hbmFseXRpY3N7cG9zaXRpb246aW5pdGlhbCFpbXBvcnRhbnR9W3Zpc2libGUtd2hlbi1pbnZhbGlkXTpub3QoLnZpc2libGUpLGZvcm0gW3N1Ym1pdC1lcnJvcl0sZm9ybSBbc3VibWl0LXN1Y2Nlc3NdLGZvcm0gW3N1Ym1pdHRpbmdde2Rpc3BsYXk6bm9uZX1hbXAtYWNjb3JkaW9ue2Rpc3BsYXk6YmxvY2shaW1wb3J0YW50fWFtcC1hY2NvcmRpb24%2Bc2VjdGlvbntmbG9hdDpub25lIWltcG9ydGFudH1hbXAtYWNjb3JkaW9uPnNlY3Rpb24%2BKntmbG9hdDpub25lIWltcG9ydGFudDtkaXNwbGF5OmJsb2NrIWltcG9ydGFudDtvdmVyZmxvdzpoaWRkZW4haW1wb3J0YW50O3Bvc2l0aW9uOnJlbGF0aXZlIWltcG9ydGFudH1hbXAtYWNjb3JkaW9uLGFtcC1hY2NvcmRpb24%2Bc2VjdGlvbnttYXJnaW46MH1hbXAtYWNjb3JkaW9uPnNlY3Rpb24%2BOmxhc3QtY2hpbGR7ZGlzcGxheTpub25lIWltcG9ydGFudH1hbXAtYWNjb3JkaW9uPnNlY3Rpb25bZXhwYW5kZWRdPjpsYXN0LWNoaWxke2Rpc3BsYXk6YmxvY2shaW1wb3J0YW50fVxuLyojIHNvdXJjZVVSTD0vY3NzL2FtcHNoYXJlZC5jc3MqL2h0bWwuaS1hbXBodG1sLWluYWJveHt3aWR0aDoxMDAlIWltcG9ydGFudDtoZWlnaHQ6MTAwJSFpbXBvcnRhbnR9aHRtbC5pLWFtcGh0bWwtaW5hYm94PmJvZHl7cG9zaXRpb246aW5pdGlhbCFpbXBvcnRhbnR9PC9zdHlsZT48bWV0YSBjb250ZW50PVwid2lkdGg9ZGV2aWNlLXdpZHRoLG1pbmltdW0tc2NhbGU9MSxpbml0aWFsLXNjYWxlPTFcIiBuYW1lPXZpZXdwb3J0PjxtZXRhIGNvbnRlbnQ9XCJ2ZW5kb3I9ZG91YmxlY2xpY2ssdHlwZT1pbXByZXNzaW9uLWlkLHZhbHVlPUNKV1locXk3M09zQ0ZaUUlpd29kd2NjRmdBXCIgbmFtZT1hbXA0YWRzLWlkPjxsaW5rIGFzPXNjcmlwdCBocmVmPWh0dHBzOi8vY2RuLmFtcHByb2plY3Qub3JnL3J0di8wMTIwMDgyNDIzMDEwMDAvYW1wNGFkcy12MC5qcyByZWw9cHJlbG9hZD48c2NyaXB0IGFzeW5jIHNyYz1odHRwczovL2Nkbi5hbXBwcm9qZWN0Lm9yZy9ydHYvMDEyMDA4MjQyMzAxMDAwL2FtcDRhZHMtdjAuanM%2BPC9zY3JpcHQ%2BPHNjcmlwdCBhc3luYyBjdXN0b20tZWxlbWVudD1hbXAtYWQtZXhpdCBzcmM9aHR0cHM6Ly9jZG4uYW1wcHJvamVjdC5vcmcvcnR2LzAxMjAwODI0MjMwMTAwMC92MC9hbXAtYWQtZXhpdC0wLjEuanM%2BPC9zY3JpcHQ%2BPHNjcmlwdCBhc3luYyBjdXN0b20tZWxlbWVudD1hbXAtYW5hbHl0aWNzIHNyYz1odHRwczovL2Nkbi5hbXBwcm9qZWN0Lm9yZy9ydHYvMDEyMDA4MjQyMzAxMDAwL3YwL2FtcC1hbmFseXRpY3MtMC4xLmpzPjwvc2NyaXB0PjxzY3JpcHQgYXN5bmMgY3VzdG9tLWVsZW1lbnQ9YW1wLWZpdC10ZXh0IHNyYz1odHRwczovL2Nkbi5hbXBwcm9qZWN0Lm&i=2-8&t=adltag_kevkyyz5_Qf69PlSTwVm&r=b7d67488abfc790ba4d38e91589f323&c=math-aids-threatpost&z=1
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/b-9a4f7ce-a7f6098c.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.84.156.60 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-84-156-60.txl52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Wed, 09 Sep 2020 03:19:23 GMT
via: 1.1 5cf5bc69324ade55eebb5e539fa6c2fa.cloudfront.net (CloudFront)
age: 46348
x-cache: Error from cloudfront
status: 200
content-length: 0
last-modified: Mon, 15 Jun 2020 18:35:10 GMT
server: AmazonS3
etag: "d41d8cd98f00b204e9800998ecf8427e"
access-control-max-age: 3000
access-control-allow-methods: GET
x-amz-version-id: D2POxJleIt92FyXaxSi7iRHuNLtujALh
access-control-allow-origin: *
x-amz-cf-pop: TXL52-C1
accept-ranges: bytes
content-type: text/plain
x-amz-cf-id: jtVdYW4H_niZGbrRoyO9nmczbHpwVLnHNCIH1IBYf95PuBqd2CaGBg==

POST
H2 200 tag
math-aids-threatpost-tagan.adlightning.com/ 0
427 B 64ms
40ms Other
text/plain 99.84.156.60
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://math-aids-threatpost-tagan.adlightning.com/tag?s=bl&d=9yZy9ydHYvMDEyMDA4MjQyMzAxMDAwL3YwL2FtcC1maXQtdGV4dC0wLjEuanM%2BPC9zY3JpcHQ%2BPHNjcmlwdCBhc3luYyBjdXN0b20tZWxlbWVudD1hbXAtZm9ybSBzcmM9aHR0cHM6Ly9jZG4uYW1wcHJvamVjdC5vcmcvcnR2LzAxMjAwODI0MjMwMTAwMC92MC9hbXAtZm9ybS0wLjEuanM%2BPC9zY3JpcHQ%2BPHN0eWxlIGFtcC1jdXN0b20%2BYSB7IGNvbG9yOiAjMDAwMDAwIH1ib2R5IHsgbWFyZ2luOiAwOyBiYWNrZ3JvdW5kOiB0cmFuc3BhcmVudDsgfSNnb29nbGVfaW1hZ2VfZGl2IHtoZWlnaHQ6IDYwMHB4O3dpZHRoOiAzMDBweDtvdmVyZmxvdzpoaWRkZW47cG9zaXRpb246cmVsYXRpdmV9aHRtbCwgYm9keSB7d2lkdGg6MTAwJTtoZWlnaHQ6MTAwJTt9Ym9keSB7ZGlzcGxheTp0YWJsZTt0ZXh0LWFsaWduOmNlbnRlcjt9I2dvb2dsZV9jZW50ZXJfZGl2IHtkaXNwbGF5OnRhYmxlLWNlbGw7dmVydGljYWwtYWxpZ246bWlkZGxlO30jZ29vZ2xlX2ltYWdlX2RpdiB7ZGlzcGxheTppbmxpbmUtYmxvY2s7fS5hYmdjIHtwb3NpdGlvbjphYnNvbHV0ZTt6LWluZGV4OjIxNDc0ODM2NDY7cmlnaHQ6MDt0b3A6MDt9LmFiZ2MgYW1wLWltZywgLmFiZ2MgaW1nIHtkaXNwbGF5OmJsb2NrO30uYWJncyB7cG9zaXRpb246YWJzb2x1dGU7LXdlYmtpdC10cmFuc2Zvcm06dHJhbnNsYXRlWCg3NnB4KTt0cmFuc2Zvcm06dHJhbnNsYXRlWCg3NnB4KTtyaWdodDoxNnB4O3RvcDowO30uYWJnY3Age3Bvc2l0aW9uOmFic29sdXRlO3JpZ2h0OjA7dG9wOjA7d2lkdGg6MzFweDtoZWlnaHQ6MTVweDtwYWRkaW5nLWxlZnQ6MTBweDtwYWRkaW5nLWJvdHRvbToxMHB4O30uYWJnYiB7cG9zaXRpb246cmVsYXRpdmU7bWFyZ2luLXJpZ2h0OjE2cHg7dG9wOjA7fS5hYmdjOmhvdmVyIC5hYmdzIHstd2Via2l0LXRyYW5zZm9ybTpub25lO3RyYW5zZm9ybTpub25lO30uY2JiIHtkaXNwbGF5OiBibG9jaztwb3NpdGlvbjogYWJzb2x1dGU7cmlnaHQ6MDt0b3A6MDtjdXJzb3I6IHBvaW50ZXI7aGVpZ2h0OiAxNXB4O3dpZHRoOiAxNXB4O3otaW5kZXg6IDkwMjA7cGFkZGluZy1sZWZ0OjE2cHg7fS5idG4ge2Rpc3BsYXk6IGlubGluZS1ibG9jaztib3JkZXItcmFkaXVzOiAycHg7LW1vei1ib3gtc2l6aW5nOiBib3JkZXItYm94Oy13ZWJraXQtYm94LXNpemluZzogYm9yZGVyLWJveDtib3gtc2l6aW5nOiBib3JkZXItYm94O2JveC1zaGFkb3c6IDBweCAwcHggMnB4IHJnYmEoMCwwLDAsMC4xMiksIDBweCAxcHggM3B4IHJnYmEoMCwwLDAsMC4yNik7Y3Vyc29yOiBwb2ludGVyO2ZvbnQtc2l6ZTogMC43ZW07bWFyZ2luOiAwIDFweCAwLjRlbSAxcHg7fUBtZWRpYSAobWF4LXdpZHRoOiAzNzVweCkgYW5kIChtaW4taGVpZ2h0OiAxMDBweCkgey5idG4ge2Rpc3BsYXk6IGJsb2NrO3dpZHRoOiA5MCU7bWF4LXdpZHRoOiAyNDBweDttYXJnaW4tbGVmdDogYXV0bzttYXJnaW4tcmlnaHQ6IGF1dG87fX0jc3B2MSBhbXAtZml0LXRleHQ%2BZGl2IHstd2Via2l0LWp1c3RpZnktY29udGVudDogZmxleC1zdGFydDtqdXN0aWZ5LWNvbnRlbnQ6IGZsZXgtc3RhcnQ7fS5qdCAucG4gYW1wLWZpdC10ZXh0PmRpdiB7LXdlYmtpdC1qdXN0aWZ5LWNvbnRlbnQ6IGZsZXgtc3RhcnQ7anVzdGlmeS1jb250ZW50OiBmbGV4LXN0YXJ0O30uYnRuID4gc3BhbiB7ZGlzcGxheTogaW5saW5lLWJsb2NrO3BhZGRpbmc6IDAuNWVtIDAuNmVtO2xpbmUtaGVpZ2h0OiAxZW07fSNzYnRuIHtiYWNrZ3JvdW5kLWNvbG9yOiAjRkZGRkZGO2NvbG9yOiAjOUU5RUE2O3RleHQtZGVjb3JhdGlvbjogbm9uZTt9I3NidG46aG92ZXIsI3NidG46YWN0aXZlIHtiYWNrZ3JvdW5kLWNvbG9yOiAjRjVGNUY1O30jcmJ0biB7YmFja2dyb3VuZC1jb2xvcjogcmdiKDY2LDEzMywyNDUpO2NvbG9yOiB3aGl0ZTt9I3JidG46aG92ZXIsI3JidG46YWN0aXZlIHtiYWNrZ3JvdW5kLWNvbG9yOiAjMzI3NUU1O30jbXRhIHtwb3NpdGlvbjphYnNvbHV0ZTt0b3A6IDA7bGVmdDogMDtmb250LWZhbWlseTogQXJpYWwsIHNhbnMtc2VyaWY7Zm9udC1zaXplOiAxMnB4O2ZvbnQtd2VpZ2h0OiA0MDA7bGluZS1oZWlnaHQ6IDFlbTt9I210YSBpbnB1dFt0eXBlPVwicmFkaW9cIl0ge2Rpc3BsYXk6IG5vbmU7fSNtdGEgLnBuIHtyaWdodDogLTMwMHB4O3RvcDogLTYwMHB4O3dpZHRoOjMwMHB4O2hlaWdodDo2MDBweDtwb3NpdGlvbjogYWJzb2x1dGU7LW1vei1ib3gtc2l6aW5nOiBib3JkZXItYm94Oy13ZWJraXQtYm94LXNpemluZzogYm9yZGVyLWJveDtib3gtc2l6aW5nOiBib3JkZXItYm94O2JhY2tncm91bmQtY29sb3I6ICNGQUZBRkE7dGV4dC1hbGlnbjogY2VudGVyO30jc3B2MiB7ZGlzcGxheTogLXdlYmtpdC1mbGV4O2Rpc3BsYXk6IGZsZXg7LXdlYmtpdC1qdXN0aWZ5LWNvbnRlbnQ6IGZsZXgtc3RhcnQ7anVzdGlmeS1jb250ZW50OiBmbGV4LXN0YXJ0Oy13ZWJraXQtZmxleC13cmFwOiBub3dyYXA7ZmxleC13cmFwOiBub3dyYXA7b3ZlcmZsb3c6IGhpZGRlbjtiYWNrZ3JvdW5kLWNvbG9yOiAjRkFGQUZBO2ZvbnQtc2l6ZTogMDt9LnN2ICNzcHYyIHstd2Via2l0LWZsZXgtZGlyZWN0aW9uOiBjb2x1bW47ZmxleC1kaXJlY3Rpb246IGNvbHVtbjt9Lmp0LnN2ICNzcHYyIHstd2Via2l0LWp1c3RpZnktY29udGVudDogZmxleC1zdGFydDtqdXN0aWZ5LWNvbnRlbnQ6IGZsZXgtc3RhcnQ7LXdlYmtpdC1hbGlnbi1pdGVtczogY2VudGVyO2FsaWduLWl0ZW1zOiBjZW50ZXI7fSNzcHYyICogey1tb3otYm94LXNpemluZzogYm9yZGVyLWJveDstd2Via2l0LWJveC1zaXppbmc6IGJvcmRlci1ib3g7Ym94LXNpemluZzogYm9yZGVyLWJveDt9I3NwcjE6Y2hlY2tlZCB%2BICNjYmIsI3NwcjI6Y2hlY2tlZCB%2BICNjYmIsI3NwcjM6Y2hlY2tlZCB%2BICNjYmJ7ZGlzcGxheTogbm9uZTt9I3NwdjMge29wYWNpdHk6MTt9LmFtcC1hbmltYXRlICNzcHY0IHtvcGFjaXR5OjA7dHJhbnNpdGlvbjogb3BhY2l0eSAwLjVzIGxpbmVhciAyLjVzO30uYW1wLWFuaW1hdGUgICNzcHYzIGFtcC1maXQtdGV4dCB7b3BhY2l0eToxO3RyYW5zaXRpb246IG9wYWNpdHkgMC41cyBsaW5lYXIgMnM7fSNzcHIzOmNoZWNrZWQgfiAjc3B2MyBhbXAtZml0LXRleHQge29wYWNpdHk6MH0jc3ByMzpjaGVja2VkIH4gI3NwdjQge29wYWNpdHk6MTt9I3NwcjE6Y2hlY2tlZCB%2BICNzcHYxLCNzcHIyOmNoZWNrZWQgfiAjc3B2Miwjc3ByMzpjaGVja2VkIH4gI3NwdjMsI3NwcjM6Y2hlY2tlZCB%2BICNzcHY0e3JpZ2h0OiAwcHg7dG9wOiAwcHg7fS5jbG9zZSB7cG9zaXRpb246IGFic29sdXRlO3RvcDogMnB4O2NvbG9yOiBibGFjaztmb250LXNpemU6IDE1cHg7bGluZS1oZWlnaHQ6IDE1cHg7b3BhY2l0eTogMC41O2hlaWdodDogMTVweDt3aWR0aDogMTVweDt1c2VyLXNlbGVjdDogbm9uZTtjdXJzb3I6IHBvaW50ZXI7fVtkaXI9XCJydGxcIl0gLmNsb3NlIHt0cmFuc2Zvcm06IHNjYWxlWCgtMSk7fS5jdCBzdmcge2JvcmRlcjogMDttYXJnaW46IDAgMCAtMC40NWVtIDA7ZGlzcGxheTogaW5saW5lLWJsb2NrO2hlaWdodDogMS4zOGVtO29wYWNpdHk6IDAuNDt9LmN0IHtkaXNwbGF5OiBpbmxpbmUtYmxvY2s7bGluZS1oZWlnaHQ6IDEuMjhlbTtjb2xvcjogcmdiYSgwLDAsMCwwLjQpO3RleHQtYWxpZ246Y2VudGVyO3BhZGRpbmc6IDAuM2VtO30uZmN0IHtwYWRkaW5nOiAxZW07fSNwY3Qge2Rpc3BsYXk6IGJsb2NrO2ZvbnQtd2VpZ2h0OiBib2xkO3BhZGRpbmc6IDFlbSAwLjNlbTt9I3RpIHt3aWR0aDogMzAwcHg7fSNidG5zIHt3aWR0aDogMzAwcHg7fS5mbCB7d2lkdGg6IDMwMHB4O2hlaWdodDo2MDBweDt9I3NpIHtwb3NpdGlvbjogcmVsYXRpdmU7ZGlzcGxheTogaW5saW5lLWJsb2NrO21hcmdpbi1ib3R0b206IC0wLjE1ZW07aGVpZ2h0OiAxZW07d2lkdGg6IDFlbTtvcGFjaXR5OiAwLjQ7fS5zYiB7ZmxleC1zaHJpbms6IDA7aGVpZ2h0OiA1MHB4O30uc28ge3Bvc2l0aW9uOiByZWxhdGl2ZTt6LWluZGV4OiA5MTEwO292ZXJmbG93OiBoaWRkZW47ZGlzcGxheTogaW5saW5lLWJsb2NrO3BhZGRpbmc6IDFweCA1cHg7d2lkdGg6IDk2cHg7aGVpZ2h0OiA1MHB4O2JvcmRlcjogMXB4IHNvbGlkICNFMEUwRTA7YmFja2dyb3VuZC1jb2xvcjogI0ZGRkZGRjtjdXJzb3I6IHBvaW50ZXI7fS5zbzpob3Zlciwuc286YWN0aXZlIHtiYWNrZ3JvdW5kLWNvbG9yOiAjRjVGNUY1O30uc28gZGl2IHtkaXNwbGF5OiAtd2Via2l0LWZsZXg7ZGlzcGxheTogZmxleDstd2Via2l0LWFsaWduLWl0ZW1zOiBjZW50ZXI7YWxpZ24taXRlbXM6IGNlbnRlcjstd2Via2l0LWp1c3RpZnktY29udGVudDogY2VudGVyO2p1c3RpZnktY29udGVudDogY2VudGVyO3dpZHRoOiAxMDAlO2hlaWdodDogMTAwJTt9LnNvIHNwYW4ge2NvbG9yOiAjNDI4NUY0O2ZvbnQtZmFtaWx5OiBBcmlhbCwgc2Fucy1zZXJpZjt0ZXh0LWFsaWduOiBjZW50ZXI7Zm9udC1zaXplOiAxMnB4O2xpbmUtaGVpZ2h0OiAxNHB4O3doaXRlLXNwYWNlOiBub3JtYWw7fUBtZWRpYSAobWluLWhlaWdodDogNTRweCkgey5zaC5zcyAuc28sLnN2IC5zbyB7Ym94LXNoYWRvdzogMHB4IDBweCAycHggcmdiYSgwLDAsMCwwLjEyKSwgMHB4IDFweCAzcHggcmdiYSgwLDAsMCwwLjI2KTtib3JkZXI6IG5vbmU7fX0uc3YgLnNvLC5zaC5zcyAuc28ge2JvcmRlci1yYWRpdXM6IDJweDt9LnN2IC5zbyB7bWFyZ2luOiA0cHg7fS5zdi5qdCAuc286Zmlyc3QtY2hpbGQge21hcmdpbi10b3A6IDhweDt9PC9zdHlsZT48L2hlYWQ%2BPGJvZHkgY2xhc3M9YW1wLWFuaW1hdGU%2BPGRpdiBpZD1nb29nbGVfY2VudGVyX2Rpdj48ZGl2IGlkPWdvb2dsZV9pbWFnZV9kaXY%2BPGEgaHJlZj1cImh0dHBzOi8vZ29vZ2xlYWRzLmcuZG91YmxlY2xpY2submV0L2FjbGs%2Fc2E9bCZhbXA7YWk9Q1lyNEt4ZjVZWDlXaElKU1JyQVRCajVlQUNLaUs1NUpmZ056d2lzd012LUVlRUFFZzBZZlNJR0NSaElDQV9CZWdBZkdEX1pVRHlBRUM0QUlBcUFNQnlBTUlxZ1Q2QVVfUVM5MUQwRnUxUllDUmdFa3pJb2dJdEYtRGZNSE5DNzU3Z1R5OFM0ZDdJemhkNnFhUVdrVDJiUnVvZ2loX19jVTdnUi1qN2NzbnFCX2dFRkVQZmlCOWF3ZGo5MktDVmUzN2VpYnNlR2Q2WUtocmtzVjRGNkVOZU0ycGVkRGlEQmVZMTZvamxBVG1FT3d1U0RVdHpOMnpsY2txYXRpYXk2SktRcFRhbE14am1MNG5EN2pTYUx0cHlFYWVnODBWczhkTVcwS2toZWJOdnl2VzlEdjZJRFFncHE4UFZ2eGZaTUxMeV9UdDdRVG5iTXJxc2VGTlYtU0xCcXBMaWg2aEthNnFiZ25ka05nVGFLRFY2YUxvLU40a3lMUlFzY0ROSGtUZUVaLXZtYjU4V19VUHREQnNOVkV3R1hQdUphdERtaXo2a2dyLVBiUHBNbG5BQk16RXZNT2VBdUFFQWFBR0FvQUhzOS1fZ1FHb0I0N09HNmdIMWNrYnFBZVQyQnVvQjdvR3FBZncyUnVvQl9MWkc2Z0hwcjRicUFmczFSdW9CX1BSRzZnSDdOVWJxQWVXMkJ1b0I4TGFHOWdIQWRJSUNRaUE0WUJBRUFFWUhmSUlHMkZrZUMxemRXSnplVzR0TnpJMk16VTNNelEwTmpnd05EQTNPTEVKdU50NklUY3FmTWlBQ2dPWUN3SElDd0hZRXd3JmFtcDthZT0xJmFtcDtudW09MSZhbXA7Y2lkPUNBQVNQZVJvVE9CMVNYMkRkZFZpRm5Fb21JNzFxdWJNVXpGZWdyTGo3c1FkMGlzM0p1aWhVZmFXVkFUUFZRQjNrb3pUaGxYUjNPWEtWYWItREhTTExWbyZhbXA7c2lnPUFPRDY0XzEzbzB4OTZZQU5IZUdndTVqWUJQNzJCUXZYV2cmYW1wO2NsaWVudD1jYS1wdWItOTY4NTczNDQ0NTQ3NjgxNCZhbXA7bng9Q0xJQ0tfWCZhbXA7bnk9Q0xJQ0tfWSZhbXA7bmI9MiZhbXA7YWR1cmw9aHR0cHM6Ly93d3cubmV3Y2hpYy5jb20vdGhlbWUtbWVuLWNhcHMtYmFja3BhY2tzLXQtMzQxNzQ2LyUzRnV0bV9zb3VyY2UlM0Rnb29nbGUlMjZ1dG1fbWVkaXVtJTNEY3BjX2FkczElMjZ1dG1fY2FtcGFpZ24lM0RjbmV3LW1zLXAtY2wyNzE0ODctMDgyMi1hbGwtMDkwOC0zNDE3NDYlMjZ1dG1fY29udGVudCUzRHZvbGFpJTI2dXRtX2Rlc2lnbiUzRDEzOCUyNmdjbGlkJTNERUFJYUlRb2JDaE1JbFppR3JMdmM2d0lWbEFpTENoM0J4d1dBRUFFWUFT&i=3-8&t=adltag_kevkyyz5_Qf69PlSTwVm&r=b7d67488abfc790ba4d38e91589f323&c=math-aids-threatpost&z=1
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/b-9a4f7ce-a7f6098c.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.84.156.60 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-84-156-60.txl52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Wed, 09 Sep 2020 03:19:23 GMT
via: 1.1 5cf5bc69324ade55eebb5e539fa6c2fa.cloudfront.net (CloudFront)
age: 46348
x-cache: Error from cloudfront
status: 200
content-length: 0
last-modified: Mon, 15 Jun 2020 18:35:10 GMT
server: AmazonS3
etag: "d41d8cd98f00b204e9800998ecf8427e"
access-control-max-age: 3000
access-control-allow-methods: GET
x-amz-version-id: D2POxJleIt92FyXaxSi7iRHuNLtujALh
access-control-allow-origin: *
x-amz-cf-pop: TXL52-C1
accept-ranges: bytes
content-type: text/plain
x-amz-cf-id: ITG-UaBIXhc5kmO-VehtcH6LxJ2K9Fq3mlLbAuQYvCGWhIzb9CuaBQ==

POST
H2 200 tag
math-aids-threatpost-tagan.adlightning.com/ 0
428 B 65ms
41ms Other
text/plain 99.84.156.60
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://math-aids-threatpost-tagan.adlightning.com/tag?s=bl&d=QUFFZ0lPNV9EX0J3RVwiIGlkPWF3MCBvbj1cInRhcDpleGl0LWFwaS5leGl0KHRhcmdldD0mIzM5O2xhbmRpbmdQYWdlJiMzOTssX25iPSYjMzk7MiYjMzk7KVwiIHRhcmdldD1fYmxhbms%2BPGFtcC1pbWcgYWx0IGNsYXNzPVwiaW1nX2FkIGktYW1waHRtbC1sYXlvdXQtZml4ZWQgaS1hbXBodG1sLWxheW91dC1zaXplLWRlZmluZWRcIiBoZWlnaHQ9NjAwIGktYW1waHRtbC1sYXlvdXQ9Zml4ZWQgaS1hbXBodG1sLXNzciBzcmM9XCJodHRwczovL3RwYy5nb29nbGVzeW5kaWNhdGlvbi5jb20vc2ltZ2FkLzY3MTAyOTkwMTYzODU2MTQ0MzI%2Fc3FwPTRzcVB5UVE3UWprcU54QUJIUUFBdEVJZ0FTZ0JNQWs0QTBEd2t3bFlBV0JmY0FLQUFRR0lBUUdkQVFBQWdELW9BUUd3QVlDdDRnUzRBVl9GQVMyeW5UNCZhbXA7cnM9QU9nYTRxbTlhSnV1MmxaSGRPSmlXSGJEYmhTckNXSGE5d1wiIHN0eWxlPXdpZHRoOjMwMHB4O2hlaWdodDo2MDBweDsgd2lkdGg9MzAwPjxpbWcgYWx0IGNsYXNzPVwiaS1hbXBodG1sLWZpbGwtY29udGVudCBpLWFtcGh0bWwtcmVwbGFjZWQtY29udGVudFwiIGRlY29kaW5nPWFzeW5jIHNyYz1cImh0dHBzOi8vdHBjLmdvb2dsZXN5bmRpY2F0aW9uLmNvbS9zaW1nYWQvNjcxMDI5OTAxNjM4NTYxNDQzMj9zcXA9NHNxUHlRUTdRamtxTnhBQkhRQUF0RUlnQVNnQk1BazRBMER3a3dsWUFXQmZjQUtBQVFHSUFRR2RBUUFBZ0Qtb0FRR3dBWUN0NGdTNEFWX0ZBUzJ5blQ0JmFtcDtycz1BT2dhNHFtOWFKdXUybFpIZE9KaVdIYkRiaFNyQ1dIYTl3XCI%2BPC9hbXAtaW1nPjwvYT48YW1wLXBpeGVsIGNsYXNzPVwiaS1hbXBodG1sLWxheW91dC1maXhlZCBpLWFtcGh0bWwtbGF5b3V0LXNpemUtZGVmaW5lZFwiIGktYW1waHRtbC1sYXlvdXQ9Zml4ZWQgcmVmZXJyZXJwb2xpY3k9bm8tcmVmZXJyZXIgc3JjPS8vd3d3Lmdvb2dsZS5jb20vcGFnZWFkL2RydC91aSBzdHlsZT13aWR0aDoxcHg7aGVpZ2h0OjFweDs%2BPC9hbXAtcGl4ZWw%2BPGRpdiBhcmlhLWhpZGRlbj10cnVlIGNsYXNzPVwiYWJnYyBhYmdmIHBlblwiIGRpcj1sdHIgaWQ9YWJnYz48ZGl2IGNsYXNzPVwiYWJnY3AgcGVhXCIgaWQ9YWJnY3A%2BPGRpdiBjbGFzcz1hYmdzIGlkPWFiZ3M%2BPGEgY2xhc3M9YWJnbCBocmVmPVwiaHR0cHM6Ly9hZHNzZXR0aW5ncy5nb29nbGUuY29tL3doeXRoaXNhZD9yZWFzb25zPUFCM2FmR0VBQUFVY1cxdGJXMjUxYkd3c1d6RXdYU3h1ZFd4c0xHNTFiR3dzYm5Wc2JDeGJJamt5TURBd0lsMWRMRnR1ZFd4c0xDSm9kSFJ3Y3pvdkwyZHZiMmRzWldGa2N5NW5MbVJ2ZFdKc1pXTnNhV05yTG01bGRDOXdZV2RsWVdRdlkyOXVkbVZ5YzJsdmJpOF9ZV2s5UTFseU5FdDRaalZaV0RsWGFFbEtVMUp5UVZSQ2FqVmxRVU5MYVVzMU5VcG1aMDU2ZDJsemQwMTJMVVZsUlVGRlp6QlpabE5KUjBOU2FFbERRVjlDWldkQlprZEVYMXBWUkhsQlJVTTBRVWxCY1VGTlFubEJUVWx4WjFRMlFWVmZVVk01TVVRd1JuVXhVbGxEVW1kRmEzcEpiMmRKZEVZdFJHWk5TRTVETnpVM1oxUjVPRk0wWkRkSmVtaGtObkZoVVZkclZESmlVblZ2WjJsb1gxOWpWVGRuVWkxcU4yTnpibkZDWDJkRlJrVlFabWxDT1dGM1pHbzVNa3REVm1Vek4yVnBZbk5sUjJRMldVdG9jbXR6VmpSR05rVk9aVTB5Y0dWa1JHbEVRbVZaTVRadmFteEJWRzFGVDNkMVUwUlZkSHBPTW5wc1kydHhZWFJwWVhrMlNrdFJjRlJoYkUxNGFtMU1ORzVFTjJwVFlVeDBjSGxGWVdWbk9EQldjemhrVFZjd1MydG9aV0pPZG5sMlZ6bEVkalpKUkZGbmNIRTRVRloyZUdaYVRVeE1lVjlVZERkUlZHNWlUWEp4YzJWR1RsWXRVMHhDY1hCTWFXZzJhRXRoTm5GaVoyNWthMDVuVkdGTFJGWTJZVXh2TFU0MGEzbE1VbEZ6WTBST1NHdFVaVVZhTFhadFlqVTRWMTlWVUhSRVFuTk9Wa1YzUjFoUWRVcGhkRVJ0YVhvMmEyZHlMVkJpVUhCTmJHNUJRazE2UlhaTlQyVkJkVUZGUVdGQlIwRnZRVWh6T1MxZloxRkhiMEkwTjA5SE5tZElNV05yWW5GQlpWUXlRblZ2UWpkdlIzRkJabmN5VW5WdlFsOU1Xa2MyWjBod2NqUmljVUZtY3pGU2RXOUNYMUJTUnpablNEZE9WV0p4UVdWWE1rSjFiMEk0VEdGSE9XZElRV1JKU1VOUmFVRTBXVUpCUlVGRldVaG1TVWxITWtaclpVTXhlbVJYU25wbFZ6UjBUbnBKTWsxNlZUTk5lbEV3VG1wbmQwNUVRVE5QVEVWS2RVNTBOa2xVWTNGbVRXbEJRMmRQV1VOM1NFbERkMGhaUlhkM1hIVXdNREkyYzJsbmFEMDNORVJFUVRNMlUwMU5UVngxTURBeU5tTnBaRDFEUVZGVFVIZERUa2x5VEUxM2FIQnRXbGhKV21SeFJVcDFVRkYwUVdvNVNXTlJaMUJPUlVWMFNVRmlTMU5VTVdodFNFaFhjRUprY1hWbk5YZFlSMUJYZGtsR04zVjJjREp4Vm5CNGNrcGZhM2QxUzJ0alN5MU1UbmNpTEZ0dWRXeHNMRzUxYkd3c2JuVnNiQ3dpYUhSMGNITTZMeTlrYVhOd2JHRjVZV1J6TFdadmNtMWhkSE11WjI5dloyeGxkWE5sY21OdmJuUmxiblF1WTI5dEwyRmtjeTl3Y21WMmFXVjNMMk52Ym5SbGJuUXVhbk1fWTJ4cFpXNTBQWGQwWVZ4MU1EQXlObTlpWm5WelkyRjBaV1JEZFhOMGIyMWxja2xrUFRRMk1URTFNRE16TlRoY2RUQXdNalpqY21WaGRHbDJaVWxrUFRRMk1qUTJOek0wTXpjNU1WeDFNREF5Tm5abGNuTnBiMjVKWkQwd1hIVXdNREkyWVdSSGNtOTFjRU55WldGMGFYWmxTV1E5TkRNeU56UXdOemN6TXpjMlhIVXdNREkyYUhSdGJGQmhjbVZ1ZEVsa1BYQnlaWFl0TUZ4MU1EQXlObWhsYVdkb2REMDJNREJjZFRBd01qWjNhV1IwYUQwek1EQmNkVEF3TWpaemFXYzlRVU5wVmtKZmVuSmtMVEJCY21oSWNWSk1lRlpKYmsxTU1GRjBWMjB5UmxNdGR5SmRMRzUxYkd3c2JuVnNiQ3d4TENKNFpWRmpUV1ZOY21zMWQwbG5UbnAzYVhOM1RVVk9MVWQyVGxsSVIwODJOVE5KUlVKSlozUjFXbGhrYW1GSGJHcE1iVTUyWWxWSldGa3lSWFJqU0ZacFRGUnJNazlFVlROTmVsRXdUa1JWTUU1NldUUk5WRkpKUW14blEyTkJSU0lzSWpJd05qQXpPRGN4TmpjaVhWMWRMRnN4TERFc01WMWRZWklvMEMyQnBFT2NQTmNDU0hFX0E3OFVJeXlYNDhRY0hwZFVVelFhbU9UaDNLbm40cmFBVjBPWVN2a25OSFBSMXc4TTF3TWdEempSMjRUMFBSOWxnWU90dEVhWG5ha09sT3VYR0pOZGFaZUlOaDB5SmFwZldjS09mNGNDaWZrb1V2VWtsRFpSdm5nUzVhY2cwOWhqMFRPRmhsMGJTYlFrcUZQWWFNMkdxdVgwNURqLVpWNDAwM3hSR3BfTFV2Ukk0Vy1Tc0gwZXFhdG5YdWhLc3lQak1SLW40Q2ZabXZvbFFIbzRpa0hCSmZWT0paeVB6SURab2RZTHM2WTNCZWJsRnA1ejltaHBHNmVwRjcyVUNTR2JUTWN2UzZnS1prUEZ2dmtpWGZRSEFOUWtJS1ZkcUJIc0FJWWRlck9YbkZzdUc2OXdmOGhnZVh6UGk1ME9iZmdnOFEsZldGTEIydHkzaVB0MUJOTnFzYlNRZyZhbXA7c291cmNlPWRpc3BsYXlcIiBpZD1hYmdsIHRhcmdldD1fYmxhbms%2BPGFtcC1pbWcgY2xhc3M9XCJpLWFtcGh0bWwtbGF5b3V0LWZpeGVkIGktYW1waHRtbC1sYXlvdXQtc2l6ZS1kZWZpbmVkXCIgaGVpZ2h0PTE1IGktYW1waHRtbC1sYXlvdXQ9Zml4ZWQgaS1hbXBodG1sLXNzciBzcmM9aHR0cHM6Ly90cGMuZ29vZ2xlc3luZGljYXRpb24uY29tL3BhZ2VhZC9pbWFnZXMvYWRjaG9pY2VzL2VuLnBuZyBzdHlsZT13aWR0aDo3NXB4O2hlaWdodDoxNXB4OyB3aWR0aD03NT48aW1nIGNsYXNzPVwiaS1hbXBodG1sLWZpbGwtY29udGVudCBpLWFtcGh0bWwtcmVwbGFjZWQtY29udGVudFwiIGRlY29kaW5nPWFzeW5jIHNyYz1odHRwczovL3RwYy5nb29nbGVzeW5kaWNhdGlvbi5jb20vcGFnZWFkL2ltYWdlcy9hZGNob2ljZXMvZW4ucG5nPjwvYW1wLWltZz48L2E%2BPC9kaXY%2BPGRpdiBjbGFzcz1hYmdiIGlkPWFiZ2I%2BPGEgaHJlZj1cImh0dHBzOi8vYWRzc2V0dGluZ3MuZ29vZ2xlLmNvbS93aHl0aGlzYWQ%2FcmVhc29ucz1BQjNhZkdFQUFBVWNXMXRiVzI1MWJHd3NXekV3WFN4dWRXeHNMRzUxYkd3c2JuVnNiQ3hiSWpreU1EQXdJbDFkTEZ0dWRXeHNMQ0pvZEhSd2N6b3ZMMmR2YjJkc1pXRmtjeTVuTG1SdmRXSnNaV05zYVdOckxtNWxkQzl3WVdkbFlXUXZZMjl1ZG1WeWMybHZiaThfWVdrOVExbHlORXQ0WmpWWldEbFhhRWxLVTFKeVFWUkNhalZsUVVOTGFVczFOVXBtWjA1NmQybHpkMDEyTFVWbFJVRkZaekJaWmxOSlIwTlNhRWxEUVY5Q1pXZEJaa2RFWDFwVlJIbEJSVU0wUVVsQmNVRk5RbmxCVFVseFoxUTJRVlZmVVZNNU1VUXdSblV4VWxsRFVtZEZhM3BKYjJkSmRFWXRSR1pOU0U1RE56VTNaMVI1T0ZNMFpEZEplbWhrTm5GaFVWZHJWREppVW5WdloybG9YMTlqVlRkblVpMXFOMk56Ym5GQ1gyZEZSa1ZRWm1sQ09XRjNaR281TWt0RFZtVXpOMlZwWW5ObFIyUTJXVXRvY210elZqUkdOa1ZPWlUweWNHVmtSR2xFUW1WWk1UWnZhbXhCVkcxRlQzZDFVMFJWZEhwT01ucHNZMnR4WVhScFlYazJTa3RSY0ZSaGJFMTRhbTFNTkc1RU4ycFRZVXgwY0hsRllXVm5PREJXY3poa1RWY3dTMnRvWldKT2RubDJWemxFZGpaSlJGRm5jSEU0VUZaMmVHWmFUVXhNZVY5VWREZFJWRzVpVFhKeGMyVkdUbFl0VTB4Q2NYQk1hV2cyYUV0aE5uRmlaMjVrYTA1blZHRkxSRlkyWVV4dkxVNDBhM2xNVWxGelkwUk9TR3RVWlVWYUxYWnRZalU0VjE5VlVIUkVRbk5PVmtWM1IxaFFkVXBoZEVSdGFYbzJhMmR5TFZCaVVIQk5iRzVCUWsxNlJYWk5UMlZCZFVGRlFXRkJSMEZ2UVVoek9TMWZaMUZIYjBJME4wOUhObWRJTVdOclluRkJaVlF5UW5WdlFqZHZSM0ZCWm5jeVVuVnZRbDlNV2tjMlowaHdjalJpY1VGbWN6RlNkVzlDWDFCU1J6Wm5TRGRPVldKeFFXVlhNa0oxYjBJNFRHRkhPV2RJUVdSSlNVTlJhVUUwV1VKQlJVRkZXVWhtU1VsSE1rWnJaVU14ZW1SWFNucGxWelIwVG5wSk1rMTZWVE5OZWxFd1RtcG5kMDVFUVROUFRFVktkVTUwTmtsVVkzRm1UV2xCUTJkUFdVTjNTRWxEZDBoWlJYZDNYSFV3TURJMmMybG5hRDAzTkVSRVFUTTJVMDFOVFZ4MU1EQXlObU5wWkQxRFFWRlRVSGREVGtseVRFMTNhSEJ0V2xoSldtUnhSVXAxVUZGMFFXbzVTV05SWjFCT1JVVjBTVUZpUzFOVU1XaHRTRWhYY0VKa2NYVm5OWGRZUjFCWGRrbEdOM1YyY0RKeFZuQjRja3BmYTNkMVMydGpTeTFNVG5jaUxGdHVkV3hzTEc1MWJHd3NiblZzYkN3aWFIUjBjSE02THk5a2FYTndiR0Y1WVdSekxXWnZjbTFoZEhNdVoyOXZaMnhsZFhObGNtTnZiblJsYm5RdVkyOXRMMkZrY3k5d2NtVjJhV1YzTDJOdmJuUmxiblF1YW5NX1kyeHBaVzUwUFhkMFlWeDFNREF5Tm05aVpuVnpZMkYwWldSRGRYTjBiMjFsY2tsa1BUUTJNVEUxTURNek5UaGNkVEF3TWpaamNtVmhkR2wyWlVsa1BUUTJNalEyTnpNME16YzVNVngxTURBeU5uWmxjbk5wYjI1SlpEMHdYSFV3TURJMllXUkhjbTkxY0VOeVpXRjBhWFpsU1dROU5ETXlOelF3Tnpjek16YzJYSFV3TURJMmFIUnRiRkJoY21WdWRFbGtQWEJ5WlhZdE1GeDFNREF5Tm1obGFXZG9kRDAyTURCY2RUQXdNalozYVdSMGFEMHpNREJjZFRBd01qWnphV2M5UVVOcFZrSmZlbkprTFRCQmNtaEljVkpNZUZaSmJrMU1NRkYwVjIweVJsTXRkeUpkTEc1MWJHd3NiblZzYkN3eExDSjRaVkZqVFdWTmNtczFkMGxuVG5wM2FYTjNUVVZPTFVkMlRsbElSMDgyTlROSlJVSkpaM1IxV2xoa2FtRkhiR3BNYlU1MllsVkpXRmt5UlhSalNGWnBURlJyTWs5RVZUTk5lbEV3VGtSVk1FNTZXVFJOVkZKSlFteG5RMk5CUlNJc0lqSXdOakF6T0RjeE5qY2lYVjFkTEZzeExERXNNVjFkWVpJbzBDMkJwRU9jUE5jQ1NIRV9BNzhVSXl5WDQ4UWNIcGRVVXpRYW1PVGgzS25uNHJhQVYwT1lTdmtuTkhQUjF3OE0xd01nRHpqUjI0VDBQUjlsZ1lPdHRFYVhuYWtPbE91WEdKTmRhWmVJTmgweUphcGZXY0tPZjRjQ2lma29VdlVrbERaUnZuZ1M1YWNnMDloajBUT0ZobDBiU2JRa3FGUFlhTTJHcXVYMDVEai1aVjQwMDN4UkdwX0xVdlJJNFctU3NIMGVxYXRuWHVoS3N5UGpNUi1uNENmWm12b2xRSG80aWtIQkpmVk9KWnlQeklEWm9kWUxzNlkzQmVibEZwNXo5bWhwRzZlcEY3MlVDU0diVE1jdlM2Z0taa1BGdnZraVhmUUhBTlFrSUtWZHFCSHNBSVlkZXJPWG5Gc3VHNjl3ZjhoZ2VYelBpNTBPYmZnZzhRLGZXRkxCMnR5M2lQdDFCTk5xc2JTUWcmYW1wO3NvdXJjZT1kaXNwbGF5XCIgdGFyZ2V0PV9ibGFuaz48YW1wLWlt&i=4-8&t=adltag_kevkyyz5_Qf69PlSTwVm&r=b7d67488abfc790ba4d38e91589f323&c=math-aids-threatpost&z=1
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/b-9a4f7ce-a7f6098c.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.84.156.60 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-84-156-60.txl52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Wed, 09 Sep 2020 03:19:23 GMT
via: 1.1 5cf5bc69324ade55eebb5e539fa6c2fa.cloudfront.net (CloudFront)
age: 46348
x-cache: Error from cloudfront
status: 200
content-length: 0
last-modified: Mon, 15 Jun 2020 18:35:10 GMT
server: AmazonS3
etag: "d41d8cd98f00b204e9800998ecf8427e"
access-control-max-age: 3000
access-control-allow-methods: GET
x-amz-version-id: D2POxJleIt92FyXaxSi7iRHuNLtujALh
access-control-allow-origin: *
x-amz-cf-pop: TXL52-C1
accept-ranges: bytes
content-type: text/plain
x-amz-cf-id: z63W9Ef-bD5YPH86uvEWopSQQMji4Ji1VN8twj8ZDwMdTM4nExqXnA==

POST
H2 200 tag
math-aids-threatpost-tagan.adlightning.com/ 0
427 B 67ms
43ms Other
text/plain 99.84.156.60
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://math-aids-threatpost-tagan.adlightning.com/tag?s=bl&d=ZyBjbGFzcz1cImktYW1waHRtbC1sYXlvdXQtZml4ZWQgaS1hbXBodG1sLWxheW91dC1zaXplLWRlZmluZWRcIiBoZWlnaHQ9MTUgaS1hbXBodG1sLWxheW91dD1maXhlZCBpLWFtcGh0bWwtc3NyIHNyYz1odHRwczovL3RwYy5nb29nbGVzeW5kaWNhdGlvbi5jb20vcGFnZWFkL2ltYWdlcy9hZGNob2ljZXMvaWNvbi5wbmcgc3R5bGU9d2lkdGg6MTVweDtoZWlnaHQ6MTVweDsgd2lkdGg9MTU%2BPGltZyBjbGFzcz1cImktYW1waHRtbC1maWxsLWNvbnRlbnQgaS1hbXBodG1sLXJlcGxhY2VkLWNvbnRlbnRcIiBkZWNvZGluZz1hc3luYyBzcmM9aHR0cHM6Ly90cGMuZ29vZ2xlc3luZGljYXRpb24uY29tL3BhZ2VhZC9pbWFnZXMvYWRjaG9pY2VzL2ljb24ucG5nPjwvYW1wLWltZz48L2E%2BPC9kaXY%2BPC9kaXY%2BPGFtcC1hbmFseXRpY3MgY2xhc3M9XCJpLWFtcGh0bWwtbGF5b3V0LWZpeGVkIGktYW1waHRtbC1sYXlvdXQtc2l6ZS1kZWZpbmVkXCIgaS1hbXBodG1sLWxheW91dD1maXhlZCBzdHlsZT13aWR0aDoxcHg7aGVpZ2h0OjFweDsgdHJpZ2dlcj1pbW1lZGlhdGU%2BPHNjcmlwdCB0eXBlPWFwcGxpY2F0aW9uL2pzb24%2Be1wicmVxdWVzdHNcIjoge1wicmVwb3J0Tm9MYWJlbEluc3RhbmNlXCI6IFwiaHR0cHM6Ly9nb29nbGVhZHMuZy5kb3VibGVjbGljay5uZXQvcGFnZWFkL2NvbnZlcnNpb24vP2FpPUNZcjRLeGY1WVg5V2hJSlNSckFUQmo1ZUFDS2lLNTVKZmdOendpc3dNdi1FZUVBRWcwWWZTSUdDUmhJQ0FfQmVnQWZHRF9aVUR5QUVDNEFJQXFBTUJ5QU1JcWdUNkFVX1FTOTFEMEZ1MVJZQ1JnRWt6SW9nSXRGLURmTUhOQzc1N2dUeThTNGQ3SXpoZDZxYVFXa1QyYlJ1b2dpaF9fY1U3Z1Itajdjc25xQl9nRUZFUGZpQjlhd2RqOTJLQ1ZlMzdlaWJzZUdkNllLaHJrc1Y0RjZFTmVNMnBlZERpREJlWTE2b2psQVRtRU93dVNEVXR6TjJ6bGNrcWF0aWF5NkpLUXBUYWxNeGptTDRuRDdqU2FMdHB5RWFlZzgwVnM4ZE1XMEtraGViTnZ5dlc5RHY2SURRZ3BxOFBWdnhmWk1MTHlfVHQ3UVRuYk1ycXNlRk5WLVNMQnFwTGloNmhLYTZxYmduZGtOZ1RhS0RWNmFMby1ONGt5TFJRc2NETkhrVGVFWi12bWI1OFdfVVB0REJzTlZFd0dYUHVKYXREbWl6Nmtnci1QYlBwTWxuQUJNekV2TU9lQXVBRUFhQUdBb0FIczktX2dRR29CNDdPRzZnSDFja2JxQWVUMkJ1b0I3b0dxQWZ3MlJ1b0JfTFpHNmdIcHI0YnFBZnMxUnVvQl9QUkc2Z0g3TlVicUFlVzJCdW9COExhRzlnSEFkSUlDUWlBNFlCQUVBRVlIZklJRzJGa2VDMXpkV0p6ZVc0dE56STJNelUzTXpRME5qZ3dOREEzT0xFSnVOdDZJVGNxZk1pQUNnT1lDd0hJQ3dIWUV3dyZzaWdoPTc0RERBMzZTTU1NJmNpZD1DQVFTUHdDTklyTE13aHBtWlhJWmRxRUp1UFF0QWo5SWNRZ1BORUV0SUFiS1NUMWhtSEhXcEJkcXVnNXdYR1BXdklGN3V2cDJxVnB4ckpfa3d1S2tjSy1MTncmY2lkPUNBUVNQd0NOSXJMTXdocG1aWElaZHFFSnVQUXRBajlJY1FnUE5FRXRJQWJLU1QxaG1ISFdwQmRxdWc1d1hHUFd2SUY3dXZwMnFWcHhySl9rd3VLa2NLLUxOdyZsYWJlbD0ke2xhYmVsfVwiLFwicmVwb3J0TGFiZWxJbnN0YW5jZVwiOiBcImh0dHBzOi8vZ29vZ2xlYWRzLmcuZG91YmxlY2xpY2submV0L3BhZ2VhZC9jb252ZXJzaW9uLz9haT1DWXI0S3hmNVlYOVdoSUpTUnJBVEJqNWVBQ0tpSzU1SmZnTnp3aXN3TXYtRWVFQUVnMFlmU0lHQ1JoSUNBX0JlZ0FmR0RfWlVEeUFFQzRBSUFxQU1CeUFNSXFnVDZBVV9RUzkxRDBGdTFSWUNSZ0VreklvZ0l0Ri1EZk1ITkM3NTdnVHk4UzRkN0l6aGQ2cWFRV2tUMmJSdW9naWhfX2NVN2dSLWo3Y3NucUJfZ0VGRVBmaUI5YXdkajkyS0NWZTM3ZWlic2VHZDZZS2hya3NWNEY2RU5lTTJwZWREaURCZVkxNm9qbEFUbUVPd3VTRFV0ek4yemxja3FhdGlheTZKS1FwVGFsTXhqbUw0bkQ3alNhTHRweUVhZWc4MFZzOGRNVzBLa2hlYk52eXZXOUR2NklEUWdwcThQVnZ4ZlpNTEx5X1R0N1FUbmJNcnFzZUZOVi1TTEJxcExpaDZoS2E2cWJnbmRrTmdUYUtEVjZhTG8tTjRreUxSUXNjRE5Ia1RlRVotdm1iNThXX1VQdERCc05WRXdHWFB1SmF0RG1pejZrZ3ItUGJQcE1sbkFCTXpFdk1PZUF1QUVBYUFHQW9BSHM5LV9nUUdvQjQ3T0c2Z0gxY2ticUFlVDJCdW9CN29HcUFmdzJSdW9CX0xaRzZnSHByNGJxQWZzMVJ1b0JfUFJHNmdIN05VYnFBZVcyQnVvQjhMYUc5Z0hBZElJQ1FpQTRZQkFFQUVZSGZJSUcyRmtlQzF6ZFdKemVXNHROekkyTXpVM016UTBOamd3TkRBM09MRUp1TnQ2SVRjcWZNaUFDZ09ZQ3dISUN3SFlFd3cmc2lnaD03NEREQTM2U01NTSZjaWQ9Q0FRU1B3Q05JckxNd2hwbVpYSVpkcUVKdVBRdEFqOUljUWdQTkVFdElBYktTVDFobUhIV3BCZHF1ZzV3WEdQV3ZJRjd1dnAycVZweHJKX2t3dUtrY0stTE53JmNpZD1DQVFTUHdDTklyTE13aHBtWlhJWmRxRUp1UFF0QWo5SWNRZ1BORUV0SUFiS1NUMWhtSEhXcEJkcXVnNXdYR1BXdklGN3V2cDJxVnB4ckpfa3d1S2tjSy1MTncmbGFiZWw9JHtsYWJlbH0mbGFiZWxfaW5zdGFuY2U9JHtsYWJlbEluc3RhbmNlfSZjYnQ9eGVRY01lTXJrNXdJZ056d2lzd01FTi1Hdk5ZSEdPNjUzSUVCSWd0dVpYZGphR2xqTG1OdmJVSVhZMkV0Y0hWaUxUazJPRFUzTXpRME5EVTBOelk0TVRSSUJsZ0NjQUVcIn0sXCJ0cmFuc3BvcnRcIjoge1wiYmVhY29uXCI6IGZhbHNlLFwieGhycG9zdFwiOiBmYWxzZSxcImltYWdlXCI6IHRydWV9LFwidHJpZ2dlcnNcIjoge1widHJhY2tNdXRlXCI6IHtcIm9uXCI6IFwiY2xpY2tcIixcInNlbGVjdG9yXCI6IFwibGFiZWxbZm9yPSdzcHIxJ11cIixcInJlcXVlc3RcIjogXCJyZXBvcnROb0xhYmVsSW5zdGFuY2VcIn0sXCJ0cmFja1JlcG9ydEFkXCI6IHtcIm9uXCI6IFwiY2xpY2tcIixcInNlbGVjdG9yXCI6IFwibGFiZWxbZm9yPSdzcHIyJ11cIixcInJlcXVlc3RcIjogXCJyZXBvcnRMYWJlbEluc3RhbmNlXCJ9LFwidHJhY2tTdXJ2ZXlSZXNwb25zZVwiOiB7XCJvblwiOiBcImNsaWNrXCIsXCJzZWxlY3RvclwiOiBcImxhYmVsW2Zvcj0nc3ByMyddXCIsXCJyZXF1ZXN0XCI6IFwicmVwb3J0TGFiZWxJbnN0YW5jZVwifSxcInRyYWNrV2h5VGhpc0FkXCI6IHtcIm9uXCI6IFwiY2xpY2tcIixcInNlbGVjdG9yXCI6IFwiI3NidG5cIixcInJlcXVlc3RcIjogXCJyZXBvcnRMYWJlbEluc3RhbmNlXCJ9fX08L3NjcmlwdD48L2FtcC1hbmFseXRpY3M%2BPGZvcm0gYWN0aW9uPS8vZy5jbyBjbGFzcz1cInN2IGp0IGFtcC1hbmltYXRlIGFiZ2YgcGVuXCIgaWQ9bXRhIHRhcmdldD1fYmxhbms%2BPGlucHV0IGlkPXNwcjAgbmFtZT1hIHR5cGU9cmFkaW8%2BPGlucHV0IGlkPXNwcjEgbmFtZT1hIHR5cGU9cmFkaW8%2BPGlucHV0IGlkPXNwcjIgbmFtZT1hIHR5cGU9cmFkaW8%2BPGlucHV0IGlkPXNwcjMgbmFtZT1hIHR5cGU9cmFkaW8%2BPGxhYmVsIGNsYXNzPVwiY2JiIHBlYVwiIGRhdGEtdmFycy1sYWJlbD11c2VyX2ZlZWRiYWNrX21lbnVfaW50ZXJhY3Rpb24gZm9yPXNwcjEgaWQ9Y2JiPjxzdmcgaGVpZ2h0PTE1IHdpZHRoPTE1IHhtbG5zPS8vd3d3LnczLm9yZy8yMDAwL3N2Zz48cGF0aCBkPU0wLDBsMTUsMGwwLDE1bC0xNSwwWiBmaWxsPSNjZGNjY2M%2BPC9wYXRoPjxwYXRoIGQ9TTMuMjUsMy4yNWw4LjUsOC41TTExLjc1LDMuMjVsLTguNSw4LjUgc3Ryb2tlPSMwMGFlY2Qgc3Ryb2tlLXdpZHRoPTEuMjU%2BPC9wYXRoPjwvc3ZnPjwvbGFiZWw%2BPGRpdiBjbGFzcz1cInBuIGFiZ2ZcIiBpZD1zcHYxPjxhbXAtZml0LXRleHQgY2xhc3M9XCJmbCBpLWFtcGh0bWwtbGF5b3V0LXJlc3BvbnNpdmUgaS1hbXBodG1sLWxheW91dC1zaXplLWRlZmluZWRcIiBoZWlnaHQ9NjAwIGktYW1waHRtbC1sYXlvdXQ9cmVzcG9uc2l2ZSBsYXlvdXQ9cmVzcG9uc2l2ZSBtYXgtZm9udC1zaXplPTIwIG1pbi1mb250LXNpemU9OCB3aWR0aD0zMDA%2BPGktYW1waHRtbC1zaXplciBzdHlsZT1kaXNwbGF5OmJsb2NrO3BhZGRpbmctdG9wOjIwMC4wMDAwJTs%2BPC9pLWFtcGh0bWwtc2l6ZXI%2BPGRpdiBjbGFzcz1jbG9zZSBpZD1tZW51LWRpc21pc3M%2BPGxhYmVsIGZvcj1zcHIwPjxzdmcgdmlld2JveD1cIjAgMCAyNCAyNFwiPjxwYXRoIGNsYXNzPW5hdGl2ZS1hcnJvdyBkPVwiTTIwIDExSDcuODNsNS41OS01LjU5TDEyIDRsLTggOCA4IDggMS40MS0xLjQxTDcuODMgMTNIMjB2LTJ6XCI%2BPC9wYXRoPjwvc3ZnPjwvbGFiZWw%2BPC9kaXY%2BPGRpdiBpZD10aT48c3BhbiBjbGFzcz1jdD5BZHMgYnkgPHN2ZyBmaWxsPSMwMDAwMDAgdmlld2JveD1cIjAgMCA2MCAyNFwiIHhtbG5zPWh0dHA6Ly93d3cudzMub3JnLzIwMDAvc3ZnPjxwYXRoIGQ9XCJNNy41IDE2LjI5Yy00LjA3IDAtNy40OS0zLjMxLTcuNDktNy4zOFMzLjQzIDEuNTMgNy41IDEuNTNjMi4yNSAwIDMuODUuODggNS4wNiAyLjAzbC0xLjQyIDEuNDJjLS44Ny0uODEtMi4wNC0xLjQ0LTMuNjQtMS40NC0yLjk3IDAtNS4yOSAyLjQtNS4yOSA1LjM3czIuMzIgNS4zNyA1LjI5IDUuMzdjMS45MyAwIDMuMDMtLjc3IDMuNzMtMS40OC41OC0uNTguOTUtMS40IDEuMS0yLjU0SDcuNVY4LjI0aDYuNzljLjA3LjM2LjExLjc5LjExIDEuMjYgMCAxLjUxLS40MSAzLjM5LTEuNzUgNC43Mi0xLjMgMS4zNS0yLjk1IDIuMDctNS4xNSAyLjA3em0xNy43NS00Ljc2YzAgMi43NC0yLjEzIDQuNzUtNC43NSA0Ljc1cy00Ljc1LTIuMDItNC43NS00Ljc1YzAtMi43NSAyLjEzLTQuNzUgNC43NS00Ljc1czQuNzUgMiA0Ljc1IDQuNzV6bS0yLjA4IDBjMC0xLjcxLTEuMjQtMi44OC0yLjY3LTIuODhzLTIuNjcgMS4xNy0yLjY3IDIuODhjMCAxLjY5IDEuMjQgMi44OCAyLjY3IDIuODhzMi42Ny0xLjE4IDIuNjctMi44OHptMTMuMDggMGMwIDIuNzQtMi4xMyA0Ljc1LTQuNzUgNC43NXMtNC43NS0yLjAyLTQuNzUtNC43NWMwLTIuNzUgMi4xMy00Ljc1IDQuNzUtNC43NXM0Ljc1IDIgNC43NSA0Ljc1em0tMi4wOCAwYzAtMS43MS0xLjI0LTIuODgtMi42Ny0yLjg4cy0yLjY3IDEuMTctMi42NyAyLjg4YzAgMS42OSAxLjI0IDIuODggMi42NyAyLjg4czIuNjctMS4xOCAyLjY3LTIuODh6bTEyLjU4LTQuNDZ2OC41M2MwIDMuNTEtMi4wNyA0Ljk1LTQuNTIgNC45NS0yLjMgMC0zLjY5LTEuNTUtNC4yMS0yLjgxbDEuODItLjc2Yy4zMi43NyAxLjEyIDEuNjkgMi4zOSAxLjY5IDEuNTcgMCAyLjU0LS45NyAyLjU0LTIuNzl2LS42OGgtLjA3Yy0uNDcuNTgtMS4zNyAxLjA4LTIuNSAxLjA4LTIuMzggMC00LjU2LTIuMDctNC41Ni00Ljc0IDAtMi42OCAyLjE4LTQuNzcgNC41Ni00Ljc3IDEuMTMgMCAyLjAzLjUgMi41IDEuMDZoLjA3di0uNzZoMS45OHptLTEuODQgNC40OGMwLTEuNjctMS4xMi0yLjktMi41NC0yLjktMS40NCAwLTIuNjUgMS4yMi0yLjY1IDIuOSAwIDEuNjYgMS4yMSAyLjg2IDIuNjUgMi44NiAxLjQzLjAxIDIuNTQtMS4yIDIuNTQtMi44NnptNS44OS05LjUyVjE2aC0yLjA5VjIuMDNoMi4wOXptOC40OSAxMS4wN2wxLjYyIDEuMDhjLS41Mi43Ny0xLjc4IDIuMTEtMy45NiAyLjExLTIuNyAwLTQuNzItMi4wOS00LjcyLTQuNzUgMC0yLjgzIDIuMDMtNC43NSA0LjQ4LTQuNzUgMi40NyAwIDMuNjcgMS45NiA0LjA3IDMuMDJsLjIyLjU0LTYuMzYgMi42M2MuNDkuOTUgMS4yNCAxLjQ0IDIuMyAxLjQ0IDEuMDcgMCAxLjgxLS41MyAyLjM1LTEuMzJ6bS00Ljk5LTEuNzFsNC4yNS0xLjc2Yy0uMjMtLjU5LS45NC0xLjAxLTEuNzYtMS4wMS0xLjA2IDAtMi41NC45My0yLjQ5IDIuNzd6XCI%2BPC9wYXRoPjxwYXRoIGQ9XCJNMCAwaDYydjI0SDB6XCIgZmlsbD1ub25lPjwvcGF0aD48L3N2Zz48L3NwYW4%2BPC9kaXY%2BPGRpdiBpZD1idG5zPjxsYWJlbCBkYXRhLXZhcnMtbGFiZWw9dXNlcl9mZWVkYmFja19tZW51X29wdGlvbiBkYXRhLXZhcnMtbGFiZWwtaW5zdGFuY2U9MSBmb3I9c3ByMj48YSBjbGFzcz1idG4gaWQ9cmJ0bj48c3Bhbj5TZW5kIGZlZWRiYWNrPC9zcGFuPjwvYT48L2xhYmVsPjxsYWJlbD48YSBjbGFzcz1idG4gZGF0YS12YXJzLWxhYmVsPWNsb3NlYnV0dG9uX3doeXRoaXNhZF9jbGljayBkYXRhLXZhcnMtbGFiZW&i=5-8&t=adltag_kevkyyz5_Qf69PlSTwVm&r=b7d67488abfc790ba4d38e91589f323&c=math-aids-threatpost&z=1
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/b-9a4f7ce-a7f6098c.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.84.156.60 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-84-156-60.txl52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Wed, 09 Sep 2020 03:19:23 GMT
via: 1.1 5cf5bc69324ade55eebb5e539fa6c2fa.cloudfront.net (CloudFront)
age: 46348
x-cache: Error from cloudfront
status: 200
content-length: 0
last-modified: Mon, 15 Jun 2020 18:35:10 GMT
server: AmazonS3
etag: "d41d8cd98f00b204e9800998ecf8427e"
access-control-max-age: 3000
access-control-allow-methods: GET
x-amz-version-id: D2POxJleIt92FyXaxSi7iRHuNLtujALh
access-control-allow-origin: *
x-amz-cf-pop: TXL52-C1
accept-ranges: bytes
content-type: text/plain
x-amz-cf-id: L_w_Ek2Z7bkoGxU89YB1-95GYke3YV7cWMpB4osn1LlJZD_Twwy40w==

POST
H2 200 tag
math-aids-threatpost-tagan.adlightning.com/ 0
426 B 69ms
45ms Other
text/plain 99.84.156.60
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://math-aids-threatpost-tagan.adlightning.com/tag?s=bl&d=wtaW5zdGFuY2U9MSBocmVmPVwiaHR0cHM6Ly9hZHNzZXR0aW5ncy5nb29nbGUuY29tL3doeXRoaXNhZD9yZWFzb25zPUFCM2FmR0VBQUFVY1cxdGJXMjUxYkd3c1d6RXdYU3h1ZFd4c0xHNTFiR3dzYm5Wc2JDeGJJamt5TURBd0lsMWRMRnR1ZFd4c0xDSm9kSFJ3Y3pvdkwyZHZiMmRzWldGa2N5NW5MbVJ2ZFdKc1pXTnNhV05yTG01bGRDOXdZV2RsWVdRdlkyOXVkbVZ5YzJsdmJpOF9ZV2s5UTFseU5FdDRaalZaV0RsWGFFbEtVMUp5UVZSQ2FqVmxRVU5MYVVzMU5VcG1aMDU2ZDJsemQwMTJMVVZsUlVGRlp6QlpabE5KUjBOU2FFbERRVjlDWldkQlprZEVYMXBWUkhsQlJVTTBRVWxCY1VGTlFubEJUVWx4WjFRMlFWVmZVVk01TVVRd1JuVXhVbGxEVW1kRmEzcEpiMmRKZEVZdFJHWk5TRTVETnpVM1oxUjVPRk0wWkRkSmVtaGtObkZoVVZkclZESmlVblZ2WjJsb1gxOWpWVGRuVWkxcU4yTnpibkZDWDJkRlJrVlFabWxDT1dGM1pHbzVNa3REVm1Vek4yVnBZbk5sUjJRMldVdG9jbXR6VmpSR05rVk9aVTB5Y0dWa1JHbEVRbVZaTVRadmFteEJWRzFGVDNkMVUwUlZkSHBPTW5wc1kydHhZWFJwWVhrMlNrdFJjRlJoYkUxNGFtMU1ORzVFTjJwVFlVeDBjSGxGWVdWbk9EQldjemhrVFZjd1MydG9aV0pPZG5sMlZ6bEVkalpKUkZGbmNIRTRVRloyZUdaYVRVeE1lVjlVZERkUlZHNWlUWEp4YzJWR1RsWXRVMHhDY1hCTWFXZzJhRXRoTm5GaVoyNWthMDVuVkdGTFJGWTJZVXh2TFU0MGEzbE1VbEZ6WTBST1NHdFVaVVZhTFhadFlqVTRWMTlWVUhSRVFuTk9Wa1YzUjFoUWRVcGhkRVJ0YVhvMmEyZHlMVkJpVUhCTmJHNUJRazE2UlhaTlQyVkJkVUZGUVdGQlIwRnZRVWh6T1MxZloxRkhiMEkwTjA5SE5tZElNV05yWW5GQlpWUXlRblZ2UWpkdlIzRkJabmN5VW5WdlFsOU1Xa2MyWjBod2NqUmljVUZtY3pGU2RXOUNYMUJTUnpablNEZE9WV0p4UVdWWE1rSjFiMEk0VEdGSE9XZElRV1JKU1VOUmFVRTBXVUpCUlVGRldVaG1TVWxITWtaclpVTXhlbVJYU25wbFZ6UjBUbnBKTWsxNlZUTk5lbEV3VG1wbmQwNUVRVE5QVEVWS2RVNTBOa2xVWTNGbVRXbEJRMmRQV1VOM1NFbERkMGhaUlhkM1hIVXdNREkyYzJsbmFEMDNORVJFUVRNMlUwMU5UVngxTURBeU5tTnBaRDFEUVZGVFVIZERUa2x5VEUxM2FIQnRXbGhKV21SeFJVcDFVRkYwUVdvNVNXTlJaMUJPUlVWMFNVRmlTMU5VTVdodFNFaFhjRUprY1hWbk5YZFlSMUJYZGtsR04zVjJjREp4Vm5CNGNrcGZhM2QxUzJ0alN5MU1UbmNpTEZ0dWRXeHNMRzUxYkd3c2JuVnNiQ3dpYUhSMGNITTZMeTlrYVhOd2JHRjVZV1J6TFdadmNtMWhkSE11WjI5dloyeGxkWE5sY21OdmJuUmxiblF1WTI5dEwyRmtjeTl3Y21WMmFXVjNMMk52Ym5SbGJuUXVhbk1fWTJ4cFpXNTBQWGQwWVZ4MU1EQXlObTlpWm5WelkyRjBaV1JEZFhOMGIyMWxja2xrUFRRMk1URTFNRE16TlRoY2RUQXdNalpqY21WaGRHbDJaVWxrUFRRMk1qUTJOek0wTXpjNU1WeDFNREF5Tm5abGNuTnBiMjVKWkQwd1hIVXdNREkyWVdSSGNtOTFjRU55WldGMGFYWmxTV1E5TkRNeU56UXdOemN6TXpjMlhIVXdNREkyYUhSdGJGQmhjbVZ1ZEVsa1BYQnlaWFl0TUZ4MU1EQXlObWhsYVdkb2REMDJNREJjZFRBd01qWjNhV1IwYUQwek1EQmNkVEF3TWpaemFXYzlRVU5wVmtKZmVuSmtMVEJCY21oSWNWSk1lRlpKYmsxTU1GRjBWMjB5UmxNdGR5SmRMRzUxYkd3c2JuVnNiQ3d4TENKNFpWRmpUV1ZOY21zMWQwbG5UbnAzYVhOM1RVVk9MVWQyVGxsSVIwODJOVE5KUlVKSlozUjFXbGhrYW1GSGJHcE1iVTUyWWxWSldGa3lSWFJqU0ZacFRGUnJNazlFVlROTmVsRXdUa1JWTUU1NldUUk5WRkpKUW14blEyTkJSU0lzSWpJd05qQXpPRGN4TmpjaVhWMWRMRnN4TERFc01WMWRZWklvMEMyQnBFT2NQTmNDU0hFX0E3OFVJeXlYNDhRY0hwZFVVelFhbU9UaDNLbm40cmFBVjBPWVN2a25OSFBSMXc4TTF3TWdEempSMjRUMFBSOWxnWU90dEVhWG5ha09sT3VYR0pOZGFaZUlOaDB5SmFwZldjS09mNGNDaWZrb1V2VWtsRFpSdm5nUzVhY2cwOWhqMFRPRmhsMGJTYlFrcUZQWWFNMkdxdVgwNURqLVpWNDAwM3hSR3BfTFV2Ukk0Vy1Tc0gwZXFhdG5YdWhLc3lQak1SLW40Q2ZabXZvbFFIbzRpa0hCSmZWT0paeVB6SURab2RZTHM2WTNCZWJsRnA1ejltaHBHNmVwRjcyVUNTR2JUTWN2UzZnS1prUEZ2dmtpWGZRSEFOUWtJS1ZkcUJIc0FJWWRlck9YbkZzdUc2OXdmOGhnZVh6UGk1ME9iZmdnOFEsZldGTEIydHkzaVB0MUJOTnFzYlNRZyZhbXA7c291cmNlPWRpc3BsYXlcIiBpZD1zYnRuIHRhcmdldD1fYmxhbms%2BPHNwYW4%2BV2h5IHRoaXMgYWQ%2FwqA8c3ZnIGZpbGw9IzAwMDAwMCBpZD1zaSB2aWV3Ym94PVwiMCAwIDE2IDE2XCIgeG1sbnM9Ly93d3cudzMub3JnLzIwMDAvc3ZnPjxjaXJjbGUgY3g9NiBjeT02IHI9MC42Nz48L2NpcmNsZT48cGF0aCBkPU00LjIsMTEuM1EzLjMsMTEuOCwzLjMsMTAuNzVMMy4zLDQuMVEzLjMsMy4xLDQuMywzLjVMMTAuNCw3LjBRMTIuMCw3LjUsMTAuNCw4LjBMNi42NSwxMC4wTDYuNjUsNy43NWEwLjY1LDAuNjUsMCwxLDAsLTEuMywwTDUuMzUsMTAuNzVhMC45LDAuOSwwLDAsMCwxLjMsMC44TDEyLjcsOC4yUTEzLjcsNy41LDEyLjcsNi43TDMuMywxLjZRMi4yLDEuMywxLjgsMi41TDEuOCwxMi41UTIuMiwxMy45LDMuMywxMy4zTDQuOCwxMi41QTAuMywwLjMsMCwxLDAsNC4yLDExLjNaPjwvcGF0aD48L3N2Zz48L3NwYW4%2BPC9hPjwvbGFiZWw%2BPC9kaXY%2BPC9hbXAtZml0LXRleHQ%2BPC9kaXY%2BPGRpdiBjbGFzcz1cInBuIGFiZ2ZcIiBpZD1zcHYyPjxsYWJlbCBjbGFzcz1cInNiIHNvXCIgZGF0YS12YXJzLWxhYmVsPW11dGVfc3VydmV5X29wdGlvbiBkYXRhLXZhcnMtbGFiZWwtaW5zdGFuY2U9OCBmb3I9c3ByMz48ZGl2PjxzcGFuPkFkIHdhcyBpbmFwcHJvcHJpYXRlPC9zcGFuPjwvZGl2PjwvbGFiZWw%2BPGxhYmVsIGNsYXNzPVwic2Igc29cIiBkYXRhLXZhcnMtbGFiZWw9bXV0ZV9zdXJ2ZXlfb3B0aW9uIGRhdGEtdmFycy1sYWJlbC1pbnN0YW5jZT0yIGZvcj1zcHIzPjxkaXY%2BPHNwYW4%2BU2VlbiB0aGlzIGFkIG11bHRpcGxlIHRpbWVzPC9zcGFuPjwvZGl2PjwvbGFiZWw%2BPGxhYmVsIGNsYXNzPVwic2Igc29cIiBkYXRhLXZhcnMtbGFiZWw9bXV0ZV9zdXJ2ZXlfb3B0aW9uIGRhdGEtdmFycy1sYWJlbC1pbnN0YW5jZT03IGZvcj1zcHIzPjxkaXY%2BPHNwYW4%2BTm90IGludGVyZXN0ZWQgaW4gdGhpcyBhZDwvc3Bhbj48L2Rpdj48L2xhYmVsPjxsYWJlbCBjbGFzcz1cInNiIHNvXCIgZGF0YS12YXJzLWxhYmVsPW11dGVfc3VydmV5X29wdGlvbiBkYXRhLXZhcnMtbGFiZWwtaW5zdGFuY2U9MyBmb3I9c3ByMz48ZGl2PjxzcGFuPkFkIGNvdmVyZWQgY29udGVudDwvc3Bhbj48L2Rpdj48L2xhYmVsPjwvZGl2PjxkaXYgY2xhc3M9XCJwbiBhYmdmXCIgaWQ9c3B2Mz48YW1wLWZpdC10ZXh0IGNsYXNzPVwiZmwgaS1hbXBodG1sLWxheW91dC1yZXNwb25zaXZlIGktYW1waHRtbC1sYXlvdXQtc2l6ZS1kZWZpbmVkXCIgaGVpZ2h0PTYwMCBpLWFtcGh0bWwtbGF5b3V0PXJlc3BvbnNpdmUgbGF5b3V0PXJlc3BvbnNpdmUgbWF4LWZvbnQtc2l6ZT0xNyBtaW4tZm9udC1zaXplPTggd2lkdGg9MzAwPjxpLWFtcGh0bWwtc2l6ZXIgc3R5bGU9ZGlzcGxheTpibG9jaztwYWRkaW5nLXRvcDoyMDAuMDAwMCU7PjwvaS1hbXBodG1sLXNpemVyPjxzcGFuIGlkPXBjdD5UaGFua3MuIEZlZWRiYWNrIGltcHJvdmVzIEdvb2dsZSBhZHM8L3NwYW4%2BPC9hbXAtZml0LXRleHQ%2BPC9kaXY%2BPGRpdiBjbGFzcz1cInBuIGFiZ2ZcIiBpZD1zcHY0PjxhbXAtZml0LXRleHQgY2xhc3M9XCJmbCBpLWFtcGh0bWwtbGF5b3V0LXJlc3BvbnNpdmUgaS1hbXBodG1sLWxheW91dC1zaXplLWRlZmluZWRcIiBoZWlnaHQ9NjAwIGktYW1waHRtbC1sYXlvdXQ9cmVzcG9uc2l2ZSBsYXlvdXQ9cmVzcG9uc2l2ZSBtYXgtZm9udC1zaXplPTIwIG1pbi1mb250LXNpemU9OCB3aWR0aD0zMDA%2BPGktYW1waHRtbC1zaXplciBzdHlsZT1kaXNwbGF5OmJsb2NrO3BhZGRpbmctdG9wOjIwMC4wMDAwJTs%2BPC9pLWFtcGh0bWwtc2l6ZXI%2BPHNwYW4gY2xhc3M9XCJjdCBmY3RcIj5BZCBjbG9zZWQgYnkgPHN2ZyBmaWxsPSMwMDAwMDAgdmlld2JveD1cIjAgMCA2MCAyNFwiIHhtbG5zPWh0dHA6Ly93d3cudzMub3JnLzIwMDAvc3ZnPjxwYXRoIGQ9XCJNNy41IDE2LjI5Yy00LjA3IDAtNy40OS0zLjMxLTcuNDktNy4zOFMzLjQzIDEuNTMgNy41IDEuNTNjMi4yNSAwIDMuODUuODggNS4wNiAyLjAzbC0xLjQyIDEuNDJjLS44Ny0uODEtMi4wNC0xLjQ0LTMuNjQtMS40NC0yLjk3IDAtNS4yOSAyLjQtNS4yOSA1LjM3czIuMzIgNS4zNyA1LjI5IDUuMzdjMS45MyAwIDMuMDMtLjc3IDMuNzMtMS40OC41OC0uNTguOTUtMS40IDEuMS0yLjU0SDcuNVY4LjI0aDYuNzljLjA3LjM2LjExLjc5LjExIDEuMjYgMCAxLjUxLS40MSAzLjM5LTEuNzUgNC43Mi0xLjMgMS4zNS0yLjk1IDIuMDctNS4xNSAyLjA3em0xNy43NS00Ljc2YzAgMi43NC0yLjEzIDQuNzUtNC43NSA0Ljc1cy00Ljc1LTIuMDItNC43NS00Ljc1YzAtMi43NSAyLjEzLTQuNzUgNC43NS00Ljc1czQuNzUgMiA0Ljc1IDQuNzV6bS0yLjA4IDBjMC0xLjcxLTEuMjQtMi44OC0yLjY3LTIuODhzLTIuNjcgMS4xNy0yLjY3IDIuODhjMCAxLjY5IDEuMjQgMi44OCAyLjY3IDIuODhzMi42Ny0xLjE4IDIuNjctMi44OHptMTMuMDggMGMwIDIuNzQtMi4xMyA0Ljc1LTQuNzUgNC43NXMtNC43NS0yLjAyLTQuNzUtNC43NWMwLTIuNzUgMi4xMy00Ljc1IDQuNzUtNC43NXM0Ljc1IDIgNC43NSA0Ljc1em0tMi4wOCAwYzAtMS43MS0xLjI0LTIuODgtMi42Ny0yLjg4cy0yLjY3IDEuMTctMi42NyAyLjg4YzAgMS42OSAxLjI0IDIuODggMi42NyAyLjg4czIuNjctMS4xOCAyLjY3LTIuODh6bTEyLjU4LTQuNDZ2OC41M2MwIDMuNTEtMi4wNyA0Ljk1LTQuNTIgNC45NS0yLjMgMC0zLjY5LTEuNTUtNC4yMS0yLjgxbDEuODItLjc2Yy4zMi43NyAxLjEyIDEuNjkgMi4zOSAxLjY5IDEuNTcgMCAyLjU0LS45NyAyLjU0LTIuNzl2LS42OGgtLjA3Yy0uNDcuNTgtMS4zNyAxLjA4LTIuNSAxLjA4LTIuMzggMC00LjU2LTIuMDctNC41Ni00Ljc0IDAtMi42OCAyLjE4LTQuNzcgNC41Ni00Ljc3IDEuMTMgMCAyLjAzLjUgMi41IDEuMDZoLjA3di0uNzZoMS45OHptLTEuODQgNC40OGMwLTEuNjctMS4xMi0yLjktMi41NC0yLjktMS40NCAwLTIuNjUgMS4yMi0yLjY1IDIuOSAwIDEuNjYgMS4yMSAyLjg2IDIuNjUgMi44NiAxLjQzLjAxIDIuNTQtMS4yIDIuNTQtMi44NnptNS44OS05LjUyVjE2aC0yLjA5VjIuMDNoMi4wOXptOC40OSAxMS4wN2wxLjYyIDEuMDhjLS41Mi43Ny0xLjc4IDIuMTEtMy45NiAyLjExLTIuNyAwLTQuNzItMi4wOS00LjcyLTQuNzUgMC0yLjgzIDIuMDMtNC43NSA0LjQ4LTQuNzUgMi40NyAwIDMuNjcgMS45NiA0LjA3IDMuMDJsLjIyLjU0LTYuMzYgMi42M2MuNDkuOTUgMS4yNCAxLjQ0IDIuMyAxLjQ0IDEuMDcgMCAxLjgxLS41MyAyLjM1LTEuMzJ6bS00Ljk5LTEuNzFsNC4yNS0xLjc2Yy0uMjMtLjU5LS45NC0xLjAxLTEuNzYtMS4wMS0xLjA2IDAtMi41NC45My0yLjQ5IDIuNzd6XCI%2BPC9wYXRoPjxwYXRoIGQ9XCJNMCAwaDYydjI0SDB6XCIgZmlsbD1ub25lPjwvcGF0aD48L3N2Zz48L3NwYW4%2BPC9hbXAtZml0LXRleHQ%2BPC9kaXY%2BPC9mb3JtPjwvZGl2PjwvZGl2PjwvZGl2PjxhbXAtYW5hbHl0aWNzIGNsYXNzPVwiaS1hbXBodG1sLWxheW91dC1maXhlZCBpLWFtcGh0bWwtbGF5b3V0LXNpemUtZGVmaW5lZFwiIGktYW1waHRtbC1sYXlvdXQ9Zml4ZWQgc3R5bGU9d2lkdGg6MXB4O2hlaWdodDoxcHg7IHRyaWdnZXI9aW1tZWRpYXRlPjxzY3JpcHQgdHlwZT1hcHBsaWNhdGlvbi9qc29uPntcInRyYW5zcG9ydFwiOiB7XCJiZWFjb25cIjogZmFsc2UsIFwieGhycG9zdFwiOiBmYWxzZX0sXCJyZXF1ZXN0c1wiOiB7XCJ2aXNpYmlsaXR5MVwiOiBcImh0dHBzOi8vcGFnZWFkMi5nb29nbGVzeW5kaWNhdGlvbi5jb20vcGNzL2FjdGl2ZXZpZXc%2FeGFpPUFLQU9qc3N2QnV2VE13&i=6-8&t=adltag_kevkyyz5_Qf69PlSTwVm&r=b7d67488abfc790ba4d38e91589f323&c=math-aids-threatpost&z=1
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/b-9a4f7ce-a7f6098c.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.84.156.60 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-84-156-60.txl52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Wed, 09 Sep 2020 03:19:23 GMT
via: 1.1 5cf5bc69324ade55eebb5e539fa6c2fa.cloudfront.net (CloudFront)
age: 46348
x-cache: Error from cloudfront
status: 200
content-length: 0
last-modified: Mon, 15 Jun 2020 18:35:10 GMT
server: AmazonS3
etag: "d41d8cd98f00b204e9800998ecf8427e"
access-control-max-age: 3000
access-control-allow-methods: GET
x-amz-version-id: D2POxJleIt92FyXaxSi7iRHuNLtujALh
access-control-allow-origin: *
x-amz-cf-pop: TXL52-C1
accept-ranges: bytes
content-type: text/plain
x-amz-cf-id: p_90AfFkCTumd5jXBIw-508ec4ZNM8S6aKckTbK82gohpd0AeuXROw==

POST
H2 200 tag
math-aids-threatpost-tagan.adlightning.com/ 0
428 B 82ms
58ms Other
text/plain 99.84.156.60
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://math-aids-threatpost-tagan.adlightning.com/tag?s=bl&d=MkNMQmNpcTBlcklSNGd1eFJuSW13QkVVVS1zaW1kQ1dTZHZuQUxzMnBHUHBsSUNya2w5Mjg4S0FkbC1FUWZjWlZTVE9yeXRIS2l4UXVUelZVV2FXOWVGYUxQeXFWZjJEckFzWTlUdTU2cGhHMndrd3VzQ1Emc2FpPUFNZmwtWVNiQVRQVDdYRXcxZFY0b05MMEZFMXFhYldDQTBZc09kSHhKT282eU9OZkRlcTRmLVFCYS1ST0NtX2R6M1RMYlFsT2pGSTU5RWxtcFgySVdOWk8tNWNKWG9qM0pYcE4xTlFyMXM2OEdEU1ptNklBNEtrbjdkSWR3V0twNU5jRSZzaWc9Q2cwQXJLSlN6RFljeEY5bXNCTENFQUUmY2lkPUNBQVNQZVJvVE9CMVNYMkRkZFZpRm5Fb21JNzFxdWJNVXpGZWdyTGo3c1FkMGlzM0p1aWhVZmFXVkFUUFZRQjNrb3pUaGxYUjNPWEtWYWItREhTTExWbyZpZD1hbXBpbSZvPSR7ZWxlbWVudFh9LCR7ZWxlbWVudFl9JmQ9JHtlbGVtZW50V2lkdGh9LCR7ZWxlbWVudEhlaWdodH0mc3M9JHtzY3JlZW5XaWR0aH0sJHtzY3JlZW5IZWlnaHR9JmJzPSR7dmlld3BvcnRXaWR0aH0sJHt2aWV3cG9ydEhlaWdodH0mbWN2dD0ke21heENvbnRpbnVvdXNWaXNpYmxlVGltZX0mbXRvcz0wLDAsJHttYXhDb250aW51b3VzVmlzaWJsZVRpbWV9LCR7bWF4Q29udGludW91c1Zpc2libGVUaW1lfSwke21heENvbnRpbnVvdXNWaXNpYmxlVGltZX0mdG9zPTAsMCwke3RvdGFsVmlzaWJsZVRpbWV9LDAsMCZ0ZnM9JHtmaXJzdFNlZW5UaW1lfSZ0bHM9JHtsYXN0U2VlblRpbWV9Jmc9JHttaW5WaXNpYmxlUGVyY2VudGFnZX0maD0ke21heFZpc2libGVQZXJjZW50YWdlfSZ0dD0ke3RvdGFsVGltZX0mcj12JmF2bXM9YW1wYSZhZGs9Mzc1Mzg5ODEyXCJ9LFwidHJpZ2dlcnNcIjoge1wiY29udGludW91c1Zpc2libGVcIjoge1wib25cIjogXCJ2aXNpYmxlXCIsXCJyZXF1ZXN0XCI6IFtcInZpc2liaWxpdHkxXCJdLFwicGFyZW50UG9zdE1lc3NhZ2VcIjogXCJpbXByZXNzaW9uLXZpZXdhYmxlXCIsXCJ2aXNpYmlsaXR5U3BlY1wiOiB7XCJzZWxlY3RvclwiOiBcIjpyb290XCIsXCJ2aXNpYmxlUGVyY2VudGFnZU1pblwiOiA1MCxcImNvbnRpbnVvdXNUaW1lTWluXCI6IDEwMDB9fSxcInZpc2liaWxpdHlDaGFuZ2VkXCI6IHtcIm9uXCI6IFwidmlzaWJsZVwiLFwicGFyZW50UG9zdE1lc3NhZ2VcIjogXCJ2aXNpYmlsaXR5LWNoYW5nZWQtJHtpbnRlcnNlY3Rpb25SYXRpb31cIixcInZpc2liaWxpdHlTcGVjXCI6IHtcInJlcGVhdFwiOiB0cnVlLFwic2VsZWN0b3JcIjogXCI6cm9vdFwiLFwidmlzaWJsZVBlcmNlbnRhZ2VUaHJlc2hvbGRzXCI6IFtbMCwwXSxbMCw1XSxbNSwxMF0sWzEwLDE1XSxbMTUsMjBdLFsyMCwyNV0sWzI1LDMwXSxbMzAsMzVdLFszNSw0MF0sWzQwLDQ1XSxbNDUsNTBdLFs1MCw1NV0sWzU1LDYwXSxbNjAsNjVdLFs2NSw3MF0sWzcwLDc1XSxbNzUsODBdLFs4MCw4NV0sWzg1LDkwXSxbOTAsOTVdLFs5NSwxMDBdLFsxMDAsMTAwXV19fSxcImluaUxvYWRcIjoge1wib25cIjogXCJpbmktbG9hZFwiLFwicGFyZW50UG9zdE1lc3NhZ2VcIjogXCJ7XFxcImNcXFwiOlxcXCJzZmNoYW5uZWwzXFxcIixcXFwicFxcXCI6XFxcIntcXFxcXFxcInVpZFxcXFxcXFwiOlxcXFxcXFwiM1xcXFxcXFwiLFxcXFxcXFwid2lkdGhcXFxcXFxcIjoke3Njcm9sbFdpZHRofSxcXFxcXFxcImhlaWdodFxcXFxcXFwiOiR7c2Nyb2xsSGVpZ2h0fX1cXFwiLFxcXCJzXFxcIjpcXFwiY3JlYXRpdmVfZ2VvbWV0cnlfdXBkYXRlXFxcIn1cXG5cIn19fTwvc2NyaXB0PjwvYW1wLWFuYWx5dGljcz48YW1wLWFuYWx5dGljcyBjbGFzcz1cImktYW1waHRtbC1sYXlvdXQtZml4ZWQgaS1hbXBodG1sLWxheW91dC1zaXplLWRlZmluZWRcIiBpLWFtcGh0bWwtbGF5b3V0PWZpeGVkIHN0eWxlPXdpZHRoOjFweDtoZWlnaHQ6MXB4OyB0cmlnZ2VyPWltbWVkaWF0ZT48c2NyaXB0IHR5cGU9YXBwbGljYXRpb24vanNvbj57XCJ0cmFuc3BvcnRcIjoge1wiYmVhY29uXCI6IHRydWUsIFwieGhycG9zdFwiOiBmYWxzZX0sXCJyZXF1ZXN0c1wiOiB7XCJhbXBlb3NcIjogXCJodHRwczovL3BhZ2VhZDIuZ29vZ2xlc3luZGljYXRpb24uY29tL3Bjcy9hY3RpdmV2aWV3P3hhaT1BS0FPanNzdkJ1dlRNdzJDTEJjaXEwZXJJUjRndXhSbkltd0JFVVUtc2ltZENXU2R2bkFMczJwR1BwbElDcmtsOTI4OEtBZGwtRVFmY1pWU1RPcnl0SEtpeFF1VHpWVVdhVzllRmFMUHlxVmYyRHJBc1k5VHU1NnBoRzJ3a3d1c0NRJnNhaT1BTWZsLVlTYkFUUFQ3WEV3MWRWNG9OTDBGRTFxYWJXQ0EwWXNPZEh4Sk9vNnlPTmZEZXE0Zi1RQmEtUk9DbV9kejNUTGJRbE9qRkk1OUVsbXBYMklXTlpPLTVjSlhvajNKWHBOMU5RcjFzNjhHRFNabTZJQTRLa243ZElkd1dLcDVOY0Umc2lnPUNnMEFyS0pTekRZY3hGOW1zQkxDRUFFJmNpZD1DQUFTUGVSb1RPQjFTWDJEZGRWaUZuRW9tSTcxcXViTVV6RmVnckxqN3NRZDBpczNKdWloVWZhV1ZBVFBWUUIza296VGhsWFIzT1hLVmFiLURIU0xMVm8maWQ9YW1wZW9zJm89JHtlbGVtZW50WH0sJHtlbGVtZW50WX0mZD0ke2VsZW1lbnRXaWR0aH0sJHtlbGVtZW50SGVpZ2h0fSZzcz0ke3NjcmVlbldpZHRofSwke3NjcmVlbkhlaWdodH0mYnM9JHt2aWV3cG9ydFdpZHRofSwke3ZpZXdwb3J0SGVpZ2h0fSZtY3Z0PSR7bWF4Q29udGludW91c1Zpc2libGVUaW1lfSZtdG9zPTAsMCwke21heENvbnRpbnVvdXNWaXNpYmxlVGltZX0sJHttYXhDb250aW51b3VzVmlzaWJsZVRpbWV9LCR7bWF4Q29udGludW91c1Zpc2libGVUaW1lfSZ0b3M9MCwwLCR7dG90YWxWaXNpYmxlVGltZX0sMCwwJnRmcz0ke2ZpcnN0U2VlblRpbWV9JnRscz0ke2xhc3RTZWVuVGltZX0mZz0ke21pblZpc2libGVQZXJjZW50YWdlfSZoPSR7bWF4VmlzaWJsZVBlcmNlbnRhZ2V9JnB0PSR7cGFnZUxvYWRUaW1lfSZ0dD0ke3RvdGFsVGltZX0mcnB0PSR7bmF2VGltaW5nKG5hdmlnYXRpb25TdGFydCxsb2FkRXZlbnRTdGFydCl9JnJzdD0ke25hdlRpbWluZyhuYXZpZ2F0aW9uU3RhcnQpfSZyPWRlJmlzZD0ke2luaXRpYWxTY3JvbGxEZXB0aH0mbXNkPSR7bWF4U2Nyb2xsRGVwdGh9JmF2bXM9YW1wYVwifSxcInRyaWdnZXJzXCI6IHtcImVuZE9mU2Vzc2lvblwiOiB7XCJvblwiOiBcInZpc2libGVcIixcInJlcXVlc3RcIjogXCJhbXBlb3NcIixcInZpc2liaWxpdHlTcGVjXCI6IHtcInJlcG9ydFdoZW5cIjogXCJkb2N1bWVudEV4aXRcIixcInNlbGVjdG9yXCI6IFwiOnJvb3RcIixcInZpc2libGVQZXJjZW50YWdlTWluXCI6IDUwfX19fTwvc2NyaXB0PjwvYW1wLWFuYWx5dGljcz48ZGl2IHN0eWxlPWJvdHRvbTowO3JpZ2h0OjA7d2lkdGg6MzAwcHg7aGVpZ2h0OjYwMHB4O2JhY2tncm91bmQ6aW5pdGlhbDtwb3NpdGlvbjphYnNvbHV0ZTttYXgtd2lkdGg6MTAwJTttYXgtaGVpZ2h0OjEwMCU7cG9pbnRlci1ldmVudHM6bm9uZTtpbWFnZS1yZW5kZXJpbmc6cGl4ZWxhdGVkO3otaW5kZXg6MjE0NzQ4MzY0NztiYWNrZ3JvdW5kLWltYWdlOnVybCgmIzM5O2RhdGE6aW1hZ2UvcG5nO2Jhc2U2NCxpVkJPUncwS0dnb0FBQUFOU1VoRVVnQUFBQ3NBQUFBV0JBTUFBQUNybDNpQUFBQUFCbEJNVkVVQUFBRCtBY2lXbVp6V0FBQUFBblJTVGxNQUFwaWRyQlFBQUFCOFNVUkJWQmpUYlpFQkRvQWdEQVBMRC9yLzF5cGIxOVZFUW9ib1VXOEsvSS9UNDcyNDB6dXdudkt1M0YwUlFyRzd5NUZWb1pWSkY1NDA1a3htNjkxbVpiS2o4UFRHRkIxcVNCUGdSRXQza3FINjdWQ0ZuTlFKUFlGUDRQTGgzVjdWYm5UcDJMcGhYWWxZMjErUTB3R0Ribjk3N04vSlAyUVRxYlROQTFpcEJjREdnR2JsQUFBQUFFbEZUa1N1UW1DQyYjMzk7KTs%2BPC9kaXY%2BPGFtcC1waXhlbCBhbGxvdy1zc3ItaW1nIGNsYXNzPVwiaS1hbXBodG1sLWxheW91dC1maXhlZCBpLWFtcGh0bWwtbGF5b3V0LXNpemUtZGVmaW5lZFwiIGktYW1waHRtbC1sYXlvdXQ9Zml4ZWQgaS1hbXBodG1sLXNzciBzcmM9XCJodHRwczovL3NlY3VyZXB1YmFkcy5nLmRvdWJsZWNsaWNrLm5ldC9wYWdlYWQvYWR2aWV3P2FpPUNrVlJFeGY1WVg5V2hJSlNSckFUQmo1ZUFDS2lLNTVKZmdOendpc3dNdi1FZUVBRWcwWWZTSUdDUmhJQ0FfQmVnQWZHRF9aVUR5QUVDNEFJQXFBTUJ5QU1JcWdUM0FVX1FTOTFEMEZ1MVJZQ1JnRWt6SW9nSXRGLURmTUhOQzc1N2dUeThTNGQ3SXpoZDZxYVFXa1QyYlJ1b2dpaF9fY1U3Z1Itajdjc25xQl9nRUZFUGZpQjlhd2RqOTJLQ1ZlMzdlaWJzZUdkNllLaHJrc1Y0RjZFTmVNMnBlZERpREJlWTE2b2psQVRtRU93dVNEVXR6TjJ6bGNrcWF0aWF5NkpLUXBUYWxNeGptTDRuRDdqU2FMdHB5RWFlZzgwVnM4ZE1XMEtraGViTnZ5dlc5RHY2SURRZ3BxOFBWdnhmWk1MTHlfVHQ3UVRuYk1ycXNlRk5WLVNMQnFwTGloNmhLYTZxYmduZGtOZ1RhS0RWNmFMby1ONGt5TFJRc2NETkhrVGVFWi12bWI1OFdfVVB0REJzTlZGeUczMThsa3FPczlZM3Zib0xBUXpBQk16RXZNT2VBdUFFQVpJRkJBZ0VHQUdTQlFRSUJSZ0VvQVlDZ0FlejM3LUJBYWdIanM0YnFBZlZ5UnVvQjVQWUc2Z0h1Z2FvQl9EWkc2Z0g4dGticUFlbXZodW9CLXpWRzlnSEFmSUhCQkRLMUE3U0NBa0lnT0dBUUJBQkdCM3lDQnRoWkhndGMzVmljM2x1TFRjeU5qTTFOek0wTkRZNE1EUXdOemlBQ2dQSUN3SFlFd3cmYW1wO3NpZ2g9cTREb2RFQlc4OUUmYW1wO3RwZD1BR1doSm11Z2JUOUhRdkk4QVdSLTQ4RmZOaWs1TXUwY3ZuekZMNUw3c2hWSWhFQ19md1wiIHN0eWxlPXdpZHRoOjFweDtoZWlnaHQ6MXB4Oz48aW1nIHNyYz1cImh0dHBzOi8vc2VjdXJlcHViYWRzLmcuZG91YmxlY2xpY2submV0L3BhZ2VhZC9hZHZpZXc%2FYWk9Q2tWUkV4ZjVZWDlXaElKU1JyQVRCajVlQUNLaUs1NUpmZ056d2lzd012LUVlRUFFZzBZZlNJR0NSaElDQV9CZWdBZkdEX1pVRHlBRUM0QUlBcUFNQnlBTUlxZ1QzQVVfUVM5MUQwRnUxUllDUmdFa3pJb2dJdEYtRGZNSE5DNzU3Z1R5OFM0ZDdJemhkNnFhUVdrVDJiUnVvZ2loX19jVTdnUi1qN2NzbnFCX2dFRkVQZmlCOWF3ZGo5MktDVmUzN2VpYnNlR2Q2WUtocmtzVjRGNkVOZU0ycGVkRGlEQmVZMTZvamxBVG1FT3d1U0RVdHpOMnpsY2txYXRpYXk2SktRcFRhbE14am1MNG5EN2pTYUx0cHlFYWVnODBWczhkTVcwS2toZWJOdnl2VzlEdjZJRFFncHE4UFZ2eGZaTUxMeV9UdDdRVG5iTXJxc2VGTlYtU0xCcXBMaWg2aEthNnFiZ25ka05nVGFLRFY2YUxvLU40a3lMUlFzY0ROSGtUZUVaLXZtYjU4V19VUHREQnNOVkZ5RzMxOGxrcU9zOVkzdmJvTEFRekFCTXpFdk1PZUF1QUVBWklGQkFnRUdBR1NCUVFJQlJnRW9BWUNnQWV6MzctQkFhZ0hqczRicUFmVnlSdW9CNVBZRzZnSHVnYW9CX0RaRzZnSDh0a2JxQWVtdmh1b0ItelZHOWdIQWZJSEJCREsxQTdTQ0FrSWdPR0FRQkFCR0IzeUNCdGhaSGd0YzNWaWMzbHVMVGN5TmpNMU56TTBORFk0TURRd056aUFDZ1BJQ3dIWUV3dyZhbXA7c2lnaD1xNERvZEVCVzg5RSZhbXA7dHBkPUFHV2hKbXVnYlQ5SFF2SThBV1ItNDhGZk5pazVNdTBjdm56Rkw1TDdzaFZJaEVDX2Z3XCI%2BPC9hbXAtcGl4ZWw%2BPGFtcC1hZC1leGl0IGNsYXNzPWktYW1waHRtbC1sYXlvdXQtY29udGFpbmVyIGktYW1waHRtbC1sYXlvdXQ9Y29udGFpbmVyIGlkPWV4aXQtYXBpPjxzY3JpcHQgdHlwZT1hcHBsaWNhdGlvbi9qc29uPntcImZpbHRlcnNcIjp7fSxcIm9wdGlvbnNcIjp7XCJzdGFydFRpbWluZ0V2ZW50XCI6XCJuYXZpZ2F0aW9uU3RhcnRcIn0sXCJ0YXJnZXRzXCI6e1wibGFuZGluZ1BhZ2VcIjp7XCJmaWx0ZXJzXCI6W10sXCJmaW5hbFVybFwiOlwiaHR0cHM6Ly93d3cubmV3Y2hpYy5jb20vdGhlbWUtbWVuLWNhcHMtYmFja3BhY2tzLXQtMzQxNzQ2Lz91dG1fc291cmNlPWdvb2dsZVxcdTAwMjZ1dG1fbWVkaXVtPWNwY19hZHMxXFx1MDAyNnV0bV9jYW1wYWlnbj1jbmV3LW1zLXAtY2wyNzE0ODctMDgyMi1hbGwtMDkwOC0zNDE3NDZcXHUwMDI2dXRtX2NvbnRlbnQ9dm9sYWlcXHUwMDI2dXRtX2Rlc2lnbj0xMzhcXHUwMDI2Z2NsaWQ9RUFJYUlRb2JDaE1JbFppR3JMdmM2d0lWbEFpTENoM0J4d1dBRUFFWUFTQUFFZ0lPNV9EX0J3RVwiLFwidHJhY2tpbmdVcmxzXCI6W1wiaHR0cHM6Ly9nb29nbG&i=7-8&t=adltag_kevkyyz5_Qf69PlSTwVm&r=b7d67488abfc790ba4d38e91589f323&c=math-aids-threatpost&z=1
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/b-9a4f7ce-a7f6098c.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.84.156.60 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-84-156-60.txl52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Wed, 09 Sep 2020 03:19:23 GMT
via: 1.1 5cf5bc69324ade55eebb5e539fa6c2fa.cloudfront.net (CloudFront)
age: 46348
x-cache: Error from cloudfront
status: 200
content-length: 0
last-modified: Mon, 15 Jun 2020 18:35:10 GMT
server: AmazonS3
etag: "d41d8cd98f00b204e9800998ecf8427e"
access-control-max-age: 3000
access-control-allow-methods: GET
x-amz-version-id: D2POxJleIt92FyXaxSi7iRHuNLtujALh
access-control-allow-origin: *
x-amz-cf-pop: TXL52-C1
accept-ranges: bytes
content-type: text/plain
x-amz-cf-id: QQEb_uE_dhF8tFCUjgoSFQ9yA4LWganLIgtUWxT5MrdICfkYE8W5RA==

POST
H2 200 tag
math-aids-threatpost-tagan.adlightning.com/ 0
427 B 82ms
58ms Other
text/plain 99.84.156.60
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://math-aids-threatpost-tagan.adlightning.com/tag?s=bl&d=VhZHMuZy5kb3VibGVjbGljay5uZXQvYWNsaz9zYT1sXFx1MDAyNmFpPUNZcjRLeGY1WVg5V2hJSlNSckFUQmo1ZUFDS2lLNTVKZmdOendpc3dNdi1FZUVBRWcwWWZTSUdDUmhJQ0FfQmVnQWZHRF9aVUR5QUVDNEFJQXFBTUJ5QU1JcWdUNkFVX1FTOTFEMEZ1MVJZQ1JnRWt6SW9nSXRGLURmTUhOQzc1N2dUeThTNGQ3SXpoZDZxYVFXa1QyYlJ1b2dpaF9fY1U3Z1Itajdjc25xQl9nRUZFUGZpQjlhd2RqOTJLQ1ZlMzdlaWJzZUdkNllLaHJrc1Y0RjZFTmVNMnBlZERpREJlWTE2b2psQVRtRU93dVNEVXR6TjJ6bGNrcWF0aWF5NkpLUXBUYWxNeGptTDRuRDdqU2FMdHB5RWFlZzgwVnM4ZE1XMEtraGViTnZ5dlc5RHY2SURRZ3BxOFBWdnhmWk1MTHlfVHQ3UVRuYk1ycXNlRk5WLVNMQnFwTGloNmhLYTZxYmduZGtOZ1RhS0RWNmFMby1ONGt5TFJRc2NETkhrVGVFWi12bWI1OFdfVVB0REJzTlZFd0dYUHVKYXREbWl6Nmtnci1QYlBwTWxuQUJNekV2TU9lQXVBRUFhQUdBb0FIczktX2dRR29CNDdPRzZnSDFja2JxQWVUMkJ1b0I3b0dxQWZ3MlJ1b0JfTFpHNmdIcHI0YnFBZnMxUnVvQl9QUkc2Z0g3TlVicUFlVzJCdW9COExhRzlnSEFkSUlDUWlBNFlCQUVBRVlIZklJRzJGa2VDMXpkV0p6ZVc0dE56STJNelUzTXpRME5qZ3dOREEzT0xFSnVOdDZJVGNxZk1pQUNnT1lDd0hJQ3dIWUV3d1xcdTAwMjZhZT0xXFx1MDAyNm51bT0xXFx1MDAyNmNpZD1DQUFTUGVSb1RPQjFTWDJEZGRWaUZuRW9tSTcxcXViTVV6RmVnckxqN3NRZDBpczNKdWloVWZhV1ZBVFBWUUIza296VGhsWFIzT1hLVmFiLURIU0xMVm9cXHUwMDI2c2lnPUFPRDY0XzEzbzB4OTZZQU5IZUdndTVqWUJQNzJCUXZYV2dcXHUwMDI2Y2xpZW50PWNhLXB1Yi05Njg1NzM0NDQ1NDc2ODE0XFx1MDAyNm5iPV9uYlxcdTAwMjZueD1DTElDS19YXFx1MDAyNm55PUNMSUNLX1lcXHUwMDI2YWN0PTFcXHUwMDI2cmk9MVxcdTAwMjZhZHVybD1odHRwczovL3d3dy5uZXdjaGljLmNvbS90aGVtZS1tZW4tY2Fwcy1iYWNrcGFja3MtdC0zNDE3NDYvJTNGdXRtX3NvdXJjZSUzRGdvb2dsZSUyNnV0bV9tZWRpdW0lM0RjcGNfYWRzMSUyNnV0bV9jYW1wYWlnbiUzRGNuZXctbXMtcC1jbDI3MTQ4Ny0wODIyLWFsbC0wOTA4LTM0MTc0NiUyNnV0bV9jb250ZW50JTNEdm9sYWklMjZ1dG1fZGVzaWduJTNEMTM4JTI2Z2NsaWQlM0RFQUlhSVFvYkNoTUlsWmlHckx2YzZ3SVZsQWlMQ2gzQnh3V0FFQUVZQVNBQUVnSU81X0RfQndFXCJdLFwidmFyc1wiOntcIl9uYlwiOntcImRlZmF1bHRWYWx1ZVwiOlwiXCIsXCJpZnJhbWVUcmFuc3BvcnRTaWduYWxcIjpcIlwifX19fX08L3NjcmlwdD48L2FtcC1hZC1leGl0PjwvYm9keT48L2h0bWw%2BIiwibWV0aG9kQmxvY2tlZCI6ImluaXRpYWxERlAtd3JpdGUifSwiYmxvY2tlZCI6dHJ1ZSwiY2FsbFN0YWNrIjoiRXJyb3JcbiAgICBhdCBhQyAoaHR0cHM6Ly90YWdhbi5hZGxpZ2h0bmluZy5jb20vbWF0aC1haWRzLXRocmVhdHBvc3QvYi05YTRmN2NlLWE3ZjYwOThjLmpzOjE6MjAyNzApXG4gICAgYXQgYU0gKGh0dHBzOi8vdGFnYW4uYWRsaWdodG5pbmcuY29tL21hdGgtYWlkcy10aHJlYXRwb3N0L2ItOWE0ZjdjZS1hN2Y2MDk4Yy5qczoxOjIzODI4KVxuICAgIGF0IEhUTUxEb2N1bWVudC48YW5vbnltb3VzPiAoaHR0cHM6Ly90YWdhbi5hZGxpZ2h0bmluZy5jb20vbWF0aC1haWRzLXRocmVhdHBvc3Qvb3AuanM6MToyMzMzOClcbiAgICBhdCBVdiAoaHR0cHM6Ly9zZWN1cmVwdWJhZHMuZy5kb3VibGVjbGljay5uZXQvZ3B0L3B1YmFkc19pbXBsXzIwMjAwOTAyMDEuanM6NjoyMDM0NTUpXG4gICAgYXQgdHcubCAoaHR0cHM6Ly9zZWN1cmVwdWJhZHMuZy5kb3VibGVjbGljay5uZXQvZ3B0L3B1YmFkc19pbXBsXzIwMjAwOTAyMDEuanM6NjoyMDk2NjUpXG4gICAgYXQgbXcgKGh0dHBzOi8vc2VjdXJlcHViYWRzLmcuZG91YmxlY2xpY2submV0L2dwdC9wdWJhZHNfaW1wbF8yMDIwMDkwMjAxLmpzOjY6MjA2NzUzKVxuICAgIGF0IHd3LmogKGh0dHBzOi8vc2VjdXJlcHViYWRzLmcuZG91YmxlY2xpY2submV0L2dwdC9wdWJhZHNfaW1wbF8yMDIwMDkwMjAxLmpzOjY6MjExMTk3KVxuICAgIGF0IEVjLmwgKGh0dHBzOi8vc2VjdXJlcHViYWRzLmcuZG91YmxlY2xpY2submV0L2dwdC9wdWJhZHNfaW1wbF8yMDIwMDkwMjAxLmpzOjY6MTMzNTI4KVxuICAgIGF0IEdjIChodHRwczovL3NlY3VyZXB1YmFkcy5nLmRvdWJsZWNsaWNrLm5ldC9ncHQvcHViYWRzX2ltcGxfMjAyMDA5MDIwMS5qczo2OjEyODkxKVxuICAgIGF0IEljLm5leHQgKGh0dHBzOi8vc2VjdXJlcHViYWRzLmcuZG91YmxlY2xpY2submV0L2dwdC9wdWJhZHNfaW1wbF8yMDIwMDkwMjAxLmpzOjY6MTMxODMpIn0%3D&i=8-8&t=adltag_kevkyyz5_Qf69PlSTwVm&r=b7d67488abfc790ba4d38e91589f323&c=math-aids-threatpost&z=1
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/b-9a4f7ce-a7f6098c.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.84.156.60 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-84-156-60.txl52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Wed, 09 Sep 2020 03:19:23 GMT
via: 1.1 5cf5bc69324ade55eebb5e539fa6c2fa.cloudfront.net (CloudFront)
age: 46348
x-cache: Error from cloudfront
status: 200
content-length: 0
last-modified: Mon, 15 Jun 2020 18:35:10 GMT
server: AmazonS3
etag: "d41d8cd98f00b204e9800998ecf8427e"
access-control-max-age: 3000
access-control-allow-methods: GET
x-amz-version-id: D2POxJleIt92FyXaxSi7iRHuNLtujALh
access-control-allow-origin: *
x-amz-cf-pop: TXL52-C1
accept-ranges: bytes
content-type: text/plain
x-amz-cf-id: arogWdSur_e1-DIrC_WHCUmC5U7uVwJEMJhXeO2CHhNmeix26ZxxXg==

GET
H2 200 bl-9a4f7ce-ca40eed9.js Show response
tagan.adlightning.com/math-aids-threatpost/ Frame 2F59 79 KB
22 KB 33ms
33ms Script
application/javascript 99.84.156.34
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/math-aids-threatpost/bl-9a4f7ce-ca40eed9.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.84.156.34 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-84-156-34.txl52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 82e2369bfee3725eb4f4ef3af5431637009a89ac42f4e6da6f68e66d3b034788

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 09 Sep 2020 03:12:51 GMT
content-encoding: gzip
age: 46740
x-cache: Hit from cloudfront
status: 200
content-length: 22389
x-amz-meta-git_commit: 9a4f7ce
last-modified: Tue, 08 Sep 2020 22:17:44 GMT
server: AmazonS3
etag: "79e00495b70f820a38b6b36c3f2f8ff5"
x-amz-version-id: F.XN1SsPf_y4x2xIDo65TAplqCsfb9A2
via: 1.1 df792ea3bbbe656e2f5c7b61aa85cc47.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: TXL52-C1
accept-ranges: bytes
content-type: application/javascript
x-amz-cf-id: eu22bR2wGfqxjWdoVxbvLg77sFV2mKmHOT8jzmOozsXMtDDEuMDipQ==

GET
H2 200 b-9a4f7ce-a7f6098c.js Show response
tagan.adlightning.com/math-aids-threatpost/ Frame 2F59 61 KB
21 KB 34ms
33ms Script
application/javascript 99.84.156.34
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/math-aids-threatpost/b-9a4f7ce-a7f6098c.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.84.156.34 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-84-156-34.txl52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 0119689800eadf6270855a19b65d74251e7da6be5e4686f36c15bf81281ddb4c

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 07 Sep 2020 01:11:01 GMT
content-encoding: gzip
age: 226850
x-cache: Hit from cloudfront
status: 200
content-length: 20808
x-amz-meta-git_commit: 9a4f7ce
last-modified: Tue, 18 Aug 2020 17:45:57 GMT
server: AmazonS3
etag: "98ae1c21c96b68b5f173604d82c35d5d"
x-amz-version-id: PzdVsYQ0bdCd7Kp..jKBw4vE53Z4BW7z
via: 1.1 df792ea3bbbe656e2f5c7b61aa85cc47.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: TXL52-C1
accept-ranges: bytes
content-type: application/javascript
x-amz-cf-id: nCqFP41PxYdRRcfGnGIYgL1HxdXGTKl26kBvjsIv9YTEGebq2kjxAw==

GET
H3-Q050 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 41 KB
10 KB 339ms
338ms XHR
text/plain 216.58.206.2
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=2293265400039676&correlator=2978068259280712&output=ldjh&impl=fifs&adsid=NT&vrg=2020090201&gdpr=0&tfua=0&tfcd=0&guci=1.2.0.0.2.2.0.0&sc=1&sfv=1-0-37&ecs=20200909&iu_parts=21707124336%2CThreatPost-970x250-ATF&enc_prev_ius=%2F0%2F1&prev_iu_szs=728x90%7C970x250%7C970x90&ris=1&rcs=1&prev_scp=amznbid%3D2%26amznp%3D2&eri=1&cust_params=urlhost%3Dhttps%253A%252F%252Fthreatpost.com%252F%26urlpath%3D%252Fshlayer-mac-malware-extra-sneakiness%252F156669%252F%26urlquery%3Dgoogfc%26contentid%3D156669%26category%3Deditors-picks%26contenttags%3Danti-evasion%252Cfake-adobe-flash-installer%252Cgoogle-search%252Cintego%252Cmac-malware%252Cmalware-analysis%252Cnew-version%252Cpoisoned-search-results%252Cshlayer%252Cstealth&cookie=ID%3Daadebd7d56d5671c-22a069c3d3b80062%3AT%3D1599667909%3AS%3DALNI_MbEdjx27GgmNj0bEpn0lN0l5kZgNg&bc=31&abxe=1&lmt=1599667910&dt=1599667910078&dlt=1599667907873&idt=584&frm=20&biw=1600&bih=1200&oid=3&adxs=315&adys=10&adks=1015519800&ucis=5&ifi=5&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fthreatpost.com%2Fshlayer-mac-malware-extra-sneakiness%2F156669%2F%3Fweb_view%3Dtrue&dssz=47&icsg=171851648000&std=0&vis=1&dmc=8&scr_x=0&scr_y=0&psz=970x250&msz=970x250&psts=AGkb-H_u66j_224wxqGSIBhRxwxW3eLaBPqFuPAJ2sw4UWNkszAxvp-JQ-8f8T_9KGsaE8-9Vu0cVS0t1HUak652XA9MfLMpQM8&ga_vid=1262107814.1599667909&ga_sid=1599667909&ga_hid=625129160&fws=0&ohw=0

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020090201.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

216.58.206.2 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s20-in-f2.1e100.net

Software

cafe /

Resource Hash

a4e2a0b0382d275acb336b62767fcd11c6e3fae31f047eebebfb95651f9832b1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 09 Sep 2020 16:11:50 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10309
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://threatpost.com
access-control-expose-headers: x-google-amp-ad-validated-version
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 4 KB
2 KB 328ms
324ms XHR
text/plain 216.58.206.2
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=2293265400039676&correlator=3740131205052034&output=ldjh&impl=fifs&adsid=NT&vrg=2020090201&gdpr=0&tfua=0&tfcd=0&guci=1.2.0.0.2.2.0.0&sc=1&sfv=1-0-37&ecs=20200909&iu_parts=21707124336%2CThreatPost-300x600-ATF&enc_prev_ius=%2F0%2F1&prev_iu_szs=300x250%7C300x600&ris=1&rcs=1&prev_scp=amznbid%3D2%26amznp%3D2%26hb_adid_nobid%3D630bbcc4f0db2bf%26hb_bidder_nobid%3Dnobid%26dyn_bids%3D0.01&eri=1&cust_params=urlhost%3Dhttps%253A%252F%252Fthreatpost.com%252F%26urlpath%3D%252Fshlayer-mac-malware-extra-sneakiness%252F156669%252F%26urlquery%3Dgoogfc%26contentid%3D156669%26category%3Deditors-picks%26contenttags%3Danti-evasion%252Cfake-adobe-flash-installer%252Cgoogle-search%252Cintego%252Cmac-malware%252Cmalware-analysis%252Cnew-version%252Cpoisoned-search-results%252Cshlayer%252Cstealth&cookie=ID%3Daadebd7d56d5671c-22a069c3d3b80062%3AT%3D1599667909%3AS%3DALNI_MbEdjx27GgmNj0bEpn0lN0l5kZgNg&bc=31&abxe=1&lmt=1599667910&dt=1599667910104&dlt=1599667907873&idt=584&frm=20&biw=1600&bih=1200&oid=3&adxs=1082&adys=1704&adks=375389812&ucis=6&ifi=6&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fthreatpost.com%2Fshlayer-mac-malware-extra-sneakiness%2F156669%2F%3Fweb_view%3Dtrue&dssz=47&icsg=171851648000&std=0&vis=1&dmc=8&scr_x=0&scr_y=0&psz=300x600&msz=300x600&psts=AGkb-H_u66j_224wxqGSIBhRxwxW3eLaBPqFuPAJ2sw4UWNkszAxvp-JQ-8f8T_9KGsaE8-9Vu0cVS0t1HUak652XA9MfLMpQM8&ga_vid=1262107814.1599667909&ga_sid=1599667909&ga_hid=625129160&fws=0&ohw=0

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020090201.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

216.58.206.2 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s20-in-f2.1e100.net

Software

cafe /

Resource Hash

878e2f7001cb0a69582bf4849bb5f14d1004f8008564ebce428386ef98bb7726

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 09 Sep 2020 16:11:50 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2350
x-xss-protection: 0
google-lineitem-id: 5192770279
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: 138293210928
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://threatpost.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 amp4ads-v0.js Show response
cdn.ampproject.org/rtv/012008242301000/ Frame EFC4 206 KB
56 KB 43ms
16ms Script
text/javascript 2a00:1450:4001:820::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012008242301000/amp4ads-v0.js

Requested by

Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:820::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b08c92f2985a2cf85e942b566af89d0738cb22e14d0db5ddbefd6c4034a169e8

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 13225
status: 200
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 57291
x-xss-protection: 0
server: sffe
date: Wed, 09 Sep 2020 12:31:25 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "fe153f75f3748e81"
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 09 Sep 2021 12:31:25 GMT

GET
H2 200 amp-ad-exit-0.1.js Show response
cdn.ampproject.org/rtv/012008242301000/v0/ Frame EFC4 16 KB
6 KB 42ms
15ms Script
text/javascript 2a00:1450:4001:820::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012008242301000/v0/amp-ad-exit-0.1.js

Requested by

Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:820::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

30cfde8a99cbbfb145edbaee540db712a5c6e8efa9e0b8209d803a7d4ecbdbbb

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 13225
status: 200
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5745
x-xss-protection: 0
server: sffe
date: Wed, 09 Sep 2020 12:31:25 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "f38bf2e806d02bb3"
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 09 Sep 2021 12:31:25 GMT

GET
H2 200 amp-analytics-0.1.js Show response
cdn.ampproject.org/rtv/012008242301000/v0/ Frame EFC4 95 KB
29 KB 37ms
10ms Script
text/javascript 2a00:1450:4001:820::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012008242301000/v0/amp-analytics-0.1.js

Requested by

Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:820::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a0b8d5f925cb1ad83c665488cf3d59c2b4acf9f0ec9f277db2441ca69d3900b0

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 13228
status: 200
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 29201
x-xss-protection: 0
server: sffe
date: Wed, 09 Sep 2020 12:31:22 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "64b4eb13675b1bd5"
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 09 Sep 2021 12:31:22 GMT

GET
H2 200 amp-fit-text-0.1.js Show response
cdn.ampproject.org/rtv/012008242301000/v0/ Frame EFC4 4 KB
2 KB 36ms
9ms Script
text/javascript 2a00:1450:4001:820::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012008242301000/v0/amp-fit-text-0.1.js

Requested by

Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:820::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

af517de65e4d2beaa3da8659682a9daaf863b96f59567e7550b7a1812a4f97e1

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 13226
status: 200
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1788
x-xss-protection: 0
server: sffe
date: Wed, 09 Sep 2020 12:31:24 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "0cdd699146251721"
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 09 Sep 2021 12:31:24 GMT

GET
H2 200 amp-form-0.1.js Show response
cdn.ampproject.org/rtv/012008242301000/v0/ Frame EFC4 47 KB
15 KB 34ms
7ms Script
text/javascript 2a00:1450:4001:820::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012008242301000/v0/amp-form-0.1.js

Requested by

Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:820::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

05148a217f01f1d6b7a9e90813a2c58d0dbbd947f76cbcbba24e4c0411463b08

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 13229
status: 200
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 14592
x-xss-protection: 0
server: sffe
date: Wed, 09 Sep 2020 12:31:21 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "c6e61a9007c16120"
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 09 Sep 2021 12:31:21 GMT

GET
H3-Q050 200 css
fonts.googleapis.com/ Frame EFC4 7 KB
1 KB 39ms
22ms Stylesheet
text/css 2a00:1450:4001:809::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto:300|Roboto:400,500&lang=en

Requested by

Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

d3838febe02ee1538a1336ac01f452a6fe7682106cd21b46cda9c40092c8e3aa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
status: 200
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Wed, 09 Sep 2020 14:40:57 GMT
server: ESF
date: Wed, 09 Sep 2020 16:11:50 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Wed, 09 Sep 2020 16:11:50 GMT

GET
H3-Q050 200 css
fonts.googleapis.com/ Frame EFC4 5 KB
687 B 39ms
23ms Stylesheet
text/css 2a00:1450:4001:809::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto:400,500&text=

Requested by

Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

c4a7b4babd8d76af2ddc0840bda733cd5a0b409895bb74d5302ff1155c9b32bc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
status: 200
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Wed, 09 Sep 2020 15:04:32 GMT
server: ESF
date: Wed, 09 Sep 2020 16:11:50 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Wed, 09 Sep 2020 16:11:50 GMT

GET
H3-Q050 200 downsize_200k_v1
tpc.googlesyndication.com/simgad/5298659094702092292/ Frame EFC4 12 KB
12 KB 36ms
18ms Image
image/jpeg 2a00:1450:4001:820::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/5298659094702092292/downsize_200k_v1?sqp=4sqPyQSWAUKTAQgAEhQNzczMPhUAAABAHQAAAAAlAAAAABgAIgoNAACAPxUAAIA_Kk8IWhABHQAAtEIgASgBMAY4A0CAwtcvSABQAFgAYFpwAngAgAEAiAEAkAEAnQEAAIA_oAEAqAEAsAGAreIEuAH___________8BxQEtsp0-MhoIqgIQnAEYASABLQAAAD8wqgI4nAFFAACAPw&rs=AOga4qmdRTu21rrtEUbNkDFKMbuc98lMfg

Requested by

Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:820::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8a6d8662f2fd519facf1393940cd0632cce658caa5bbab176b9360973ca8f6e3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 09 Sep 2020 03:27:21 GMT
x-content-type-options: nosniff
last-modified: Sun, 15 Mar 2020 18:50:42 GMT
server: sffe
age: 45869
status: 200
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 12345
x-xss-protection: 0
expires: Thu, 09 Sep 2021 03:27:21 GMT

GET
H3-Q050 200 downsize_200k_v1
tpc.googlesyndication.com/simgad/12873405645878381694/ Frame EFC4 2 KB
2 KB 33ms
16ms Image
image/png 2a00:1450:4001:820::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/12873405645878381694/downsize_200k_v1?sqp=4sqPyQR5QncIABIUDc3MzD4VAAAAQB0AAAAAJQAAAAAYACIKDQAAgD8VAACAPypPCFoQAR0AALRCIAEoATAGOANAgMLXL0gAUABYAGBacAJ4AIABAIgBAJABAJ0BAACAP6ABAKgBALABgK3iBLgB____________AcUBLbKdPg&rs=AOga4ql45MtAWjzPkLW0I9qh0O63Bde1yQ

Requested by

Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:820::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

06c5c6f82e19c34ebf8c6c560780a5a6bdb89460159b8aafc38e7ac5f9609184

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 07 Sep 2020 11:18:49 GMT
x-content-type-options: nosniff
last-modified: Thu, 09 Jan 2020 18:12:51 GMT
server: sffe
age: 190381
status: 200
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1862
x-xss-protection: 0
expires: Tue, 07 Sep 2021 11:18:49 GMT

GET
H3-Q050 200 adview
securepubads.g.doubleclick.net/pagead/ Frame EFC4 0
0 68ms
67ms Image
text/html 216.58.206.2
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=Cy6Lzxf5YX9ShIJSRrATBj5eACNeL_JBf8IWtt9ELqdjKwIcTEAEg0YfSIGCRhICA_BegAYqX_IgDyAEGqQKhj9ssCbqRPuACAKgDAcgDCqoE-gFP0EvbT0_xeP5s0Vw4BKo2XEusKJGUG8yCNKHj3eQAo-OBFVLa5I64CkwuyUOb6-T0VtsC7KUlyhsW7src9RJRzAPHZuVWrT1UTx9kGTKH2EuNHvDQOyE28L4EUQOWn4VTI5-YCIEZHW6kLtn-pd7STDSprOr_lvpOqwHAVyr-tzG2lkM03G4nEj1iWV4c9ReAxoCwNWBn38nZNMCQ5a5iSRT1Pz_kD_v3r3XXcWq9H2bn7zQcv7e63Mp3QShQlIoz1Usj4F9KLcSxTjgnw7SY9Zf-HaI6nQhO80AdWtT-kiFC4kPaMmIKvK3AhnXIJjVkeX2_DAu_QbDhwASvsv3N9wHgBAGSBQQIBBgBkgUECAUYBJIFBAgFGBiSBQUIBRioAaAGN4AH3uiDd6gHjs4bqAfVyRuoB5PYG6gHugaoB_DZG6gH8tkbqAemvhuoB-zVG9gHAfIHBBD0lQvSCAkIgOGAQBABGB3yCBthZHgtc3Vic3luLTcyNjM1NzM0NDY4MDQwNziACgPICwHYEwyYFgE&sigh=-Z_AOUbSg0g&template_id=492&tpd=AGWhJmvxWd-6jRzUKXcqkm4df5wuG-TI0pmq-Ie0FmYKYgbNSg
Requested by: Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Protocol: H3-Q050
Security: QUIC, , AES_128_GCM
Server: 216.58.206.2 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS: fra16s20-in-f2.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

GET
H3-Q050 200 en.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame EFC4 2 KB
3 KB 30ms
13ms Image
image/png 2a00:1450:4001:820::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/en.png

Requested by

Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:820::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 08 Sep 2020 23:34:13 GMT
x-content-type-options: nosniff
server: cafe
age: 59857
etag: 14819457070020093239
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: public, max-age=86400
content-type: image/png
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2502
x-xss-protection: 0
expires: Wed, 09 Sep 2020 23:34:13 GMT

GET
H3-Q050 200 icon.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame EFC4 295 B
388 B 31ms
14ms Image
image/png 2a00:1450:4001:820::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png

Requested by

Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:820::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 08 Sep 2020 21:53:21 GMT
x-content-type-options: nosniff
server: cafe
age: 65909
etag: 426692510519060060
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: public, max-age=86400
content-type: image/png
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 295
x-xss-protection: 0
expires: Wed, 09 Sep 2020 21:53:21 GMT

GET
DATA 200
OK truncated
/ Frame EFC4 216 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 06a5907d46bb26a5d53a5c93a39493430cae984aad4edec11e59b7fb0a78cadd

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/png

GET
H3-Q050 200 amp4ads-v0.js Show response
cdn.ampproject.org/rtv/012008242301000/ Frame 2F59 206 KB
57 KB 28ms
13ms Script
text/javascript 2a00:1450:4001:820::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012008242301000/amp4ads-v0.js

Requested by

Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:820::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b08c92f2985a2cf85e942b566af89d0738cb22e14d0db5ddbefd6c4034a169e8

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 13225
status: 200
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 57291
x-xss-protection: 0
server: sffe
date: Wed, 09 Sep 2020 12:31:25 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "fe153f75f3748e81"
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 09 Sep 2021 12:31:25 GMT

GET
H3-Q050 200 amp-analytics-0.1.js Show response
cdn.ampproject.org/rtv/012008242301000/v0/ Frame 2F59 95 KB
29 KB 29ms
14ms Script
text/javascript 2a00:1450:4001:820::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012008242301000/v0/amp-analytics-0.1.js

Requested by

Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:820::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a0b8d5f925cb1ad83c665488cf3d59c2b4acf9f0ec9f277db2441ca69d3900b0

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 13228
status: 200
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 29201
x-xss-protection: 0
server: sffe
date: Wed, 09 Sep 2020 12:31:22 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "64b4eb13675b1bd5"
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 09 Sep 2021 12:31:22 GMT

GET
H3-Q050 200 7464639028652035684
tpc.googlesyndication.com/simgad/ Frame 2F59 330 B
455 B 7ms
6ms Image
image/png 2a00:1450:4001:820::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/7464639028652035684

Requested by

Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:820::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f19e7ee6cdf20bd478c037707c447b7cd469051de4dadeac32a795efb463c2e2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 07 Sep 2020 16:04:38 GMT
x-content-type-options: nosniff
age: 173232
x-dns-prefetch-control: off
status: 200
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 330
x-xss-protection: 0
last-modified: Tue, 28 Jan 2020 23:02:00 GMT
server: sffe
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 07 Sep 2021 16:04:38 GMT

GET
H3-Q050 200 view
securepubads.g.doubleclick.net/pcs/ Frame 2F59 0
31 B 57ms
56ms Image
image/gif 216.58.206.2
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvrEfD7qnBmZqQXvhR88l76XVGBYVfXorMvoB9R1sXwj0S8sOEFJ3j2WiUilRtHlKIe1tdVOAKBasMbsI_hgISBS5txUaSYZZ6Py7YIhlx1Bqrj5gFebUZvQ4eO4Uq9fMgEMJRFgDGrrmHa6SK8s7kJdKEATjtmRwzFWbSaW2thWB4G7GF9QwQwTOP38oEqPjoGv0kyC7gHLt4yQTkiI-Km1EkKQsCjjXOhZoD2j7pPDQYRKS0pn7re-Ljv7edKN2tzfsLXpdRT4mry7FrLQA&sai=AMfl-YSOohbuRMRxkl7YdER3Onf6tvhSIkXe1QYthXXVBZklC-XsWDgnluCaDlk9_zEdFD0Q6zZS3OlqVB6RPWsDH8fHBry_jx3sul-DFLCDQU5a904YsJXp5x65PGGBz21Y&sig=Cg0ArKJSzBwz4NT43iFDEAE&adurl=

Requested by

Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

216.58.206.2 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s20-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 09 Sep 2020 16:11:50 GMT
x-content-type-options: nosniff
server: cafe
status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H3-Q050 204 l
www.google.com/ads/measurement/ Frame 2F59 0
0 14ms
13ms Image
text/html 2a00:1450:4001:81a::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaTAZH0K_sb7W3BxiUxWeNCfdrKwsDh_V08bebo25pLIy6v4tsqB2_aYnzJhZdrPgZh-yyDf
Requested by: Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Protocol: H3-Q050
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:81a::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

GET
DATA 200
OK truncated
/ Frame 2F59 216 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 29bbbb257d14cbd0a964a91f780fad62eb92e638bd8ef5479f200b7e256b7771

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/png

GET
H3-Q050 200 KFOmCnqEu92Fr1Mu4mxKKTU1Kg.woff2
fonts.gstatic.com/s/roboto/v20/ Frame EFC4 11 KB
11 KB 6ms
6ms Font
font/woff2 2a00:1450:4001:815::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v20/KFOmCnqEu92Fr1Mu4mxKKTU1Kg.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:300|Roboto:400,500&lang=en

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:815::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5d1bc9b443f3f81fa4b4ad4634c1bb9702194c1898e3a9de0ab5e2cdc0e9f479

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://threatpost.com
Referer: https://fonts.googleapis.com/css?family=Roboto:300|Roboto:400,500&lang=en
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 07 Sep 2020 11:04:00 GMT
x-content-type-options: nosniff
last-modified: Wed, 24 Jul 2019 01:18:50 GMT
server: sffe
age: 191270
status: 200
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11016
x-xss-protection: 0
expires: Tue, 07 Sep 2021 11:04:00 GMT

GET
H3-Q050 200 KFOlCnqEu92Fr1MmEU9fBBc4AMP6lQ.woff2
fonts.gstatic.com/s/roboto/v20/ Frame EFC4 11 KB
11 KB 7ms
6ms Font
font/woff2 2a00:1450:4001:815::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v20/KFOlCnqEu92Fr1MmEU9fBBc4AMP6lQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:300|Roboto:400,500&lang=en

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:815::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ce897833ac6e362df7c91ac8223fe511c6defcf33964928a81004600a2dd4c2e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://threatpost.com
Referer: https://fonts.googleapis.com/css?family=Roboto:300|Roboto:400,500&lang=en
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 07 Sep 2020 11:04:01 GMT
x-content-type-options: nosniff
last-modified: Wed, 24 Jul 2019 01:18:48 GMT
server: sffe
age: 191269
status: 200
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11056
x-xss-protection: 0
expires: Tue, 07 Sep 2021 11:04:01 GMT

GET
H2

200

si
googleads.g.doubleclick.net/pagead/drt/ Frame EFC4
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si

0
0

39ms
39ms

Image
text/html

2a00:1450:4001:814::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://googleads.g.doubleclick.net/pagead/drt/si
Requested by: Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:814::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Redirect headers

date: Wed, 09 Sep 2020 16:11:50 GMT
x-content-type-options: nosniff
server: safe
status: 302
content-type: text/html; charset=UTF-8
location: https://googleads.g.doubleclick.net/pagead/drt/si
cache-control: private
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 246
x-xss-protection: 0

GET
H3-Q050 200 downsize_200k_v1
tpc.googlesyndication.com/simgad/5298659094702092292/ Frame EFC4 12 KB
12 KB 7ms
7ms Image
image/jpeg 2a00:1450:4001:820::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012008242301000/amp4ads-v0.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:820::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8a6d8662f2fd519facf1393940cd0632cce658caa5bbab176b9360973ca8f6e3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 09 Sep 2020 03:27:21 GMT
x-content-type-options: nosniff
last-modified: Sun, 15 Mar 2020 18:50:42 GMT
server: sffe
age: 45869
status: 200
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 12345
x-xss-protection: 0
expires: Thu, 09 Sep 2021 03:27:21 GMT

GET
H3-Q050 200 downsize_200k_v1
tpc.googlesyndication.com/simgad/12873405645878381694/ Frame EFC4 2 KB
2 KB 7ms
7ms Image
image/png 2a00:1450:4001:820::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012008242301000/amp4ads-v0.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:820::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

06c5c6f82e19c34ebf8c6c560780a5a6bdb89460159b8aafc38e7ac5f9609184

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 07 Sep 2020 11:18:49 GMT
x-content-type-options: nosniff
last-modified: Thu, 09 Jan 2020 18:12:51 GMT
server: sffe
age: 190381
status: 200
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1862
x-xss-protection: 0
expires: Tue, 07 Sep 2021 11:18:49 GMT

GET
H3-Q050 200 en.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame EFC4 2 KB
2 KB 7ms
6ms Image
image/png 2a00:1450:4001:820::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/en.png

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012008242301000/amp4ads-v0.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:820::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 08 Sep 2020 23:34:13 GMT
x-content-type-options: nosniff
server: cafe
age: 59857
etag: 14819457070020093239
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: public, max-age=86400
content-type: image/png
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2502
x-xss-protection: 0
expires: Wed, 09 Sep 2020 23:34:13 GMT

GET
H3-Q050 200 icon.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame EFC4 295 B
319 B 7ms
7ms Image
image/png 2a00:1450:4001:820::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012008242301000/amp4ads-v0.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:820::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 08 Sep 2020 21:53:21 GMT
x-content-type-options: nosniff
server: cafe
age: 65909
etag: 426692510519060060
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: public, max-age=86400
content-type: image/png
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 295
x-xss-protection: 0
expires: Wed, 09 Sep 2020 21:53:21 GMT

GET
H2 200 bl-9a4f7ce-ca40eed9.js Show response
tagan.adlightning.com/math-aids-threatpost/ Frame BDD6 79 KB
22 KB 33ms
32ms Script
application/javascript 99.84.156.34
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/math-aids-threatpost/bl-9a4f7ce-ca40eed9.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.84.156.34 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-84-156-34.txl52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 82e2369bfee3725eb4f4ef3af5431637009a89ac42f4e6da6f68e66d3b034788

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 09 Sep 2020 03:12:51 GMT
content-encoding: gzip
age: 46740
x-cache: Hit from cloudfront
status: 200
content-length: 22389
x-amz-meta-git_commit: 9a4f7ce
last-modified: Tue, 08 Sep 2020 22:17:44 GMT
server: AmazonS3
etag: "79e00495b70f820a38b6b36c3f2f8ff5"
x-amz-version-id: F.XN1SsPf_y4x2xIDo65TAplqCsfb9A2
via: 1.1 df792ea3bbbe656e2f5c7b61aa85cc47.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: TXL52-C1
accept-ranges: bytes
content-type: application/javascript
x-amz-cf-id: IO7PgPjyTzcGUAIYDeXe1LU3jnTnbszDhSb6kQ9fdkQx89KaOZ_2mg==

GET
H2 200 b-9a4f7ce-a7f6098c.js Show response
tagan.adlightning.com/math-aids-threatpost/ Frame BDD6 61 KB
21 KB 33ms
33ms Script
application/javascript 99.84.156.34
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/math-aids-threatpost/b-9a4f7ce-a7f6098c.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.84.156.34 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-84-156-34.txl52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 0119689800eadf6270855a19b65d74251e7da6be5e4686f36c15bf81281ddb4c

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 07 Sep 2020 01:11:01 GMT
content-encoding: gzip
age: 226850
x-cache: Hit from cloudfront
status: 200
content-length: 20808
x-amz-meta-git_commit: 9a4f7ce
last-modified: Tue, 18 Aug 2020 17:45:57 GMT
server: AmazonS3
etag: "98ae1c21c96b68b5f173604d82c35d5d"
x-amz-version-id: PzdVsYQ0bdCd7Kp..jKBw4vE53Z4BW7z
via: 1.1 df792ea3bbbe656e2f5c7b61aa85cc47.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: TXL52-C1
accept-ranges: bytes
content-type: application/javascript
x-amz-cf-id: Y7zNrfVuZOm4ba8DDHuZWvi6e1E2WtKQrxzhTiujMc16mfzWD1lo3g==

GET
H2 200 bl-9a4f7ce-ca40eed9.js Show response
tagan.adlightning.com/math-aids-threatpost/ Frame DFFD 79 KB
22 KB 33ms
32ms Script
application/javascript 99.84.156.34
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/math-aids-threatpost/bl-9a4f7ce-ca40eed9.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.84.156.34 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-84-156-34.txl52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 82e2369bfee3725eb4f4ef3af5431637009a89ac42f4e6da6f68e66d3b034788

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 09 Sep 2020 03:12:51 GMT
content-encoding: gzip
age: 46740
x-cache: Hit from cloudfront
status: 200
content-length: 22389
x-amz-meta-git_commit: 9a4f7ce
last-modified: Tue, 08 Sep 2020 22:17:44 GMT
server: AmazonS3
etag: "79e00495b70f820a38b6b36c3f2f8ff5"
x-amz-version-id: F.XN1SsPf_y4x2xIDo65TAplqCsfb9A2
via: 1.1 df792ea3bbbe656e2f5c7b61aa85cc47.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: TXL52-C1
accept-ranges: bytes
content-type: application/javascript
x-amz-cf-id: 3NDxrwWM7ZT9mypgZfY8lrjjyDuwoOU0h0Z9NPrJe3IRgKje77C-Vg==

GET
H2 200 b-9a4f7ce-a7f6098c.js Show response
tagan.adlightning.com/math-aids-threatpost/ Frame DFFD 61 KB
21 KB 33ms
32ms Script
application/javascript 99.84.156.34
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/math-aids-threatpost/b-9a4f7ce-a7f6098c.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.84.156.34 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-84-156-34.txl52.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 0119689800eadf6270855a19b65d74251e7da6be5e4686f36c15bf81281ddb4c

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 07 Sep 2020 01:11:01 GMT
content-encoding: gzip
age: 226850
x-cache: Hit from cloudfront
status: 200
content-length: 20808
x-amz-meta-git_commit: 9a4f7ce
last-modified: Tue, 18 Aug 2020 17:45:57 GMT
server: AmazonS3
etag: "98ae1c21c96b68b5f173604d82c35d5d"
x-amz-version-id: PzdVsYQ0bdCd7Kp..jKBw4vE53Z4BW7z
via: 1.1 df792ea3bbbe656e2f5c7b61aa85cc47.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: TXL52-C1
accept-ranges: bytes
content-type: application/javascript
x-amz-cf-id: _JA028Ej7e3Q3w9ZCsBgm1HfXAAUjtkY62YfExkOT8dYJEraVQ7gVg==

GET
H2 200 adsbygoogle.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame DFFD 127 KB
44 KB 24ms
22ms Script
text/javascript 2a00:1450:4001:814::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:814::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

dd8edf08014c1976f429cf0ff8cb5e47ada72fb6c6fe42723ab483d939a98e5c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 09 Sep 2020 16:11:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 44950
x-xss-protection: 0
server: cafe
etag: 3234362041578318797
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Wed, 09 Sep 2020 16:11:50 GMT

GET
H3-Q050 200 osd_listener.js Show response
www.googletagservices.com/activeview/js/current/ Frame DFFD 74 KB
28 KB 43ms
43ms Script
text/javascript 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

21fb271392e0c7a737fb39243d3726a125a1282d2a0853cb910a87c1b890b525

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 09 Sep 2020 16:11:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1599152861011880"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 28780
x-xss-protection: 0
expires: Wed, 09 Sep 2020 16:11:50 GMT

GET
H3-Q050 200 osd.js Show response
www.googletagservices.com/activeview/js/current/ 72 KB
27 KB 46ms
45ms Script
text/javascript 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd.js?cb=%2Fr20100101

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020090201.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

330798625ce3468cc078ba28574ec8651fd742c9f70673c29333f9a9683a2a21

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 09 Sep 2020 16:11:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1599152861011880"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 27492
x-xss-protection: 0
expires: Wed, 09 Sep 2020 16:11:50 GMT

GET
H3-Q050 200 view
securepubads.g.doubleclick.net/pcs/ Frame 2F59 0
21 B 58ms
57ms Image
image/gif 216.58.206.2
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjssxdK5t4XxD4bgL4MboKO1un_A6AyTXeIH9kL73SLXTN8amGeunsXRMqB7nSwcJWLPVi4_6WxATpQubuI__s-nDVoyV-bs197JTSzUbHhJOV5meXqwJfn5J2Lotz-qfumXLuKT3UZ65oMASa3bTBJZMfH_Loa5u1dOhc8HnM3t-ht2lzu7YgOK5iVi3xTO-rqJhQ12dE_ZuK2wGLuckxdCbEfw-iiQzgACS0LZ_cIa4TjycFpgU2vPFRcT1XuEpM3FVB0ALe8wft-WkSnJnalSW&sai=AMfl-YSQGwIUfzu5p6JOJQKtT1XBqEwX1KXXtLejK81JPhnqybkeECXvvGArb6XFduRdku92q7XDybnq4NVKg63CMs0RADLspBrrRuFLkIQ2lL6gVn4eMQIzZg2HsZ99ah4L&sig=Cg0ArKJSzBUZpkrgJYVzEAE&adurl=

Requested by

Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

216.58.206.2 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s20-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 09 Sep 2020 16:11:50 GMT
x-content-type-options: nosniff
server: cafe
status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H3-Q050 200 7464639028652035684
tpc.googlesyndication.com/simgad/ Frame 2F59 330 B
355 B 7ms
6ms Image
image/png 2a00:1450:4001:820::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/7464639028652035684

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012008242301000/amp4ads-v0.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:820::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f19e7ee6cdf20bd478c037707c447b7cd469051de4dadeac32a795efb463c2e2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 07 Sep 2020 16:04:38 GMT
x-content-type-options: nosniff
age: 173232
x-dns-prefetch-control: off
status: 200
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 330
x-xss-protection: 0
last-modified: Tue, 28 Jan 2020 23:02:00 GMT
server: sffe
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 07 Sep 2021 16:04:38 GMT

GET
H3-Q050 200 amp4ads-v0.js Show response
cdn.ampproject.org/rtv/012008242301000/ Frame BDD6 206 KB
56 KB 9ms
7ms Script
text/javascript 2a00:1450:4001:820::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012008242301000/amp4ads-v0.js

Requested by

Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:820::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b08c92f2985a2cf85e942b566af89d0738cb22e14d0db5ddbefd6c4034a169e8

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 13225
status: 200
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 57291
x-xss-protection: 0
server: sffe
date: Wed, 09 Sep 2020 12:31:25 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "fe153f75f3748e81"
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 09 Sep 2021 12:31:25 GMT

GET
H3-Q050 200 amp-ad-exit-0.1.js Show response
cdn.ampproject.org/rtv/012008242301000/v0/ Frame BDD6 16 KB
6 KB 12ms
9ms Script
text/javascript 2a00:1450:4001:820::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012008242301000/v0/amp-ad-exit-0.1.js

Requested by

Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:820::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

30cfde8a99cbbfb145edbaee540db712a5c6e8efa9e0b8209d803a7d4ecbdbbb

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 13225
status: 200
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5745
x-xss-protection: 0
server: sffe
date: Wed, 09 Sep 2020 12:31:25 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "f38bf2e806d02bb3"
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 09 Sep 2021 12:31:25 GMT

GET
H3-Q050 200 amp-analytics-0.1.js Show response
cdn.ampproject.org/rtv/012008242301000/v0/ Frame BDD6 95 KB
29 KB 12ms
10ms Script
text/javascript 2a00:1450:4001:820::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012008242301000/v0/amp-analytics-0.1.js

Requested by

Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:820::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a0b8d5f925cb1ad83c665488cf3d59c2b4acf9f0ec9f277db2441ca69d3900b0

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 13228
status: 200
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 29201
x-xss-protection: 0
server: sffe
date: Wed, 09 Sep 2020 12:31:22 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "64b4eb13675b1bd5"
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 09 Sep 2021 12:31:22 GMT

GET
H3-Q050 200 amp-fit-text-0.1.js Show response
cdn.ampproject.org/rtv/012008242301000/v0/ Frame BDD6 4 KB
2 KB 14ms
12ms Script
text/javascript 2a00:1450:4001:820::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012008242301000/v0/amp-fit-text-0.1.js

Requested by

Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:820::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

af517de65e4d2beaa3da8659682a9daaf863b96f59567e7550b7a1812a4f97e1

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 13226
status: 200
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1788
x-xss-protection: 0
server: sffe
date: Wed, 09 Sep 2020 12:31:24 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "0cdd699146251721"
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 09 Sep 2021 12:31:24 GMT

GET
H3-Q050 200 amp-form-0.1.js Show response
cdn.ampproject.org/rtv/012008242301000/v0/ Frame BDD6 47 KB
14 KB 15ms
13ms Script
text/javascript 2a00:1450:4001:820::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012008242301000/v0/amp-form-0.1.js

Requested by

Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:820::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

05148a217f01f1d6b7a9e90813a2c58d0dbbd947f76cbcbba24e4c0411463b08

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 13229
status: 200
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 14592
x-xss-protection: 0
server: sffe
date: Wed, 09 Sep 2020 12:31:21 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/javascript
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "c6e61a9007c16120"
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 09 Sep 2021 12:31:21 GMT

GET
H3-Q050 200 en.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame BDD6 2 KB
2 KB 13ms
11ms Image
image/png 2a00:1450:4001:820::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/en.png

Requested by

Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:820::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 08 Sep 2020 23:34:13 GMT
x-content-type-options: nosniff
server: cafe
age: 59857
etag: 14819457070020093239
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: public, max-age=86400
content-type: image/png
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2502
x-xss-protection: 0
expires: Wed, 09 Sep 2020 23:34:13 GMT

GET
H3-Q050 200 icon.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame BDD6 295 B
319 B 13ms
11ms Image
image/png 2a00:1450:4001:820::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png

Requested by

Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:820::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 08 Sep 2020 21:53:21 GMT
x-content-type-options: nosniff
server: cafe
age: 65909
etag: 426692510519060060
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: public, max-age=86400
content-type: image/png
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 295
x-xss-protection: 0
expires: Wed, 09 Sep 2020 21:53:21 GMT

GET
H3-Q050 200 10558153782905241568
tpc.googlesyndication.com/daca_images/simgad/ Frame BDD6 39 KB
40 KB 13ms
11ms Image
image/png 2a00:1450:4001:820::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/daca_images/simgad/10558153782905241568

Requested by

Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:820::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

263cb75aae2d5f444da7f29e4a4c345664b88639e37e878fd5bed2f05aa7b52c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 07 Sep 2020 11:33:56 GMT
x-content-type-options: nosniff
age: 189474
x-dns-prefetch-control: off
status: 200
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 40436
x-xss-protection: 0
last-modified: Thu, 30 Jan 2020 03:35:55 GMT
server: sffe
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 07 Sep 2021 11:33:56 GMT

GET
H3-Q050 200 adview
securepubads.g.doubleclick.net/pagead/ Frame BDD6 0
0 59ms
58ms Image
text/html 216.58.206.2
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=CdBh6xv5YX6m9B86t3gO5l7vADKzU8Ltb7bfY3fQKwI23ARABINGH0iBgkYSAgPwXoAHOgf_TA8gBAqkCG9QHIPZfqT7gAgCoAwHIAwiqBPUBT9DEmHyIj6GOTVeNS4RxQND3fd8M_uOW_xgcX1G99nzMlZEZW2mA71H5AdSjQ_RtyVcynryLdRpckD0iaHl4XFz3UOCUn2uzJgqukq-aCjYUD6qWblYnFDgDySpEEMLNmYhWWqsaAKpl2_59bu-3eMXwubVu1TC19z-4mL8CG6N9k7lm_PouAnONx1SUcKc7IRJRAr1VycRM5Z-rnguRAEql7BKsLJPKOYlcmQSb6fjh7Jbp3KfOX-dsjqDgvSFPmOfZC-3f5V7wtnxvYLZseZV4nAcnoGDm5AeQ10UWVD0ZdJObifirPsPGb4FlFgDNr3fNjYvABLzL1NTaAuAEAZIFBAgEGAGSBQQIBRgEoAYCgAea_oAsqAeOzhuoB9XJG6gHk9gbqAe6BqgH8NkbqAfy2RuoB6a-G6gH7NUb2AcB8gcEEKeUCNIIBwiAYRABGB3yCBthZHgtc3Vic3luLTcyNjM1NzM0NDY4MDQwNziACgPICwHYEw0&sigh=-ofp302QlTQ&tpd=AGWhJmtHHXBrrYqh8-Du8npdexLIlk_U-4iPmA0g5ut1elXzSg
Requested by: Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Protocol: H3-Q050
Security: QUIC, , AES_128_GCM
Server: 216.58.206.2 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS: fra16s20-in-f2.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

GET
DATA 200
OK truncated
/ Frame BDD6 210 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 0dc6e498973ccdc85333c8edd8333b916b22c6fec7a0a6d51fcc1d8290500d0a

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/png

GET
H3-Q050 200 view
securepubads.g.doubleclick.net/pcs/ Frame DFFD 0
0 64ms
57ms Fetch
image/gif 216.58.206.2
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstT8R9RTV85P-sMnTJg27qdD7JRwIVIdgsghLFiQq42fsqolv8JdQFUPMdb3CwNyVzfXL5uZr1rb2vhSVXCudwZTZYLMw9EJEBjYTt52GkcrXAjpdp6NLyOZkwRysIewJu9-KzYfBcyMsNbP2LAY9Knnx3Lf2cWWs6AKshQbNaMvgobfVbV6BlllviHE321fzXYzeuf2TwdGVI8OevcBeimr9317g30sctgRcLtDKwbv4LOQG58b8o7SPfQ6OQczXTMmp36d6kG3S4o0g_fSxQRMA&sig=Cg0ArKJSzNaAaREm1pEdEAE&urlfix=1&adurl=

Requested by

Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

216.58.206.2 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s20-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 09 Sep 2020 16:11:50 GMT
x-content-type-options: nosniff
server: cafe
status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame DFFD 212 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 6cb565b65b08c18fa828c63d8e6a73da39053df7bc76d2029c9f09339a1c8200

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/png

GET
H3-Q050 200 integrator.js Show response
adservice.google.de/adsid/ Frame DFFD 109 B
868 B 35ms
21ms Script
application/javascript 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=threatpost.com

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/b-9a4f7ce-a7f6098c.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 09 Sep 2020 16:11:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status: 200
cache-control: private, no-cache, no-store
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 104
x-xss-protection: 0

GET
H3-Q050 200 integrator.js Show response
adservice.google.com/adsid/ Frame DFFD 109 B
868 B 35ms
22ms Script
application/javascript 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=threatpost.com

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/b-9a4f7ce-a7f6098c.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 09 Sep 2020 16:11:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status: 200
cache-control: private, no-cache, no-store
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 104
x-xss-protection: 0

GET
H3-Q050 200 show_ads_impl_fy2019.js Show response
pagead2.googlesyndication.com/pagead/js/r20200901/r20190131/ Frame DFFD 228 KB
86 KB 26ms
26ms Script
text/javascript 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20200901/r20190131/show_ads_impl_fy2019.js

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/b-9a4f7ce-a7f6098c.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f223afe73e8e54bef06ee5fb36c0f8c7bcd4c835717d137d8915996b3309c8d6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 09 Sep 2020 16:11:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 87668
x-xss-protection: 0
server: cafe
etag: 5831147292718782217
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=1209600
timing-allow-origin: *
expires: Wed, 09 Sep 2020 16:11:50 GMT

GET
H3-Q050 200 zrt_lookup.html
googleads.g.doubleclick.net/pagead/html/r20200901/r20190131/ Frame 1688 0
0 7ms
5ms Document
text/html 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20200901/r20190131/zrt_lookup.html

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/b-9a4f7ce-a7f6098c.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/html/r20200901/r20190131/zrt_lookup.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: IDE=AHWqTUnFOhHhx_e-lN96GQCP0kp8AmHk-5s5BAW5xgSG9wQcBH5euqZIt-_Rl_N1; DSID=NO_DATA
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Response headers

status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
vary: Accept-Encoding
date: Wed, 09 Sep 2020 09:18:18 GMT
expires: Wed, 23 Sep 2020 09:18:18 GMT
content-type: text/html; charset=UTF-8
etag: 9704104221650600920
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 4744
x-xss-protection: 0
age: 24812
cache-control: public, max-age=1209600
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"

GET
H3-Q050 200 ads
googleads.g.doubleclick.net/pagead/ Frame 3A07 0
0 135ms
134ms Document
text/html 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-7500593236707325&output=html&h=250&slotname=2376748102&adk=2477513961&adf=776186316&w=300&psa=0&guci=1.2.0.0.2.2.0.0&format=300x250&url=https%3A%2F%2Fthreatpost.com%2Fshlayer-mac-malware-extra-sneakiness%2F156669%2F%3Fweb_view%3Dtrue&ea=0&flash=0&wgl=1&adsid=NT&dt=1599667910604&bpp=20&bdt=144&idt=103&shv=r20200901&cbv=r20190131&ptt=9&saldr=aa&correlator=5686873144420&frm=23&ife=4&pv=2&ga_vid=1262107814.1599667909&ga_sid=1599667911&ga_hid=234238073&ga_fc=1&iag=3&icsg=8362&nhd=1&dssz=14&mdo=0&mso=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1082&ady=1574&biw=1600&bih=1200&isw=300&ish=250&ifk=65441356&scr_x=0&scr_y=0&eid=42530621%2C42530672%2C21066648&oid=3&pvsid=274053545329849&pem=119&rx=0&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C300%2C250&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=8196&bc=31&ifi=1&uci=1.g8ieqwo3u1il&btvi=1&fsb=1&dtd=117

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/b-9a4f7ce-a7f6098c.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?client=ca-pub-7500593236707325&output=html&h=250&slotname=2376748102&adk=2477513961&adf=776186316&w=300&psa=0&guci=1.2.0.0.2.2.0.0&format=300x250&url=https%3A%2F%2Fthreatpost.com%2Fshlayer-mac-malware-extra-sneakiness%2F156669%2F%3Fweb_view%3Dtrue&ea=0&flash=0&wgl=1&adsid=NT&dt=1599667910604&bpp=20&bdt=144&idt=103&shv=r20200901&cbv=r20190131&ptt=9&saldr=aa&correlator=5686873144420&frm=23&ife=4&pv=2&ga_vid=1262107814.1599667909&ga_sid=1599667911&ga_hid=234238073&ga_fc=1&iag=3&icsg=8362&nhd=1&dssz=14&mdo=0&mso=0&u_tz=120&u_his=2&u_java=0&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=0&u_nmime=0&adx=1082&ady=1574&biw=1600&bih=1200&isw=300&ish=250&ifk=65441356&scr_x=0&scr_y=0&eid=42530621%2C42530672%2C21066648&oid=3&pvsid=274053545329849&pem=119&rx=0&eae=2&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C300%2C250&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=8196&bc=31&ifi=1&uci=1.g8ieqwo3u1il&btvi=1&fsb=1&dtd=117
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: IDE=AHWqTUnFOhHhx_e-lN96GQCP0kp8AmHk-5s5BAW5xgSG9wQcBH5euqZIt-_Rl_N1; DSID=NO_DATA
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Response headers

status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Wed, 09 Sep 2020 16:11:50 GMT
server: cafe
content-length: 204
x-xss-protection: 0
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"

GET
H3-Q050 200 osd.js Show response
www.googletagservices.com/activeview/js/current/ Frame DFFD 72 KB
27 KB 39ms
39ms Script
text/javascript 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd.js?cb=%2Fr20100101

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/b-9a4f7ce-a7f6098c.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

330798625ce3468cc078ba28574ec8651fd742c9f70673c29333f9a9683a2a21

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 09 Sep 2020 16:11:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1599152861011880"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 27492
x-xss-protection: 0
expires: Wed, 09 Sep 2020 16:11:50 GMT

GET
H/1.1 200
OK showad.js
ads.pubmatic.com/AdServer/js/ Frame 5D1F 0
0 25ms
25ms Document
text/html 23.210.249.92
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/showad.js
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/content/prebid/prebidVid.3.19.0_9.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.210.249.92 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-249-92.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash

Request headers

Host: ads.pubmatic.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Cookie: KTPCACOOKIE=YES; KCCH=YES; pi=159196:2
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Response headers

Last-Modified: Sat, 01 Aug 2020 14:58:34 GMT
ETag: "13006b6-94fd-5abd223c2ac92"
Server: Apache/2.2.15 (CentOS)
Accept-Ranges: bytes
Content-Encoding: gzip
P3P: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
Content-Length: 13837
Content-Type: text/html; charset=UTF-8
Cache-Control: public, max-age=53451
Expires: Thu, 10 Sep 2020 07:02:41 GMT
Date: Wed, 09 Sep 2020 16:11:50 GMT
Connection: keep-alive
Vary: Accept-Encoding

GET
H/1.1 200
OK showad.js
ads.pubmatic.com/AdServer/js/ Frame 36A0 0
0 50ms
25ms Document
text/html 23.210.249.92
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/showad.js
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/content/prebid/prebidVid.3.19.0_9.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.210.249.92 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-249-92.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash

Request headers

Host: ads.pubmatic.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Cookie: KTPCACOOKIE=YES; KCCH=YES; pi=159196:2
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Response headers

Last-Modified: Sat, 01 Aug 2020 14:58:34 GMT
ETag: "13006b6-94fd-5abd223c2ac92"
Server: Apache/2.2.15 (CentOS)
Accept-Ranges: bytes
Content-Encoding: gzip
P3P: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
Content-Length: 13837
Content-Type: text/html; charset=UTF-8
Cache-Control: public, max-age=53451
Expires: Thu, 10 Sep 2020 07:02:41 GMT
Date: Wed, 09 Sep 2020 16:11:50 GMT
Connection: keep-alive
Vary: Accept-Encoding

GET
H/1.1 200
OK async_usersync.html
acdn.adnxs.com/ib/static/usersync/v3/ Frame 821C 0
0 94ms
47ms Document
text/html 23.210.249.83
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://acdn.adnxs.com/ib/static/usersync/v3/async_usersync.html
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/content/prebid/prebidVid.3.19.0_9.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.210.249.83 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-249-83.deploy.static.akamaitechnologies.com
Software: nginx/1.9.13 /
Resource Hash

Request headers

Host: acdn.adnxs.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Response headers

Last-Modified: Fri, 20 May 2016 02:07:09 GMT
ETag: "573e714d-3e3"
Server: nginx/1.9.13
Content-Type: text/html
Vary: Accept-Encoding
Access-Control-Allow-Origin: *
Content-Encoding: gzip
Content-Length: 506
Cache-Control: max-age=31536000
Expires: Thu, 09 Sep 2021 16:11:50 GMT
Date: Wed, 09 Sep 2020 16:11:50 GMT
Connection: keep-alive

GET
H2 200 pd
u.openx.net/w/1.0/ Frame FC52 0
0 26ms
25ms Document
text/html 35.244.159.8
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://u.openx.net/w/1.0/pd?gdpr=1&gdpr_consent=
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/content/prebid/prebidVid.3.19.0_9.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.159.8 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/16.193.0 /
Resource Hash

Request headers

:method: GET
:authority: u.openx.net
:scheme: https
:path: /w/1.0/pd?gdpr=1&gdpr_consent=
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: i=3b97355a-6aa1-4a80-8ebc-14169494a19d|1599667909
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Response headers

status: 200
vary: Accept, Accept-Encoding
set-cookie: i=3b97355a-6aa1-4a80-8ebc-14169494a19d|1599667909; Version=1; Expires=Thu, 09-Sep-2021 16:11:50 GMT; Max-Age=31536000; Secure; Domain=.openx.net; Path=/; SameSite=None pd=v2|1599667910|gekin0vNiygu; Version=1; Expires=Thu, 24-Sep-2020 16:11:50 GMT; Max-Age=1296000; Secure; Domain=.openx.net; Path=/; SameSite=None
server: OXGW/16.193.0
p3p: CP="CUR ADM OUR NOR STA NID"
date: Wed, 09 Sep 2020 16:11:50 GMT
content-type: text/html
content-length: 419
content-encoding: gzip
via: 1.1 google
alt-svc: clear

GET
H/1.1 200
OK ixmatch.html
js-sec.indexww.com/um/ Frame 3E9D 0
0 316ms
22ms Document
text/html 23.210.249.164
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://js-sec.indexww.com/um/ixmatch.html
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/content/prebid/prebidVid.3.19.0_9.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.210.249.164 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-249-164.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash

Request headers

Host: js-sec.indexww.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Response headers

Server: Apache
Last-Modified: Mon, 19 Jun 2017 19:18:19 GMT
ETag: "74087b-112-55254ff6699bb"
Accept-Ranges: bytes
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: text/html; charset=UTF-8
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 211
Date: Wed, 09 Sep 2020 16:11:51 GMT
Connection: keep-alive

GET
H2

204

sync
pixel.advertising.com/ups/55953/ Frame 9723
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=adaptv&ttd_tpi=1
https://match.adsrvr.org/track/cmb/generic?ttd_pid=adaptv&ttd_tpi=1
https://pixel.advertising.com/ups/55953/sync?uid=d3628999-3edf-49ea-babb-8e6fa8134f97&_origin=1&gdpr=1&gdpr_consent=&piggybackCookie=d3628999-3edf-49ea-babb-8e6fa8134f97

0
124 B

67ms
23ms

Image
text/plain

35.156.153.71
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pixel.advertising.com/ups/55953/sync?uid=d3628999-3edf-49ea-babb-8e6fa8134f97&_origin=1&gdpr=1&gdpr_consent=&piggybackCookie=d3628999-3edf-49ea-babb-8e6fa8134f97

Requested by

Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

35.156.153.71 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-35-156-153-71.eu-central-1.compute.amazonaws.com

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 204
date: Wed, 09 Sep 2020 16:11:51 GMT
strict-transport-security: max-age=31536000
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

Redirect headers

pragma: no-cache
date: Wed, 09 Sep 2020 16:11:50 GMT
x-aspnet-version: 4.0.30319
status: 302
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://pixel.advertising.com/ups/55953/sync?uid=d3628999-3edf-49ea-babb-8e6fa8134f97&_origin=1&gdpr=1&gdpr_consent=&piggybackCookie=d3628999-3edf-49ea-babb-8e6fa8134f97
cache-control: private,no-cache, must-revalidate
content-type: text/html
content-length: 369

GET
H/1.1

204
No Content

sync
ups.analytics.yahoo.com/ups/57304/ Frame 9723
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=adaptv_dbm&google_cm&google_sc
https://pixel.advertising.com/ups/57304/sync?uid=CAESEDlPERJWn8ZL_B_IBiS9XaU&google_cver=1
https://ups.analytics.yahoo.com/ups/57304/sync?uid=CAESEDlPERJWn8ZL_B_IBiS9XaU&google_cver=1&apid=1A2a527996-f2b7-11ea-bc35-12795fd23bd8
https://ups.analytics.yahoo.com/ups/57304/sync?uid=CAESEDlPERJWn8ZL_B_IBiS9XaU&google_cver=1&apid=1A2a527996-f2b7-11ea-bc35-12795fd23bd8&verify=true

0
506 B

47ms
23ms

Image
text/plain

3.126.56.137
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ups.analytics.yahoo.com/ups/57304/sync?uid=CAESEDlPERJWn8ZL_B_IBiS9XaU&google_cver=1&apid=1A2a527996-f2b7-11ea-bc35-12795fd23bd8&verify=true

Requested by

Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

3.126.56.137 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-126-56-137.eu-central-1.compute.amazonaws.com

Software

ATS/7.1.2.113 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Wed, 09 Sep 2020 16:11:51 GMT
Server: ATS/7.1.2.113
Connection: keep-alive
Age: 0
Strict-Transport-Security: max-age=31536000
P3P: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

Redirect headers

Date: Wed, 09 Sep 2020 16:11:51 GMT
Server: ATS/7.1.2.113
Age: 0
Strict-Transport-Security: max-age=31536000
P3P: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
Location: https://ups.analytics.yahoo.com/ups/57304/sync?uid=CAESEDlPERJWn8ZL_B_IBiS9XaU&google_cver=1&apid=1A2a527996-f2b7-11ea-bc35-12795fd23bd8&verify=true
Connection: keep-alive
Content-Length: 0

GET
H2

204

sync
pixel.advertising.com/ups/55986/ Frame 9723
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/m7y5t93k?gdpr=1&gdpr_consent=&redir=https%3A%2F%2Fpixel.advertising.com%2Fups%2F55986%2Fsync%3Fuid%3D%24%7BUSER_ID%7D%26_origin%3D0&gdpr=1&gdpr_consent=
https://sync-tm.everesttech.net/ct/upi/pid/m7y5t93k?gdpr=1&gdpr_consent=&redir=https%3A%2F%2Fpixel.advertising.com%2Fups%2F55986%2Fsync%3Fuid%3D%24%7BUSER_ID%7D%26_origin%3D0&gdpr=1&gdpr_consent=&_...
https://pixel.advertising.com/ups/55986/sync?uid=X1j_xgAAAEONDXYV&_origin=0&gdpr=1&gdpr_consent=&_test=X1j_xgAAAEONDXYV

0
124 B

25ms
24ms

Image
text/plain

35.156.153.71
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pixel.advertising.com/ups/55986/sync?uid=X1j_xgAAAEONDXYV&_origin=0&gdpr=1&gdpr_consent=&_test=X1j_xgAAAEONDXYV

Requested by

Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

35.156.153.71 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-35-156-153-71.eu-central-1.compute.amazonaws.com

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 204
date: Wed, 09 Sep 2020 16:11:51 GMT
strict-transport-security: max-age=31536000
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

Redirect headers

pragma: no-cache
date: Wed, 09 Sep 2020 16:11:51 GMT
via: 1.1 varnish
server: Varnish
x-timer: S1599667911.015133,VS0,VE0
x-served-by: cache-fra19130-FRA
status: 302
x-cache: HIT
location: https://pixel.advertising.com/ups/55986/sync?uid=X1j_xgAAAEONDXYV&_origin=0&gdpr=1&gdpr_consent=&_test=X1j_xgAAAEONDXYV
cache-control: no-cache
accept-ranges: bytes
content-length: 0
retry-after: 0
x-cache-hits: 0

GET
H2 200 %7Bcombo_uid%7D
pr-bh.ybp.yahoo.com/sync/adaptv_ortb/ Frame 9723 43 B
841 B 147ms
44ms Image
image/gif 2a00:1288:110:c305::8000
YAHOO-IRD

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pr-bh.ybp.yahoo.com/sync/adaptv_ortb/%7Bcombo_uid%7D

Requested by

Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a00:1288:110:c305::8000 , United Kingdom, ASN34010 (YAHOO-IRD, GB),

Reverse DNS

Software

ATS /

Resource Hash

48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 09 Sep 2020 16:11:50 GMT
referrer-policy: strict-origin-when-cross-origin
server: ATS
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security: max-age=31536000
content-type: image/gif
status: 200
x-xss-protection: 1; mode=block
content-length: 43
x-content-type-options: nosniff
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H3-Q050

200

si
googleads.g.doubleclick.net/pagead/drt/ Frame BDD6
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si

0
0

38ms
38ms

Image
text/html

2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://googleads.g.doubleclick.net/pagead/drt/si
Requested by: Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Protocol: H3-Q050
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Redirect headers

date: Wed, 09 Sep 2020 16:11:50 GMT
x-content-type-options: nosniff
server: safe
status: 302
content-type: text/html; charset=UTF-8
location: https://googleads.g.doubleclick.net/pagead/drt/si
cache-control: private
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 246
x-xss-protection: 0

GET
H3-Q050 200 10558153782905241568
tpc.googlesyndication.com/daca_images/simgad/ Frame BDD6 39 KB
40 KB 7ms
6ms Image
image/png 2a00:1450:4001:820::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/daca_images/simgad/10558153782905241568

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012008242301000/amp4ads-v0.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:820::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

263cb75aae2d5f444da7f29e4a4c345664b88639e37e878fd5bed2f05aa7b52c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 07 Sep 2020 11:33:56 GMT
x-content-type-options: nosniff
age: 189474
x-dns-prefetch-control: off
status: 200
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 40436
x-xss-protection: 0
last-modified: Thu, 30 Jan 2020 03:35:55 GMT
server: sffe
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 07 Sep 2021 11:33:56 GMT

GET
H3-Q050 200 en.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame BDD6 2 KB
2 KB 8ms
8ms Image
image/png 2a00:1450:4001:820::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/en.png

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012008242301000/amp4ads-v0.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:820::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 08 Sep 2020 23:34:13 GMT
x-content-type-options: nosniff
server: cafe
age: 59857
etag: 14819457070020093239
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: public, max-age=86400
content-type: image/png
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2502
x-xss-protection: 0
expires: Wed, 09 Sep 2020 23:34:13 GMT

GET
H3-Q050 200 icon.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame BDD6 295 B
319 B 8ms
7ms Image
image/png 2a00:1450:4001:820::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012008242301000/amp4ads-v0.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:820::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 08 Sep 2020 21:53:21 GMT
x-content-type-options: nosniff
server: cafe
age: 65909
etag: 426692510519060060
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: public, max-age=86400
content-type: image/png
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 295
x-xss-protection: 0
expires: Wed, 09 Sep 2020 21:53:21 GMT

GET
H3-Q050 200 view
securepubads.g.doubleclick.net/pcs/ Frame DFFD 0
21 B 58ms
58ms Image
image/gif 216.58.206.2
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvLf7U75Dc5_rmx7ac-zkPgHf0nneRtmEObA_0v8XJQVO7hBg1XuPmyv2hFUbw8vQ91eJPQyeMDULZxrrBOpv787DdMwi1QfGm-gx5bi4z0klbs6utcylLezLSRQRKqIugp6khrb7wsvmPznlJARfOQyO1FppZU8nurK_AakFtSKFIG0YtOs2zAIaAraMI870TpGI0cROXTADlkq0djBVUaDq1K4Uah8MSnBSdS46IpdCTxF6aOCw_dg2MUHxk0JMhHpCAvgFb9q4uWeCLTfj8A1Mai&sig=Cg0ArKJSzP-lyIMcRt3AEAE&urlfix=1&adurl=

Requested by

Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

216.58.206.2 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s20-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 09 Sep 2020 16:11:50 GMT
x-content-type-options: nosniff
server: cafe
status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H3-Q050 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ Frame DFFD 8 KB
7 KB 57ms
42ms XHR
application/json 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20200901&st=env

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20200901/r20190131/show_ads_impl_fy2019.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

542a7bfb6cb07cc57d7c39c2e5f870810b3955f1411ccb005f1057b9e12a10b7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 09 Sep 2020 16:11:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
status: 200
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 6425
x-xss-protection: 0

GET
H3-Q050 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ Frame DFFD 14 KB
6 KB 14ms
14ms Script
text/javascript 2a00:1450:4001:820::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/b-9a4f7ce-a7f6098c.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:820::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

08f50e9e70388c99977ca13b6af3a49f8f48c83e79230d51ea72a56c0735bd0c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 09 Sep 2020 16:11:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1591403518460474"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5540
x-xss-protection: 0
expires: Wed, 09 Sep 2020 16:11:50 GMT

GET
H3-Q050 200 runner.html
tpc.googlesyndication.com/sodar/sodar2/210/ Frame 3F9B 0
0 6ms
6ms Document
text/html 2a00:1450:4001:820::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/210/runner.html

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/b-9a4f7ce-a7f6098c.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:820::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/sodar2/210/runner.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Response headers

status: 200
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
content-length: 4590
date: Wed, 09 Sep 2020 15:26:22 GMT
expires: Thu, 09 Sep 2021 15:26:22 GMT
last-modified: Wed, 26 Feb 2020 19:47:50 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 2728
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-Q050 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame DFFD 0
72 B 39ms
39ms Image
image/gif 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=210&t=2&li=gda_r20200901&jk=274053545329849&bg=!bG-lb3dY1VGLObUpVHECAAAAT1IAAAAzCgFtLXX5MK2TGPhu9HLYAhBHnZAAjjYsZCTmsKi2EtEpFYsBvttrrIfTppZHF4KphSemmBd3ZK9OtfHQZ7Nv4ChyvXnkqagu_Ha6VFTC2gQhaVF5gAKhIghCMgL7ux95UNGCHEMwq6WYkuAMfM3hsSb55BLqHPCD51uu8JRAKcFuT6cTgf7yE9hDeTh0KnsQlgi9AemYj9QMSRL49QVrRneCG4eaBoWzdukE0n7Cs_6M4GQ4ymJUNUVKANmeBOxFYEvL55uafufLxlZBUBrJPw6goqtMKucTNRg27po709c4OoZbK5rvltWoN6oPUTlXA3q6G2El7l5Za_1pHjxM9y_gsa3ilpBY9IIHDh_YncR38ZTvnpBD6OUf_oupqhQCL9tsYo3q8e4XEYlNfAi21IBnI_Pzx1Uo2BAOyEVY6mFlkZcnkteYXMX2mfCmRjhkIJzgVVAj9WnlU0ph4d3weyomJf7jS6vCLKryAnHIHOyZAa0_T3RHmosExvrD4YuqhgBOknR2hh-ikyyB-38uU30YFcRVkY7q-bclvzDA5ibRSx0O7hMRCsnUzNV9K1UHxZP9H9aEcIfvKJEPQcjHfd9qyUAmZfun19ipmxLiD3d1d7v3mYrYoZZxHMpxAd1zx0H35dqY6wsrZAkKcJfkzzRhUX_xtAsbE1PBewf2nmXiGZkOm7dSDWl60XRI4ZZcyJeS0FATh0BJJcsuxU0bibExcEgAooGZiOs_lpr0GTTdhtBHGlIhj80j4S86woZQjmmY-n6lvTRNp76pR3ELbt05PmpGFoywR3JdFbmX6eECFY9iF5xfAyVH2PPazipuTSEUzjo2ging_pssmSIYEYMgOmPe1TV5615ibjEYSLLo1fpYiuD8ESrcQAow8UEPT5L6DvC0rDY5uKkAKCg7Bs7KrTgTwSsupeh__g_USHI4eHONahB09Fhrb3yvU6CTiCk7-gFwn8JCqOzfM-uQ6HwDVsOFPXZHEH8jsMWqRN__UoxV5OJmGLSn-QDWu0F_jH9b9WkAk6PWnjzDwgJNpFyhBfwlDtMhS_VbSBWic1k

Requested by

Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 09 Sep 2020 16:11:51 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 204
cache-control: no-cache, must-revalidate
content-type: image/gif
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK liveView.php
live.sekindo.com/live/ 0
353 B 23ms
23ms Image
text/html 185.220.204.204
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://live.sekindo.com/live/liveView.php?njs=1&ito=1&vid_event=36&serverTime=1599667909&vid_playerVer=3.1.0&s=101281&sta=0&x=300&y=250&vid_passDomain=threatpost.com&subId=threatpost.com&debugInformation=&isApp=0&userIpAddr=185.217.171.12&userUA=Mozilla%2F5.0%20%28Macintosh%3B%20Intel%20Mac%20OS%20X%2010_14_5%29%20AppleWebKit%2F537.36%20%28KHTML%2C%20like%20Gecko%29%20Chrome%2F83.0.4103.61%20Safari%2F537.36&csuuid=5f58fec4dc913&contentFileId=0&mediaPlayListId=0&mediaListId=0&cbuster=1599667911286&gdpr=1&gdprConsent=&isWePassGdpr=0&ccpa=0&ccpaConsent=&uid=SekindoSPlayer5f58fec5149c6&pubUrl=https%3A%2F%2Fthreatpost.com%2Fshlayer-mac-malware-extra-sneakiness%2F156669%2F%3Fweb_view%3Dtrue&floatStatus=true
Requested by: Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 185.220.204.204 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, GB),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 09 Sep 2020 16:11:50 GMT
content-encoding: gzip
server: nginx
age: 0
transfer-encoding: chunked
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
access-control-allow-origin: *
cache-control: no-store
content-type: text/html; charset=UTF-8

GET
H3-Q050 200 activeview
pagead2.googlesyndication.com/pcs/ Frame 2F59 42 B
129 B 39ms
39ms Image
image/gif 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjss6BaT2hE76ukqRGcJQMNeelM_BJQlkKG4drS8gSsPOiiFlheLiXw93A0NQ7vm_Jv0rDc0iekTcOS5AugU97Njld8N1udQcEBA3YvJmE_A&sig=Cg0ArKJSzE_Rh3rTWJ3gEAE&id=ampim&o=0,0&d=2,2&ss=1600,1200&bs=1600,1200&mcvt=1000&mtos=0,0,1000,1000,1000&tos=0,0,1000,0,0&tfs=100&tls=1100&g=100&h=100&tt=1100&r=v&avms=ampa&adk=3385906655

Requested by

Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 09 Sep 2020 16:11:51 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
status: 200
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
content-type: image/gif
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 activeview
pagead2.googlesyndication.com/pcs/ Frame EFC4 42 B
65 B 46ms
45ms Image
image/gif 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjssfITdBNBIkl-JuCzT168s8yfok1l2bGcNr2EWGkmXgwLxe8vDFwb7V04xPdbK2QNXT09BFTCOOdE4YjvqleNVnKlZhNmhZLpjOXRQdJeuhhwXkg_eZvfhxaS_6wOQdCh9sBm21eLhNubwyywADUfRl&sai=AMfl-YR1XXyOIxXMfBBu5z485Fv9ob_65c4lhbQi4SCyKCwzzPmivQEC7fQvVvL1_oViw_Ud8qIM1J5fwSyBl6jTPMvZUz1ofaedT_4LcQwYM73S0tFY5Guc0-GGh1u2ae4H&sig=Cg0ArKJSzMAfPKJQtCEjEAE&cid=CAASPeRo1LhlXkEw2l86aW3ejrj42fwIAc3q5351b6inn5_GIdi9Vtf5NGF54aNja2L4ltnoOHEBZJgt7KMR6LU&id=ampim&o=1082,417&d=300,250&ss=1600,1200&bs=1600,1200&mcvt=1002&mtos=0,0,1002,1002,1002&tos=0,0,1002,0,0&tfs=168&tls=1170&g=100&h=100&tt=1171&r=v&avms=ampa&adk=654286612

Requested by

Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 09 Sep 2020 16:11:51 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
status: 200
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
content-type: image/gif
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 activeview
pagead2.googlesyndication.com/pcs/ Frame BDD6 42 B
65 B 44ms
43ms Image
image/gif 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjssnRKM-04JkYHFkhMCjU9OQJDICnfpTGrBHX-G9kNWxIJtIDObMBKCRHUTIhxHqHDRECOUoNaJskxpri0RiDoXMz063UiadlZXDeOP3rHqw2bbiqMklNJRLmNg&sai=AMfl-YShWRc5BCvGOi4Eq4V1kggGptGIHmL3BQrzf4b2txTZD5w6XE0gzfPflymW_4ypv4CUT4zRCkif4i2aj0N3UV4IRX1w_7MB-FXuKdU5mrRaFriQ_Tt5dbWSAekt&sig=Cg0ArKJSzJiu3kUo43GhEAE&cid=CAASFeRokR1dHVdG6wtoPI48cj_7rfm_VQ&id=ampim&o=315,10&d=970,120&ss=1600,1200&bs=1600,1200&mcvt=1001&mtos=0,0,1001,1001,1001&tos=0,0,1001,0,0&tfs=141&tls=1142&g=100&h=100&tt=1142&r=v&avms=ampa&adk=1015519800

Requested by

Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 09 Sep 2020 16:11:51 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
status: 200
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
content-type: image/gif
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

sync
eb2.3lift.com/ Frame 8390
Redirect Chain

https://eb2.3lift.com/sync?
https://eb2.3lift.com/sync?&ld=1

0
0

89ms
79ms

Document
text/html

54.93.147.19
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://eb2.3lift.com/sync?&ld=1
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.93.147.19 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash

Request headers

:method: GET
:authority: eb2.3lift.com
:scheme: https
:path: /sync?&ld=1
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: tluid=14970812114436034832
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Response headers

status: 200
date: Wed, 09 Sep 2020 16:11:52 GMT
content-type: text/html; charset=utf-8
content-length: 468
set-cookie: sync=CgoIgQIQjf-MnccuCgoIoQEQjf-MnccuCgoI4gEQjf-MnccuCgoI5gEQjf-MnccuCgoI1gEQjf-MnccuCgoIhwIQjf-MnccuCgkIOhCN_4ydxy4KCQgLEI3_jJ3HLgoJCF8Qjf-MnccuCgkIHxCN_4ydxy4=; Max-Age=7776000; Expires=Tue, 08 Dec 2020 16:11:52 GMT; Path=/sync; Domain=.3lift.com; SameSite=None; Secure tluid=14970812114436034832; Max-Age=7776000; Expires=Tue, 08 Dec 2020 16:11:52 GMT; Path=/; Domain=.3lift.com; SameSite=None; Secure
content-encoding: gzip
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
cache-control: no-cache, no-store, must-revalidate

Redirect headers

status: 302
date: Wed, 09 Sep 2020 16:11:52 GMT
content-length: 0
set-cookie: tluid=14970812114436034832; Max-Age=7776000; Expires=Tue, 08 Dec 2020 16:11:52 GMT; Path=/; Domain=.3lift.com; SameSite=None; Secure
location: /sync?&ld=1
cache-control: no-cache, no-store, must-revalidate
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H/1.1

200
OK

2000891.html
serverbid-sync.nyc3.cdn.digitaloceanspaces.com/ss/ Frame C5C4
Redirect Chain

https://sync.serverbid.com/ss/2000891.html
https://serverbid-sync.nyc3.cdn.digitaloceanspaces.com/ss/2000891.html

0
0

816ms
17ms

Document
text/html

205.185.216.42
HIGHWINDS3

General

Check archive.org

Show headers Download Go to

Full URL

https://serverbid-sync.nyc3.cdn.digitaloceanspaces.com/ss/2000891.html

Requested by

Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

205.185.216.42 Phoenix, United States, ASN20446 (HIGHWINDS3, US),

Reverse DNS

map2.hwcdn.net

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload

Request headers

Host: serverbid-sync.nyc3.cdn.digitaloceanspaces.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Response headers

Date: Wed, 09 Sep 2020 16:11:54 GMT
Connection: Keep-Alive
Cache-Control: max-age=3546
Content-Length: 4947
Content-Type: text/html
Last-Modified: Wed, 20 Nov 2019 20:29:05 GMT
Accept-Ranges: bytes
ETag: "1b0ebac83fe30af80513039edbdf566f"
x-amz-request-id: tx000000000000068f8293b-005f57bb24-35d9d00-nyc3a
Strict-Transport-Security: max-age=15552000; includeSubDomains; preload
Vary: Access-Control-Request-Headers,Access-Control-Request-Method,Origin
X-HW: 1599667914.dop126.am5.t,1599667914.cds241.am5.shn,1599667914.dop126.am5.t,1599667914.cds277.am5.c

Redirect headers

status: 302
content-length: 0
location: https://serverbid-sync.nyc3.cdn.digitaloceanspaces.com/ss/2000891.html
cache-control: no-cache

GET
H/1.1 200
OK usync.html
eus.rubiconproject.com/ Frame F1B8 0
0 1086ms
21ms Document
text/html 104.111.230.142
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.html
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.111.230.142 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-230-142.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash

Request headers

Host: eus.rubiconproject.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Cookie: rsid=1|GdCqMVQW/e7eWy+6n8k7DE/csJlhJKmtmCxRUZWfOAt9roT5PmziRNTCN9WE5/rIRx3CvDzGDGfGQhinGXK9BwvuslMKlFofuhUuVZDhR1578z/6X/8LU67/VKHYWVqPA9Sa+k89aUDxov4=; ses15=; vis15=300372^1; ses2=; vis2=300372^1; khaos=KEVKYY6R-C-4DPG; audit=1|hLZGFuTafB3WT3fY7JRf77Rkaxq/kNsV4NR/Pei4ADYIdmxANNSNfUD3pCcW8TpHcpj76PKZXj8oT2OqK/B16qwRNgFmLHdP
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Response headers

Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Last-Modified: Wed, 19 Aug 2020 18:23:01 GMT
Content-Encoding: gzip
Content-Length: 9457
Content-Type: text/html; charset=UTF-8
Cache-Control: max-age=45276
Expires: Thu, 10 Sep 2020 04:46:29 GMT
Date: Wed, 09 Sep 2020 16:11:53 GMT
Connection: keep-alive
Vary: Accept-Encoding

GET
H/1.1 200
OK ixmatch.html
js-sec.indexww.com/um/ Frame 7D3C 0
0 25ms
23ms Document
text/html 23.210.249.164
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://js-sec.indexww.com/um/ixmatch.html
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.210.249.164 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-249-164.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash

Request headers

Host: js-sec.indexww.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Response headers

Server: Apache
Last-Modified: Mon, 19 Jun 2017 19:18:19 GMT
ETag: "74087b-112-55254ff6699bb"
Accept-Ranges: bytes
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: text/html; charset=UTF-8
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 211
Date: Wed, 09 Sep 2020 16:11:52 GMT
Connection: keep-alive

GET
H/1.1 200
OK Cookie set beacon
ap.lijit.com/ Frame 807D 0
0 45ms
22ms Document
text/html 72.251.249.9
VOXEL-DOT-NET

General

Check archive.org

Show headers Download Go to

Full URL: https://ap.lijit.com/beacon?informer=13394437
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 72.251.249.9 Amsterdam, Netherlands, ASN29791 (VOXEL-DOT-NET, US),
Reverse DNS
Software: nginx / raptor
Resource Hash

Request headers

Host: ap.lijit.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Cookie: ljtrtb=eJyrrgUAAXUA%2BQ%3D%3D; ljt_reader=5c77613319777788922ea239
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Response headers

Server: nginx
Date: Wed, 09 Sep 2020 16:11:52 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Vary: Accept-Encoding
Expires: Fri, 20 Mar 2009 00:00:00 GMT
Set-Cookie: ljtrtbexp=eJxlkEESwCAIA%2F%2FiuQdBMdCvdfr3ascL0dtmSAg%2BRcotFgHrTfQqJm5TGbU6YEsZI7NmbBkhmaVmjgjKx85XKH6HHg4citMW6ui01amld2Lq5JxHDZTydOxflPkWI9%2FUKK%2BTv0dmo3lL974fTg5Vhw%3D%3D;Path=/;Domain=.lijit.com;Expires=Thu, 09-Sep-2021 16:11:52 GMT;Max-Age=31536000;Secure;SameSite=None ljtrtb=eJyrrgUAAXUA%2BQ%3D%3D;Path=/;Domain=.lijit.com;Expires=Thu, 09-Sep-2021 16:11:52 GMT;Max-Age=31536000;Secure;SameSite=None ljt_reader=5c77613319777788922ea239;Path=/;Domain=.lijit.com;Max-Age=31536000;Secure;SameSite=None
Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
Pragma: no-cache
P3P: CP="CUR ADM OUR NOR STA NID"
X-Powered-By: raptor
Content-Encoding: gzip
X-Sovrn-Pod: ad_ap3ams1

GET
H2 200 sync.html
public.servenobid.com/ Frame 84A7 0
0 60ms
20ms Document
text/html 2620:1ec:bdf::10
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://public.servenobid.com/sync.html
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:bdf::10 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash

Request headers

:method: GET
:authority: public.servenobid.com
:scheme: https
:path: /sync.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Response headers

status: 200
cache-control: max-age=86400
content-type: text/html
content-encoding: br
last-modified: Wed, 26 Aug 2020 18:24:34 GMT
accept-ranges: bytes
etag: "202461a171f44cd9bf99b8a0f91a6c12"
server: AmazonS3
x-cache: TCP_HIT
x-amz-id-2: uBzeAsZfMgDzeYQ8FGWEfuhAk9J6Qg+WRCJLUilnBZA1N2BCcHzF98yQhpZvvcA6PI+1Zopng0g=
x-amz-request-id: EF2021A312D6747C
x-azure-ref-originshield: 0U5tYXwAAAAAmo/nNXl4zQ4UJpi5nVip+TE9OMjFFREdFMTUxNAA4NGU3ZGZhMi0xNDQyLTQzMzQtYjM0Zi1lNDJkM2Y3ZGRhZDk=
x-azure-ref: 0yP5YXwAAAAD4xf74PRKuT6NMPPkenVpiQlJVMzBFREdFMDQwNwA4NGU3ZGZhMi0xNDQyLTQzMzQtYjM0Zi1lNDJkM2Y3ZGRhZDk=
date: Wed, 09 Sep 2020 16:11:51 GMT

GET
H/1.1 200
OK async_usersync.html
acdn.adnxs.com/dmp/ Frame 5203 0
0 29ms
29ms Document
text/html 23.210.249.83
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://acdn.adnxs.com/dmp/async_usersync.html
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.210.249.83 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-249-83.deploy.static.akamaitechnologies.com
Software: nginx/1.13.10 /
Resource Hash

Request headers

Host: acdn.adnxs.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Response headers

Last-Modified: Tue, 24 Mar 2020 15:52:19 GMT
ETag: "5e7a2cb3-cefd"
Server: nginx/1.13.10
Access-Control-Allow-Origin: *
Content-Type: text/html
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 17037
Cache-Control: max-age=86402
Expires: Thu, 10 Sep 2020 16:11:54 GMT
Date: Wed, 09 Sep 2020 16:11:52 GMT
Connection: keep-alive

GET
H2 200 pd
eu-u.openx.net/w/1.0/ Frame 0D1D 0
0 22ms
21ms Document
text/html 35.244.159.8
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://eu-u.openx.net/w/1.0/pd?plm=6&ph=e1b1f5e1-3c2c-4287-9806-317cfbf3bd12&gdpr=0
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.159.8 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/16.193.0 /
Resource Hash

Request headers

:method: GET
:authority: eu-u.openx.net
:scheme: https
:path: /w/1.0/pd?plm=6&ph=e1b1f5e1-3c2c-4287-9806-317cfbf3bd12&gdpr=0
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: i=3b97355a-6aa1-4a80-8ebc-14169494a19d|1599667909; pd=v2|1599667910|gekin0vNiygu
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Response headers

status: 200
vary: Accept, Accept-Encoding
set-cookie: i=3b97355a-6aa1-4a80-8ebc-14169494a19d|1599667909; Version=1; Expires=Thu, 09-Sep-2021 16:11:52 GMT; Max-Age=31536000; Secure; Domain=.openx.net; Path=/; SameSite=None pd=v2|1599667910.2|kiiygevNgun0.mWgqsLommOns; Version=1; Expires=Thu, 24-Sep-2020 16:11:52 GMT; Max-Age=1296000; Secure; Domain=.openx.net; Path=/; SameSite=None
server: OXGW/16.193.0
p3p: CP="CUR ADM OUR NOR STA NID"
date: Wed, 09 Sep 2020 16:11:52 GMT
content-type: text/html
content-length: 315
content-encoding: gzip
via: 1.1 google
alt-svc: clear

GET
H/1.1 200
OK showad.js
ads.pubmatic.com/AdServer/js/ Frame CE1C 0
0 25ms
25ms Document
text/html 23.210.249.92
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/showad.js
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.210.249.92 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-249-92.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash

Request headers

Host: ads.pubmatic.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Cookie: KTPCACOOKIE=YES; pi=159196:2
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Response headers

Last-Modified: Sat, 01 Aug 2020 14:58:34 GMT
ETag: "13006b6-94fd-5abd223c2ac92"
Server: Apache/2.2.15 (CentOS)
Accept-Ranges: bytes
Content-Encoding: gzip
P3P: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
Content-Length: 13837
Content-Type: text/html; charset=UTF-8
Cache-Control: public, max-age=53449
Expires: Thu, 10 Sep 2020 07:02:41 GMT
Date: Wed, 09 Sep 2020 16:11:52 GMT
Connection: keep-alive
Vary: Accept-Encoding

GET
H2 204 current
aol-match.dotomi.com/match/bounce/ 0
104 B 130ms
84ms Image
text/plain 2a02:fa8:8806:16::1370
VCLK-EU-

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://aol-match.dotomi.com/match/bounce/current?networkId=60&version=1&nuid=1A2a4db208-f2b7-11ea-9d06-126145921f52&gdpr=1&gdpr_consent=&rurl=https%3A%2F%2Fpixel.advertising.com%2Fups%2F55853%2Fsync%3Fuid%3D%24UID%26_origin%3D0%26gdpr%3D1%26gdpr_consent%3D
Requested by: Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2a02:fa8:8806:16::1370 , Sweden, ASN41041 (VCLK-EU-, SE),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 204
pragma: no-cache
date: Wed, 09 Sep 2020 16:11:52 GMT
cache-control: no-cache, private, max-age=0, no-store
server: nginx
expires: 0

GET
H2 403 /
c1.adform.net/serving/cookie/match/ 0
187 B 33ms
26ms Image
text/plain 37.157.3.30
ADFORM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://c1.adform.net/serving/cookie/match/?CC=1&party=15&gdpr=1&gdpr_consent=&curl=https%3A%2F%2Fpixel.advertising.com%2Fups%2F55944%2Fsync%3Fuid%3D%24UID%26_origin%3D0%26gdpr%3d1%26gdpr_consent%3d

Requested by

Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

37.157.3.30 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 09 Sep 2020 16:11:52 GMT
server: nginx
status: 403
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
content-length: 0
expires: -1

GET
H2

204

setuid
aas.dc-1.net/
Redirect Chain

https://ib.adnxs.com/getuid?https%3A%2F%2Faas.dc-1.net%2Fsetuid%3FA%3Dece9205e-dc04-4ae6-a2be-d426a0b775ae%26D%3D%26bidder%3Dappnexus%26uid%3D%24UID
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%253A%252F%252Faas.dc-1.net%252Fsetuid%253FA%253Dece9205e-dc04-4ae6-a2be-d426a0b775ae%2526D%253D%2526bidder%253Dappnexus%2526uid%253D%2524UID
https://aas.dc-1.net/setuid?A=ece9205e-dc04-4ae6-a2be-d426a0b775ae&D=&bidder=appnexus&uid=5552695140468941548

0
193 B

265ms
103ms

Image
text/plain

52.5.29.22
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://aas.dc-1.net/setuid?A=ece9205e-dc04-4ae6-a2be-d426a0b775ae&D=&bidder=appnexus&uid=5552695140468941548
Requested by: Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.5.29.22 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-5-29-22.compute-1.amazonaws.com
Software: Cowboy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 204
date: Wed, 09 Sep 2020 16:11:52 GMT
cache-control: max-age=0, private, must-revalidate
server: Cowboy

Redirect headers

Pragma: no-cache
Date: Wed, 09 Sep 2020 16:11:52 GMT
X-Proxy-Origin: 185.217.171.12; 185.217.171.12; 692.bm-nginx-loadbalancer.mgmt.fra1; *.adnxs.com; 37.252.172.109:80
AN-X-Request-Uuid: 8ced5e64-1861-4c3d-a589-13fde862a454
Server: nginx/1.17.9
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://aas.dc-1.net/setuid?A=ece9205e-dc04-4ae6-a2be-d426a0b775ae&D=&bidder=appnexus&uid=5552695140468941548
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2

204

setuid
aas.dc-1.net/
Redirect Chain

https://image2.pubmatic.com/AdServer/UCookieSetPug?rd=https%3A%2F%2Faas.dc-1.net%2Fsetuid%3FA%3Dece9205e-dc04-4ae6-a2be-d426a0b775ae%26D%3D%26bidder%3Dpubmatic%26uid%3D%23PM_USER_ID
https://aas.dc-1.net/setuid?A=ece9205e-dc04-4ae6-a2be-d426a0b775ae&D=&bidder=pubmatic&uid=8C11317B-B416-432D-86AA-AD1B0A1D1554

0
198 B

104ms
104ms

Image
text/plain

52.5.29.22
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://aas.dc-1.net/setuid?A=ece9205e-dc04-4ae6-a2be-d426a0b775ae&D=&bidder=pubmatic&uid=8C11317B-B416-432D-86AA-AD1B0A1D1554
Requested by: Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.5.29.22 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-5-29-22.compute-1.amazonaws.com
Software: Cowboy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 204
date: Wed, 09 Sep 2020 16:11:52 GMT
cache-control: max-age=0, private, must-revalidate
server: Cowboy

Redirect headers

Location: https://aas.dc-1.net/setuid?A=ece9205e-dc04-4ae6-a2be-d426a0b775ae&D=&bidder=pubmatic&uid=8C11317B-B416-432D-86AA-AD1B0A1D1554
Date: Wed, 09 Sep 2020 16:11:52 GMT
X-Cnection: close
Server: Apache/2.2.24 (Unix) mod_ssl/2.2.24 OpenSSL/1.0.0-fips mod_fastcgi/2.4.6
P3P: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
Content-Length: 457
Content-Type: text/html; charset=iso-8859-1

GET
H2 200 generic
match.adsrvr.org/track/cmf/ 70 B
264 B 36ms
31ms Image
image/gif 52.31.46.99
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.adsrvr.org/track/cmf/generic?ttd_pid=aoladtech&gdpr=1&gdpr_consent=
Requested by: Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.31.46.99 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-31-46-99.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 09 Sep 2020 16:11:52 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
status: 200
cache-control: private,no-cache, must-revalidate
content-type: image/gif
content-length: 70

GET
H2

204

setuid
aas.dc-1.net/
Redirect Chain

https://ap.lijit.com/pixel?redir=https%3A%2F%2Faas.dc-1.net%2Fsetuid%3FA%3Dece9205e-dc04-4ae6-a2be-d426a0b775ae%26D%3D%26bidder%3Dsovrn%26uid%3D%24UID
https://aas.dc-1.net/setuid?A=ece9205e-dc04-4ae6-a2be-d426a0b775ae&D=&bidder=sovrn&uid=5c77613319777788922ea239

0
193 B

312ms
103ms

Image
text/plain

52.5.29.22
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://aas.dc-1.net/setuid?A=ece9205e-dc04-4ae6-a2be-d426a0b775ae&D=&bidder=sovrn&uid=5c77613319777788922ea239
Requested by: Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.5.29.22 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-5-29-22.compute-1.amazonaws.com
Software: Cowboy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 204
date: Wed, 09 Sep 2020 16:11:52 GMT
cache-control: max-age=0, private, must-revalidate
server: Cowboy

Redirect headers

Date: Wed, 09 Sep 2020 16:11:52 GMT
Server: nginx
Location: https://aas.dc-1.net/setuid?A=ece9205e-dc04-4ae6-a2be-d426a0b775ae&D=&bidder=sovrn&uid=5c77613319777788922ea239
Access-Control-Allow-Methods: GET, POST, DELETE, PUT
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: true
X-Sovrn-Pod: ad_ap3ams1
Access-Control-Allow-Headers: X-Requested-With, Content-Type
Content-Length: 0

GET
H2 204 sync
pixel.advertising.com/ups/56465/ 0
124 B 28ms
23ms Image
text/plain 35.156.153.71
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pixel.advertising.com/ups/56465/sync?_origin=0&redir=true&gdpr=1&gdpr_consent=

Requested by

Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

35.156.153.71 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-35-156-153-71.eu-central-1.compute.amazonaws.com

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 204
date: Wed, 09 Sep 2020 16:11:52 GMT
strict-transport-security: max-age=31536000
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H2

204

setuid
aas.dc-1.net/
Redirect Chain

https://ssum.casalemedia.com/usermatchredir?s=191503&cb=https%3A%2F%2Faas.dc-1.net%2Fsetuid%3FA%3Dece9205e-dc04-4ae6-a2be-d426a0b775ae%26D%3D%26bidder%3Dindex_rtb%26uid%3D
https://aas.dc-1.net/setuid?A=ece9205e-dc04-4ae6-a2be-d426a0b775ae&D=&bidder=index_rtb&uid=X1j.x7lQJvgAAD2cFXoAAAAD%261185

0
193 B

105ms
104ms

Image
text/plain

52.5.29.22
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://aas.dc-1.net/setuid?A=ece9205e-dc04-4ae6-a2be-d426a0b775ae&D=&bidder=index_rtb&uid=X1j.x7lQJvgAAD2cFXoAAAAD%261185
Requested by: Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.5.29.22 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-5-29-22.compute-1.amazonaws.com
Software: Cowboy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 204
date: Wed, 09 Sep 2020 16:11:53 GMT
cache-control: max-age=0, private, must-revalidate
server: Cowboy

Redirect headers

Pragma: no-cache
Date: Wed, 09 Sep 2020 16:11:53 GMT
Server: Apache
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Location: https://aas.dc-1.net/setuid?A=ece9205e-dc04-4ae6-a2be-d426a0b775ae&D=&bidder=index_rtb&uid=X1j.x7lQJvgAAD2cFXoAAAAD%261185
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: text/html; charset=iso-8859-1
Content-Length: 318
Expires: Wed, 09 Sep 2020 16:11:53 GMT

GET
H2

204

sync
pixel.advertising.com/ups/55965/
Redirect Chain

https://pixel.quantserve.com/pixel/p-NcBg8UA4xqUFp.gif?idmatch=0&gdpr=1&gdpr_consent=
https://pixel.advertising.com/ups/55965/sync?_origin=0&gdpr=1&uid=SF6dZBtdy2lQAM4-SF2FPUkNzT5QWs1oTQgLhLkM

0
124 B

24ms
23ms

Image
text/plain

35.156.153.71
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pixel.advertising.com/ups/55965/sync?_origin=0&gdpr=1&uid=SF6dZBtdy2lQAM4-SF2FPUkNzT5QWs1oTQgLhLkM

Requested by

Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

35.156.153.71 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-35-156-153-71.eu-central-1.compute.amazonaws.com

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 204
date: Wed, 09 Sep 2020 16:11:52 GMT
strict-transport-security: max-age=31536000
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

Redirect headers

pragma: no-cache
date: Wed, 09 Sep 2020 16:11:52 GMT
status: 302
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
location: https://pixel.advertising.com/ups/55965/sync?_origin=0&gdpr=1&uid=SF6dZBtdy2lQAM4-SF2FPUkNzT5QWs1oTQgLhLkM
cache-control: private, no-cache, no-store, proxy-revalidate
strict-transport-security: max-age=86400
content-length: 0
expires: Fri, 04 Aug 1978 12:00:00 GMT

POST
H/1.1 200
OK liveMatching.php Show response
live.sekindo.com/live/ Frame 9723 0
419 B 85ms
52ms XHR
text/html 185.220.204.204
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to

Full URL: https://live.sekindo.com/live/liveMatching.php
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/live/liveVideo.php?vpaidManager=sekindo&s=58057&ri=6C69766553746174737C736B317B54307D7B64323032302D30392D30395F31397D7B7331323334383830387D7B4335387D7B53644768795A5746306347397A6443356A6232303D7D7B626368726F6D657D7B716465736B746F707D7B6F6D61636F73787D7B583330307D7B593235307D7B66317D7B4C363631357DFEFE&userIpAddr=185.217.171.12&userUA=Mozilla%2F5.0+%28Macintosh%3B+Intel+Mac+OS+X+10_14_5%29+AppleWebKit%2F537.36+%28KHTML%2C+like+Gecko%29+Chrome%2F83.0.4103.61+Safari%2F537.36&debugInformation=&isWePassGdpr=0&schain=1.0%2C1%21admetricspro.com%2C1005%2C1&noViewableMidrollPolicy=vary&isDoublePreroll=1&autoSkipVideoSec=30&c2pWaitTime=10&csuuid=5f58fec4dc913&debugInfo=12348808_&debugPlayerSession=&pubUrlDEMO=&sta=12348808&showLogo=0&clkUrl=&plMult=-1&schedule=eyJwcmVfcm9sbCI6MSwibWlkX3JvbGwiOltdLCJnYXAiOiJhdXRvIn0%3D&content=plembed173akunvrojp&secondaryContent=&x=300&y=250&pubUrl=https%3A%2F%2Fthreatpost.com%2Fshlayer-mac-malware-extra-sneakiness%2F156669%2F%3Fweb_view%3Dtrue&contentNum=1&flow_closeBtn=1&flowCloseTimeout=0&flow_closeButtonPosition=right&flow_direction=br&flow_horizontalOffset=10&flow_bottomOffset=10&impGap=2&flow_width=320&flow_height=180&videoType=flow&gdpr=1&gdprConsent=&contentFeedId=&geoLati=52.069&geoLong=5.1024&vpTemplate=6615&flowMode=both&isRealPreroll=0&playerApiId=&isApp=0&ccpa=0&ccpaConsent=
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 185.220.204.204 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, GB),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-type: application/x-www-form-urlencoded

Response headers

pragma: no-cache
date: Wed, 09 Sep 2020 16:11:53 GMT
content-encoding: gzip
server: nginx
age: 0
transfer-encoding: chunked
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
cache-control: no-store

GET
H/1.1 200
OK liveView.php
live.sekindo.com/live/ 0
353 B 21ms
21ms Image
text/html 185.220.204.204
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://live.sekindo.com/live/liveView.php?njs=1&ito=1&vid_event=42&serverTime=1599667909&vid_playerVer=3.1.0&s=101281&sta=0&x=300&y=250&vid_passDomain=threatpost.com&subId=threatpost.com&debugInformation=&isApp=0&userIpAddr=185.217.171.12&userUA=Mozilla%2F5.0%20%28Macintosh%3B%20Intel%20Mac%20OS%20X%2010_14_5%29%20AppleWebKit%2F537.36%20%28KHTML%2C%20like%20Gecko%29%20Chrome%2F83.0.4103.61%20Safari%2F537.36&csuuid=5f58fec4dc913&contentFileId=0&mediaPlayListId=0&mediaListId=0&dur=500&viewPct={%22w%22:0,%22h%22:0}&cbuster=1599667914365&gdpr=1&gdprConsent=&isWePassGdpr=0&ccpa=0&ccpaConsent=&uid=SekindoSPlayer5f58fec5149c6&pubUrl=https%3A%2F%2Fthreatpost.com%2Fshlayer-mac-malware-extra-sneakiness%2F156669%2F%3Fweb_view%3Dtrue&floatStatus=true
Requested by: Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 185.220.204.204 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, GB),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 09 Sep 2020 16:11:54 GMT
content-encoding: gzip
server: nginx
age: 0
transfer-encoding: chunked
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
access-control-allow-origin: *
cache-control: no-store
content-type: text/html; charset=UTF-8

POST
H/1.1 204
No Content openrtb Show response
ads.adaptv.advertising.com/rtb/ Frame 9723 0
215 B 103ms
39ms XHR
application/json 18.197.185.70
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.adaptv.advertising.com/rtb/openrtb?ext_id=TeachingAidsLLC
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/content/prebid/prebidVid.3.19.0_9.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.197.185.70 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-197-185-70.eu-central-1.compute.amazonaws.com
Software: adaptv/1.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://threatpost.com
access-control-allow-credentials: true
server: adaptv/1.0
Connection: keep-alive
content-length: 0
content-type: application/json

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ Frame 9723 19 B
711 B 703ms
27ms XHR
application/json 37.252.172.36
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: live.sekindo.com
URL: https://live.sekindo.com/content/prebid/prebidVid.3.19.0_9.min.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.172.36 , Ascension Island, ASN29990 (ASN-APPNEX, US),

Reverse DNS

692.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

Software

nginx/1.17.9 /

Resource Hash

0c09c070833c786cb25be38bc30992b30bad578f817dbc9e34beacd8b8ea44c5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Wed, 09 Sep 2020 16:11:57 GMT
X-Proxy-Origin: 185.217.171.12; 185.217.171.12; 692.bm-nginx-loadbalancer.mgmt.fra1; *.adnxs.com; 37.252.172.51:80
AN-X-Request-Uuid: 6fb8c24a-e58d-4ef5-8418-41ce5d0be068
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://threatpost.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json; charset=utf-8
Content-Length: 19
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 204 translator Show response
hbopenbid.pubmatic.com/ Frame 9723 0
59 B 19ms
18ms XHR
text/plain 185.64.189.112
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/content/prebid/prebidVid.3.19.0_9.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.189.112 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

status: 204
date: Wed, 09 Sep 2020 16:11:57 GMT
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
access-control-allow-origin: https://threatpost.com

GET
H/1.1 200
OK cygnus Show response
as-sec.casalemedia.com/ Frame 9723 25 B
673 B 1209ms
144ms XHR
application/json 23.210.249.164
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://as-sec.casalemedia.com/cygnus?s=435870&v=8.1&r={%22id%22:%222722c4f3c7cece6%22,%22imp%22:[{%22id%22:%2228f9ce1ed69abf2%22,%22ext%22:{%22siteID%22:%22435870%22,%22sid%22:%22320x180%22},%22bidfloor%22:1.8,%22bidfloorcur%22:%22USD%22,%22video%22:{%22mimes%22:[%22video/mp4%22,%22application/javascript%22,%22video/webm%22],%22minduration%22:1,%22maxduration%22:200,%22api%22:[1,2],%22protocols%22:[1,2,3,4,5,6],%22linearity%22:1,%22startdelay%22:0,%22skip%22:1,%22w%22:320,%22h%22:180,%22placement%22:1}},{%22id%22:%22297c08514e05a3c%22,%22ext%22:{%22siteID%22:%22435871%22,%22sid%22:%22320x180%22},%22bidfloor%22:1.8,%22bidfloorcur%22:%22USD%22,%22video%22:{%22mimes%22:[%22video/mp4%22,%22application/javascript%22,%22video/webm%22],%22minduration%22:1,%22maxduration%22:200,%22api%22:[1,2],%22protocols%22:[1,2,3,4,5,6],%22linearity%22:1,%22startdelay%22:0,%22skip%22:1,%22w%22:320,%22h%22:180,%22placement%22:1}}],%22site%22:{%22page%22:%22https%3A%2F%2Fthreatpost.com%2Fshlayer-mac-malware-extra-sneakiness%2F156669%2F%3Fweb_view%3Dtrue%22},%22ext%22:{%22source%22:%22prebid%22},%22source%22:{%22ext%22:{%22schain%22:{%22ver%22:%221.0%22,%22complete%22:1,%22nodes%22:[{%22asi%22:%22admetricspro.com%22,%22sid%22:%221005%22,%22hp%22:1}]}}},%22regs%22:{%22ext%22:{%22gdpr%22:1}},%22user%22:{%22ext%22:{%22consent%22:%22%22}}}&ac=j&sd=1&nf=1
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/content/prebid/prebidVid.3.19.0_9.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.210.249.164 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-249-164.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 2b25834a3c81710eb20539a989a9a248e7cf534beb9c33180e89962045dca151

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Wed, 09 Sep 2020 16:11:58 GMT
Content-Encoding: gzip
Server: Apache
Vary: Accept-Encoding
Content-Type: application/json
Access-Control-Allow-Origin: https://threatpost.com
Cache-Control: max-age=0, no-cache, no-store
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 45
Expires: Wed, 09 Sep 2020 16:11:58 GMT

GET
H2 200 avjp Show response
teachingaids-d.openx.net/v/1.0/ Frame 9723 92 B
282 B 30ms
29ms XHR
application/json 35.244.159.8
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://teachingaids-d.openx.net/v/1.0/avjp?ju=https%3A%2F%2Fthreatpost.com%2Fshlayer-mac-malware-extra-sneakiness%2F156669%2F%3Fweb_view%3Dtrue&ch=UTF-8&res=1600x1200x24&ifr=true&tz=-120&tws=1600x1200&be=1&bc=hb_pb_3.0.2&dddid=aaa61b95-1ae5-4d09-a098-c8b324e6906c&nocache=1599667917098&gdpr_consent=&gdpr=1&schain=1.0,1!admetricspro.com,1005,1,,,&skip=1&auid=540882778&vwd=320&vht=180
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/content/prebid/prebidVid.3.19.0_9.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.159.8 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/16.193.0 /
Resource Hash: 004e5faf0bf890f61697daeede9f21826affd1137fb2cb58eaf4719937a04a14

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Wed, 09 Sep 2020 16:11:57 GMT
via: 1.1 google
server: OXGW/16.193.0
status: 200
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: https://threatpost.com
cache-control: private, max-age=0, no-cache
access-control-allow-credentials: true
content-type: application/json
alt-svc: clear
content-length: 92
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H/1.1 200
OK liveView.php
live.sekindo.com/live/ 0
353 B 58ms
27ms Image
text/html 185.220.204.204
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://live.sekindo.com/live/liveView.php?njs=1&ito=1&vid_event=25&serverTime=1599667909&vid_playerVer=3.1.0&s=101281&sta=0&x=300&y=250&vid_passDomain=threatpost.com&subId=threatpost.com&debugInformation=&isApp=0&userIpAddr=185.217.171.12&userUA=Mozilla%2F5.0%20%28Macintosh%3B%20Intel%20Mac%20OS%20X%2010_14_5%29%20AppleWebKit%2F537.36%20%28KHTML%2C%20like%20Gecko%29%20Chrome%2F83.0.4103.61%20Safari%2F537.36&csuuid=5f58fec4dc913&contentFileId=0&mediaPlayListId=0&mediaListId=0&dur=1000&cbuster=1599667919182&gdpr=1&gdprConsent=&isWePassGdpr=0&ccpa=0&ccpaConsent=&uid=SekindoSPlayer5f58fec5149c6&pubUrl=https%3A%2F%2Fthreatpost.com%2Fshlayer-mac-malware-extra-sneakiness%2F156669%2F%3Fweb_view%3Dtrue&floatStatus=true
Requested by: Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 185.220.204.204 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, GB),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 09 Sep 2020 16:11:58 GMT
content-encoding: gzip
server: nginx
age: 0
transfer-encoding: chunked
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
access-control-allow-origin: *
cache-control: no-store
content-type: text/html; charset=UTF-8

POST
H/1.1 204
No Content openrtb Show response
ads.adaptv.advertising.com/rtb/ Frame 9723 0
215 B 67ms
26ms XHR
application/json 18.197.185.70
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.adaptv.advertising.com/rtb/openrtb?ext_id=TeachingAidsLLC
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/content/prebid/prebidVid.3.19.0_9.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.197.185.70 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-197-185-70.eu-central-1.compute.amazonaws.com
Software: adaptv/1.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://threatpost.com
access-control-allow-credentials: true
server: adaptv/1.0
Connection: keep-alive
content-length: 0
content-type: application/json

GET
H/1.1 200
OK cygnus Show response
as-sec.casalemedia.com/ Frame 9723 25 B
673 B 148ms
107ms XHR
application/json 23.210.249.164
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://as-sec.casalemedia.com/cygnus?s=435870&v=8.1&r={%22id%22:%2234960bfe1ca8b9a%22,%22imp%22:[{%22id%22:%22357c434e79afb04%22,%22ext%22:{%22siteID%22:%22435870%22,%22sid%22:%22320x180%22},%22bidfloor%22:1.6,%22bidfloorcur%22:%22USD%22,%22video%22:{%22mimes%22:[%22video/mp4%22,%22application/javascript%22,%22video/webm%22],%22minduration%22:1,%22maxduration%22:200,%22api%22:[1,2],%22protocols%22:[1,2,3,4,5,6],%22linearity%22:1,%22startdelay%22:0,%22skip%22:1,%22w%22:320,%22h%22:180,%22placement%22:1}},{%22id%22:%2236166b3ff847f54%22,%22ext%22:{%22siteID%22:%22435871%22,%22sid%22:%22320x180%22},%22bidfloor%22:1.6,%22bidfloorcur%22:%22USD%22,%22video%22:{%22mimes%22:[%22video/mp4%22,%22application/javascript%22,%22video/webm%22],%22minduration%22:1,%22maxduration%22:200,%22api%22:[1,2],%22protocols%22:[1,2,3,4,5,6],%22linearity%22:1,%22startdelay%22:0,%22skip%22:1,%22w%22:320,%22h%22:180,%22placement%22:1}}],%22site%22:{%22page%22:%22https%3A%2F%2Fthreatpost.com%2Fshlayer-mac-malware-extra-sneakiness%2F156669%2F%3Fweb_view%3Dtrue%22},%22ext%22:{%22source%22:%22prebid%22},%22source%22:{%22ext%22:{%22schain%22:{%22ver%22:%221.0%22,%22complete%22:1,%22nodes%22:[{%22asi%22:%22admetricspro.com%22,%22sid%22:%221005%22,%22hp%22:1}]}}},%22regs%22:{%22ext%22:{%22gdpr%22:1}},%22user%22:{%22ext%22:{%22consent%22:%22%22}}}&ac=j&sd=1&nf=1
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/content/prebid/prebidVid.3.19.0_9.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.210.249.164 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-249-164.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 9fb2e1ccc0fcdf99c9a1e0a2d2b4e4856573b245aa81244be6f9351f7745582c

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Wed, 09 Sep 2020 16:11:59 GMT
Content-Encoding: gzip
Server: Apache
Vary: Accept-Encoding
Content-Type: application/json
Access-Control-Allow-Origin: https://threatpost.com
Cache-Control: max-age=0, no-cache, no-store
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 45
Expires: Wed, 09 Sep 2020 16:11:59 GMT

GET
H2 200 avjp Show response
teachingaids-d.openx.net/v/1.0/ Frame 9723 92 B
282 B 75ms
73ms XHR
application/json 35.244.159.8
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://teachingaids-d.openx.net/v/1.0/avjp?ju=https%3A%2F%2Fthreatpost.com%2Fshlayer-mac-malware-extra-sneakiness%2F156669%2F%3Fweb_view%3Dtrue&ch=UTF-8&res=1600x1200x24&ifr=true&tz=-120&tws=1600x1200&be=1&bc=hb_pb_3.0.2&dddid=0c3ba951-4873-4e55-bf74-b9123f404ea1&nocache=1599667919376&gdpr_consent=&gdpr=1&schain=1.0,1!admetricspro.com,1005,1,,,&skip=1&auid=540882778&vwd=320&vht=180
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/content/prebid/prebidVid.3.19.0_9.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.159.8 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/16.193.0 /
Resource Hash: 004e5faf0bf890f61697daeede9f21826affd1137fb2cb58eaf4719937a04a14

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Wed, 09 Sep 2020 16:11:59 GMT
via: 1.1 google
server: OXGW/16.193.0
status: 200
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: https://threatpost.com
cache-control: private, max-age=0, no-cache
access-control-allow-credentials: true
content-type: application/json
alt-svc: clear
content-length: 92
expires: Mon, 26 Jul 1997 05:00:00 GMT

POST
H2 204 translator Show response
hbopenbid.pubmatic.com/ Frame 9723 0
59 B 20ms
19ms XHR
text/plain 185.64.189.112
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/content/prebid/prebidVid.3.19.0_9.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.189.112 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

status: 204
date: Wed, 09 Sep 2020 16:11:59 GMT
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
access-control-allow-origin: https://threatpost.com

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ Frame 9723 19 B
867 B 69ms
27ms XHR
application/json 37.252.172.36
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: live.sekindo.com
URL: https://live.sekindo.com/content/prebid/prebidVid.3.19.0_9.min.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.172.36 , Ascension Island, ASN29990 (ASN-APPNEX, US),

Reverse DNS

692.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

Software

nginx/1.17.9 /

Resource Hash

0c09c070833c786cb25be38bc30992b30bad578f817dbc9e34beacd8b8ea44c5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Wed, 09 Sep 2020 16:11:59 GMT
X-Proxy-Origin: 185.217.171.12; 185.217.171.12; 692.bm-nginx-loadbalancer.mgmt.fra1; *.adnxs.com; 37.252.172.187:80
AN-X-Request-Uuid: c39d7218-9af1-46df-8987-6332eee00b51
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://threatpost.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json; charset=utf-8
Content-Length: 19
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1 200
OK liveView.php
live.sekindo.com/live/ 43 B
437 B 25ms
24ms Image
image/gif 185.220.204.204
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://live.sekindo.com/live/liveView.php?njs=1&ito=1&vid_event=6&serverTime=1599667909&vid_playerVer=3.1.0&s=58057&sta=12381421&x=320&y=180&msta=12348808&vid_vastType=3&vid_viewabilityState=1&vid_passDomain=threatpost.com&subId=threatpost.com&debugInformation=&isApp=0&userIpAddr=185.217.171.12&userUA=Mozilla%2F5.0%20%28Macintosh%3B%20Intel%20Mac%20OS%20X%2010_14_5%29%20AppleWebKit%2F537.36%20%28KHTML%2C%20like%20Gecko%29%20Chrome%2F83.0.4103.61%20Safari%2F537.36&csuuid=5f58fec4dc913&rvn=${VP_RVN_MACRO}&attemptMultiplier=10&contentFileId=0&mediaPlayListId=0&mediaListId=0&cbuster=1599667919370&gdpr=1&gdprConsent=&isWePassGdpr=0&ccpa=0&ccpaConsent=&uid=SekindoSPlayer5f58fec5149c6&pubUrl=https%3A%2F%2Fthreatpost.com%2Fshlayer-mac-malware-extra-sneakiness%2F156669%2F%3Fweb_view%3Dtrue&floatStatus=true
Requested by: Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 185.220.204.204 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, GB),
Reverse DNS
Software: nginx /
Resource Hash: 42b976597a2d977d0e300f6d06bc903db389e5c112d33c1c8c249690a522d9f2

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 09 Sep 2020 16:11:58 GMT
server: nginx
age: 0
transfer-encoding: chunked
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
access-control-allow-origin: *
cache-control: max-age=315360000
content-disposition: inline; filename="pixel.gif"
content-type: image/gif
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H/1.1 200
OK liveView.php
live.sekindo.com/live/ 0
353 B 44ms
21ms Image
text/html 185.220.204.204
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://live.sekindo.com/live/liveView.php?njs=1&ito=1&vid_event=42&serverTime=1599667909&vid_playerVer=3.1.0&s=101281&sta=0&x=300&y=250&vid_passDomain=threatpost.com&subId=threatpost.com&debugInformation=&isApp=0&userIpAddr=185.217.171.12&userUA=Mozilla%2F5.0%20%28Macintosh%3B%20Intel%20Mac%20OS%20X%2010_14_5%29%20AppleWebKit%2F537.36%20%28KHTML%2C%20like%20Gecko%29%20Chrome%2F83.0.4103.61%20Safari%2F537.36&csuuid=5f58fec4dc913&contentFileId=0&mediaPlayListId=0&mediaListId=0&dur=502&viewPct={%22w%22:0,%22h%22:0}&cbuster=1599667919380&gdpr=1&gdprConsent=&isWePassGdpr=0&ccpa=0&ccpaConsent=&uid=SekindoSPlayer5f58fec5149c6&pubUrl=https%3A%2F%2Fthreatpost.com%2Fshlayer-mac-malware-extra-sneakiness%2F156669%2F%3Fweb_view%3Dtrue&floatStatus=true
Requested by: Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 185.220.204.204 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, GB),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 09 Sep 2020 16:11:59 GMT
content-encoding: gzip
server: nginx
age: 0
transfer-encoding: chunked
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
access-control-allow-origin: *
cache-control: no-store
content-type: text/html; charset=UTF-8

GET
H/1.1 200
OK chunklist_480.m3u8 Show response
video.sekindo.com/uploads/cn7/video/users/hls/24485/video1523972806/vid5f508425c816b126612114.mp4/ 2 KB
3 KB 83ms
20ms XHR
application/vnd.apple.mpegurl 45.83.41.102
CLOUDWEBMANAGE-IL-FR

General

Check archive.org

Show headers Download Go to

Full URL: https://video.sekindo.com/uploads/cn7/video/users/hls/24485/video1523972806/vid5f508425c816b126612114.mp4/chunklist_480.m3u8
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/content/video/hls/hls.0.12.4_2.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 45.83.41.102 Frankfurt am Main, Germany, ASN204548 (CLOUDWEBMANAGE-IL-FR, GB),
Reverse DNS
Software: Tengine /
Resource Hash: 7d00448f30b7a32c1678cd5407922646b360ae43e2f101551d00cb7ff428999a

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Wed, 09 Sep 2020 16:11:35 GMT
last-modified: Sun, 06 Sep 2020 22:32:33 GMT
Server: Tengine
etag: "5f556381-977"
Content-Type: application/vnd.apple.mpegurl
access-control-allow-origin: *
expires: Wed, 16 Sep 2020 16:11:35 GMT
cache-control: max-age=604800
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=25
Content-Length: 2423
X-Proxy-Cache: HIT

GET
H/1.1 200
OK w_480_00000.ts Show response
video.sekindo.com/uploads/cn7/video/users/hls/24485/video1523972806/vid5f508425c816b126612114.mp4/ 264 KB
264 KB 28ms
28ms XHR
video/mp2t 45.83.41.102
CLOUDWEBMANAGE-IL-FR

General

Check archive.org

Show headers Download Go to

Full URL: https://video.sekindo.com/uploads/cn7/video/users/hls/24485/video1523972806/vid5f508425c816b126612114.mp4/w_480_00000.ts
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/content/video/hls/hls.0.12.4_2.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 45.83.41.102 Frankfurt am Main, Germany, ASN204548 (CLOUDWEBMANAGE-IL-FR, GB),
Reverse DNS
Software: Tengine /
Resource Hash: 5ac87169a981f2044e9085326079de27da30a84cfe2b97c2d038a2f4f653eb18

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Wed, 09 Sep 2020 16:11:35 GMT
last-modified: Sun, 06 Sep 2020 22:32:35 GMT
Server: Tengine
etag: "5f556383-42008"
Content-Type: video/mp2t
access-control-allow-origin: *
expires: Wed, 16 Sep 2020 16:11:35 GMT
cache-control: max-age=604800
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=25
Content-Length: 270344
X-Proxy-Cache: HIT

GET
BLOB 200
OK 6f7cb732-545c-4dd4-8b4e-668bf131170f
https://threatpost.com/ 65 KB
0 Other
text/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://threatpost.com/6f7cb732-545c-4dd4-8b4e-668bf131170f
Requested by: Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: d2dffba8a31eb663c59a5494783cbf197c182104edc58f0c0a17b7992429d7af

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Length: 66258
Content-Type: text/javascript

GET
H/1.1 200
OK w_480_00001.ts Show response
video.sekindo.com/uploads/cn7/video/users/hls/24485/video1523972806/vid5f508425c816b126612114.mp4/ 246 KB
247 KB 22ms
22ms XHR
video/mp2t 45.83.41.102
CLOUDWEBMANAGE-IL-FR

General

Check archive.org

Show headers Download Go to

Full URL: https://video.sekindo.com/uploads/cn7/video/users/hls/24485/video1523972806/vid5f508425c816b126612114.mp4/w_480_00001.ts
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/content/video/hls/hls.0.12.4_2.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 45.83.41.102 Frankfurt am Main, Germany, ASN204548 (CLOUDWEBMANAGE-IL-FR, GB),
Reverse DNS
Software: Tengine /
Resource Hash: ad3c31c7ea482ad4425499b5fe3ffb4a7e0ab73d69112eb707cba1bada9dfcb9

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Wed, 09 Sep 2020 16:11:35 GMT
last-modified: Sun, 06 Sep 2020 22:32:35 GMT
Server: Tengine
etag: "5f556383-3d8cc"
Content-Type: video/mp2t
access-control-allow-origin: *
expires: Wed, 16 Sep 2020 16:11:35 GMT
cache-control: max-age=604800
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=25
Content-Length: 252108
X-Proxy-Cache: HIT

GET
H/1.1 200
OK liveView.php
live.sekindo.com/live/ 0
353 B 22ms
21ms Image
text/html 185.220.204.204
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://live.sekindo.com/live/liveView.php?njs=1&ito=1&vid_event=16&serverTime=1599667909&vid_playerVer=3.1.0&s=0&sta=12348808&x=320&y=180&vid_passDomain=threatpost.com&subId=threatpost.com&debugInformation=&isApp=0&userIpAddr=185.217.171.12&userUA=Mozilla%2F5.0%20%28Macintosh%3B%20Intel%20Mac%20OS%20X%2010_14_5%29%20AppleWebKit%2F537.36%20%28KHTML%2C%20like%20Gecko%29%20Chrome%2F83.0.4103.61%20Safari%2F537.36&csuuid=5f58fec4dc913&contentFileId=988715&mediaPlayListId=5946&mediaListId=0&contentMatchType=&isExcludeFromOpt=0&cbuster=1599667919740&gdpr=1&gdprConsent=&isWePassGdpr=0&ccpa=0&ccpaConsent=&uid=SekindoSPlayer5f58fec5149c6&pubUrl=https%3A%2F%2Fthreatpost.com%2Fshlayer-mac-malware-extra-sneakiness%2F156669%2F%3Fweb_view%3Dtrue&floatStatus=true
Requested by: Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 185.220.204.204 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, GB),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 09 Sep 2020 16:11:59 GMT
content-encoding: gzip
server: nginx
age: 0
transfer-encoding: chunked
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
access-control-allow-origin: *
cache-control: no-store
content-type: text/html; charset=UTF-8

GET
H/1.1 200
OK w_480_00002.ts Show response
video.sekindo.com/uploads/cn7/video/users/hls/24485/video1523972806/vid5f508425c816b126612114.mp4/ 202 KB
202 KB 22ms
22ms XHR
video/mp2t 45.83.41.102
CLOUDWEBMANAGE-IL-FR

General

Check archive.org

Show headers Download Go to

Full URL: https://video.sekindo.com/uploads/cn7/video/users/hls/24485/video1523972806/vid5f508425c816b126612114.mp4/w_480_00002.ts
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/content/video/hls/hls.0.12.4_2.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 45.83.41.102 Frankfurt am Main, Germany, ASN204548 (CLOUDWEBMANAGE-IL-FR, GB),
Reverse DNS
Software: Tengine /
Resource Hash: 1ce473be690c2fb6095c2a60a1f587286f0ac9ea76adf96dafe011d8c155cdf2

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Wed, 09 Sep 2020 16:11:35 GMT
last-modified: Sun, 06 Sep 2020 22:32:35 GMT
Server: Tengine
etag: "5f556383-32658"
Content-Type: video/mp2t
access-control-allow-origin: *
expires: Wed, 16 Sep 2020 16:11:35 GMT
cache-control: max-age=604800
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=25
Content-Length: 206424
X-Proxy-Cache: HIT

GET
H/1.1 200
OK w_480_00003.ts Show response
video.sekindo.com/uploads/cn7/video/users/hls/24485/video1523972806/vid5f508425c816b126612114.mp4/ 207 KB
207 KB 22ms
22ms XHR
video/mp2t 45.83.41.102
CLOUDWEBMANAGE-IL-FR

General

Check archive.org

Show headers Download Go to

Full URL: https://video.sekindo.com/uploads/cn7/video/users/hls/24485/video1523972806/vid5f508425c816b126612114.mp4/w_480_00003.ts
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/content/video/hls/hls.0.12.4_2.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 45.83.41.102 Frankfurt am Main, Germany, ASN204548 (CLOUDWEBMANAGE-IL-FR, GB),
Reverse DNS
Software: Tengine /
Resource Hash: 04e4a80e68cc9a6e075037c848f6dd13f5b29d7784c1262297729838cf55d06b

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Wed, 09 Sep 2020 16:11:35 GMT
last-modified: Sun, 06 Sep 2020 22:32:35 GMT
Server: Tengine
etag: "5f556383-33c60"
Content-Type: video/mp2t
access-control-allow-origin: *
expires: Wed, 16 Sep 2020 16:11:35 GMT
cache-control: max-age=604800
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=25
Content-Length: 212064
X-Proxy-Cache: HIT

GET
H/1.1 200
OK w_480_00004.ts Show response
video.sekindo.com/uploads/cn7/video/users/hls/24485/video1523972806/vid5f508425c816b126612114.mp4/ 206 KB
207 KB 22ms
21ms XHR
video/mp2t 45.83.41.102
CLOUDWEBMANAGE-IL-FR

General

Check archive.org

Show headers Download Go to

Full URL: https://video.sekindo.com/uploads/cn7/video/users/hls/24485/video1523972806/vid5f508425c816b126612114.mp4/w_480_00004.ts
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/content/video/hls/hls.0.12.4_2.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 45.83.41.102 Frankfurt am Main, Germany, ASN204548 (CLOUDWEBMANAGE-IL-FR, GB),
Reverse DNS
Software: Tengine /
Resource Hash: 89e25584c442b1d3d12d218853f50a47951a828946e04aad76dbaf4a86c80acf

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Wed, 09 Sep 2020 16:11:35 GMT
last-modified: Sun, 06 Sep 2020 22:32:35 GMT
Server: Tengine
etag: "5f556383-33970"
Content-Type: video/mp2t
access-control-allow-origin: *
expires: Wed, 16 Sep 2020 16:11:35 GMT
cache-control: max-age=604800
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=25
Content-Length: 211312
X-Proxy-Cache: HIT

GET
H/1.1 200
OK w_480_00005.ts Show response
video.sekindo.com/uploads/cn7/video/users/hls/24485/video1523972806/vid5f508425c816b126612114.mp4/ 200 KB
200 KB 22ms
22ms XHR
video/mp2t 45.83.41.102
CLOUDWEBMANAGE-IL-FR

General

Check archive.org

Show headers Download Go to

Full URL: https://video.sekindo.com/uploads/cn7/video/users/hls/24485/video1523972806/vid5f508425c816b126612114.mp4/w_480_00005.ts
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/content/video/hls/hls.0.12.4_2.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 45.83.41.102 Frankfurt am Main, Germany, ASN204548 (CLOUDWEBMANAGE-IL-FR, GB),
Reverse DNS
Software: Tengine /
Resource Hash: cc0a2c0ac7432d5c47b0bfa5df2e747840c452315813c22c9f7c5fef27426125

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Wed, 09 Sep 2020 16:11:35 GMT
last-modified: Sun, 06 Sep 2020 22:32:35 GMT
Server: Tengine
etag: "5f556383-31e44"
Content-Type: video/mp2t
access-control-allow-origin: *
expires: Wed, 16 Sep 2020 16:11:35 GMT
cache-control: max-age=604800
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=25
Content-Length: 204356
X-Proxy-Cache: HIT

GET
H/1.1 200
OK liveView.php
live.sekindo.com/live/ 0
353 B 40ms
23ms Image
text/html 185.220.204.204
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://live.sekindo.com/live/liveView.php?njs=1&ito=1&vid_event=42&serverTime=1599667909&vid_playerVer=3.1.0&s=101281&sta=0&x=300&y=250&vid_passDomain=threatpost.com&subId=threatpost.com&debugInformation=&isApp=0&userIpAddr=185.217.171.12&userUA=Mozilla%2F5.0%20%28Macintosh%3B%20Intel%20Mac%20OS%20X%2010_14_5%29%20AppleWebKit%2F537.36%20%28KHTML%2C%20like%20Gecko%29%20Chrome%2F83.0.4103.61%20Safari%2F537.36&csuuid=5f58fec4dc913&contentFileId=0&mediaPlayListId=0&mediaListId=0&dur=499&viewPct={%22w%22:0,%22h%22:0}&cbuster=1599667924367&gdpr=1&gdprConsent=&isWePassGdpr=0&ccpa=0&ccpaConsent=&uid=SekindoSPlayer5f58fec5149c6&pubUrl=https%3A%2F%2Fthreatpost.com%2Fshlayer-mac-malware-extra-sneakiness%2F156669%2F%3Fweb_view%3Dtrue&floatStatus=true
Requested by: Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 185.220.204.204 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, GB),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 09 Sep 2020 16:12:04 GMT
content-encoding: gzip
server: nginx
age: 0
transfer-encoding: chunked
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
access-control-allow-origin: *
cache-control: no-store
content-type: text/html; charset=UTF-8

GET
H/1.1 200
OK w_480_00006.ts Show response
video.sekindo.com/uploads/cn7/video/users/hls/24485/video1523972806/vid5f508425c816b126612114.mp4/ 213 KB
214 KB 28ms
27ms XHR
video/mp2t 45.83.41.102
CLOUDWEBMANAGE-IL-FR

General

Check archive.org

Show headers Download Go to

Full URL: https://video.sekindo.com/uploads/cn7/video/users/hls/24485/video1523972806/vid5f508425c816b126612114.mp4/w_480_00006.ts
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/content/video/hls/hls.0.12.4_2.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 45.83.41.102 Frankfurt am Main, Germany, ASN204548 (CLOUDWEBMANAGE-IL-FR, GB),
Reverse DNS
Software: Tengine /
Resource Hash: eaddfae170836731fb5febe739b695dd232c478278ab70a79e70429203d676f3

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Wed, 09 Sep 2020 16:11:41 GMT
last-modified: Sun, 06 Sep 2020 22:32:35 GMT
Server: Tengine
etag: "5f556383-35558"
Content-Type: video/mp2t
access-control-allow-origin: *
expires: Wed, 16 Sep 2020 16:11:41 GMT
cache-control: max-age=604800
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=25
Content-Length: 218456
X-Proxy-Cache: HIT

GET
H2 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 8 KB
7 KB 37ms
18ms XHR
application/json 2a00:1450:4001:814::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=2020090201&st=env

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020090201.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:814::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d6146cecea5909786af7e054d8bbc151de07443f394fd7b26732d2bf6b10cd8e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 09 Sep 2020 16:12:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
status: 200
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 6362
x-xss-protection: 0

GET
H2 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 14 KB
6 KB 14ms
13ms Script
text/javascript 2a00:1450:4001:820::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:820::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

08f50e9e70388c99977ca13b6af3a49f8f48c83e79230d51ea72a56c0735bd0c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 09 Sep 2020 16:12:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1591403518460474"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5540
x-xss-protection: 0
expires: Wed, 09 Sep 2020 16:12:08 GMT

GET
H3-Q050 200 runner.html
tpc.googlesyndication.com/sodar/sodar2/210/ Frame 4186 0
0 6ms
6ms Document
text/html 2a00:1450:4001:820::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/210/runner.html

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:820::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/sodar2/210/runner.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Response headers

status: 200
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
content-length: 4590
date: Wed, 09 Sep 2020 15:26:22 GMT
expires: Thu, 09 Sep 2021 15:26:22 GMT
last-modified: Wed, 26 Feb 2020 19:47:50 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 2746
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-Q050 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
184 B 41ms
41ms Image
image/gif 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=210&t=2&li=gpt_2020090201&jk=2293265400039676&bg=!T0ylTFRYycwLEkztAp4CAAAAQFIAAAANCgIHAvWKkLkEtS8gLo98Je_5aEJBM19L_Du-7f7J9B79zy0tEJnwoZpOLns3epVjsSEpuf4p0e754rowVlKoB3mMe3T-juXdzNesQQo8QYZt-EeNI0Umehu1bXhBuYfGO_YDYbNviHk3lHG36nSAE0-4lcifQ1HIa4z3Jh711cKfORjDQIE5ksCw9ZRbYyJX2WmqEmql0gGOLFHCpNNfghqbbT_F3KhzLZuTTV8EC26_bsGDhnZny2APMn3jS4J2eKCc4Q3GFieydEgW0yCrVuBf2mSfpHF-Ue6a-KMyYWZEzZqN-YnPyHdR-Wh0xG_9U1-1EM43YD30BCkrDcFzxbEvXkL-qjoBzd6lBCz8qDIXz86sEh-RBBtWUYOHl3qDk82z_G-LpTVaqDtNhgUBwHzZyurHq6VTS2rD9cuY2rmDpLTQUOfWWxplU-lhTpmotummT6MwM8D0jGvA23pfEOVsgh46cvrjs9srqp9NuqgjYqbjMakCRVs2uZ6RQlx7u4dc_jLP01oe4QqCLJGkCOjXte1g5AUzFAPRu-d57l6aPqzJ16p-pCklQk3-CUhnagtscA0XNtg2UYom8DSZ2ZIU1xq3c9UnV7F8pXha4GvIKqQMTR73sVK5nwekJT3ekZZGZO8r7Txt_hUkHEGsv1JzGli9IDiNxFln5b1CVsUMk4WRP-f9mU4nmQGn6SuLJ10_lsibCGoMAisvZ1DPR4Zdwd6ZA7KAA_Rvf3r8BadY9YWs7Q_ep77uo-4qWG__XQkW6tlzXDE7nkowIb2DIJLvPmQtA3Mlm0iSP7Yt4uN97T1G66-B0Fk7vtTC3gB1BRGA708iOFxhCEaK_Nr_199QJ1GU7aO6laOwgZMFu7NhzPSHDzBdJRa5AyuC5yCq78he4EQwI-ZYsPTQ5pA2SUlfOqA7O2ROry78ZOlN0TMB5_BQozQ8AtV3JbrdLX5iD_dU-XYbM9wzbMlW9Orjz8pWHRpZQC20GnqweHgA1hfKBsgcsGJf30afdDFkb-HKhgDp9gu0QB2zWI7_15CJJb1DWqPx8aLB81Ya2HQy9qGz5_JgDtuREKzCr2bT-gNmiu9iNTB7pVlatYVdHFTs2UVm8iNlDwuDwRFZ4V9lChtzZ3Wi1rwIV8CRhAlPJWINB21SAj-VNVy351KBmgJ_OjWjNqviGDlbh_FqUxdiz4KLiL-9oKhjdLKQkEQ5xTbRhwtN4EtvENcc88FEE_2_hEkc5lhBpJt_Ybgjr3F15jau8TL-

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 09 Sep 2020 16:12:08 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 204
cache-control: no-cache, must-revalidate
content-type: image/gif
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK liveView.php
live.sekindo.com/live/ 0
353 B 26ms
26ms Image
text/html 185.220.204.204
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://live.sekindo.com/live/liveView.php?njs=1&ito=1&vid_event=25&serverTime=1599667909&vid_playerVer=3.1.0&s=101281&sta=0&x=300&y=250&vid_passDomain=threatpost.com&subId=threatpost.com&debugInformation=&isApp=0&userIpAddr=185.217.171.12&userUA=Mozilla%2F5.0%20%28Macintosh%3B%20Intel%20Mac%20OS%20X%2010_14_5%29%20AppleWebKit%2F537.36%20%28KHTML%2C%20like%20Gecko%29%20Chrome%2F83.0.4103.61%20Safari%2F537.36&csuuid=5f58fec4dc913&contentFileId=0&mediaPlayListId=0&mediaListId=0&dur=1000&cbuster=1599667929182&gdpr=1&gdprConsent=&isWePassGdpr=0&ccpa=0&ccpaConsent=&uid=SekindoSPlayer5f58fec5149c6&pubUrl=https%3A%2F%2Fthreatpost.com%2Fshlayer-mac-malware-extra-sneakiness%2F156669%2F%3Fweb_view%3Dtrue&floatStatus=true
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 185.220.204.204 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, GB),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 09 Sep 2020 16:12:08 GMT
content-encoding: gzip
server: nginx
age: 0
transfer-encoding: chunked
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
access-control-allow-origin: *
cache-control: no-store
content-type: text/html; charset=UTF-8

GET
H/1.1 200
OK liveView.php
live.sekindo.com/live/ 0
353 B 23ms
23ms Image
text/html 185.220.204.204
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://live.sekindo.com/live/liveView.php?njs=1&ito=1&vid_event=42&serverTime=1599667909&vid_playerVer=3.1.0&s=101281&sta=0&x=300&y=250&vid_passDomain=threatpost.com&subId=threatpost.com&debugInformation=&isApp=0&userIpAddr=185.217.171.12&userUA=Mozilla%2F5.0%20%28Macintosh%3B%20Intel%20Mac%20OS%20X%2010_14_5%29%20AppleWebKit%2F537.36%20%28KHTML%2C%20like%20Gecko%29%20Chrome%2F83.0.4103.61%20Safari%2F537.36&csuuid=5f58fec4dc913&contentFileId=0&mediaPlayListId=0&mediaListId=0&dur=500&viewPct={%22w%22:0,%22h%22:0}&cbuster=1599667929365&gdpr=1&gdprConsent=&isWePassGdpr=0&ccpa=0&ccpaConsent=&uid=SekindoSPlayer5f58fec5149c6&pubUrl=https%3A%2F%2Fthreatpost.com%2Fshlayer-mac-malware-extra-sneakiness%2F156669%2F%3Fweb_view%3Dtrue&floatStatus=true
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 185.220.204.204 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, GB),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 09 Sep 2020 16:12:09 GMT
content-encoding: gzip
server: nginx
age: 0
transfer-encoding: chunked
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
access-control-allow-origin: *
cache-control: no-store
content-type: text/html; charset=UTF-8

POST
H/1.1 204
No Content openrtb Show response
ads.adaptv.advertising.com/rtb/ Frame 9723 0
215 B 70ms
26ms XHR
application/json 18.197.185.70
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.adaptv.advertising.com/rtb/openrtb?ext_id=TeachingAidsLLC
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/content/prebid/prebidVid.3.19.0_9.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.197.185.70 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-197-185-70.eu-central-1.compute.amazonaws.com
Software: adaptv/1.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://threatpost.com
access-control-allow-credentials: true
server: adaptv/1.0
Connection: keep-alive
content-length: 0
content-type: application/json

POST
H2 204 translator Show response
hbopenbid.pubmatic.com/ Frame 9723 0
59 B 23ms
21ms XHR
text/plain 185.64.189.112
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/content/prebid/prebidVid.3.19.0_9.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.189.112 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

status: 204
date: Wed, 09 Sep 2020 16:12:10 GMT
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
access-control-allow-origin: https://threatpost.com

GET
H2 200 avjp Show response
teachingaids-d.openx.net/v/1.0/ Frame 9723 92 B
282 B 30ms
27ms XHR
application/json 35.244.159.8
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://teachingaids-d.openx.net/v/1.0/avjp?ju=https%3A%2F%2Fthreatpost.com%2Fshlayer-mac-malware-extra-sneakiness%2F156669%2F%3Fweb_view%3Dtrue&ch=UTF-8&res=1600x1200x24&ifr=true&tz=-120&tws=1600x1200&be=1&bc=hb_pb_3.0.2&dddid=53357bd9-90bc-42f6-b8b2-a260b05d3890&nocache=1599667930561&gdpr_consent=&gdpr=1&schain=1.0,1!admetricspro.com,1005,1,,,&skip=1&auid=540882778&vwd=320&vht=180
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/content/prebid/prebidVid.3.19.0_9.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.159.8 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/16.193.0 /
Resource Hash: 004e5faf0bf890f61697daeede9f21826affd1137fb2cb58eaf4719937a04a14

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Wed, 09 Sep 2020 16:12:10 GMT
via: 1.1 google
server: OXGW/16.193.0
status: 200
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: https://threatpost.com
cache-control: private, max-age=0, no-cache
access-control-allow-credentials: true
content-type: application/json
alt-svc: clear
content-length: 92
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H/1.1 200
OK cygnus Show response
as-sec.casalemedia.com/ Frame 9723 25 B
673 B 153ms
112ms XHR
application/json 23.210.249.164
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://as-sec.casalemedia.com/cygnus?s=435870&v=8.1&r={%22id%22:%22493f886e0feb9da%22,%22imp%22:[{%22id%22:%22506c9902f1c172c%22,%22ext%22:{%22siteID%22:%22435870%22,%22sid%22:%22320x180%22},%22bidfloor%22:1.4,%22bidfloorcur%22:%22USD%22,%22video%22:{%22mimes%22:[%22video/mp4%22,%22application/javascript%22,%22video/webm%22],%22minduration%22:1,%22maxduration%22:200,%22api%22:[1,2],%22protocols%22:[1,2,3,4,5,6],%22linearity%22:1,%22startdelay%22:0,%22skip%22:1,%22w%22:320,%22h%22:180,%22placement%22:1}},{%22id%22:%22515a69e2504cb02%22,%22ext%22:{%22siteID%22:%22435871%22,%22sid%22:%22320x180%22},%22bidfloor%22:1.4,%22bidfloorcur%22:%22USD%22,%22video%22:{%22mimes%22:[%22video/mp4%22,%22application/javascript%22,%22video/webm%22],%22minduration%22:1,%22maxduration%22:200,%22api%22:[1,2],%22protocols%22:[1,2,3,4,5,6],%22linearity%22:1,%22startdelay%22:0,%22skip%22:1,%22w%22:320,%22h%22:180,%22placement%22:1}}],%22site%22:{%22page%22:%22https%3A%2F%2Fthreatpost.com%2Fshlayer-mac-malware-extra-sneakiness%2F156669%2F%3Fweb_view%3Dtrue%22},%22ext%22:{%22source%22:%22prebid%22},%22source%22:{%22ext%22:{%22schain%22:{%22ver%22:%221.0%22,%22complete%22:1,%22nodes%22:[{%22asi%22:%22admetricspro.com%22,%22sid%22:%221005%22,%22hp%22:1}]}}},%22regs%22:{%22ext%22:{%22gdpr%22:1}},%22user%22:{%22ext%22:{%22consent%22:%22%22}}}&ac=j&sd=1&nf=1
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/content/prebid/prebidVid.3.19.0_9.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.210.249.164 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-249-164.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: c11d4586ffa5c520486d4fcd1664e93d4704a404e695c38d39b50d065fe08e51

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Wed, 09 Sep 2020 16:12:10 GMT
Content-Encoding: gzip
Server: Apache
Vary: Accept-Encoding
Content-Type: application/json
Access-Control-Allow-Origin: https://threatpost.com
Cache-Control: max-age=0, no-cache, no-store
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 45
Expires: Wed, 09 Sep 2020 16:12:10 GMT

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ Frame 9723 19 B
711 B 67ms
26ms XHR
application/json 37.252.172.36
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: live.sekindo.com
URL: https://live.sekindo.com/content/prebid/prebidVid.3.19.0_9.min.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.172.36 , Ascension Island, ASN29990 (ASN-APPNEX, US),

Reverse DNS

692.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

Software

nginx/1.17.9 /

Resource Hash

0c09c070833c786cb25be38bc30992b30bad578f817dbc9e34beacd8b8ea44c5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Wed, 09 Sep 2020 16:12:10 GMT
X-Proxy-Origin: 185.217.171.12; 185.217.171.12; 692.bm-nginx-loadbalancer.mgmt.fra1; *.adnxs.com; 37.252.173.48:80
AN-X-Request-Uuid: 6052c65c-e593-45a2-95a2-704e9bbe5bb0
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://threatpost.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json; charset=utf-8
Content-Length: 19
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1 200
OK liveView.php
live.sekindo.com/live/ 43 B
437 B 21ms
21ms Image
image/gif 185.220.204.204
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://live.sekindo.com/live/liveView.php?njs=1&ito=1&vid_event=6&serverTime=1599667909&vid_playerVer=3.1.0&s=58057&sta=12381421&x=320&y=180&msta=12348808&vid_vastType=3&vid_viewabilityState=1&vid_passDomain=threatpost.com&subId=threatpost.com&debugInformation=&isApp=0&userIpAddr=185.217.171.12&userUA=Mozilla%2F5.0%20%28Macintosh%3B%20Intel%20Mac%20OS%20X%2010_14_5%29%20AppleWebKit%2F537.36%20%28KHTML%2C%20like%20Gecko%29%20Chrome%2F83.0.4103.61%20Safari%2F537.36&csuuid=5f58fec4dc913&rvn=${VP_RVN_MACRO}&attemptMultiplier=10&contentFileId=0&mediaPlayListId=0&mediaListId=0&cbuster=1599667930552&gdpr=1&gdprConsent=&isWePassGdpr=0&ccpa=0&ccpaConsent=&uid=SekindoSPlayer5f58fec5149c6&pubUrl=https%3A%2F%2Fthreatpost.com%2Fshlayer-mac-malware-extra-sneakiness%2F156669%2F%3Fweb_view%3Dtrue&floatStatus=true
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 185.220.204.204 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, GB),
Reverse DNS
Software: nginx /
Resource Hash: 42b976597a2d977d0e300f6d06bc903db389e5c112d33c1c8c249690a522d9f2

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 09 Sep 2020 16:12:10 GMT
server: nginx
age: 0
transfer-encoding: chunked
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
access-control-allow-origin: *
cache-control: max-age=315360000
content-disposition: inline; filename="pixel.gif"
content-type: image/gif
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H/1.1 200
OK w_480_00007.ts Show response
video.sekindo.com/uploads/cn7/video/users/hls/24485/video1523972806/vid5f508425c816b126612114.mp4/ 239 KB
240 KB 28ms
27ms XHR
video/mp2t 45.83.41.102
CLOUDWEBMANAGE-IL-FR

General

Check archive.org

Show headers Download Go to

Full URL: https://video.sekindo.com/uploads/cn7/video/users/hls/24485/video1523972806/vid5f508425c816b126612114.mp4/w_480_00007.ts
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/content/video/hls/hls.0.12.4_2.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 45.83.41.102 Frankfurt am Main, Germany, ASN204548 (CLOUDWEBMANAGE-IL-FR, GB),
Reverse DNS
Software: Tengine /
Resource Hash: 2f1c6e7c735439260de95655430c72780945cf0c8fe7479fd74dea07d234b35e

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Wed, 09 Sep 2020 16:11:47 GMT
last-modified: Sun, 06 Sep 2020 22:32:35 GMT
Server: Tengine
etag: "5f556383-3bce4"
Content-Type: video/mp2t
access-control-allow-origin: *
expires: Wed, 16 Sep 2020 16:11:47 GMT
cache-control: max-age=604800
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=25
Content-Length: 244964
X-Proxy-Cache: HIT

GET
H/1.1 200
OK liveView.php
live.sekindo.com/live/ 0
353 B 22ms
22ms Image
text/html 185.220.204.204
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://live.sekindo.com/live/liveView.php?njs=1&ito=1&vid_event=42&serverTime=1599667909&vid_playerVer=3.1.0&s=101281&sta=0&x=300&y=250&vid_passDomain=threatpost.com&subId=threatpost.com&debugInformation=&isApp=0&userIpAddr=185.217.171.12&userUA=Mozilla%2F5.0%20%28Macintosh%3B%20Intel%20Mac%20OS%20X%2010_14_5%29%20AppleWebKit%2F537.36%20%28KHTML%2C%20like%20Gecko%29%20Chrome%2F83.0.4103.61%20Safari%2F537.36&csuuid=5f58fec4dc913&contentFileId=0&mediaPlayListId=0&mediaListId=0&dur=500&viewPct={%22w%22:0,%22h%22:0}&cbuster=1599667934366&gdpr=1&gdprConsent=&isWePassGdpr=0&ccpa=0&ccpaConsent=&uid=SekindoSPlayer5f58fec5149c6&pubUrl=https%3A%2F%2Fthreatpost.com%2Fshlayer-mac-malware-extra-sneakiness%2F156669%2F%3Fweb_view%3Dtrue&floatStatus=true
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 185.220.204.204 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, GB),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 09 Sep 2020 16:12:13 GMT
content-encoding: gzip
server: nginx
age: 0
transfer-encoding: chunked
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
access-control-allow-origin: *
cache-control: no-store
content-type: text/html; charset=UTF-8

GET
H/1.1 200
OK w_480_00008.ts Show response
video.sekindo.com/uploads/cn7/video/users/hls/24485/video1523972806/vid5f508425c816b126612114.mp4/ 191 KB
191 KB 28ms
28ms XHR
video/mp2t 45.83.41.102
CLOUDWEBMANAGE-IL-FR

General

Check archive.org

Show headers Download Go to

Full URL: https://video.sekindo.com/uploads/cn7/video/users/hls/24485/video1523972806/vid5f508425c816b126612114.mp4/w_480_00008.ts
Requested by: Host: live.sekindo.com
URL: https://live.sekindo.com/content/video/hls/hls.0.12.4_2.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 45.83.41.102 Frankfurt am Main, Germany, ASN204548 (CLOUDWEBMANAGE-IL-FR, GB),
Reverse DNS
Software: Tengine /
Resource Hash: ae9429b421d8415d13c887aa18e59f12ce144653d38a34aa3cafe38471afafe9

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Wed, 09 Sep 2020 16:11:53 GMT
last-modified: Sun, 06 Sep 2020 22:32:35 GMT
Server: Tengine
etag: "5f556383-2fa48"
Content-Type: video/mp2t
access-control-allow-origin: *
expires: Wed, 16 Sep 2020 16:11:53 GMT
cache-control: max-age=604800
Connection: keep-alive
Accept-Ranges: bytes
Keep-Alive: timeout=25
Content-Length: 195144
X-Proxy-Cache: HIT

GET
H/1.1 200
OK liveView.php
live.sekindo.com/live/ 0
353 B 25ms
23ms Image
text/html 185.220.204.204
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://live.sekindo.com/live/liveView.php?njs=1&ito=1&vid_event=25&serverTime=1599667909&vid_playerVer=3.1.0&s=101281&sta=0&x=300&y=250&vid_passDomain=threatpost.com&subId=threatpost.com&debugInformation=&isApp=0&userIpAddr=185.217.171.12&userUA=Mozilla%2F5.0%20%28Macintosh%3B%20Intel%20Mac%20OS%20X%2010_14_5%29%20AppleWebKit%2F537.36%20%28KHTML%2C%20like%20Gecko%29%20Chrome%2F83.0.4103.61%20Safari%2F537.36&csuuid=5f58fec4dc913&contentFileId=0&mediaPlayListId=0&mediaListId=0&dur=1000&cbuster=1599667939182&gdpr=1&gdprConsent=&isWePassGdpr=0&ccpa=0&ccpaConsent=&uid=SekindoSPlayer5f58fec5149c6&pubUrl=https%3A%2F%2Fthreatpost.com%2Fshlayer-mac-malware-extra-sneakiness%2F156669%2F%3Fweb_view%3Dtrue&floatStatus=true
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 185.220.204.204 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, GB),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 09 Sep 2020 16:12:19 GMT
content-encoding: gzip
server: nginx
age: 0
transfer-encoding: chunked
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
access-control-allow-origin: *
cache-control: no-store
content-type: text/html; charset=UTF-8

GET
H/1.1 200
OK liveView.php
live.sekindo.com/live/ 0
353 B 23ms
23ms Image
text/html 185.220.204.204
CLOUDWEBMANAGE-EU

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://live.sekindo.com/live/liveView.php?njs=1&ito=1&vid_event=42&serverTime=1599667909&vid_playerVer=3.1.0&s=101281&sta=0&x=300&y=250&vid_passDomain=threatpost.com&subId=threatpost.com&debugInformation=&isApp=0&userIpAddr=185.217.171.12&userUA=Mozilla%2F5.0%20%28Macintosh%3B%20Intel%20Mac%20OS%20X%2010_14_5%29%20AppleWebKit%2F537.36%20%28KHTML%2C%20like%20Gecko%29%20Chrome%2F83.0.4103.61%20Safari%2F537.36&csuuid=5f58fec4dc913&contentFileId=0&mediaPlayListId=0&mediaListId=0&dur=500&viewPct={%22w%22:0,%22h%22:0}&cbuster=1599667939366&gdpr=1&gdprConsent=&isWePassGdpr=0&ccpa=0&ccpaConsent=&uid=SekindoSPlayer5f58fec5149c6&pubUrl=https%3A%2F%2Fthreatpost.com%2Fshlayer-mac-malware-extra-sneakiness%2F156669%2F%3Fweb_view%3Dtrue&floatStatus=true
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 185.220.204.204 Amsterdam, Netherlands, ASN41436 (CLOUDWEBMANAGE-EU, GB),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 09 Sep 2020 16:12:19 GMT
content-encoding: gzip
server: nginx
age: 0
transfer-encoding: chunked
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
access-control-allow-origin: *
cache-control: no-store
content-type: text/html; charset=UTF-8

Verdicts & Comments Add Verdict or Comment

267 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

40 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/ros-layout.js(Line 372) Message: gBrowserWidth =1600
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/ros-layout.js(Line 397) Message: OpenX Slot defined for /21707124336/ThreatPost-970x250-ATF div-gpt-ad-6794670-2
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/ros-layout.js(Line 397) Message: OpenX Slot defined for /21707124336/ThreatPost-300x250-ATF div-gpt-ad-6794670-3
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/ros-layout.js(Line 397) Message: OpenX Slot defined for /21707124336/ThreatPost-300x600-ATF div-gpt-ad-6794670-5
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/ros-layout.js(Line 397) Message: OpenX Slot defined for /21707124336/ThreatPost-2x2-Skin div-gpt-ad-6794670-1
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/cmp.js(Line 27) Message: CMP: Startup v238
console-api	warning	URL: https://qd.admetricspro.com/js/threatpost/prebid.js(Line 3) Message: fun-hooks: referenced 'registerAdserver' but it was never created
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: ENGINE: gSChainNodes found, prebid configured with 1 supply chain object(s)
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: ENGINE: final pbjs config
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: [object Object]
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: Initial Ad Load
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/cmp.js(Line 27) Message: __uspLaunch begin
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/cmp.js(Line 27) Message: CMP: No existing consent found in cookie, local or session storage
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/cmp.js(Line 27) Message: CMP: checking non TCF vendor cookie
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/cmp.js(Line 27) Message: CMP: No existing non-TCF consent found in cookie, local or session storage
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/cmp.js(Line 27) Message: __uspLaunch(): addEventListener:
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/cmp.js(Line 27) Message: [object Object]
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/cmp.js(Line 27) Message: CMP: Locale=en-us gdpr= false
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/cmp.js(Line 27) Message: CMP: GDPR does not apply
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/cmp.js(Line 27) Message: __uspLaunch(): addEventListener:
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/cmp.js(Line 27) Message: [object Object]
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: sendBidRequests() gPBJSTimeoutTimer=null pbjs.adserverRequestSent=undefined
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: Amazon bids returned, count=4
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: [object Object],[object Object],[object Object],[object Object]
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: pbjs bids returned
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: gPBJSTimeoutTimer cleared
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: sendAdserverRequest(): pbjsBidsBack
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: sendAdserverRequest()
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: pbjs.getAdserverTargeting: >> Amazon >> Prebid
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: [object Object]
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: pbjs.getBidResponses:
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: [object Object]
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: gThisRefreshSlots=
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: [object Object],[object Object],[object Object],[object Object]
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: sendAdserverRequest(): ---> Calling googletag.pubads().refresh()
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: console.groupEnd
console-api	info	URL: https://cdn.ampproject.org/rtv/012008242301000/amp4ads-v0.js(Line 420) Message: Powered by AMP ⚡ HTML – Version 2008242301000 https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
console-api	info	URL: https://cdn.ampproject.org/rtv/012008242301000/amp4ads-v0.js(Line 420) Message: Powered by AMP ⚡ HTML – Version 2008242301000 https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
console-api	warning	URL: https://cdn.ampproject.org/rtv/012008242301000/amp4ads-v0.js(Line 21) Message: [amp-analytics/transport] Response unparseable or failed to send image request https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjssxdK5t4XxD4bgL4MboKO1un_A6AyTXeIH9kL73SLXTN8amGeunsXRMqB7nSwcJWLPVi4_6WxATpQubuI__s-nDVoyV-bs197JTSzUbHhJOV5meXqwJfn5J2Lotz-qfumXLuKT3UZ65oMASa3bTBJZMfH_Loa5u1dOhc8HnM3t-ht2lzu7YgOK5iVi3xTO-rqJhQ12dE_ZuK2wGLuckxdCbEfw-iiQzgACS0LZ_cIa4TjycFpgU2vPFRcT1XuEpM3FVB0ALe8wft-WkSnJnalSW&sai=AMfl-YSQGwIUfzu5p6JOJQKtT1XBqEwX1KXXtLejK81JPhnqybkeECXvvGArb6XFduRdku92q7XDybnq4NVKg63CMs0RADLspBrrRuFLkIQ2lL6gVn4eMQIzZg2HsZ99ah4L&sig=Cg0ArKJSzBUZpkrgJYVzEAE&adurl=
console-api	info	URL: https://cdn.ampproject.org/rtv/012008242301000/amp4ads-v0.js(Line 420) Message: Powered by AMP ⚡ HTML – Version 2008242301000 https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

5214586febd538a8a28723ff5f414638.safeframe.googlesyndication.com
aas.dc-1.net
acdn.adnxs.com
ads.adaptv.advertising.com
ads.pubmatic.com
ads.servenobid.com
adserver-us.adtech.advertising.com
adservice.google.com
adservice.google.de
analytics.twitter.com
aol-match.dotomi.com
ap.lijit.com
as-sec.casalemedia.com
assets.threatpost.com
c.amazon-adsystem.com
c1.adform.net
cdn.ampproject.org
cm.g.doubleclick.net
csync.loopme.me
e.serverbid.com
eb2.3lift.com
eu-u.openx.net
eus.rubiconproject.com
fastlane.rubiconproject.com
fonts.googleapis.com
fonts.gstatic.com
googleads.g.doubleclick.net
graph.facebook.com
hbopenbid.pubmatic.com
ib.adnxs.com
image2.pubmatic.com
js-sec.indexww.com
kasperskycontenthub.com
live.sekindo.com
match.adsrvr.org
math-aids-threatpost-tagan.adlightning.com
media.threatpost.com
pagead2.googlesyndication.com
pixel.advertising.com
pixel.quantserve.com
pr-bh.ybp.yahoo.com
prebid.a-mo.net
public.servenobid.com
qd.admetricspro.com
rules.quantcount.com
secure.quantserve.com
securepubads.g.doubleclick.net
serverbid-sync.nyc3.cdn.digitaloceanspaces.com
ssum.casalemedia.com
static.ads-twitter.com
stats.g.doubleclick.net
sync-tm.everesttech.net
sync.search.spotxchange.com
sync.serverbid.com
t.co
tagan.adlightning.com
teachingaids-d.openx.net
threatpost.com
tlx.3lift.com
tpc.googlesyndication.com
u.openx.net
ups.analytics.yahoo.com
video.sekindo.com
www.google-analytics.com
www.google.com
www.google.de
www.googletagmanager.com
www.googletagservices.com
www.gstatic.com
www.linkedin.com
www.reddit.com
x.bidswitch.net
104.111.230.142
104.244.42.133
104.244.42.195
134.209.129.254
151.101.112.157
151.101.14.49
167.172.1.14
172.217.18.2
18.194.69.213
18.197.185.70
185.220.204.204
185.64.189.112
185.64.190.80
185.94.180.125
195.201.164.125
199.232.53.140
205.185.216.42
216.58.206.2
23.210.249.164
23.210.249.83
23.210.249.92
2600:9000:20e8:7200:0:5c46:4f40:93a1
2600:9000:20e8:9400:6:44e3:f8c0:93a1
2600:9000:20e8:ba00:2:9275:3d40:93a1
2606:2800:233:97b6:26be:138a:cba8:bb01
2606:4700:e6::ac40:c31a
2620:116:800d:21:5a23:9c4e:e774:96c1
2620:1ec:21::14
2620:1ec:bdf::10
2a00:1288:110:c305::8000
2a00:1450:4001:802::2002
2a00:1450:4001:808::2003
2a00:1450:4001:809::2002
2a00:1450:4001:809::200a
2a00:1450:4001:814::2002
2a00:1450:4001:815::2001
2a00:1450:4001:815::2003
2a00:1450:4001:817::2003
2a00:1450:4001:819::2003
2a00:1450:4001:81a::2004
2a00:1450:4001:820::2001
2a00:1450:4001:820::200a
2a00:1450:4001:824::2008
2a00:1450:4001:824::200e
2a00:1450:4001:825::200e
2a00:1450:400c:c06::9c
2a02:fa8:8806:16::1370
2a03:2880:f01c:800e:face:b00c:0:2
3.126.56.137
34.237.157.170
35.156.153.71
35.156.68.202
35.173.160.135
35.244.159.8
37.157.3.30
37.252.172.36
45.83.41.102
52.212.5.193
52.31.46.99
52.5.29.22
54.93.147.19
69.173.144.143
72.251.249.9
99.84.153.196
99.84.156.34
99.84.156.60
003dea087f7ccec2e6468f02be66548dc63b148e0e22e898b457d5735fc5b185
004e5faf0bf890f61697daeede9f21826affd1137fb2cb58eaf4719937a04a14
00d4fbacbadc6ecbd73be323ec77febf3d856ce00dc5334d06462a315c7da8e7
0119689800eadf6270855a19b65d74251e7da6be5e4686f36c15bf81281ddb4c
01864580e1f385dc4512aed0de4b324cc1a04812709e7020e857612fc0ce9f4c
037f0569583539cc02e38c7a1dcb9a1f28d7de1ddee4cad3c26612c89d7c56c6
039f2a12a4fefd4b33bcae31f1f2f17d12cf51f4e6301792ada3885f412a2761
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
04e4a80e68cc9a6e075037c848f6dd13f5b29d7784c1262297729838cf55d06b
05148a217f01f1d6b7a9e90813a2c58d0dbbd947f76cbcbba24e4c0411463b08
0535c3bb3a17e4ac0fb7d29214d2181275662129dc2bdd2a89c35934e9fc5ba5
06a5907d46bb26a5d53a5c93a39493430cae984aad4edec11e59b7fb0a78cadd
06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844
06c5c6f82e19c34ebf8c6c560780a5a6bdb89460159b8aafc38e7ac5f9609184
06fc565587b8b700936a1677218cb269a6cc31ca5f701eb45461e86a3d54d5c7
07ee8492749e3102e7ff5f6fd9583f90ac50bad0608d734528e22c2038323250
08f50e9e70388c99977ca13b6af3a49f8f48c83e79230d51ea72a56c0735bd0c
0c09c070833c786cb25be38bc30992b30bad578f817dbc9e34beacd8b8ea44c5
0cf25abe73b03e246c0a820c825a1f433e36949c2cf456ce889d86e8dd9ec427
0dc6e498973ccdc85333c8edd8333b916b22c6fec7a0a6d51fcc1d8290500d0a
0e422661b869922bc94c19d58ec76e34207c45dc912bec8f3b21d63dfd7ba63b
102de457101f323f21b172f40c5840f77fd693dc80f672de32562a884e9c8ccb
12c9acd2dd58cfe3cbab5c7be32c13431018977aafd9f03d3fe3cc05ee379f49
13ab06913444b6e3b4139e5487813073f11e082878ae8a5bf5213fdc6f95f5e0
1554f794a0cc095ee381dee0971f1d1a8a9aaa55c743103e24913f07e18ec6b5
15e9840f31982980328598c38e5c60434072901f2c902713ef9c4d4900e05307
172314ff74044b918766ed4763279b5e8798622087c0a2930f59c9d44662213d
1ce473be690c2fb6095c2a60a1f587286f0ac9ea76adf96dafe011d8c155cdf2
1db21d816296e6939ba1f42962496e4134ae2b0081e26970864c40c6d02bb1df
1fbd06d98ff87713eb030669571c929ab75539f05252f04ae1df807c28b20e95
21d98ae2b4353492ffe5c29d1425e6b499793f8d3af3e3b362c7720ba981420e
21e46fe44c6929876f5a413c843ae516c0ddfd1aad3e8e33446b7bc0a6781b08
21fb271392e0c7a737fb39243d3726a125a1282d2a0853cb910a87c1b890b525
24df50eaac2cd2446fdaab1d483c62afd09d70245bcae6e50d381f7d97656350
263cb75aae2d5f444da7f29e4a4c345664b88639e37e878fd5bed2f05aa7b52c
27fb8b952323e75440813cce206abda7235fc414d55cf3422c0d2bc00fdaa833
29257e6f0eaa20a411d881c29d9fdd181a811ec32b5fdd1cb46ec4bd4719861f
296654789dcafc623692f600b55d486d3e5428f3671fc145c29527f67f4023ef
29bbbb257d14cbd0a964a91f780fad62eb92e638bd8ef5479f200b7e256b7771
2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe
2b25834a3c81710eb20539a989a9a248e7cf534beb9c33180e89962045dca151
2de77164bb9924542e1dea4ee4a0ff27d40b51a3d7939dac7db11a95045c9b7d
2f0be9d60fc023baccaf662aea974a753e85d849f89d71ab1b7c2e77dbc4ddda
2f1c6e7c735439260de95655430c72780945cf0c8fe7479fd74dea07d234b35e
3097d0444becd9d089b52b7074072f19201525de874d0775012572fb375b7838
30cfde8a99cbbfb145edbaee540db712a5c6e8efa9e0b8209d803a7d4ecbdbbb
31c322fcf8f745ff255514a08189b08d8a961f53877ddca470d0c09994084ef3
325025896d87b56f70344e031303c8aca70da2631b14a35798ec45d5d3dfadfa
330798625ce3468cc078ba28574ec8651fd742c9f70673c29333f9a9683a2a21
3435531b595fb1b2b529346e1df8c979a1fd727f56ea8c0d792316035440cac5
36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1
39af7c1116fb967a330e8770f775e6b5ee871add01ed45c98a1634911cebfb0a
39f437357a2ffa0d788c9fc8563f3af59d73d529060cb407ac639513df958597
41f3222c29889fb48f5dca1d481858e5339a759655510c256ef4edf56c80f7f5
420508fc523520f35de5c851905543294123d7676b5a5668744691f2abe9e730
42b976597a2d977d0e300f6d06bc903db389e5c112d33c1c8c249690a522d9f2
45ddc09b0ad6ab916bd9a0282070b161045e186fc025303f4aa1aa821fc45ac7
48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438
4edf4e4d19fa8ec8abf42e728012fb704a7d8e49a25bbf778b77abd20d90b8ce
4f7cd55655bafca4db9b67255125ed52cd91d21b1727e9f28f71219aa1341de5
506d565f94cecbb486394c545a96e8459217f8d045496b511e8c815142abfc70
511032aee4997e4c51979d4e35b0fa03ee5259f7cfb58c4081969a258251427f
542a7bfb6cb07cc57d7c39c2e5f870810b3955f1411ccb005f1057b9e12a10b7
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
5a7ed822968963e31d88424c96387ad9f4fd4f4b5a5b581a33f65e3784d162cf
5ac87169a981f2044e9085326079de27da30a84cfe2b97c2d038a2f4f653eb18
5d1bc9b443f3f81fa4b4ad4634c1bb9702194c1898e3a9de0ab5e2cdc0e9f479
6cb565b65b08c18fa828c63d8e6a73da39053df7bc76d2029c9f09339a1c8200
6cdc57f82f4b0d09e5b4e584ca4736cd3871f20563d4ce25120b057d8ffb4eb2
6e4710b4f9dca47ff9fcdeddbd2ab7716c46a80de168faa31b0acc1db000be4d
745a085b52b8371ec6705413fca70a28c6d8bff0db480e6b124bd08c54e95ef8
7517792de8d4a1319afd85d8c3dcffe799ba5545129a650182e6c4b055302852
76102878c1198de858725194952ba1c6b35bdee0f870cc6a124e93d17385e64e
7860ef37e85676dcb81a99d7e5d6453bdacdf9d35aa45517a9ba9ea25bbd4c85
791135f98b21bbd99c1cbcd56e2827cab155856c144602a8749a57acaa5aa813
7b3a6824b29805651d57c590d42543e6f1b575917fb2977a23e15229beb0fdf4
7d00448f30b7a32c1678cd5407922646b360ae43e2f101551d00cb7ff428999a
7d612c9f3ff74a635e6e38f0e709e2e8ca2c49cbe24c44f3e067fec8451c881d
7e2b472509d9e149690aba45c5917ebdd2f52471b98d414c2726301b90e08f21
7e52121828e29520878c88a7f014d5733ce03f8756225f860911a22378b07a22
7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b
8130c2c72afad9d94581ef93aaa00524093103c47c71fce52f606d5ff693c3ce
8247f4332667950989fe6bf790f87723343db2ec83d975503e9c5dc13a6eb5dc
829bd5abf5ca1bbe4c76b65c46350dd124a4e41139f83c8fef0edf1a890c329d
82e2369bfee3725eb4f4ef3af5431637009a89ac42f4e6da6f68e66d3b034788
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
83fdaf5f46b5914739cd14bbe81a1545c9db87c59200288b013e2f99aa5425ae
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
854f7a7915f240546d3950dd2b067466da13c013d04a3f8c790880c58ec61151
859faa9b9ed0990288b2f393a102b1fe2668ac79088b113b6f0beaee521221eb
878e2f7001cb0a69582bf4849bb5f14d1004f8008564ebce428386ef98bb7726
89ce08431545cd3c6d42419d99ee0152027a68c1d0c7c82838cc9a51d9d52451
89e25584c442b1d3d12d218853f50a47951a828946e04aad76dbaf4a86c80acf
8a6d8662f2fd519facf1393940cd0632cce658caa5bbab176b9360973ca8f6e3
8c665507e16736e1323acf89104e508e8cac863d30e8ca5ff5d6ac5303b25277
8c7a87a79fab9f43ce2b5e90052a8d51ecc432f6c92af48da3a4bd5a24d5e88e
8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0
98e804f97bd2d52ec902f0275aa9823f8387a22585bb41e56f829b03700ff86b
9da97c6ff0eae2f1f8447d8e41f2f66336636eac52235e5326966c4bbf34fc42
9fb2e1ccc0fcdf99c9a1e0a2d2b4e4856573b245aa81244be6f9351f7745582c
a0b8d5f925cb1ad83c665488cf3d59c2b4acf9f0ec9f277db2441ca69d3900b0
a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8
a3336e3373c170b40764f5a62d121335bec4243b0034e561937194dfe2e413fd
a4e2a0b0382d275acb336b62767fcd11c6e3fae31f047eebebfb95651f9832b1
a612051e7fded859faaa74f2ccf3a7ecdefc622d380ca549360e45e1079f06b5
a9d2b2df99c1a115d5394c70a898d8801092208dc582f8bd6fb01b35c30d6b22
aa64fa30a3263fa3105736228a6feaaa4f7d32d8ef96b12e56f6fb95511b66a7
aa90c2d77583dd25e7fbdc1411c8d718f29d9665ab48f985ffe6f3a38b34b6a7
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
ad3c31c7ea482ad4425499b5fe3ffb4a7e0ab73d69112eb707cba1bada9dfcb9
ae00ae9c862bc8b8923efd1d9a18befa912678a869d4dd01179a59ed3de731be
ae9429b421d8415d13c887aa18e59f12ce144653d38a34aa3cafe38471afafe9
af517de65e4d2beaa3da8659682a9daaf863b96f59567e7550b7a1812a4f97e1
b0209d39595432d762f6ba2a81dc0bffa6a6e1ed9021ba24ffa06c3c7e4bcb02
b08c92f2985a2cf85e942b566af89d0738cb22e14d0db5ddbefd6c4034a169e8
b38e3464dee0d0f1007c2c1195c69202c8212455c982d1fddf214b8aeedcb417
b4e8f2d73294065f2c0e54cb17bcba8bf7440408b804f9052ac03c0ff9adb398
b78dafcf7a545a97b8d466e4be39ad8d59d30078e95e9aa36132f8f39747eccb
bab2f390df5c0f89d0b511da9790e6b6a4fd6daa3706a535e14a9cc1174fc5d4
c11d4586ffa5c520486d4fcd1664e93d4704a404e695c38d39b50d065fe08e51
c4a7b4babd8d76af2ddc0840bda733cd5a0b409895bb74d5302ff1155c9b32bc
ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356
cb65884c6b89265ff4cf3bf3bcac834481909f7820336106b4deb451d86a42d5
cc0a2c0ac7432d5c47b0bfa5df2e747840c452315813c22c9f7c5fef27426125
ce897833ac6e362df7c91ac8223fe511c6defcf33964928a81004600a2dd4c2e
d2dffba8a31eb663c59a5494783cbf197c182104edc58f0c0a17b7992429d7af
d2e5434d730440add973e3d2c835b65c44e5be6f59180398b4ba620698085ace
d3838febe02ee1538a1336ac01f452a6fe7682106cd21b46cda9c40092c8e3aa
d6146cecea5909786af7e054d8bbc151de07443f394fd7b26732d2bf6b10cd8e
d62a7b7ec5313469ebff5c006b9068dc44d6d1c122cf787ffa29a10113b34060
d89d98593ac65c9f002b856f3e22a1479f3aea866f7fd15c85903c0a6d66f0e3
dbaa26fcd90cc0e6600d298a590c502a30d2d1bf3acda3b38ed2bf2aad71b0b3
dd8edf08014c1976f429cf0ff8cb5e47ada72fb6c6fe42723ab483d939a98e5c
de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af
dec1958021b50b0f46e2ead96e79c9d109a0abfa617119a0066319304c5b7901
df3e003cc30e9bdd0313100e8ee5d468070b4b34d11ad355f276a356d4b9c7bf
e118bb3b3ab039801c7adf8dc9fc41bee66096475206a1717e9f098e5a43b469
e34739060ab19db58c951a309f81d2089133f4cb989934421ca46ee5eb619806
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e4058d4ee9da1ceaddfa91ddb63650ba67285f1bbfee487d9dfe648bced669a0
e429fa4e9c6c63472ae233e4d5f6f34cb762578b4d6691835c15ae30b559f6d1
e61ebc98c55c6cacbb719c5d4f078023918a327ead894889367048af9845aabf
e9343095d5a3b8883a9be95812215933651b4915961f4b4d6e116206c8a03590
eaddfae170836731fb5febe739b695dd232c478278ab70a79e70429203d676f3
ed1bd9b5fc31e624bb0b3ca2c510546c8a1bb6b41923e06768a735c75a9c704c
ee8d80d0be74777d3ae8804cb3a4f13ca91205a976c3ad7330f1bf065bd1d1bf
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f19e7ee6cdf20bd478c037707c447b7cd469051de4dadeac32a795efb463c2e2
f223afe73e8e54bef06ee5fb36c0f8c7bcd4c835717d137d8915996b3309c8d6
f40e3d5b91387e92272b6d46fc83ce21041f130a29316d7216d3a1793d46c4f3
f4b064d961dd5c30917481f9cf22f400d352737e7dac10d70e574877eef1e8ea
f4f2c0a4763f01ee2b13b4f8189e6fd5f32bd704d71fed8d0f11883de9724198
f75166e3f70100b65a6ce1d4128bc15286e92b19a546fa7709f739e9bcfe52c6
f8a2b5b62eb722c3379b30cf0cc58d3176ee6be48036d6ad2aa838d2029c4189
fcc21658c6ad7aefdb5d9411a7b01cb5d9d1f5c2296dc2b26c07446219443c83
ff6c025882c724280e86dc4c5e881a2f7d7dfc9a0903f7915a786c72c292bd33

threatpost.com Open in urlscan Pro 35.173.160.135 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

291 Requests

100 %HTTPS

41 %IPv6

46 Domains

72 Subdomains

61 IPs

9 Countries

4931 kBTransfer

9763 kBSize

0 Cookies

14 Outgoing links

Redirected requests

291 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 4 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

threatpost.com Open in urlscan Pro
35.173.160.135 Public Scan

Screenshot
Live screenshot

Full Image

291
Requests

100 %
HTTPS

41 %
IPv6

46
Domains

72
Subdomains

61
IPs

9
Countries

4931 kB
Transfer

9763 kB
Size

0
Cookies

291 HTTP transactions
4 data transactions