threatpost.com Open in urlscan Pro
35.173.160.135 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Submission: On October 22 via api (October 22nd 2020, 8:53:34 pm UTC) from US

Summary HTTP 199 Redirects Links 14 Behaviour Indicators

Summary

This website contacted 53 IPs in 8 countries across 41 domains to perform 199 HTTP transactions. The main IP is 35.173.160.135, located in Ashburn, United States and belongs to AMAZON-AES, US. The main domain is threatpost.com.
TLS certificate: Issued by DigiCert SHA2 Secure Server CA on June 10th 2020. Valid for: a year.

This is the only time threatpost.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
18	35.173.160.135 35.173.160.135	14618 (AMAZON-AES) (AMAZON-AES)
5	54.192.206.94 54.192.206.94	16509 (AMAZON-02) (AMAZON-02)
7	2606:4700:e6:... 2606:4700:e6::ac40:c502	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 8	2a00:1450:400... 2a00:1450:4001:820::2002	15169 (GOOGLE) (GOOGLE)
8	2600:9000:207... 2600:9000:2070:8800:2:9275:3d40:93a1	16509 (AMAZON-02) (AMAZON-02)
11	2600:9000:220... 2600:9000:2204:d400:0:5c46:4f40:93a1	16509 (AMAZON-02) (AMAZON-02)
7	2a00:1450:400... 2a00:1450:4001:821::2004	15169 (GOOGLE) (GOOGLE)
1 5	216.58.208.34 216.58.208.34	15169 (GOOGLE) (GOOGLE)
3	52.222.182.122 52.222.182.122	16509 (AMAZON-02) (AMAZON-02)
1 17	151.101.114.137 151.101.114.137	54113 (FASTLY) (FASTLY)
1	2a00:1450:400... 2a00:1450:4001:824::2008	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:816::2003	15169 (GOOGLE) (GOOGLE)
3	2a00:1450:400... 2a00:1450:4001:824::200e	15169 (GOOGLE) (GOOGLE)
1 3	2620:116:800d... 2620:116:800d:21:36a9:ecb:e518:b308	16509 (AMAZON-02) (AMAZON-02)
1	151.101.112.157 151.101.112.157	54113 (FASTLY) (FASTLY)
1	2600:9000:209... 2600:9000:2093:1a00:6:44e3:f8c0:93a1	16509 (AMAZON-02) (AMAZON-02)
1	104.244.42.5 104.244.42.5	13414 (TWITTER) (TWITTER)
9	18.221.6.219 18.221.6.219	16509 (AMAZON-02) (AMAZON-02)
1	2a00:1450:400... 2a00:1450:400c:c04::9a	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:818::2003	15169 (GOOGLE) (GOOGLE)
6	185.33.221.91 185.33.221.91	29990 (ASN-APPNEX) (ASN-APPNEX)
3	136.144.59.88 136.144.59.88	54825 (PACKET) (PACKET)
1 9	104.111.215.135 104.111.215.135	16625 (AKAMAI-AS) (AKAMAI-AS)
1 2	72.251.249.9 72.251.249.9	29791 (VOXEL-DOT...) (VOXEL-DOT-NET)
4	69.173.144.143 69.173.144.143	26667 (RUBICONPR...) (RUBICONPROJECT)
5	185.64.189.112 185.64.189.112	62713 (AS-PUBMATIC) (AS-PUBMATIC)
9 14	2606:2800:233... 2606:2800:233:97b6:26be:138a:cba8:bb01	15133 (EDGECAST) (EDGECAST)
1	52.210.177.43 52.210.177.43	16509 (AMAZON-02) (AMAZON-02)
8	34.98.64.218 34.98.64.218	15169 (GOOGLE) (GOOGLE)
1	165.227.252.242 165.227.252.242	14061 (DIGITALOC...) (DIGITALOCEAN-ASN)
1	52.28.149.230 52.28.149.230	16509 (AMAZON-02) (AMAZON-02)
1	64.140.160.2 64.140.160.2	18450 (WEBNX) (WEBNX)
1	104.244.42.67 104.244.42.67	13414 (TWITTER) (TWITTER)
1	2a03:2880:f01... 2a03:2880:f01c:800e:face:b00c:0:2	32934 (FACEBOOK) (FACEBOOK)
1	2620:1ec:21::14 2620:1ec:21::14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	199.232.53.140 199.232.53.140	54113 (FASTLY) (FASTLY)
4	2a00:1450:400... 2a00:1450:400c:c02::84	15169 (GOOGLE) (GOOGLE)
6	2a00:1450:400... 2a00:1450:4001:801::2001	15169 (GOOGLE) (GOOGLE)
2	18.185.185.10 18.185.185.10	16509 (AMAZON-02) (AMAZON-02)
11	52.85.32.34 52.85.32.34	16509 (AMAZON-02) (AMAZON-02)
3	151.101.113.108 151.101.113.108	54113 (FASTLY) (FASTLY)
3	104.111.215.68 104.111.215.68	16625 (AKAMAI-AS) (AKAMAI-AS)
1	2a00:1288:110... 2a00:1288:110:c305::8000	34010 (YAHOO-IRD) (YAHOO-IRD)
2 2	151.101.114.49 151.101.114.49	54113 (FASTLY) (FASTLY)
2 6	3.124.119.192 3.124.119.192	16509 (AMAZON-02) (AMAZON-02)
2	3.126.56.137 3.126.56.137	16509 (AMAZON-02) (AMAZON-02)
2 3	52.49.73.64 52.49.73.64	16509 (AMAZON-02) (AMAZON-02)
1	2620:1ec:bdf::10 2620:1ec:bdf::10	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1 2	54.93.144.106 54.93.144.106	16509 (AMAZON-02) (AMAZON-02)
1 1	178.128.135.80 178.128.135.80	14061 (DIGITALOC...) (DIGITALOCEAN-ASN)
1	205.185.216.42 205.185.216.42	20446 (HIGHWINDS3) (HIGHWINDS3)
1	104.111.230.142 104.111.230.142	16625 (AKAMAI-AS) (AKAMAI-AS)
1	2a02:fa8:8806... 2a02:fa8:8806:20::2010	41041 (VCLK-EU-) (VCLK-EU-)
1	37.157.6.241 37.157.6.241	198622 (ADFORM) (ADFORM)
199	53

18 35.173.160.135 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-35-173-160-135.compute-1.amazonaws.com

threatpost.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
kasperskycontenthub.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 54.192.206.94 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-54-192-206-94.ham50.r.cloudfront.net

tagan.adlightning.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2606:4700:e6::ac40:c502 (United States)

ASN13335 (CLOUDFLARENET, US)

qd.admetricspro.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 2a00:1450:4001:820::2002 (Frankfurt am Main, Germany) 1 redirects

ASN15169 (GOOGLE, US)

www.googletagservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
adservice.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 2600:9000:2070:8800:2:9275:3d40:93a1 (United States)

ASN16509 (AMAZON-02, US)

assets.threatpost.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 2600:9000:2204:d400:0:5c46:4f40:93a1 (United States)

ASN16509 (AMAZON-02, US)

media.threatpost.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2a00:1450:4001:821::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 216.58.208.34 (Mountain View, United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: fra15s12-in-f34.1e100.net

securepubads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 52.222.182.122 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-52-222-182-122.ham50.r.cloudfront.net

c.amazon-adsystem.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

17 151.101.114.137 (Frankfurt am Main, Germany) 1 redirects

ASN54113 (FASTLY, US)

cd.connatix.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
cds.connatix.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
vid.connatix.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
img.connatix.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:824::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:816::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:824::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2620:116:800d:21:36a9:ecb:e518:b308 (United States) 1 redirects

ASN16509 (AMAZON-02, US)

secure.quantserve.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
pixel.quantserve.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.112.157 (Frankfurt am Main, Germany)

ASN54113 (FASTLY, US)

static.ads-twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:2093:1a00:6:44e3:f8c0:93a1 (United States)

ASN16509 (AMAZON-02, US)

rules.quantcount.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.244.42.5 (United States)

ASN13414 (TWITTER, US)

t.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 18.221.6.219 (Columbus, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-18-221-6-219.us-east-2.compute.amazonaws.com

capi.connatix.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:400c:c04::9a (Brussels, Belgium)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:818::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 185.33.221.91 (Netherlands)

ASN29990 (ASN-APPNEX, US)
PTR: 721.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

ib.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 136.144.59.88 (United States)

ASN54825 (PACKET, US)

prebid.a-mo.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 104.111.215.135 (Netherlands) 1 redirects

ASN16625 (AKAMAI-AS, US)
PTR: a104-111-215-135.deploy.static.akamaitechnologies.com

htlb.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
as-sec.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
js-sec.indexww.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
ssum.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 72.251.249.9 (Amsterdam, Netherlands) 1 redirects

ASN29791 (VOXEL-DOT-NET, US)

ap.lijit.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 69.173.144.143 (Frankfurt am Main, Germany)

ASN26667 (RUBICONPROJECT, US)

fastlane.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 185.64.189.112 (United Kingdom)

ASN62713 (AS-PUBMATIC, US)

hbopenbid.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

14 2606:2800:233:97b6:26be:138a:cba8:bb01 (United States) 9 redirects

ASN15133 (EDGECAST, US)

adserver-us.adtech.advertising.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.210.177.43 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-210-177-43.eu-west-1.compute.amazonaws.com

ads.servenobid.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 34.98.64.218 (United States)

ASN15169 (GOOGLE, US)
PTR: 218.64.98.34.bc.googleusercontent.com

teachingaids-d.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
u.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
eu-u.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 165.227.252.242 (North Bergen, United States)

ASN14061 (DIGITALOCEAN-ASN, US)

e.serverbid.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.28.149.230 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)

tlx.3lift.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 64.140.160.2 (Los Angeles, United States)

ASN18450 (WEBNX, US)
PTR: threatintelligenceplatform.com

geo.ipify.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.244.42.67 (United States)

ASN13414 (TWITTER, US)

analytics.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a03:2880:f01c:800e:face:b00c:0:2 (Ireland)

ASN32934 (FACEBOOK, US)

graph.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2620:1ec:21::14 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

www.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 199.232.53.140 (United States)

ASN54113 (FASTLY, US)

www.reddit.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:400c:c02::84 (Brussels, Belgium)

ASN15169 (GOOGLE, US)

b1ae54670d2110ccdffcb33197cc425f.safeframe.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2a00:1450:4001:801::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 18.185.185.10 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-18-185-185-10.eu-central-1.compute.amazonaws.com

ads.adaptv.advertising.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 52.85.32.34 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-52-85-32-34.ham50.r.cloudfront.net

math-aids-threatpost-tagan.adlightning.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 151.101.113.108 (Frankfurt am Main, Germany)

ASN54113 (FASTLY, US)

acdn.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 104.111.215.68 (Netherlands)

ASN16625 (AKAMAI-AS, US)
PTR: a104-111-215-68.deploy.static.akamaitechnologies.com

ads.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1288:110:c305::8000 (United Kingdom)

ASN34010 (YAHOO-IRD, GB)

pr-bh.ybp.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 151.101.114.49 (Frankfurt am Main, Germany) 2 redirects

ASN54113 (FASTLY, US)

sync-tm.everesttech.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 3.124.119.192 (Frankfurt am Main, Germany) 2 redirects

ASN16509 (AMAZON-02, US)

pixel.advertising.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 3.126.56.137 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)

ups.analytics.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 52.49.73.64 (Dublin, Ireland) 2 redirects

ASN16509 (AMAZON-02, US)

match.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2620:1ec:bdf::10 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

public.servenobid.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 54.93.144.106 (Frankfurt am Main, Germany) 1 redirects

ASN16509 (AMAZON-02, US)

eb2.3lift.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 178.128.135.80 (North Bergen, United States) 1 redirects

ASN14061 (DIGITALOCEAN-ASN, US)

sync.serverbid.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 205.185.216.42 (Phoenix, United States)

ASN20446 (HIGHWINDS3, US)
PTR: map2.hwcdn.net

serverbid-sync.nyc3.cdn.digitaloceanspaces.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.111.230.142 (Netherlands)

ASN16625 (AKAMAI-AS, US)
PTR: a104-111-230-142.deploy.static.akamaitechnologies.com

eus.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:fa8:8806:20::2010 (Sweden)

ASN41041 (VCLK-EU-, SE)

aol-match.dotomi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 37.157.6.241 (Denmark)

ASN198622 (ADFORM, DK)

c1.adform.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
36	threatpost.com threatpost.com assets.threatpost.com media.threatpost.com	694 KB
26	connatix.com 1 redirects cd.connatix.com cds.connatix.com capi.connatix.com vid.connatix.com img.connatix.com	2 MB
22	advertising.com 11 redirects adserver-us.adtech.advertising.com ads.adaptv.advertising.com pixel.advertising.com	12 KB
16	adlightning.com tagan.adlightning.com math-aids-threatpost-tagan.adlightning.com	114 KB
12	googlesyndication.com b1ae54670d2110ccdffcb33197cc425f.safeframe.googlesyndication.com tpc.googlesyndication.com pagead2.googlesyndication.com	23 KB
9	adnxs.com ib.adnxs.com acdn.adnxs.com	4 KB
8	openx.net teachingaids-d.openx.net u.openx.net eu-u.openx.net	2 KB
8	pubmatic.com hbopenbid.pubmatic.com ads.pubmatic.com	351 B
8	google.com www.google.com adservice.google.com	3 KB
7	doubleclick.net 2 redirects securepubads.g.doubleclick.net stats.g.doubleclick.net cm.g.doubleclick.net	118 KB
7	admetricspro.com qd.admetricspro.com	292 KB
6	casalemedia.com 1 redirects htlb.casalemedia.com as-sec.casalemedia.com ssum.casalemedia.com	2 KB
5	rubiconproject.com fastlane.rubiconproject.com eus.rubiconproject.com	7 KB
3	adsrvr.org 2 redirects match.adsrvr.org	1 KB
3	yahoo.com pr-bh.ybp.yahoo.com ups.analytics.yahoo.com	3 KB
3	indexww.com js-sec.indexww.com
3	3lift.com 1 redirects tlx.3lift.com eb2.3lift.com	621 B
3	a-mo.net prebid.a-mo.net	988 B
3	quantserve.com 1 redirects secure.quantserve.com pixel.quantserve.com	9 KB
3	google-analytics.com www.google-analytics.com	19 KB
3	amazon-adsystem.com c.amazon-adsystem.com	32 KB
3	googletagservices.com www.googletagservices.com	74 KB
2	everesttech.net 2 redirects sync-tm.everesttech.net	651 B
2	serverbid.com 1 redirects e.serverbid.com sync.serverbid.com	1 KB
2	servenobid.com ads.servenobid.com public.servenobid.com	3 KB
2	lijit.com 1 redirects ap.lijit.com	1 KB
2	google.de www.google.de adservice.google.de	1 KB
2	gstatic.com www.gstatic.com	268 KB
1	adform.net c1.adform.net	187 B
1	dotomi.com aol-match.dotomi.com	104 B
1	digitaloceanspaces.com serverbid-sync.nyc3.cdn.digitaloceanspaces.com
1	reddit.com www.reddit.com	1 KB
1	linkedin.com www.linkedin.com
1	facebook.com graph.facebook.com	581 B
1	twitter.com analytics.twitter.com	651 B
1	ipify.org geo.ipify.org	1 KB
1	t.co t.co	448 B
1	quantcount.com rules.quantcount.com	358 B
1	ads-twitter.com static.ads-twitter.com	2 KB
1	googletagmanager.com www.googletagmanager.com	49 KB
1	kasperskycontenthub.com kasperskycontenthub.com	398 B
199	41

	Domain	Requested by
17	threatpost.com	threatpost.com
14	adserver-us.adtech.advertising.com	9 redirects threatpost.com
11	math-aids-threatpost-tagan.adlightning.com	tagan.adlightning.com
11	vid.connatix.com	cd.connatix.com
11	media.threatpost.com	threatpost.com
9	capi.connatix.com	cd.connatix.com
8	assets.threatpost.com	threatpost.com assets.threatpost.com
7	www.google.com	threatpost.com tagan.adlightning.com
7	qd.admetricspro.com	threatpost.com qd.admetricspro.com
6	pixel.advertising.com	2 redirects
6	tpc.googlesyndication.com	tagan.adlightning.com
6	ib.adnxs.com	qd.admetricspro.com cds.connatix.com
5	teachingaids-d.openx.net	qd.admetricspro.com cds.connatix.com
5	hbopenbid.pubmatic.com	qd.admetricspro.com cds.connatix.com
5	tagan.adlightning.com	threatpost.com tagan.adlightning.com
4	as-sec.casalemedia.com	cds.connatix.com
4	b1ae54670d2110ccdffcb33197cc425f.safeframe.googlesyndication.com	tagan.adlightning.com
4	fastlane.rubiconproject.com	qd.admetricspro.com
4	securepubads.g.doubleclick.net	www.googletagservices.com securepubads.g.doubleclick.net threatpost.com
3	match.adsrvr.org	2 redirects
3	ads.pubmatic.com	cds.connatix.com qd.admetricspro.com
3	js-sec.indexww.com	cds.connatix.com qd.admetricspro.com
3	acdn.adnxs.com	cds.connatix.com qd.admetricspro.com
3	prebid.a-mo.net	qd.admetricspro.com
3	www.google-analytics.com	www.googletagmanager.com www.google-analytics.com threatpost.com
3	cds.connatix.com	threatpost.com tagan.adlightning.com cd.connatix.com
3	c.amazon-adsystem.com	qd.admetricspro.com c.amazon-adsystem.com
3	www.googletagservices.com	threatpost.com securepubads.g.doubleclick.net tagan.adlightning.com
2	eb2.3lift.com	1 redirects qd.admetricspro.com
2	cm.g.doubleclick.net	2 redirects
2	ups.analytics.yahoo.com
2	sync-tm.everesttech.net	2 redirects
2	u.openx.net	cds.connatix.com
2	pagead2.googlesyndication.com	securepubads.g.doubleclick.net
2	ads.adaptv.advertising.com	cds.connatix.com
2	img.connatix.com	threatpost.com
2	pixel.quantserve.com	1 redirects threatpost.com
2	ap.lijit.com	1 redirects qd.admetricspro.com
2	www.gstatic.com	www.google.com
1	c1.adform.net
1	ssum.casalemedia.com	1 redirects
1	aol-match.dotomi.com
1	eus.rubiconproject.com	qd.admetricspro.com
1	serverbid-sync.nyc3.cdn.digitaloceanspaces.com	qd.admetricspro.com
1	sync.serverbid.com	1 redirects
1	eu-u.openx.net	qd.admetricspro.com
1	public.servenobid.com	qd.admetricspro.com
1	pr-bh.ybp.yahoo.com
1	adservice.google.com	tagan.adlightning.com
1	adservice.google.de	tagan.adlightning.com
1	www.reddit.com	threatpost.com
1	www.linkedin.com	threatpost.com
1	graph.facebook.com	threatpost.com
1	analytics.twitter.com	tagan.adlightning.com
1	geo.ipify.org	qd.admetricspro.com
1	tlx.3lift.com	qd.admetricspro.com
1	e.serverbid.com	qd.admetricspro.com
1	ads.servenobid.com	qd.admetricspro.com
1	htlb.casalemedia.com	qd.admetricspro.com
1	www.google.de	threatpost.com
1	stats.g.doubleclick.net	www.google-analytics.com
1	t.co	threatpost.com
1	rules.quantcount.com	secure.quantserve.com
1	static.ads-twitter.com	www.googletagmanager.com
1	secure.quantserve.com	www.googletagmanager.com
1	www.googletagmanager.com	threatpost.com
1	kasperskycontenthub.com	threatpost.com
1	cd.connatix.com	1 redirects
199	68

This site contains links to these domains. Also see Links.

Domain
www.facebook.com
twitter.com
www.linkedin.com
www.youtube.com
feedly.com
www.instagram.com
www.intego.com
attendee.gotowebinar.com
akismet.com
t.co
indd.adobe.com
spotlight.threatpost.com

Subject Issuer	Validity	Valid
threatpost.com DigiCert SHA2 Secure Server CA	`2020-06-10` - `2021-06-15`	a year	crt.sh
*.adlightning.com Amazon	`2020-07-22` - `2021-08-22`	a year	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2020-08-10` - `2021-08-10`	a year	crt.sh
*.g.doubleclick.net GTS CA 1O1	`2020-09-22` - `2020-12-15`	3 months	crt.sh
assets.threatpost.com Amazon	`2020-03-04` - `2021-04-04`	a year	crt.sh
media.threatpost.com Amazon	`2020-03-04` - `2021-04-04`	a year	crt.sh
www.google.com GTS CA 1O1	`2020-10-06` - `2020-12-29`	3 months	crt.sh
*.google.com GTS CA 1O1	`2020-10-06` - `2020-12-29`	3 months	crt.sh
c.amazon-adsystem.com Amazon	`2020-08-04` - `2021-08-02`	a year	crt.sh
*.connatix.com Go Daddy Secure Certificate Authority - G2	`2020-09-29` - `2021-10-19`	a year	crt.sh
kasperskycontenthub.com DigiCert SHA2 Secure Server CA	`2020-06-01` - `2021-06-09`	a year	crt.sh
*.google-analytics.com GTS CA 1O1	`2020-10-06` - `2020-12-29`	3 months	crt.sh
*.gstatic.com GTS CA 1O1	`2020-10-06` - `2020-12-29`	3 months	crt.sh
*.quantserve.com DigiCert SHA2 High Assurance Server CA	`2020-10-02` - `2021-10-07`	a year	crt.sh
ads-twitter.com DigiCert SHA2 High Assurance Server CA	`2020-08-14` - `2021-08-19`	a year	crt.sh
t.co DigiCert SHA2 High Assurance Server CA	`2020-03-05` - `2021-03-02`	a year	crt.sh
www.google.de GTS CA 1O1	`2020-10-06` - `2020-12-29`	3 months	crt.sh
*.adnxs.com DigiCert ECC Secure Server CA	`2019-01-23` - `2021-03-08`	2 years	crt.sh
*.a-mo.net Let's Encrypt Authority X3	`2020-10-07` - `2021-01-05`	3 months	crt.sh
san.casalemedia.com GeoTrust RSA CA 2018	`2020-03-02` - `2021-04-01`	a year	crt.sh
*.lijit.com Go Daddy Secure Certificate Authority - G2	`2020-03-11` - `2021-05-10`	a year	crt.sh
*.rubiconproject.com DigiCert SHA2 Secure Server CA	`2019-01-10` - `2021-01-14`	2 years	crt.sh
*.pubmatic.com Sectigo RSA Organization Validation Secure Server CA	`2019-02-22` - `2021-02-21`	2 years	crt.sh
*.adtech.advertising.com DigiCert SHA2 Secure Server CA	`2020-04-16` - `2022-04-21`	2 years	crt.sh
*.servenobid.com Amazon	`2020-03-12` - `2021-04-12`	a year	crt.sh
*.openx.net GeoTrust RSA CA 2018	`2020-06-18` - `2021-08-17`	a year	crt.sh
e.serverbid.com Let's Encrypt Authority X3	`2020-09-18` - `2020-12-17`	3 months	crt.sh
*.3lift.com Amazon	`2020-07-04` - `2021-08-05`	a year	crt.sh
*.ipify.org COMODO RSA Domain Validation Secure Server CA	`2018-01-24` - `2021-01-23`	3 years	crt.sh
*.twitter.com DigiCert SHA2 High Assurance Server CA	`2020-03-05` - `2021-03-02`	a year	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2020-09-11` - `2020-12-10`	3 months	crt.sh
www.linkedin.com DigiCert SHA2 Secure Server CA	`2020-10-02` - `2021-04-02`	6 months	crt.sh
*.reddit.com DigiCert SHA2 Secure Server CA	`2020-08-26` - `2021-02-22`	6 months	crt.sh
*.google.de GTS CA 1O1	`2020-09-22` - `2020-12-15`	3 months	crt.sh
tpc.googlesyndication.com GTS CA 1O1	`2020-09-22` - `2020-12-15`	3 months	crt.sh
*.v.ssp.yahoo.com DigiCert SHA2 High Assurance Server CA	`2020-07-29` - `2021-01-25`	6 months	crt.sh
cdn.adnxs.com GlobalSign CloudSSL CA - SHA256 - G3	`2020-10-06` - `2021-04-14`	6 months	crt.sh
*.ybp.yahoo.com DigiCert SHA2 High Assurance Server CA	`2020-06-02` - `2020-11-29`	6 months	crt.sh
ups.analytics.yahoo.com DigiCert SHA2 High Assurance Server CA	`2020-05-27` - `2020-11-23`	6 months	crt.sh
pixel.advertising.com DigiCert SHA2 High Assurance Server CA	`2020-10-04` - `2021-03-31`	6 months	crt.sh
public.servenobid.com DigiCert SHA2 Secure Server CA	`2020-08-26` - `2021-08-25`	a year	crt.sh
*.nyc3.cdn.digitaloceanspaces.com DigiCert SHA2 Secure Server CA	`2020-03-11` - `2021-04-14`	a year	crt.sh
*.adsrvr.org Trustwave Organization Validation SHA256 CA, Level 1	`2019-03-07` - `2021-04-19`	2 years	crt.sh
*.dotomi.com GlobalSign RSA OV SSL CA 2018	`2019-06-19` - `2021-08-31`	2 years	crt.sh
track.adform.net DigiCert SHA2 Secure Server CA	`2019-09-16` - `2021-09-20`	2 years	crt.sh

This page contains 27 frames:

Primary Page: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Frame ID: E7E3412BE23B7EEE1D6BA64AC83C776D
Requests: 123 HTTP requests in this frame

Frame: https://cds.connatix.com/p/69601/connatix.player.dc.js
Frame ID: A818E83F27CBD8593AF93EAB26BC6B46
Requests: 40 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6Lfgf_8SAAAAADYbQAnKFOk7cvnWbkqo6y57-4-U&co=aHR0cHM6Ly90aHJlYXRwb3N0LmNvbTo0NDM.&hl=en&v=T9w1ROdplctW2nVKvNJYXH8o&theme=standard&size=normal&cb=7sd9rjjkmcfw
Frame ID: 864AD3D62E861DBDFDC909C59FDB4BD4
Requests: 1 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LehhAETAAAAAAcsm2ZGDsLCqyGhesy4Yn43WNBe&co=aHR0cHM6Ly90aHJlYXRwb3N0LmNvbTo0NDM.&hl=en&v=T9w1ROdplctW2nVKvNJYXH8o&theme=light&size=normal&cb=7vvctmoy3coj
Frame ID: 916ED52F1C8292E6FA323469AFE2D889
Requests: 1 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/bframe?hl=en&v=T9w1ROdplctW2nVKvNJYXH8o&k=6Lfgf_8SAAAAADYbQAnKFOk7cvnWbkqo6y57-4-U&cb=2qhmhvbt1t35
Frame ID: 9D15DE49CB39687D07BDC2798B659B1B
Requests: 1 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/bframe?hl=en&v=T9w1ROdplctW2nVKvNJYXH8o&k=6LehhAETAAAAAAcsm2ZGDsLCqyGhesy4Yn43WNBe&cb=cralyxhfbqss
Frame ID: F5323974B93AC263757FA8CA52A6A6AF
Requests: 1 HTTP requests in this frame

Frame: https://b1ae54670d2110ccdffcb33197cc425f.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html
Frame ID: 3672E2B2A5DD9CF0CDA73484E6F357A0
Requests: 1 HTTP requests in this frame

Frame: https://b1ae54670d2110ccdffcb33197cc425f.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html
Frame ID: 89058721BD1E52388146709C92020E8F
Requests: 1 HTTP requests in this frame

Frame: https://b1ae54670d2110ccdffcb33197cc425f.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html
Frame ID: 909E5BBE014CFFE8012D0AA4515DEFE0
Requests: 1 HTTP requests in this frame

Frame: https://tagan.adlightning.com/math-aids-threatpost/bl-04a3385-60312f65.js
Frame ID: 3809EBB0E719C503F462322010CBEBB7
Requests: 9 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/218/runner.html
Frame ID: 415D911A07D7A47AEF8025A0AD4C3CEF
Requests: 1 HTTP requests in this frame

Frame: https://acdn.adnxs.com/dmp/async_usersync.html
Frame ID: 12F516666B4354CCA48E87E8B77C3CBE
Requests: 1 HTTP requests in this frame

Frame: https://js-sec.indexww.com/um/ixmatch.html
Frame ID: BFA61C768B8416A8C4544E49BAF69666
Requests: 1 HTTP requests in this frame

Frame: https://ads.pubmatic.com/AdServer/js/showad.js
Frame ID: D395E9CE75E4814F02AAC37FC06C5911
Requests: 1 HTTP requests in this frame

Frame: https://u.openx.net/w/1.0/pd
Frame ID: F045EDBFEC8970F5DD83F00255D70D14
Requests: 1 HTTP requests in this frame

Frame: https://ads.pubmatic.com/AdServer/js/showad.js
Frame ID: FF27BE714F028F606E8B2F2C91647A08
Requests: 1 HTTP requests in this frame

Frame: https://u.openx.net/w/1.0/pd
Frame ID: 2D7964EE62F9FC3B2FC2A2C205627C21
Requests: 1 HTTP requests in this frame

Frame: https://acdn.adnxs.com/dmp/async_usersync.html
Frame ID: 7A4C5FF11B6670EAEFEC97DF980B2911
Requests: 1 HTTP requests in this frame

Frame: https://js-sec.indexww.com/um/ixmatch.html
Frame ID: DA7EC63945369D9DF397C293F64B97DA
Requests: 1 HTTP requests in this frame

Frame: https://public.servenobid.com/sync.html
Frame ID: A7E3751E498E084A8D00187FEA5F9053
Requests: 1 HTTP requests in this frame

Frame: https://eb2.3lift.com/sync?&ld=1
Frame ID: A0C9847F7BE00B94BECC8C60E4EB4AD8
Requests: 1 HTTP requests in this frame

Frame: https://ads.pubmatic.com/AdServer/js/showad.js
Frame ID: 304687CE461206E1E97C3C29299EE746
Requests: 1 HTTP requests in this frame

Frame: https://eu-u.openx.net/w/1.0/pd?plm=6&ph=e1b1f5e1-3c2c-4287-9806-317cfbf3bd12&gdpr=0
Frame ID: 3BBA730DFCE5DB15102F18ABFAB8F0E3
Requests: 1 HTTP requests in this frame

Frame: https://serverbid-sync.nyc3.cdn.digitaloceanspaces.com/ss/2000891.html
Frame ID: 1E118A54D13B0B0F38C6AB22D897B452
Requests: 1 HTTP requests in this frame

Frame: https://eus.rubiconproject.com/usync.html
Frame ID: BDF55027EDAA345030512C8734E1B438
Requests: 1 HTTP requests in this frame

Frame: https://js-sec.indexww.com/um/ixmatch.html
Frame ID: E0C4852CAB30C71B4B8EBC01111E7816
Requests: 1 HTTP requests in this frame

Frame: https://acdn.adnxs.com/dmp/async_usersync.html
Frame ID: 92B094E6D0D258537CEEAE63381B4875
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

headers link /rel="https:\/\/api\.w\.org\/"/i

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

headers link /rel="https:\/\/api\.w\.org\/"/i

MySQL (Databases) Expand

Overall confidence: 100%
Detected patterns

headers link /rel="https:\/\/api\.w\.org\/"/i

Nginx (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /nginx(?:\/([\d.]+))?/i

Page Statistics

199
Requests

100 %
HTTPS

37 %
IPv6

41
Domains

68
Subdomains

53
IPs

8
Countries

3306 kB
Transfer

6983 kB
Size

5
Cookies

14 Outgoing links

These are links going to different origins than the main page.

URL: https://www.facebook.com/Threatpost/

Search URL Search Domain Scan URL

URL: https://twitter.com/threatpost/

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/threatpost/

Search URL Search Domain Scan URL

URL: https://www.youtube.com/user/threatpost

Search URL Search Domain Scan URL

URL: https://feedly.com/threatpost

Search URL Search Domain Scan URL

URL: https://www.instagram.com/Threatpost/

Search URL Search Domain Scan URL

URL: https://www.intego.com/mac-security-blog/new-mac-malware-reveals-google-searches-can-be-unsafe/
Title: a posting

Search URL Search Domain Scan URL

URL: https://attendee.gotowebinar.com/register/3265005683762389007?source=ART
Title: June 24 at 2 p.m. ET

Search URL Search Domain Scan URL

URL: https://akismet.com/privacy/
Title: Learn how your comment data is processed

Search URL Search Domain Scan URL

URL: http://twitter.com/search?q=%23Office365
Title: #Office365

Search URL Search Domain Scan URL

URL: https://t.co/SeESd83von
Title: https://t.co/SeESd83von

Search URL Search Domain Scan URL

URL: https://twitter.com/threatpost
Title: Follow @threatpost

Search URL Search Domain Scan URL

URL: https://indd.adobe.com/view/01579c19-a6ca-4cb0-8106-ed4d5d02a292
Title: Advertise With Us

Search URL Search Domain Scan URL

URL: https://spotlight.threatpost.com/
Title: HackerOne Spotlight

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 25

https://cd.connatix.com/connatix.player.js HTTP 302
https://cds.connatix.com/p/69601/connatix.player.dc.js

Request Chain 76

https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166606/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=582f181f43734ee;misc=1603399993941; HTTP 302
https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166606/0/0/ADTECH;cfp=1;rndc=1603399993;v=2;cmd=bid;cors=yes;alias=582f181f43734ee;misc=1603399993941 HTTP 302
https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166606/0/0/ADTECH;apid=1A9a55d298-14a8-11eb-9bab-12e1ea48904a;cfp=1;rndc=1603399993;v=2;cmd=bid;cors=yes;alias=582f181f43734ee;misc=1603399993941

Request Chain 77

https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166847/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=590c455dbc78067;misc=1603399993941; HTTP 302
https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166847/0/0/ADTECH;cfp=1;rndc=1603399993;v=2;cmd=bid;cors=yes;alias=590c455dbc78067;misc=1603399993941 HTTP 302
https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166847/0/0/ADTECH;apid=1A9a56231a-14a8-11eb-88ae-124c2db8624e;cfp=1;rndc=1603399994;v=2;cmd=bid;cors=yes;alias=590c455dbc78067;misc=1603399993941

Request Chain 78

https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166615/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=60201f48068436a;misc=1603399993941; HTTP 302
https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166615/0/0/ADTECH;cfp=1;rndc=1603399993;v=2;cmd=bid;cors=yes;alias=60201f48068436a;misc=1603399993941 HTTP 302
https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166615/0/0/ADTECH;apid=1A9a55e81e-14a8-11eb-8cc1-1212911483a0;cfp=1;rndc=1603399993;v=2;cmd=bid;cors=yes;alias=60201f48068436a;misc=1603399993941

Request Chain 79

https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166612/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=61aa96550d98ad2;misc=1603399993941; HTTP 302
https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166612/0/0/ADTECH;cfp=1;rndc=1603399993;v=2;cmd=bid;cors=yes;alias=61aa96550d98ad2;misc=1603399993941

Request Chain 80

https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166617/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=62a9574647bc3c4;misc=1603399993941; HTTP 302
https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166617/0/0/ADTECH;cfp=1;rndc=1603399993;v=2;cmd=bid;cors=yes;alias=62a9574647bc3c4;misc=1603399993941 HTTP 302
https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166617/0/0/ADTECH;apid=1A9a566af0-14a8-11eb-be94-122675b00be4;cfp=1;rndc=1603399993;v=2;cmd=bid;cors=yes;alias=62a9574647bc3c4;misc=1603399993941

Request Chain 167

https://sync-tm.everesttech.net/upi/pid/m7y5t93k?gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fpixel.advertising.com%2Fups%2F55986%2Fsync%3Fuid%3D%24%7BUSER_ID%7D%26_origin%3D0&gdpr=0&gdpr_consent= HTTP 302
https://sync-tm.everesttech.net/ct/upi/pid/m7y5t93k?gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fpixel.advertising.com%2Fups%2F55986%2Fsync%3Fuid%3D%24%7BUSER_ID%7D%26_origin%3D0&gdpr=0&gdpr_consent=&_test=X5HxPgAAAJ8FG3bL HTTP 302
https://pixel.advertising.com/ups/55986/sync?uid=X5HxPgAAAJ8FG3bL&_origin=0&gdpr=0&gdpr_consent=&_test=X5HxPgAAAJ8FG3bL HTTP 302
https://ups.analytics.yahoo.com/ups/55986/sync?uid=X5HxPgAAAJ8FG3bL&_origin=0&gdpr=0&gdpr_consent=&_test=X5HxPgAAAJ8FG3bL&apid=1A9a566af0-14a8-11eb-be94-122675b00be4

Request Chain 168

https://cm.g.doubleclick.net/pixel?google_nid=adaptv_dbm&google_cm&google_sc HTTP 302
https://pixel.advertising.com/ups/57304/sync?uid=CAESEG20LSDDSK70WOg_cAoRODs&google_cver=1 HTTP 302
https://ups.analytics.yahoo.com/ups/57304/sync?uid=CAESEG20LSDDSK70WOg_cAoRODs&google_cver=1&apid=1A9a566af0-14a8-11eb-be94-122675b00be4

Request Chain 169

https://match.adsrvr.org/track/cmf/generic?ttd_pid=adaptv&ttd_tpi=1 HTTP 302
https://match.adsrvr.org/track/cmb/generic?ttd_pid=adaptv&ttd_tpi=1 HTTP 302
https://pixel.advertising.com/ups/55953/sync?uid=3c55703f-950e-4cbe-888f-820693f3afa9&_origin=1&gdpr=1&gdpr_consent=&piggybackCookie=3c55703f-950e-4cbe-888f-820693f3afa9

Request Chain 172

https://eb2.3lift.com/sync HTTP 302
https://eb2.3lift.com/sync?&ld=1

Request Chain 175

https://sync.serverbid.com/ss/2000891.html HTTP 302
https://serverbid-sync.nyc3.cdn.digitaloceanspaces.com/ss/2000891.html

Request Chain 180

https://cm.g.doubleclick.net/pixel?google_nid=adtech_dbm&google_cm&google_hm=MUE5YTU1ZDI5OC0xNGE4LTExZWItOWJhYi0xMmUxZWE0ODkwNGE%3D&gdpr=1&gdpr_consent=&_origin=0 HTTP 302
https://pixel.advertising.com/ups/55946/sync?uid=CAESEGx3FviE0sr3PeMTOM-M7AI&gdpr=1&gdpr_consent=&_origin=0&google_cver=1

Request Chain 183

https://ssum.casalemedia.com/usermatchredir?s=191503&cb=https%3A%2F%2Fprebid.a-mo.net%2Fsetuid%3FA%3D4c762ce2-848e-4530-919a-2f9644948974%26D%3D%26bidder%3Dindex_rtb%26uid%3D HTTP 302
https://prebid.a-mo.net/setuid?A=4c762ce2-848e-4530-919a-2f9644948974&D=&bidder=index_rtb&uid=X5HxPcbh-dEHVn286ftlbQAA%261209

Request Chain 184

https://pixel.quantserve.com/pixel/p-NcBg8UA4xqUFp.gif?idmatch=0&gdpr=1&gdpr_consent= HTTP 302
https://pixel.advertising.com/ups/55965/sync?_origin=0&gdpr=1&uid=v8DVRuyX306nw4lOupHBEriS1RGnldRB6Z7k-uLF

Request Chain 186

https://ap.lijit.com/pixel?redir=https%3A%2F%2Fprebid.a-mo.net%2Fsetuid%3FA%3D4c762ce2-848e-4530-919a-2f9644948974%26D%3D%26bidder%3Dsovrn%26uid%3D%24UID HTTP 307
https://prebid.a-mo.net/setuid?A=4c762ce2-848e-4530-919a-2f9644948974&D=&bidder=sovrn&uid=8da88ec2cb1a5a30be9082b2

199 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request / Show response
threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/ 79 KB
21 KB 403ms
101ms Document
text/html 35.173.160.135
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-35-173-160-135.compute-1.amazonaws.com

Software

nginx /

Resource Hash

9d80ceda41f19afaa0d772d357ce922e21d82d58d4100feeb90ed853aef69804

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Host: threatpost.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: none
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Server: nginx
Date: Thu, 22 Oct 2020 20:53:12 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: close
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Link: <https://threatpost.com/wp-json/>; rel="https://api.w.org/" <https://threatpost.com/wp-json/wp/v2/posts/156669>; rel="alternate"; type="application/json" <https://threatpost.com/?p=156669>; rel=shortlink
X-Frame-Options: SAMEORIGIN
X-Debug-Auth: off
X-Request-Host: threatpost.com
x-cache-hit: HIT
Content-Encoding: gzip

GET
H/1.1 200
OK main.css
threatpost.com/wp-content/themes/threatpost-2018/assets/css/ 253 KB
39 KB 390ms
190ms Stylesheet
text/css 35.173.160.135
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1603354468
Requested by: Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-173-160-135.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 41f3222c29889fb48f5dca1d481858e5339a759655510c256ef4edf56c80f7f5

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: public
Date: Thu, 22 Oct 2020 20:53:12 GMT
Content-Encoding: gzip
Last-Modified: Thu, 22 Oct 2020 08:14:30 GMT
Server: nginx
ETag: W/"5f913f66-3f2b8"
Transfer-Encoding: chunked
Content-Type: text/css
Cache-Control: max-age=604800, public
Connection: close
Expires: Thu, 29 Oct 2020 20:53:12 GMT

GET
H2 200 op.js Show response
tagan.adlightning.com/math-aids-threatpost/ 37 KB
13 KB 113ms
34ms Script
application/javascript 54.192.206.94
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Requested by: Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 54.192.206.94 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-54-192-206-94.ham50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 373f38b6afa32da2444063cd9121fe75256c3626caaf3ea0bc23b31b1bc0cd87

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 22 Oct 2020 19:58:08 GMT
content-encoding: gzip
age: 3305
x-cache: Hit from cloudfront
status: 200
content-length: 13384
x-amz-meta-git_commit: 9a4f7ce
last-modified: Thu, 22 Oct 2020 19:58:01 GMT
server: AmazonS3
etag: "56e4a8875508ed0c3828f2df1e887a01"
x-amz-version-id: yRiRXtVfLcRFmgydhZsZiW7HbIgZjZHP
via: 1.1 20997ca80e84f6ddda445ba948f015bd.cloudfront.net (CloudFront)
cache-control: max-age=3600
x-amz-cf-pop: HAM50-C3
accept-ranges: bytes
content-type: application/javascript
x-amz-cf-id: pGrkGfQoJsjOf6WhkJXisH_PvUNc4OwGvXPQ9rlzvv3bbaG51kBQYg==

GET
H2 200 ros-layout.js Show response
qd.admetricspro.com/js/threatpost/ 22 KB
3 KB 83ms
22ms Script
application/javascript 2606:4700:e6::ac40:c502
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://qd.admetricspro.com/js/threatpost/ros-layout.js
Requested by: Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:e6::ac40:c502 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7e2b472509d9e149690aba45c5917ebdd2f52471b98d414c2726301b90e08f21

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 22 Oct 2020 20:53:12 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 149
status: 200
cf-request-id: 05f3af5db80000dfc3d1927000000001
last-modified: Thu, 06 Aug 2020 02:14:13 GMT
server: cloudflare
etag: W/"579e-5ac2c0b6aa2e7-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?lkg-colo=71&lkg-time=1603399993"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=14400
cf-ray: 5e661b42cc27dfc3-FRA
expires: Thu, 22 Oct 2020 20:53:58 GMT

GET
H2 200 gpt.js Show response
www.googletagservices.com/tag/js/ 52 KB
18 KB 95ms
42ms Script
text/javascript 2a00:1450:4001:820::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/tag/js/gpt.js

Requested by

Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:820::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

018890d3981a383d72be4b1847c01c9743907947577befbcc6fc01ebb70a6319

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 22 Oct 2020 20:53:12 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "671 / 750 of 1000 / last-modified: 1603365065"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
alt-svc: h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 17696
x-xss-protection: 0
expires: Thu, 22 Oct 2020 20:53:12 GMT

GET
H2 200 cmp.js Show response
qd.admetricspro.com/js/threatpost/ 305 KB
82 KB 103ms
42ms Script
application/javascript 2606:4700:e6::ac40:c502
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://qd.admetricspro.com/js/threatpost/cmp.js
Requested by: Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:e6::ac40:c502 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 73339d824e344121a3039b2e0e9c9353fb8132e005bb6d53249814c213520d5d

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 22 Oct 2020 20:53:12 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 149
status: 200
cf-request-id: 05f3af5db80000dfc39a87a000000001
last-modified: Tue, 06 Oct 2020 19:53:29 GMT
server: cloudflare
etag: W/"4c426-5b105f3f297c7-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?lkg-colo=71&lkg-time=1603399993"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=14400
cf-ray: 5e661b42cc29dfc3-FRA
expires: Thu, 22 Oct 2020 20:53:47 GMT

GET
H2 200 uspcmp.js Show response
qd.admetricspro.com/js/threatpost/ 148 KB
55 KB 88ms
28ms Script
application/javascript 2606:4700:e6::ac40:c502
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://qd.admetricspro.com/js/threatpost/uspcmp.js
Requested by: Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:e6::ac40:c502 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1ae61ed61290f9bf2619f52667aafa622c805072c75765025f0b61a23862005f

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 22 Oct 2020 20:53:12 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 149
status: 200
cf-request-id: 05f3af5db90000dfc3c8b1a000000001
last-modified: Sat, 08 Aug 2020 22:40:07 GMT
server: cloudflare
etag: W/"24e50-5ac65673cef1c-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?lkg-colo=71&lkg-time=1603399993"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=14400
cf-ray: 5e661b42cc2ddfc3-FRA
expires: Thu, 22 Oct 2020 20:53:58 GMT

GET
H2 200 targeting.js Show response
qd.admetricspro.com/js/threatpost/ 275 B
240 B 84ms
24ms Script
application/javascript 2606:4700:e6::ac40:c502
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://qd.admetricspro.com/js/threatpost/targeting.js
Requested by: Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:e6::ac40:c502 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6cdc57f82f4b0d09e5b4e584ca4736cd3871f20563d4ce25120b057d8ffb4eb2

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 22 Oct 2020 20:53:12 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 149
status: 200
cf-request-id: 05f3af5db90000dfc3a3903000000001
last-modified: Sat, 08 Feb 2020 20:49:18 GMT
server: cloudflare
etag: W/"113-59e16a3cfb471-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?lkg-colo=71&lkg-time=1603399993"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=14400
cf-ray: 5e661b42cc2cdfc3-FRA
expires: Thu, 22 Oct 2020 20:53:58 GMT

GET
H2 200 prebid.js Show response
qd.admetricspro.com/js/threatpost/ 399 KB
113 KB 115ms
56ms Script
application/javascript 2606:4700:e6::ac40:c502
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Requested by: Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:e6::ac40:c502 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 25d6fd3b4dcdc05593cab2b4157e21194ada84e5b0de832011246e65d15fe8a9

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 22 Oct 2020 20:53:12 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 149
status: 200
cf-request-id: 05f3af5db90000dfc3a3904000000001
last-modified: Fri, 02 Oct 2020 04:32:28 GMT
server: cloudflare
etag: W/"63c0e-5b0a89ec6a525-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?lkg-colo=71&lkg-time=1603399993"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=14400
cf-ray: 5e661b42cc30dfc3-FRA
expires: Thu, 22 Oct 2020 20:53:48 GMT

GET
H2 200 engine.js Show response
qd.admetricspro.com/js/threatpost/ 28 KB
8 KB 93ms
34ms Script
application/javascript 2606:4700:e6::ac40:c502
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://qd.admetricspro.com/js/threatpost/engine.js
Requested by: Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:e6::ac40:c502 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 747a03fee397ff9cf8a76308966b2cc28f4dd00160af7610bc81ccfcb2836fab

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 22 Oct 2020 20:53:12 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 149
status: 200
cf-request-id: 05f3af5db90000dfc3752d3000000001
last-modified: Fri, 09 Oct 2020 03:25:52 GMT
server: cloudflare
etag: W/"6e56-5b1348179d4a3-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?lkg-colo=71&lkg-time=1603399993"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=14400
cf-ray: 5e661b42cc2fdfc3-FRA
expires: Thu, 22 Oct 2020 20:53:48 GMT

GET
H2 200 /
assets.threatpost.com/wp-content/plugins/bwp-minify/min/ 89 KB
18 KB 387ms
302ms Stylesheet
text/css 2600:9000:2070:8800:2:9275:3d40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-includes/css/dist/block-library/style.min.css,wp-content/plugins/wds-rss-builder/includes/css/select2.min.css,wp-content/plugins/wds-rss-builder/includes/css/wds-rss.css,wp-content/plugins/honeypot-comments/public/assets/css/public.css,wp-content/plugins/kspr_twitter_pullquote/css/style.css,wp-content/plugins/pullquote-shortcode/css/pullquote-shortcode.css,wp-content/plugins/kaspersky-social-sharing/assets/css/style.css,wp-content/plugins/kaspersky-social-sharing/assets/css/custom.css&ver=4e760b19

Requested by

Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2070:8800:2:9275:3d40:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

392cc23864e1d5ec27dc6db139581ea3da476624b962fb3b1f866248f554ae64

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 22 Oct 2020 20:53:13 GMT
content-encoding: gzip
x-amz-cf-pop: HAM50-C3
x-cache: Miss from cloudfront
status: 200
content-length: 18335
x-cache-hit: HIT
last-modified: Thu, 22 Oct 2020 08:14:27 GMT
server: nginx
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: text/css; charset=utf-8
via: 1.1 2a29e84e317dcbf526e3d2cf9be30bf7.cloudfront.net (CloudFront)
cache-control: max-age=86400
x-debug-auth: off
x-request-host: assets.threatpost.com
x-amz-cf-id: yXITYvNPTJ3pf4BhoQ3hdJzzX0xiOP7p27-vCe8ubEthxl1SwcLEsQ==
expires: Fri, 23 Oct 2020 18:51:52 GMT

GET
H/1.1 200
OK jquery.js Show response
threatpost.com/wp-includes/js/jquery/ 95 KB
37 KB 319ms
108ms Script
application/x-javascript 35.173.160.135
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://threatpost.com/wp-includes/js/jquery/jquery.js?ver=1.12.4-wp
Requested by: Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-173-160-135.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 1db21d816296e6939ba1f42962496e4134ae2b0081e26970864c40c6d02bb1df

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: public
Date: Thu, 22 Oct 2020 20:53:12 GMT
Content-Encoding: gzip
Last-Modified: Tue, 01 Sep 2020 19:07:35 GMT
Server: nginx
ETag: W/"5f4e9bf7-17a69"
Transfer-Encoding: chunked
Content-Type: application/x-javascript
Cache-Control: max-age=604800, public
Connection: close
Expires: Thu, 29 Oct 2020 20:53:12 GMT

GET
H2 200 / Show response
assets.threatpost.com/wp-content/plugins/bwp-minify/min/ 177 KB
55 KB 481ms
397ms Script
application/x-javascript 2600:9000:2070:8800:2:9275:3d40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-content/plugins/kaspersky-cookies-notification/scripts/alert_text.js,wp-content/plugins/kaspersky-cookies-notification/scripts/alert.js,wp-content/plugins/honeypot-comments/public/assets/js/public.js,wp-content/plugins/kspr_twitter_pullquote/js/kaspersky-twitter-pullquote.js,wp-content/themes/threatpost-2018/assets/js/main.js,wp-content/themes/threatpost-2018/assets/js/loadmore.js,wp-content/plugins/kaspersky-social-sharing/assets/js/social-share.js&ver=4e760b19

Requested by

Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2070:8800:2:9275:3d40:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

b0209d39595432d762f6ba2a81dc0bffa6a6e1ed9021ba24ffa06c3c7e4bcb02

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 22 Oct 2020 20:53:13 GMT
content-encoding: gzip
x-amz-cf-pop: HAM50-C3
x-cache: Miss from cloudfront
status: 200
content-length: 56256
x-cache-hit: HIT
last-modified: Thu, 22 Oct 2020 08:14:31 GMT
server: nginx
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/x-javascript; charset=utf-8
via: 1.1 2a29e84e317dcbf526e3d2cf9be30bf7.cloudfront.net (CloudFront)
cache-control: max-age=86400
x-debug-auth: off
x-request-host: assets.threatpost.com
x-amz-cf-id: 0mFLVSJT7ohSkXhtGe4QLjOkP7VjdoPGpG4UI8jOX25Us3oGI9NCJw==
expires: Fri, 23 Oct 2020 18:51:53 GMT

GET
H2 200 trojan-malware.jpg
media.threatpost.com/wp-content/uploads/sites/103/2020/01/22100148/ 126 KB
126 KB 70ms
27ms Image
image/jpeg 2600:9000:2204:d400:0:5c46:4f40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media.threatpost.com/wp-content/uploads/sites/103/2020/01/22100148/trojan-malware.jpg
Requested by: Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2204:d400:0:5c46:4f40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 4edf4e4d19fa8ec8abf42e728012fb704a7d8e49a25bbf778b77abd20d90b8ce

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 17 Oct 2020 20:21:34 GMT
via: 1.1 1277de71b2472d19ca0bfc510db9ec54.cloudfront.net (CloudFront), 1.1 d8c5e23736c47a3e5184b0a78042898f.cloudfront.net (CloudFront)
last-modified: Wed, 22 Jan 2020 15:01:49 GMT
server: AmazonS3
age: 433900
etag: "3f035e1c9c491a99670f6755b2e8e29f"
x-cache: Hit from cloudfront
content-type: image/jpeg
status: 200
cache-control: max-age=31536000
x-amz-cf-pop: FRA6-C1, AMS50-C1
accept-ranges: bytes
content-length: 128905
x-amz-cf-id: IhJqaERJpzK4c7QV_r7SvX3-PghvIDZh51ENF_KUEBfQNwOpu7ci_w==
expires: Thu, 21 Jan 2021 15:01:48 GMT

GET
H2 200 api.js Show response
www.google.com/recaptcha/ 850 B
744 B 16ms
15ms Script
text/javascript 2a00:1450:4001:821::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api.js?hl=en

Requested by

Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:821::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

fe00a828c8984aa432d60646922198377e78dba43b704e73ab70d1fd4b9458e9

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 22 Oct 2020 20:53:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: GSE
x-frame-options: SAMEORIGIN
content-type: text/javascript; charset=UTF-8
status: 200
cache-control: private, max-age=300
cross-origin-resource-policy: cross-origin
content-security-policy: frame-ancestors 'self'
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 554
x-xss-protection: 1; mode=block
expires: Thu, 22 Oct 2020 20:53:13 GMT

GET
H2 200 / Show response
assets.threatpost.com/wp-content/plugins/bwp-minify/min/ 2 KB
1 KB 304ms
303ms Script
application/x-javascript 2600:9000:2070:8800:2:9275:3d40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-content/plugins/gravityforms/js/jquery.json.min.js&ver=4e760b19

Requested by

Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2070:8800:2:9275:3d40:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

172314ff74044b918766ed4763279b5e8798622087c0a2930f59c9d44662213d

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 22 Oct 2020 20:53:13 GMT
content-encoding: gzip
x-amz-cf-pop: HAM50-C3
x-cache: Miss from cloudfront
status: 200
content-length: 926
x-cache-hit: HIT
last-modified: Thu, 22 Oct 2020 08:14:28 GMT
server: nginx
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/x-javascript; charset=utf-8
via: 1.1 2a29e84e317dcbf526e3d2cf9be30bf7.cloudfront.net (CloudFront)
cache-control: max-age=86400
x-debug-auth: off
x-request-host: assets.threatpost.com
x-amz-cf-id: ZC0bnrgwXMl-7yUuawxnPadGcNzbRtU-eTM-fw1u9IU01fsod-B5wA==
expires: Fri, 23 Oct 2020 18:51:53 GMT

GET
H/1.1 200
OK gravityforms.min.js Show response
threatpost.com/wp-content/plugins/gravityforms/js/ 34 KB
12 KB 813ms
101ms Script
application/x-javascript 35.173.160.135
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://threatpost.com/wp-content/plugins/gravityforms/js/gravityforms.min.js?ver=2.4.17.15
Requested by: Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-173-160-135.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 3097d0444becd9d089b52b7074072f19201525de874d0775012572fb375b7838

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: public
Date: Thu, 22 Oct 2020 20:53:14 GMT
Content-Encoding: gzip
Last-Modified: Thu, 22 Oct 2020 08:14:28 GMT
Server: nginx
ETag: W/"5f913f64-88c2"
Transfer-Encoding: chunked
Content-Type: application/x-javascript
Cache-Control: max-age=604800, public
Connection: close
Expires: Thu, 29 Oct 2020 20:53:14 GMT

GET
H2 200 / Show response
assets.threatpost.com/wp-content/plugins/bwp-minify/min/ 7 KB
3 KB 307ms
302ms Script
application/x-javascript 2600:9000:2070:8800:2:9275:3d40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-content/plugins/gravityforms/js/conditional_logic.min.js&ver=4e760b19

Requested by

Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2070:8800:2:9275:3d40:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

f75166e3f70100b65a6ce1d4128bc15286e92b19a546fa7709f739e9bcfe52c6

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 22 Oct 2020 20:53:13 GMT
content-encoding: gzip
x-amz-cf-pop: HAM50-C3
x-cache: Miss from cloudfront
status: 200
content-length: 2685
x-cache-hit: HIT
last-modified: Thu, 22 Oct 2020 08:14:25 GMT
server: nginx
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/x-javascript; charset=utf-8
via: 1.1 2a29e84e317dcbf526e3d2cf9be30bf7.cloudfront.net (CloudFront)
cache-control: max-age=86400
x-debug-auth: off
x-request-host: assets.threatpost.com
x-amz-cf-id: UBwYCTlArYOQTVMOm565o9FBa_C0SHYq_OTczLEiNQupO09VsrBUJg==
expires: Fri, 23 Oct 2020 18:51:55 GMT

GET
H2 200 / Show response
assets.threatpost.com/wp-content/plugins/bwp-minify/min/ 5 KB
2 KB 306ms
302ms Script
application/x-javascript 2600:9000:2070:8800:2:9275:3d40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-content/plugins/gravityforms/js/placeholders.jquery.min.js&ver=4e760b19

Requested by

Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2070:8800:2:9275:3d40:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

d62a7b7ec5313469ebff5c006b9068dc44d6d1c122cf787ffa29a10113b34060

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 22 Oct 2020 20:53:13 GMT
content-encoding: gzip
x-amz-cf-pop: HAM50-C3
x-cache: Miss from cloudfront
status: 200
content-length: 1747
x-cache-hit: HIT
last-modified: Thu, 22 Oct 2020 08:14:28 GMT
server: nginx
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/x-javascript; charset=utf-8
via: 1.1 2a29e84e317dcbf526e3d2cf9be30bf7.cloudfront.net (CloudFront)
cache-control: max-age=86400
x-debug-auth: off
x-request-host: assets.threatpost.com
x-amz-cf-id: U1Tr1-9g18zAqr5POJP74D4tZlJ1vGLemAvWSMy5L1bwKFaj5zQZGA==
expires: Fri, 23 Oct 2020 18:51:53 GMT

GET
H3-Q050 200 api.js Show response
www.google.com/recaptcha/ 852 B
749 B 50ms
16ms Script
text/javascript 2a00:1450:4001:821::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api.js?hl=en&render=explicit&ver=5.5.1

Requested by

Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:821::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

db26d6c8b9587ef47481a29cf0980a5573a3bb19a83bd6e74bdbec7b049f4c22

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 22 Oct 2020 20:53:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: GSE
x-frame-options: SAMEORIGIN
content-type: text/javascript; charset=UTF-8
status: 200
cache-control: private, max-age=300
cross-origin-resource-policy: cross-origin
content-security-policy: frame-ancestors 'self'
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 555
x-xss-protection: 1; mode=block
expires: Thu, 22 Oct 2020 20:53:13 GMT

GET
H2 200 / Show response
assets.threatpost.com/wp-content/plugins/bwp-minify/min/ 2 KB
1 KB 306ms
303ms Script
application/x-javascript 2600:9000:2070:8800:2:9275:3d40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-includes/js/wp-embed.min.js,wp-content/plugins/akismet/_inc/form.js&ver=4e760b19

Requested by

Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2070:8800:2:9275:3d40:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

21e46fe44c6929876f5a413c843ae516c0ddfd1aad3e8e33446b7bc0a6781b08

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 22 Oct 2020 20:53:13 GMT
content-encoding: gzip
x-amz-cf-pop: HAM50-C3
x-cache: Miss from cloudfront
status: 200
content-length: 973
x-cache-hit: HIT
last-modified: Tue, 01 Sep 2020 19:07:35 GMT
server: nginx
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/x-javascript; charset=utf-8
via: 1.1 2a29e84e317dcbf526e3d2cf9be30bf7.cloudfront.net (CloudFront)
cache-control: max-age=86400
x-debug-auth: off
x-request-host: assets.threatpost.com
x-amz-cf-id: VLVQdd44zSgnwQobJTZJkuL-JQQDb7o9lQX1GJo9SoI_ToY3RRyAZQ==
expires: Fri, 23 Oct 2020 18:51:53 GMT

GET
H2 200 b-9a4f7ce-a7f6098c.js Show response
tagan.adlightning.com/math-aids-threatpost/ 61 KB
21 KB 34ms
31ms Script
application/javascript 54.192.206.94
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/math-aids-threatpost/b-9a4f7ce-a7f6098c.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 54.192.206.94 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-54-192-206-94.ham50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 0119689800eadf6270855a19b65d74251e7da6be5e4686f36c15bf81281ddb4c

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 16 Oct 2020 23:36:58 GMT
content-encoding: gzip
age: 508576
x-cache: Hit from cloudfront
status: 200
content-length: 20808
x-amz-meta-git_commit: 9a4f7ce
last-modified: Tue, 18 Aug 2020 17:45:57 GMT
server: AmazonS3
etag: "98ae1c21c96b68b5f173604d82c35d5d"
x-amz-version-id: PzdVsYQ0bdCd7Kp..jKBw4vE53Z4BW7z
via: 1.1 20997ca80e84f6ddda445ba948f015bd.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: HAM50-C3
accept-ranges: bytes
content-type: application/javascript
x-amz-cf-id: ZO3lxMvtGKl70nes74KvFDXVCe1XAlvs9gTZif_fmGZc_GQBGoYKiw==

GET
H2 200 bl-04a3385-60312f65.js Show response
tagan.adlightning.com/math-aids-threatpost/ 95 KB
27 KB 34ms
31ms Script
application/javascript 54.192.206.94
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/math-aids-threatpost/bl-04a3385-60312f65.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 54.192.206.94 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-54-192-206-94.ham50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: c717b127e11b9121f5480b91aa00c66637c4b25bad4cc9e09be9e3b452087ede

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 22 Oct 2020 19:58:09 GMT
content-encoding: gzip
age: 3305
x-cache: Hit from cloudfront
status: 200
content-length: 27322
x-amz-meta-git_commit: 04a3385
last-modified: Thu, 22 Oct 2020 19:57:42 GMT
server: AmazonS3
etag: "514d1bb7215c5e149ec8109d385f60b3"
x-amz-version-id: OUQ3wCnzBD141g0QnkPbuoj58Ey7CM1z
via: 1.1 20997ca80e84f6ddda445ba948f015bd.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: HAM50-C3
accept-ranges: bytes
content-type: application/javascript
x-amz-cf-id: Vgh48Cd6jfQLT3DSwLu6q4xtk-nh4n4QVUVsZPh2i5sggHJe3Q1hOw==

GET
H2 200 pubads_impl_2020101901.js Show response
securepubads.g.doubleclick.net/gpt/ 274 KB
97 KB 115ms
57ms Script
text/javascript 216.58.208.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020101901.js

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.58.208.34 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s12-in-f34.1e100.net

Software

sffe /

Resource Hash

426706009141ad5502475bac13c268944bc54a6e772d44bf48f653f711d5915d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

date: Thu, 22 Oct 2020 20:53:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Mon, 19 Oct 2020 08:41:04 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 98358
x-xss-protection: 0
expires: Thu, 22 Oct 2020 20:53:13 GMT

GET
H2 200 vendor-list.json Show response
qd.admetricspro.com/js/cmp2/ 286 KB
30 KB 189ms
175ms XHR
application/json 2606:4700:e6::ac40:c502
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://qd.admetricspro.com/js/cmp2/vendor-list.json
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/cmp.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:e6::ac40:c502 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ec95a631650981cd2ff2eecd07118042dee23fc0a3fd6ed70926fa3d94e4e5d3

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 22 Oct 2020 20:53:13 GMT
content-encoding: br
cf-cache-status: DYNAMIC
nel: {"report_to":"cf-nel","max_age":604800}
status: 200
cf-request-id: 05f3af600d0000d725ef0ad000000001
last-modified: Tue, 06 Oct 2020 19:31:27 GMT
server: cloudflare
etag: W/"4773b-5b105a5302c6b"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?lkg-colo=71&lkg-time=1603399994"}],"group":"cf-nel","max_age":604800}
content-type: application/json
access-control-allow-origin: *
cache-control: max-age=600
cf-ray: 5e661b467d2cd725-FRA
expires: Thu, 22 Oct 2020 21:03:13 GMT

GET
H2 200 apstag.js Show response
c.amazon-adsystem.com/aax2/ 109 KB
28 KB 83ms
28ms Script
application/javascript 52.222.182.122
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/aax2/apstag.js
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/engine.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.222.182.122 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-222-182-122.ham50.r.cloudfront.net
Software: Server /
Resource Hash: 5876f68bf30a82eb99d9ec29e561f5c925ea347243c3e022021dd87823c65813

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 22 Oct 2020 18:11:14 GMT
content-encoding: gzip
server: Server
age: 9718
etag: 0ef1f140246b7e0337b522d7332711d3
x-cache: Hit from cloudfront
content-type: application/javascript
status: 200
cache-control: public, max-age=86400
x-amz-cf-pop: HAM50-C1
accept-ranges: bytes
timing-allow-origin: *
x-amz-cf-id: 4wmVLGu92H6S-g1Mie4Z6y_kVYHyldbqHPNzfUnpVKV5CxcxzgJnpA==
via: 1.1 6c080b1173adbaa14122fac10a76a7c7.cloudfront.net (CloudFront)

GET
H2

200

connatix.player.dc.js Show response
cds.connatix.com/p/69601/ Frame A818
Redirect Chain

https://cd.connatix.com/connatix.player.js
https://cds.connatix.com/p/69601/connatix.player.dc.js

890 KB
220 KB

34ms
28ms

Script
application/javascript

151.101.114.137
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://cds.connatix.com/p/69601/connatix.player.dc.js
Requested by: Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.114.137 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 9ce22df2022b031ce875389b0bc7bbf51cfad0269a259cc67932eed80ec036cd

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 22 Oct 2020 20:53:13 GMT
content-encoding: gzip
age: 41484
x-cache: HIT, HIT
status: 200
content-length: 224472
x-served-by: cache-dca17735-DCA, cache-hhn4047-HHN
access-control-allow-origin: *
last-modified: Thu, 22 Oct 2020 07:34:16 GMT
x-timer: S1603399994.621545,VS0,VE0
etag: "20398eea51d8457dd92a68833c839d7b"
vary: Accept-Encoding
content-type: application/javascript
via: 1.1 varnish, 1.1 varnish
cache-control: max-age=31557600
accept-ranges: bytes
x-cache-hits: 1, 3326

Redirect headers

date: Thu, 22 Oct 2020 20:53:13 GMT
via: 1.1 varnish
server: Varnish
age: 0
x-served-by: cache-hhn4047-HHN
status: 302
x-cache: HIT
location: https://cds.connatix.com/p/69601/connatix.player.dc.js
cache-control: no-cache, no-store, must-revalidate, max-age=0
accept-ranges: bytes
x-timer: S1603399993.445302,VS0,VE0
content-length: 0
retry-after: 0
x-cache-hits: 0

GET
H/1.1 200
OK / Show response
kasperskycontenthub.com/ 0
398 B 407ms
100ms Script
application/javascript 35.173.160.135
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://kasperskycontenthub.com/?dm=ed1f9e435dc885292eab65620c51f3fb&action=load&blogid=103&siteid=1&t=1808874945&back=https%3A%2F%2Fthreatpost.com%2Fshlayer-mac-malware-extra-sneakiness%2F156669%2F%3Fweb_view%3Dtrue

Requested by

Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-35-173-160-135.compute-1.amazonaws.com

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 22 Oct 2020 20:53:13 GMT
X-Content-Type-Options: nosniff
Server: nginx
X-Frame-Options: SAMEORIGIN
Connection: close
Content-Type: application/javascript
x-cache-hit: HIT
Transfer-Encoding: chunked
X-Debug-Auth: off
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Request-Host: kasperskycontenthub.com
X-XSS-Protection: 1; mode=block

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 151 KB
49 KB 38ms
15ms Script
application/javascript 2a00:1450:4001:824::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-PM29HLF

Requested by

Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:824::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

921743387e87c4cdca2d5dfe49779a7a1aa1dae8acc34d29a3ca46ee319710da

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 22 Oct 2020 20:53:13 GMT
content-encoding: br
vary: Accept-Encoding
status: 200
cross-origin-resource-policy: cross-origin
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 49177
x-xss-protection: 0
last-modified: Thu, 22 Oct 2020 18:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 22 Oct 2020 20:53:13 GMT

GET
H/1.1 200
OK icons.svg
threatpost.com/wp-content/themes/threatpost-2018//assets/sprite/ 13 KB
5 KB 714ms
100ms Other
image/svg+xml 35.173.160.135
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://threatpost.com/wp-content/themes/threatpost-2018//assets/sprite/icons.svg
Requested by: Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-173-160-135.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 01864580e1f385dc4512aed0de4b324cc1a04812709e7020e857612fc0ce9f4c

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: public
Date: Thu, 22 Oct 2020 20:53:14 GMT
Content-Encoding: gzip
Last-Modified: Thu, 22 Oct 2020 08:14:27 GMT
Server: nginx
ETag: W/"5f913f63-3496"
Transfer-Encoding: chunked
Content-Type: image/svg+xml
Cache-Control: max-age=604800, public
Connection: close
Expires: Thu, 29 Oct 2020 20:53:14 GMT

GET
H/1.1 200
OK icons.svg
threatpost.com/wp-content/themes/threatpost-2018/assets/sprite/ 13 KB
5 KB 719ms
100ms Other
image/svg+xml 35.173.160.135
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/sprite/icons.svg
Requested by: Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-173-160-135.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 01864580e1f385dc4512aed0de4b324cc1a04812709e7020e857612fc0ce9f4c

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: public
Date: Thu, 22 Oct 2020 20:53:14 GMT
Content-Encoding: gzip
Last-Modified: Thu, 22 Oct 2020 08:14:27 GMT
Server: nginx
ETag: W/"5f913f63-3496"
Transfer-Encoding: chunked
Content-Type: image/svg+xml
Cache-Control: max-age=604800, public
Connection: close
Expires: Thu, 29 Oct 2020 20:53:14 GMT

GET
H/1.1 200
OK logo.png
threatpost.com/wp-content/themes/threatpost-2018/assets/images/ 19 KB
19 KB 715ms
100ms Image
image/png 35.173.160.135
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/images/logo.png
Requested by: Host: threatpost.com
URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1603354468
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-173-160-135.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 39af7c1116fb967a330e8770f775e6b5ee871add01ed45c98a1634911cebfb0a

Request headers

Referer: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1603354468
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: public
Date: Thu, 22 Oct 2020 20:53:14 GMT
Last-Modified: Thu, 22 Oct 2020 08:14:27 GMT
Server: nginx
ETag: "5f913f63-4a32"
Content-Type: image/png
Cache-Control: max-age=604800, public
Connection: close
Accept-Ranges: bytes
Content-Length: 18994
Expires: Thu, 29 Oct 2020 20:53:14 GMT

GET
H/1.1 200
OK museosans-700-webfont.woff2
threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/ 20 KB
21 KB 244ms
185ms Font
font/woff2 35.173.160.135
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/museosans-700-webfont.woff2
Requested by: Host: threatpost.com
URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1603354468
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-173-160-135.compute-1.amazonaws.com
Software: nginx /
Resource Hash: ae00ae9c862bc8b8923efd1d9a18befa912678a869d4dd01179a59ed3de731be

Request headers

Origin: https://threatpost.com
Referer: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1603354468
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: public
Date: Thu, 22 Oct 2020 20:53:13 GMT
Last-Modified: Thu, 22 Oct 2020 08:14:30 GMT
Server: nginx
ETag: "5f913f66-51a4"
Content-Type: font/woff2
Access-Control-Allow-Origin: *
Cache-Control: max-age=31536000, public
Connection: close
Accept-Ranges: bytes
Content-Length: 20900
Expires: Fri, 22 Oct 2021 20:53:13 GMT

GET
H/1.1 200
OK museosans-100-webfont.woff2
threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/ 20 KB
21 KB 280ms
101ms Font
font/woff2 35.173.160.135
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/museosans-100-webfont.woff2
Requested by: Host: threatpost.com
URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1603354468
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-173-160-135.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 06fc565587b8b700936a1677218cb269a6cc31ca5f701eb45461e86a3d54d5c7

Request headers

Origin: https://threatpost.com
Referer: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1603354468
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: public
Date: Thu, 22 Oct 2020 20:53:13 GMT
Last-Modified: Thu, 22 Oct 2020 08:14:27 GMT
Server: nginx
ETag: "5f913f63-50c8"
Content-Type: font/woff2
Access-Control-Allow-Origin: *
Cache-Control: max-age=31536000, public
Connection: close
Accept-Ranges: bytes
Content-Length: 20680
Expires: Fri, 22 Oct 2021 20:53:13 GMT

GET
H/1.1 200
OK museosans-300-webfont.woff2
threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/ 20 KB
21 KB 283ms
100ms Font
font/woff2 35.173.160.135
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/museosans-300-webfont.woff2
Requested by: Host: threatpost.com
URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1603354468
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-173-160-135.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 45ddc09b0ad6ab916bd9a0282070b161045e186fc025303f4aa1aa821fc45ac7

Request headers

Origin: https://threatpost.com
Referer: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1603354468
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: public
Date: Thu, 22 Oct 2020 20:53:13 GMT
Last-Modified: Thu, 22 Oct 2020 08:14:27 GMT
Server: nginx
ETag: "5f913f63-51b8"
Content-Type: font/woff2
Access-Control-Allow-Origin: *
Cache-Control: max-age=31536000, public
Connection: close
Accept-Ranges: bytes
Content-Length: 20920
Expires: Fri, 22 Oct 2021 20:53:13 GMT

GET
H/1.1 200
OK museosans-500-webfont.woff2
threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/ 20 KB
21 KB 376ms
187ms Font
font/woff2 35.173.160.135
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/museosans-500-webfont.woff2
Requested by: Host: threatpost.com
URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1603354468
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-173-160-135.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 2de77164bb9924542e1dea4ee4a0ff27d40b51a3d7939dac7db11a95045c9b7d

Request headers

Origin: https://threatpost.com
Referer: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1603354468
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: public
Date: Thu, 22 Oct 2020 20:53:13 GMT
Last-Modified: Thu, 22 Oct 2020 08:14:30 GMT
Server: nginx
ETag: "5f913f66-5194"
Content-Type: font/woff2
Access-Control-Allow-Origin: *
Cache-Control: max-age=31536000, public
Connection: close
Accept-Ranges: bytes
Content-Length: 20884
Expires: Fri, 22 Oct 2021 20:53:13 GMT

GET
H/1.1 200
OK museosans-700italic-webfont.woff2
threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/ 15 KB
16 KB 391ms
189ms Font
font/woff2 35.173.160.135
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/museosans-700italic-webfont.woff2
Requested by: Host: threatpost.com
URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1603354468
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-173-160-135.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 859faa9b9ed0990288b2f393a102b1fe2668ac79088b113b6f0beaee521221eb

Request headers

Origin: https://threatpost.com
Referer: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1603354468
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: public
Date: Thu, 22 Oct 2020 20:53:13 GMT
Last-Modified: Thu, 22 Oct 2020 08:14:27 GMT
Server: nginx
ETag: "5f913f63-3dcc"
Content-Type: font/woff2
Access-Control-Allow-Origin: *
Cache-Control: max-age=31536000, public
Connection: close
Accept-Ranges: bytes
Content-Length: 15820
Expires: Fri, 22 Oct 2021 20:53:13 GMT

GET
H2 200 recaptcha__en.js Show response
www.gstatic.com/recaptcha/releases/T9w1ROdplctW2nVKvNJYXH8o/ 341 KB
134 KB 26ms
6ms Script
text/javascript 2a00:1450:4001:816::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/T9w1ROdplctW2nVKvNJYXH8o/recaptcha__en.js

Requested by

Host: www.google.com
URL: https://www.google.com/recaptcha/api.js?hl=en

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:816::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

54f3aa37078dcd01911c9da1a5fd753b5834dde5acfd90c5bd55243bba87cf6d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://threatpost.com
Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 22 Oct 2020 20:05:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 2887
status: 200
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 136962
x-xss-protection: 0
last-modified: Mon, 12 Oct 2020 04:11:53 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Fri, 22 Oct 2021 20:05:06 GMT

GET
H/1.1 200
OK mail-plane-light.svg
threatpost.com/wp-content/themes/threatpost-2018/assets/images/ 828 B
722 B 417ms
106ms Image
image/svg+xml 35.173.160.135
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/images/mail-plane-light.svg
Requested by: Host: threatpost.com
URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1603354468
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-173-160-135.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 5a7ed822968963e31d88424c96387ad9f4fd4f4b5a5b581a33f65e3784d162cf

Request headers

Referer: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1603354468
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: public
Date: Thu, 22 Oct 2020 20:53:13 GMT
Content-Encoding: gzip
Last-Modified: Thu, 22 Oct 2020 08:14:27 GMT
Server: nginx
ETag: W/"5f913f63-33c"
Transfer-Encoding: chunked
Content-Type: image/svg+xml
Cache-Control: max-age=604800, public
Connection: close
Expires: Thu, 29 Oct 2020 20:53:13 GMT

GET
H/1.1 200
OK twitter-blue.svg
threatpost.com/wp-content/themes/threatpost-2018/assets/images/ 868 B
847 B 525ms
99ms Image
image/svg+xml 35.173.160.135
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/images/twitter-blue.svg
Requested by: Host: threatpost.com
URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1603354468
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-173-160-135.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 420508fc523520f35de5c851905543294123d7676b5a5668744691f2abe9e730

Request headers

Referer: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1603354468
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: public
Date: Thu, 22 Oct 2020 20:53:14 GMT
Content-Encoding: gzip
Last-Modified: Thu, 22 Oct 2020 08:14:30 GMT
Server: nginx
ETag: W/"5f913f66-364"
Transfer-Encoding: chunked
Content-Type: image/svg+xml
Cache-Control: max-age=604800, public
Connection: close
Expires: Thu, 29 Oct 2020 20:53:14 GMT

GET
H/1.1 200
OK museosans-300italic-webfont.woff2
threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/ 23 KB
23 KB 189ms
102ms Font
font/woff2 35.173.160.135
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/fonts/museosans-300italic-webfont.woff2
Requested by: Host: threatpost.com
URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1603354468
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-173-160-135.compute-1.amazonaws.com
Software: nginx /
Resource Hash: f8a2b5b62eb722c3379b30cf0cc58d3176ee6be48036d6ad2aa838d2029c4189

Request headers

Origin: https://threatpost.com
Referer: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1603354468
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: public
Date: Thu, 22 Oct 2020 20:53:13 GMT
Last-Modified: Thu, 22 Oct 2020 08:14:27 GMT
Server: nginx
ETag: "5f913f63-5bac"
Content-Type: font/woff2
Access-Control-Allow-Origin: *
Cache-Control: max-age=31536000, public
Connection: close
Accept-Ranges: bytes
Content-Length: 23468
Expires: Fri, 22 Oct 2021 20:53:13 GMT

GET
H2 200 Tara-headshot.jpg
media.threatpost.com/wp-content/uploads/sites/103/2018/08/15114841/ 13 KB
13 KB 23ms
19ms Image
image/jpeg 2600:9000:2204:d400:0:5c46:4f40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media.threatpost.com/wp-content/uploads/sites/103/2018/08/15114841/Tara-headshot.jpg
Requested by: Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2204:d400:0:5c46:4f40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 89ce08431545cd3c6d42419d99ee0152027a68c1d0c7c82838cc9a51d9d52451

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 01 Oct 2020 00:04:39 GMT
via: 1.1 eb1a8c1b1275e33a016e623478052111.cloudfront.net (CloudFront), 1.1 d8c5e23736c47a3e5184b0a78042898f.cloudfront.net (CloudFront)
last-modified: Fri, 17 Aug 2018 16:22:08 GMT
server: AmazonS3
age: 1889315
etag: "dee18dfeea6de13bec60c1e5237eb723"
x-cache: Hit from cloudfront
content-type: image/jpeg
status: 200
cache-control: max-age=31536000
x-amz-cf-pop: FRA2-C2, AMS50-C1
accept-ranges: bytes
content-length: 13097
x-amz-cf-id: 02OoFYaQQewuM8wFYbHuOH4vYXOTFljJcWvkeB0Y_2nZK4XTQfZrGg==
expires: Sat, 17 Aug 2019 16:22:07 GMT

GET
H2 200 subscribe2.jpg
media.threatpost.com/wp-content/uploads/sites/103/2019/02/19151457/ 8 KB
9 KB 22ms
18ms Image
image/jpeg 2600:9000:2204:d400:0:5c46:4f40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media.threatpost.com/wp-content/uploads/sites/103/2019/02/19151457/subscribe2.jpg
Requested by: Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2204:d400:0:5c46:4f40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: aa64fa30a3263fa3105736228a6feaaa4f7d32d8ef96b12e56f6fb95511b66a7

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 22 Sep 2020 08:11:35 GMT
via: 1.1 1e498d046330e15095a1a2a958463bf5.cloudfront.net (CloudFront), 1.1 d8c5e23736c47a3e5184b0a78042898f.cloudfront.net (CloudFront)
last-modified: Tue, 19 Feb 2019 20:14:58 GMT
server: AmazonS3
age: 2637699
etag: "5ba45563f793f39ef6baf02645651654"
x-cache: Hit from cloudfront
content-type: image/jpeg
status: 200
cache-control: max-age=31536000
x-amz-cf-pop: FRA2-C2, AMS50-C1
accept-ranges: bytes
content-length: 8281
x-amz-cf-id: 1AKkjJ4hWuhS5Lhwbry0QuHJPzhpPnxcvWafq_VVpMju-XE-874r8w==
expires: Wed, 19 Feb 2020 20:14:57 GMT

GET
H2 200 Rat3-540x270.jpg
media.threatpost.com/wp-content/uploads/sites/103/2020/10/19124728/ 13 KB
14 KB 42ms
39ms Image
image/jpeg 2600:9000:2204:d400:0:5c46:4f40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media.threatpost.com/wp-content/uploads/sites/103/2020/10/19124728/Rat3-540x270.jpg
Requested by: Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2204:d400:0:5c46:4f40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: e2d7133e621e56f0d57a39f36ec3fa2a93fd5e33cf167d01fe9cf56fb4d04eed

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 19 Oct 2020 17:35:52 GMT
via: 1.1 62dc260e32d7b9197a4511447f6a264a.cloudfront.net (CloudFront), 1.1 d8c5e23736c47a3e5184b0a78042898f.cloudfront.net (CloudFront)
last-modified: Mon, 19 Oct 2020 17:02:58 GMT
server: AmazonS3
age: 271042
etag: "97ae4939075f0b09ddb9dcd2f5eea335"
x-cache: Hit from cloudfront
content-type: image/jpeg
status: 200
cache-control: max-age=31536000
x-amz-cf-pop: FRA6-C1, AMS50-C1
accept-ranges: bytes
content-length: 13618
x-amz-cf-id: -zNPmDpg0wsTm0zKyZ4KNtM6o1Koi40lxSrj17xmclPIalfRI9QwOg==
expires: Tue, 19 Oct 2021 17:02:55 GMT

GET
H2 200 cash-1-540x270.jpg
media.threatpost.com/wp-content/uploads/sites/103/2020/07/06130944/ 64 KB
65 KB 36ms
33ms Image
image/jpeg 2600:9000:2204:d400:0:5c46:4f40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media.threatpost.com/wp-content/uploads/sites/103/2020/07/06130944/cash-1-540x270.jpg
Requested by: Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2204:d400:0:5c46:4f40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: e6e8da7667cb5883b577c5d18614e703eacbe633b38112033220fe53c33d4009

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 13 Oct 2020 19:02:16 GMT
via: 1.1 89c822bb1ce1445a7be6d1057088cfbf.cloudfront.net (CloudFront), 1.1 d8c5e23736c47a3e5184b0a78042898f.cloudfront.net (CloudFront)
last-modified: Mon, 06 Jul 2020 17:10:03 GMT
server: AmazonS3
age: 784258
etag: "0bb8f0633c395c7e98740bf6ef0be2ec"
x-cache: Hit from cloudfront
content-type: image/jpeg
status: 200
cache-control: max-age=31536000
x-amz-cf-pop: FRA6-C1, AMS50-C1
accept-ranges: bytes
content-length: 66028
x-amz-cf-id: cZvEUb1pbZwZFwnVgPAR2msnB3oTdbCEhonl7MaU01rRTk7jOZnzmA==
expires: Tue, 06 Jul 2021 17:09:59 GMT

GET
H2 200 Wiper_Fire_Destruction-540x270.jpg
media.threatpost.com/wp-content/uploads/sites/103/2018/05/10063440/ 18 KB
18 KB 30ms
27ms Image
image/jpeg 2600:9000:2204:d400:0:5c46:4f40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media.threatpost.com/wp-content/uploads/sites/103/2018/05/10063440/Wiper_Fire_Destruction-540x270.jpg
Requested by: Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2204:d400:0:5c46:4f40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 0eb6e092b4af892f8a7c5c81d4b0ce2e0fc9b9a5430743609e41f478a91f9b5a

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 08 Oct 2020 17:28:08 GMT
via: 1.1 12c16baed6578bf50fb0eaa233f2bc84.cloudfront.net (CloudFront), 1.1 d8c5e23736c47a3e5184b0a78042898f.cloudfront.net (CloudFront)
last-modified: Tue, 03 Jul 2018 02:33:52 GMT
server: AmazonS3
age: 1221906
etag: "c640ade8e8bde204f7fbe884e9d7c0cb"
x-cache: Hit from cloudfront
content-type: image/jpeg
status: 200
cache-control: max-age=31536000
x-amz-cf-pop: FRA53-C1, AMS50-C1
accept-ranges: bytes
content-length: 18217
x-amz-cf-id: lHk2shvR7XNXYmgq-IfDC0ML7TseHEif1xD0awt3zcyfRqfcahtGsg==
expires: Wed, 03 Jul 2019 02:33:50 GMT

GET
H2 200 voting-64x64.jpeg
media.threatpost.com/wp-content/uploads/sites/103/2020/08/20152536/ 2 KB
3 KB 22ms
20ms Image
image/jpeg 2600:9000:2204:d400:0:5c46:4f40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media.threatpost.com/wp-content/uploads/sites/103/2020/08/20152536/voting-64x64.jpeg
Requested by: Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2204:d400:0:5c46:4f40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 680c268c211b81fee63bd2133ddeca118e1bb9ba9f5ad107e98b3c4d230bf28c

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 21 Oct 2020 13:48:50 GMT
via: 1.1 21da0a66bafe2c8de8be4a4d8039346b.cloudfront.net (CloudFront), 1.1 d8c5e23736c47a3e5184b0a78042898f.cloudfront.net (CloudFront)
last-modified: Thu, 20 Aug 2020 19:26:03 GMT
server: AmazonS3
age: 111864
etag: "9293f3ef83c25d01935212cace875cd7"
x-cache: Hit from cloudfront
content-type: image/jpeg
status: 200
cache-control: max-age=31536000
x-amz-cf-pop: FRA6-C1, AMS50-C1
accept-ranges: bytes
content-length: 2112
x-amz-cf-id: 5KYT5uqwzhRCk0LgHMz_EfWbVECHA7963WJKwgYlOLKGmPFkf1CkoA==
expires: Fri, 20 Aug 2021 19:26:00 GMT

GET
H2 200 QR-Code-64x64.png
media.threatpost.com/wp-content/uploads/sites/103/2020/09/15133828/ 8 KB
9 KB 28ms
25ms Image
image/png 2600:9000:2204:d400:0:5c46:4f40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media.threatpost.com/wp-content/uploads/sites/103/2020/09/15133828/QR-Code-64x64.png
Requested by: Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2204:d400:0:5c46:4f40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 9f4d5cca9c79886cc27246836d97c89aaf7853b2a42b09801660cb9a3df67424

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 15 Sep 2020 19:19:50 GMT
via: 1.1 06d36e78e8dfd9468327f09115761a9e.cloudfront.net (CloudFront), 1.1 d8c5e23736c47a3e5184b0a78042898f.cloudfront.net (CloudFront)
last-modified: Tue, 15 Sep 2020 17:58:41 GMT
server: AmazonS3
age: 3202404
etag: "f2a1360e4c2d784aff00a9f87f6bb703"
x-cache: Hit from cloudfront
content-type: image/png
status: 200
cache-control: max-age=31536000
x-amz-cf-pop: FRA2-C2, AMS50-C1
accept-ranges: bytes
content-length: 8421
x-amz-cf-id: OpB27Kw-EFY-ks9cGFCjuKtxhtEP6oHoNipE-K_YCom9TougMImJDw==
expires: Wed, 15 Sep 2021 17:58:37 GMT

GET
H2 200 botnet-64x64.jpg
media.threatpost.com/wp-content/uploads/sites/103/2019/11/14090552/ 2 KB
2 KB 23ms
21ms Image
image/jpeg 2600:9000:2204:d400:0:5c46:4f40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media.threatpost.com/wp-content/uploads/sites/103/2019/11/14090552/botnet-64x64.jpg
Requested by: Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2204:d400:0:5c46:4f40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 6ceb2be119d08740867f19d7f3e5c2230050de29e4eb48a588b86af1a5b7db57

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 29 Sep 2020 17:17:17 GMT
via: 1.1 50f438df6dbb947f3e4702890bc9cc06.cloudfront.net (CloudFront), 1.1 d8c5e23736c47a3e5184b0a78042898f.cloudfront.net (CloudFront)
last-modified: Thu, 14 Nov 2019 14:06:22 GMT
server: AmazonS3
age: 2000157
etag: "985f90dddb9367ad3b074a54645a8bc3"
x-cache: Hit from cloudfront
content-type: image/jpeg
status: 200
cache-control: max-age=31536000
x-amz-cf-pop: DUS51-C1, AMS50-C1
accept-ranges: bytes
content-length: 1866
x-amz-cf-id: zYq-angIYaYzxvW7SZU9gUeTnrGX0EeqYZjEI5tevzI3VMYL20jTsQ==
expires: Fri, 13 Nov 2020 14:06:19 GMT

GET
H2 200 work-from-home-64x64.jpg
media.threatpost.com/wp-content/uploads/sites/103/2020/09/18135511/ 2 KB
2 KB 26ms
24ms Image
image/jpeg 2600:9000:2204:d400:0:5c46:4f40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media.threatpost.com/wp-content/uploads/sites/103/2020/09/18135511/work-from-home-64x64.jpg
Requested by: Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2204:d400:0:5c46:4f40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 3435531b595fb1b2b529346e1df8c979a1fd727f56ea8c0d792316035440cac5

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 18 Sep 2020 17:57:04 GMT
via: 1.1 8033f9c6b87a03b2eca7c2db5157e10e.cloudfront.net (CloudFront), 1.1 d8c5e23736c47a3e5184b0a78042898f.cloudfront.net (CloudFront)
last-modified: Fri, 18 Sep 2020 17:55:32 GMT
server: AmazonS3
age: 2948170
etag: "fd4942a0704785b24b44d177f4a57d86"
x-cache: Hit from cloudfront
content-type: image/jpeg
status: 200
cache-control: max-age=31536000
x-amz-cf-pop: DUS51-C1, AMS50-C1
accept-ranges: bytes
content-length: 2098
x-amz-cf-id: Iyt_edNezOVgNr-LL4y5SJdugUbNSxZXsXSBbQNMkGaQND7MXTLp-g==
expires: Sat, 18 Sep 2021 17:55:28 GMT

GET
H2 200 zero-trust-b_w-64x64.jpg
media.threatpost.com/wp-content/uploads/sites/103/2020/09/07100716/ 3 KB
3 KB 23ms
21ms Image
image/jpeg 2600:9000:2204:d400:0:5c46:4f40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://media.threatpost.com/wp-content/uploads/sites/103/2020/09/07100716/zero-trust-b_w-64x64.jpg
Requested by: Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2204:d400:0:5c46:4f40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 039f2a12a4fefd4b33bcae31f1f2f17d12cf51f4e6301792ada3885f412a2761

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 07 Sep 2020 14:12:42 GMT
via: 1.1 ec9e3bc729d9c6d55ed32446408ad62f.cloudfront.net (CloudFront), 1.1 d8c5e23736c47a3e5184b0a78042898f.cloudfront.net (CloudFront)
last-modified: Mon, 07 Sep 2020 14:07:21 GMT
server: AmazonS3
age: 3912032
etag: "5fb2f76c4c77c7e774eb0dc933ab39f0"
x-cache: Hit from cloudfront
content-type: image/jpeg
status: 200
cache-control: max-age=31536000
x-amz-cf-pop: FRA2-C2, AMS50-C1
accept-ranges: bytes
content-length: 2602
x-amz-cf-id: RlQNdWL8lpa5TR4obFwVk0A44ye1xPWH0QGImkjbtMhGYwOhmHo2AQ==
expires: Tue, 07 Sep 2021 14:07:19 GMT

GET
H/1.1 200
OK mail-plane-large-dark.svg
threatpost.com/wp-content/themes/threatpost-2018/assets/images/ 812 B
722 B 296ms
99ms Image
image/svg+xml 35.173.160.135
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/images/mail-plane-large-dark.svg
Requested by: Host: threatpost.com
URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1603354468
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-173-160-135.compute-1.amazonaws.com
Software: nginx /
Resource Hash: a9d2b2df99c1a115d5394c70a898d8801092208dc582f8bd6fb01b35c30d6b22

Request headers

Referer: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1603354468
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: public
Date: Thu, 22 Oct 2020 20:53:14 GMT
Content-Encoding: gzip
Last-Modified: Thu, 22 Oct 2020 08:14:30 GMT
Server: nginx
ETag: W/"5f913f66-32c"
Transfer-Encoding: chunked
Content-Type: image/svg+xml
Cache-Control: max-age=604800, public
Connection: close
Expires: Thu, 29 Oct 2020 20:53:14 GMT

GET
H/1.1 200
OK logo-white.png
threatpost.com/wp-content/themes/threatpost-2018/assets/images/ 10 KB
10 KB 296ms
99ms Image
image/png 35.173.160.135
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/images/logo-white.png
Requested by: Host: threatpost.com
URL: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1603354468
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.173.160.135 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-35-173-160-135.compute-1.amazonaws.com
Software: nginx /
Resource Hash: e4058d4ee9da1ceaddfa91ddb63650ba67285f1bbfee487d9dfe648bced669a0

Request headers

Referer: https://threatpost.com/wp-content/themes/threatpost-2018/assets/css/main.css?v=1603354468
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: public
Date: Thu, 22 Oct 2020 20:53:14 GMT
Last-Modified: Thu, 22 Oct 2020 08:14:30 GMT
Server: nginx
ETag: "5f913f66-260a"
Content-Type: image/png
Cache-Control: max-age=604800, public
Connection: close
Accept-Ranges: bytes
Content-Length: 9738
Expires: Thu, 29 Oct 2020 20:53:14 GMT

GET
H2 200 aps_csm.js Show response
c.amazon-adsystem.com/bao-csm/aps-comm/ 6 KB
3 KB 89ms
26ms XHR
application/javascript 52.222.182.122
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/bao-csm/aps-comm/aps_csm.js
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.222.182.122 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-222-182-122.ham50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 22 Oct 2020 00:16:15 GMT
content-encoding: gzip
vary: Origin
age: 74219
x-cache: Hit from cloudfront
status: 200
access-control-allow-origin: *
last-modified: Wed, 30 Sep 2020 05:43:29 GMT
server: AmazonS3
etag: "a4d296427fc806b21335359e398c025c"
access-control-max-age: 3000
access-control-allow-methods: GET
content-type: application/javascript
via: 1.1 445645406967c3b88124f0bfd26a1030.cloudfront.net (CloudFront)
cache-control: public, max-age=86400
x-amz-cf-pop: HAM50-C1
x-amz-cf-id: 5KV9is1g3we13qi3VSx2UaiB1MpzWGUlzysTugrAwMWuMmBZ-WDuBA==

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 45 KB
19 KB 27ms
6ms Script
text/javascript 2a00:1450:4001:824::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PM29HLF

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:824::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

60863e86aa7743d1ac841da7f473a05cd57fba81d661cef658e385437f80d5ef

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 09 Sep 2020 01:50:37 GMT
server: Golfe2
age: 5845
date: Thu, 22 Oct 2020 19:15:48 GMT
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 18650
expires: Thu, 22 Oct 2020 21:15:48 GMT

GET
H2 200 quant.js Show response
secure.quantserve.com/ 23 KB
9 KB 27ms
8ms Script
application/javascript 2620:116:800d:21:36a9:ecb:e518:b308
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://secure.quantserve.com/quant.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PM29HLF
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2620:116:800d:21:36a9:ecb:e518:b308 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: 87d73170be9a2e277c57d324c4e05ec0ac60ed3c0191fa29e7a31133b4c4c119

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 22 Oct 2020 20:53:13 GMT
content-encoding: gzip
etag: "O/+l6c17R2TQ0JQMJXOiXA=="
vary: Accept-Encoding
content-type: application/javascript
status: 200
cache-control: private, max-age=604800
accept-ranges: bytes
expires: Thu, 29 Oct 2020 20:53:13 GMT

GET
H2 200 uwt.js Show response
static.ads-twitter.com/ 5 KB
2 KB 70ms
24ms Script
application/javascript 151.101.112.157
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://static.ads-twitter.com/uwt.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-PM29HLF
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.112.157 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 8247f4332667950989fe6bf790f87723343db2ec83d975503e9c5dc13a6eb5dc

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 22 Oct 2020 20:53:13 GMT
content-encoding: gzip
age: 84042
x-cache: HIT
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
status: 200
content-length: 1958
x-served-by: cache-hhn4076-HHN
last-modified: Mon, 10 Aug 2020 18:10:59 GMT
x-timer: S1603399994.779327,VS0,VE0
etag: "a4cc3f907681b24a3efd540acd5d2996+gzip"
vary: Accept-Encoding,Host
content-type: application/javascript; charset=utf-8
via: 1.1 varnish
cache-control: no-cache
accept-ranges: bytes

GET
H2 200 connatix.player.css
cds.connatix.com/p/69601/ 54 KB
9 KB 24ms
24ms Stylesheet
text/css 151.101.114.137
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://cds.connatix.com/p/69601/connatix.player.css
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.114.137 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 3e3bed6d3324b9b6076462d26269e9ac5f39df2627a1554dffa00e071e5cec28

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 22 Oct 2020 20:53:13 GMT
content-encoding: gzip
age: 41483
x-cache: HIT, HIT
status: 200
content-length: 8798
x-served-by: cache-dca17775-DCA, cache-hhn4047-HHN
access-control-allow-origin: *
last-modified: Thu, 22 Oct 2020 07:34:16 GMT
x-timer: S1603399994.787929,VS0,VE0
etag: "0dd96801331fec84b0ba4a8a2a695960"
vary: Accept-Encoding
content-type: text/css
via: 1.1 varnish, 1.1 varnish
cache-control: max-age=31557600
accept-ranges: bytes
x-cache-hits: 1, 3807

GET
H2 200 rules-p-_7kVx0t9Jqj90.js Show response
rules.quantcount.com/ 3 B
358 B 152ms
119ms Script
application/x-javascript 2600:9000:2093:1a00:6:44e3:f8c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://rules.quantcount.com/rules-p-_7kVx0t9Jqj90.js
Requested by: Host: secure.quantserve.com
URL: https://secure.quantserve.com/quant.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2093:1a00:6:44e3:f8c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 22 Oct 2020 20:50:17 GMT
via: 1.1 7b39f60eed6e589bf869ce2ecfe6ab8c.cloudfront.net (CloudFront)
last-modified: Fri, 03 Mar 2017 23:52:35 GMT
server: AmazonS3
age: 177
etag: "8a80554c91d9fca8acb82f023de02f11"
x-cache: Error from cloudfront
content-type: application/x-javascript
status: 200
cache-control: max-age=300
x-amz-cf-pop: HAM50-C1
accept-ranges: bytes
content-length: 3
x-amz-cf-id: qehk4XEWbosqpdG16Xd7BsqQknBED41NNEf5glvnI9HsHaMPGIkXMQ==

POST
H3-Q050 200 collect Show response
www.google-analytics.com/j/ 2 B
125 B 39ms
13ms XHR
text/plain 2a00:1450:4001:824::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j86&aip=1&a=1759624720&t=pageview&_s=1&dl=https%3A%2F%2Fthreatpost.com%2Fshlayer-mac-malware-extra-sneakiness%2F156669%2F%3Fweb_view%3Dtrue&ul=en-us&de=UTF-8&dt=Shlayer%20Mac%20Malware%20Returns%20with%20Extra%20Sneakiness%20%7C%20Threatpost&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YEBAAEABAAAAAC~&jid=1143137529&gjid=1237844692&cid=1567673916.1603399994&tid=UA-35676203-21&_gid=1038893946.1603399994&_r=1&gtm=2wgae1PM29HLF&z=2029993040

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:824::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 22 Oct 2020 20:53:13 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
status: 200
content-type: text/plain
access-control-allow-origin: https://threatpost.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 collect
www.google-analytics.com/ 35 B
405 B 24ms
13ms Image
image/gif 2a00:1450:4001:824::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j86&aip=1&a=1759624720&t=event&ni=0&_s=1&dl=https%3A%2F%2Fthreatpost.com%2Fshlayer-mac-malware-extra-sneakiness%2F156669%2F%3Fweb_view%3Dtrue&ul=en-us&de=UTF-8&dt=Shlayer%20Mac%20Malware%20Returns%20with%20Extra%20Sneakiness%20%7C%20Threatpost&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=VISIBILITY&ea=elementVisibility%20%2F%20%5BHeader%5D%20%2F%20Social%20Networks%20View&_u=YEDAAEABAAAAAC~&jid=&gjid=&cid=1567673916.1603399994&tid=UA-35676203-21&_gid=1038893946.1603399994&gtm=2wgae1PM29HLF&z=1813987736

Requested by

Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:824::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 22 Oct 2020 09:13:54 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 41959
status: 200
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2 200 adsct
t.co/i/ 43 B
448 B 203ms
147ms Image
image/gif 104.244.42.5
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://t.co/i/adsct?type=javascript&version=1.1.0&p_id=Twitter&p_user_id=0&txn_id=ntt0j&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0&tw_document_href=https%3A%2F%2Fthreatpost.com%2Fshlayer-mac-malware-extra-sneakiness%2F156669%2F%3Fweb_view%3Dtrue

Requested by

Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

104.244.42.5 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=0
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 22 Oct 2020 20:53:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
status: 200, 200 OK
x-twitter-response-tags: BouncerCompliant
content-length: 65
x-xss-protection: 0
x-response-time: 119
pragma: no-cache
last-modified: Thu, 22 Oct 2020 20:53:13 GMT
server: tsa_o
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=0
content-type: image/gif;charset=utf-8
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash: 83fcd738ea12b5c1a83796c704bc5382
x-transaction: 0049c19b000b98e3
expires: Tue, 31 Mar 1981 05:00:00 GMT

POST
H/1.1 200
OK pls Show response
capi.connatix.com/core/ Frame A818 6 KB
2 KB 471ms
120ms XHR
multipart/form-data 18.221.6.219
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://capi.connatix.com/core/pls?v=69601
Requested by: Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.221.6.219 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-221-6-219.us-east-2.compute.amazonaws.com
Software: openresty/1.15.8.2 /
Resource Hash: 4d41abdd58cec4c7ff4616601cddb196e4682236db617868f4dfb35aa38a6155

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: multipart/form-data

Response headers

Date: Thu, 22 Oct 2020 20:53:14 GMT
Content-Encoding: gzip
Server: openresty/1.15.8.2
Vary: Accept-Encoding
Content-Type: multipart/form-data
Access-Control-Allow-Origin: https://threatpost.com
transfer-encoding: chunked
Connection: keep-alive
Access-Control-Allow-Credentials: true

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 4 B
466 B 41ms
14ms XHR
text/plain 2a00:1450:400c:c04::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j86&tid=UA-35676203-21&cid=1567673916.1603399994&jid=1143137529&gjid=1237844692&_gid=1038893946.1603399994&_u=YEBAAEAAAAAAAC~&z=1493927081

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c04::9a Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
date: Thu, 22 Oct 2020 20:53:13 GMT
status: 200
content-type: text/plain
access-control-allow-origin: https://threatpost.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H/1.1 200
OK e Show response
capi.connatix.com/tr/ Frame A818 0
323 B 462ms
116ms XHR
multipart/form-data 18.221.6.219
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://capi.connatix.com/tr/e
Requested by: Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.221.6.219 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-221-6-219.us-east-2.compute.amazonaws.com
Software: openresty/1.15.8.2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: multipart/form-data

Response headers

Date: Thu, 22 Oct 2020 20:53:14 GMT
Content-Encoding: gzip
Server: openresty/1.15.8.2
Vary: Accept-Encoding
Content-Type: multipart/form-data
Access-Control-Allow-Origin: https://threatpost.com
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 20

GET
H3-Q050 200 ga-audiences
www.google.com/ads/ 42 B
247 B 20ms
19ms Image
image/gif 2a00:1450:4001:821::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j86&tid=UA-35676203-21&cid=1567673916.1603399994&jid=1143137529&_u=YEBAAEAAAAAAAC~&z=883997512

Requested by

Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:821::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 22 Oct 2020 20:53:13 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.de/ads/ 42 B
494 B 44ms
23ms Image
image/gif 2a00:1450:4001:818::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j86&tid=UA-35676203-21&cid=1567673916.1603399994&jid=1143137529&_u=YEBAAEAAAAAAAC~&z=883997512

Requested by

Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:818::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 22 Oct 2020 20:53:13 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ 19 B
712 B 90ms
42ms XHR
application/json 185.33.221.91
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.221.91 , Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

721.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

Software

nginx/1.17.9 /

Resource Hash

0c09c070833c786cb25be38bc30992b30bad578f817dbc9e34beacd8b8ea44c5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Thu, 22 Oct 2020 20:53:14 GMT
X-Proxy-Origin: 185.212.171.67; 185.212.171.67; 721.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.220.103:80
AN-X-Request-Uuid: fd090dc4-1bf0-4d9e-87e6-62a2f72892b4
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://threatpost.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json; charset=utf-8
Content-Length: 19
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 200 c Show response
prebid.a-mo.net/a/ 498 B
730 B 348ms
154ms XHR
application/json 136.144.59.88
PACKET

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.a-mo.net/a/c
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 136.144.59.88 , United States, ASN54825 (PACKET, US),
Reverse DNS
Software: envoy /
Resource Hash: 966490fdaadd070a1e129ca0923fae17f952134c626eab3c6b40f403ccf98938

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

date: Thu, 22 Oct 2020 20:53:13 GMT
content-encoding: gzip
server: envoy
status: 200
vary: origin, accept-encoding
content-type: application/json; charset=utf-8
access-control-allow-origin: https://threatpost.com
cache-control: max-age=0, private, must-revalidate
access-control-allow-credentials: true
x-envoy-upstream-service-time: 62
content-length: 302

GET
H2 200 cygnus Show response
htlb.casalemedia.com/ 24 B
286 B 157ms
107ms XHR
application/json 104.111.215.135
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://htlb.casalemedia.com/cygnus?s=438654&v=7.2&r=%7B%22id%22%3A%22966c7dc5a59ff3%22%2C%22imp%22%3A%5B%7B%22id%22%3A%2210aac682611eaa5%22%2C%22ext%22%3A%7B%22siteID%22%3A%22438654%22%2C%22sid%22%3A%22728x90%22%7D%2C%22banner%22%3A%7B%22w%22%3A728%2C%22h%22%3A90%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%2211962706b44c7d4%22%2C%22ext%22%3A%7B%22siteID%22%3A%22438649%22%2C%22sid%22%3A%22300x250%22%7D%2C%22banner%22%3A%7B%22w%22%3A300%2C%22h%22%3A250%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%2212d09431d8eb56b%22%2C%22ext%22%3A%7B%22siteID%22%3A%22438650%22%2C%22sid%22%3A%22300x250%22%7D%2C%22banner%22%3A%7B%22w%22%3A300%2C%22h%22%3A250%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%2210aac682611eaa5%22%2C%22ext%22%3A%7B%22siteID%22%3A%22438654%22%2C%22sid%22%3A%22970x250%22%7D%2C%22banner%22%3A%7B%22w%22%3A970%2C%22h%22%3A250%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%2210aac682611eaa5%22%2C%22ext%22%3A%7B%22siteID%22%3A%22438654%22%2C%22sid%22%3A%22970x90%22%7D%2C%22banner%22%3A%7B%22w%22%3A970%2C%22h%22%3A90%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%2211962706b44c7d4%22%2C%22ext%22%3A%7B%22siteID%22%3A%22438649%22%2C%22sid%22%3A%22336x280%22%7D%2C%22banner%22%3A%7B%22w%22%3A336%2C%22h%22%3A280%2C%22topframe%22%3A1%7D%7D%2C%7B%22id%22%3A%2212d09431d8eb56b%22%2C%22ext%22%3A%7B%22siteID%22%3A%22438650%22%2C%22sid%22%3A%22300x600%22%7D%2C%22banner%22%3A%7B%22w%22%3A300%2C%22h%22%3A600%2C%22topframe%22%3A1%7D%7D%5D%2C%22site%22%3A%7B%22page%22%3A%22https%3A%2F%2Fthreatpost.com%2Fshlayer-mac-malware-extra-sneakiness%2F156669%2F%3Fweb_view%3Dtrue%22%7D%2C%22ext%22%3A%7B%22source%22%3A%22prebid%22%7D%2C%22source%22%3A%7B%22ext%22%3A%7B%22schain%22%3A%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22admetricspro.com%22%2C%22sid%22%3A%221005%22%2C%22hp%22%3A1%7D%5D%7D%7D%7D%2C%22regs%22%3A%7B%22ext%22%3A%7B%22gdpr%22%3A0%7D%7D%2C%22user%22%3A%7B%22ext%22%3A%7B%22consent%22%3A%22%22%7D%7D%7D&ac=j&sd=1
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.111.215.135 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-215-135.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 1abce1725c88478746e2533d2e423d0ac6e81b0db5e3156a884cf853e725e062

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 22 Oct 2020 20:53:14 GMT
content-encoding: gzip
server: Apache
status: 200
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: https://threatpost.com
cache-control: max-age=0, no-cache, no-store
access-control-allow-credentials: true
content-length: 44
x-akamai-path-stats: [3:530:80470]
expires: Thu, 22 Oct 2020 20:53:14 GMT

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ 19 B
712 B 61ms
16ms XHR
application/json 185.33.221.91
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.221.91 , Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

721.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

Software

nginx/1.17.9 /

Resource Hash

0c09c070833c786cb25be38bc30992b30bad578f817dbc9e34beacd8b8ea44c5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Thu, 22 Oct 2020 20:53:13 GMT
X-Proxy-Origin: 185.212.171.67; 185.212.171.67; 721.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.220.139:80
AN-X-Request-Uuid: 780c5a10-e55d-4e4d-bab1-bc1c4d3eb7b3
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://threatpost.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json; charset=utf-8
Content-Length: 19
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H/1.1 200
OK bid Show response
ap.lijit.com/rtb/ 23 B
754 B 61ms
21ms XHR
application/json 72.251.249.9
VOXEL-DOT-NET

General

Check archive.org

Show headers Download Go to

Full URL: https://ap.lijit.com/rtb/bid?src=prebid_prebid_4.10.0
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 72.251.249.9 Amsterdam, Netherlands, ASN29791 (VOXEL-DOT-NET, US),
Reverse DNS
Software: nginx /
Resource Hash: 97a1cb0b1df32c383294ba92e91b9b265534612541621a4d2c46f55100a71c95

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

Date: Thu, 22 Oct 2020 20:53:13 GMT
Content-Encoding: gzip
Server: nginx
Transfer-Encoding: chunked
Vary: Accept-Encoding, Accept-Encoding, User-Agent
Access-Control-Allow-Methods: GET, POST, DELETE, PUT
Content-Type: application/json
Access-Control-Allow-Origin: https://threatpost.com
Access-Control-Allow-Credentials: true
X-Sovrn-Pod: ad_ap3ams1
Access-Control-Allow-Headers: X-Requested-With, Content-Type

GET
H/1.1 200
OK fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 263 B
2 KB 145ms
75ms XHR
application/json 69.173.144.143
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=19254&site_id=300372&zone_id=1509502&size_id=2&alt_size_ids=55%2C57&p_pos=atf&gdpr=0&rp_schain=1.0,1!admetricspro.com,1005,1,,,&rf=https%3A%2F%2Fthreatpost.com%2Fshlayer-mac-malware-extra-sneakiness%2F156669%2F%3Fweb_view%3Dtrue&tk_flint=pbjs_lite_v4.10.0&x_source.tid=24bc8231-05f7-42a7-b6cb-5c82a35d3af5&p_screen_res=1600x1200&rp_floor=0.01&rp_secure=1&slots=1&rand=0.315299393962825
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_GCM
Server: 69.173.144.143 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.16.0 /
Resource Hash: 56645b53476828932f7160c4542515ae13a10bc3cddf8304e1a41fe8cff39207

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Thu, 22 Oct 2020 20:53:14 GMT
Server: nginx/1.16.0
Vary: Accept-Encoding
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin: https://threatpost.com
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json
Keep-Alive: timeout=5
Content-Length: 263
Expires: Wed, 17 Sep 1975 21:32:10 GMT

GET
H/1.1 200
OK fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 241 B
2 KB 146ms
76ms XHR
application/json 69.173.144.143
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=19254&site_id=300372&zone_id=1509502&size_id=15&alt_size_ids=16&p_pos=atf&gdpr=0&rp_schain=1.0,1!admetricspro.com,1005,1,,,&rf=https%3A%2F%2Fthreatpost.com%2Fshlayer-mac-malware-extra-sneakiness%2F156669%2F%3Fweb_view%3Dtrue&tk_flint=pbjs_lite_v4.10.0&x_source.tid=78b988aa-6399-48ae-b615-437bc9e5e15d&p_screen_res=1600x1200&rp_floor=0.01&rp_secure=1&slots=1&rand=0.9632565580405352
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_GCM
Server: 69.173.144.143 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.16.0 /
Resource Hash: e4443984e1267cc313a18e4e42509bc17ea3781c4d873422200ba01fbcacf3eb

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Thu, 22 Oct 2020 20:53:14 GMT
Server: nginx/1.16.0
Vary: Accept-Encoding
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin: https://threatpost.com
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json
Keep-Alive: timeout=5
Content-Length: 241
Expires: Wed, 17 Sep 1975 21:32:10 GMT

GET
H/1.1 200
OK fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 261 B
2 KB 153ms
83ms XHR
application/json 69.173.144.143
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=19254&site_id=300372&zone_id=1509506&size_id=15&alt_size_ids=10&p_pos=atf&gdpr=0&rp_schain=1.0,1!admetricspro.com,1005,1,,,&rf=https%3A%2F%2Fthreatpost.com%2Fshlayer-mac-malware-extra-sneakiness%2F156669%2F%3Fweb_view%3Dtrue&tk_flint=pbjs_lite_v4.10.0&x_source.tid=52c940f0-e5d7-488b-a3d8-862fce902293&p_screen_res=1600x1200&rp_floor=0.01&rp_secure=1&slots=1&rand=0.4521612924873597
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_GCM
Server: 69.173.144.143 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.16.0 /
Resource Hash: 1979349603f68a2eb375e5f86d93ba0ebd57db1b2c3f8aabd7edc88a77783daf

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Thu, 22 Oct 2020 20:53:14 GMT
Server: nginx/1.16.0
Vary: Accept-Encoding
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin: https://threatpost.com
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json
Keep-Alive: timeout=5
Content-Length: 261
Expires: Wed, 17 Sep 1975 21:32:10 GMT

GET
H/1.1 200
OK fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 261 B
2 KB 175ms
105ms XHR
application/json 69.173.144.143
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=19254&site_id=300372&zone_id=1509502&size_id=15&alt_size_ids=10&p_pos=atf&gdpr=0&rp_schain=1.0,1!admetricspro.com,1005,1,,,&rf=https%3A%2F%2Fthreatpost.com%2Fshlayer-mac-malware-extra-sneakiness%2F156669%2F%3Fweb_view%3Dtrue&tk_flint=pbjs_lite_v4.10.0&x_source.tid=52c940f0-e5d7-488b-a3d8-862fce902293&p_screen_res=1600x1200&rp_floor=0.01&rp_secure=1&slots=1&rand=0.9897637927029359
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_GCM
Server: 69.173.144.143 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.16.0 /
Resource Hash: 5a46bc08cb30a8b919e04b954cef146b705221482eb16c2d94fb72f2605671ac

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Thu, 22 Oct 2020 20:53:14 GMT
Server: nginx/1.16.0
Vary: Accept-Encoding
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin: https://threatpost.com
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json
Keep-Alive: timeout=5
Content-Length: 261
Expires: Wed, 17 Sep 1975 21:32:10 GMT

POST
H2 204 translator Show response
hbopenbid.pubmatic.com/ 0
115 B 178ms
143ms XHR
text/plain 185.64.189.112
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.189.112 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

status: 204
date: Thu, 22 Oct 2020 20:53:14 GMT
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
access-control-allow-origin: https://threatpost.com

GET
H2

200

ADTECH;apid=1A9a55d298-14a8-11eb-9bab-12e1ea48904a;cfp=1;rndc=1603399993;v=2;cmd=bid;cors=yes;alias=582f181f43734ee;misc=1603399993941 Show response
adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166606/0/0/
Redirect Chain

https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166606/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=582f181f43734ee;misc=1603399993941;
https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166606/0/0/ADTECH;cfp=1;rndc=1603399993;v=2;cmd=bid;cors=yes;alias=582f181f43734ee;misc=1603399993941
https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166606/0/0/ADTECH;apid=1A9a55d298-14a8-11eb-9bab-12e1ea48904a;cfp=1;rndc=1603399993;v=2;cmd=bid;cors=yes;alias=582f181f43734ee;misc=16...

1 KB
2 KB

150ms
149ms

XHR
application/json

2606:2800:233:97b6:26be:138a:cba8:bb01
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166606/0/0/ADTECH;apid=1A9a55d298-14a8-11eb-9bab-12e1ea48904a;cfp=1;rndc=1603399993;v=2;cmd=bid;cors=yes;alias=582f181f43734ee;misc=1603399993941
Requested by: Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:233:97b6:26be:138a:cba8:bb01 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: Adtech Adserver /
Resource Hash: faefd75f566b8481b9eea893e2e2796142041e2c792327347cd225847a89b734

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 22 Oct 2020 20:53:14 GMT
server: Adtech Adserver
status: 200
access-control-allow-methods: POST,GET,HEAD,OPTIONS
p3p: CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
access-control-allow-origin: https://threatpost.com
cache-control: no-store, no-cache
access-control-allow-credentials: true
content-type: application/json
content-length: 1469
expires: Mon, 15 Jun 1998 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 22 Oct 2020 20:53:14 GMT
server: nginx
status: 302
location: https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166606/0/0/ADTECH;apid=1A9a55d298-14a8-11eb-9bab-12e1ea48904a;cfp=1;rndc=1603399993;v=2;cmd=bid;cors=yes;alias=582f181f43734ee;misc=1603399993941
access-control-allow-methods: POST,GET,HEAD,OPTIONS
p3p: CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
access-control-allow-origin: https://threatpost.com
cache-control: no-store, no-cache
access-control-allow-credentials: true
content-length: 0
expires: Mon, 15 Jun 1998 00:00:00 GMT

GET
H2

200

ADTECH;apid=1A9a56231a-14a8-11eb-88ae-124c2db8624e;cfp=1;rndc=1603399994;v=2;cmd=bid;cors=yes;alias=590c455dbc78067;misc=1603399993941 Show response
adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166847/0/0/
Redirect Chain

https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166847/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=590c455dbc78067;misc=1603399993941;
https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166847/0/0/ADTECH;cfp=1;rndc=1603399993;v=2;cmd=bid;cors=yes;alias=590c455dbc78067;misc=1603399993941
https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166847/0/0/ADTECH;apid=1A9a56231a-14a8-11eb-88ae-124c2db8624e;cfp=1;rndc=1603399994;v=2;cmd=bid;cors=yes;alias=590c455dbc78067;misc=16...

1 KB
2 KB

152ms
151ms

XHR
application/json

2606:2800:233:97b6:26be:138a:cba8:bb01
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166847/0/0/ADTECH;apid=1A9a56231a-14a8-11eb-88ae-124c2db8624e;cfp=1;rndc=1603399994;v=2;cmd=bid;cors=yes;alias=590c455dbc78067;misc=1603399993941
Requested by: Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:233:97b6:26be:138a:cba8:bb01 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: Adtech Adserver /
Resource Hash: e198f86287ebb0423c6cfd5c2dfdef2c2b2a8356b70578499250d9a0d59d1ded

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 22 Oct 2020 20:53:14 GMT
server: Adtech Adserver
status: 200
access-control-allow-methods: POST,GET,HEAD,OPTIONS
p3p: CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
access-control-allow-origin: https://threatpost.com
cache-control: no-store, no-cache
access-control-allow-credentials: true
content-type: application/json
content-length: 1468
expires: Mon, 15 Jun 1998 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 22 Oct 2020 20:53:14 GMT
server: nginx
status: 302
location: https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166847/0/0/ADTECH;apid=1A9a56231a-14a8-11eb-88ae-124c2db8624e;cfp=1;rndc=1603399994;v=2;cmd=bid;cors=yes;alias=590c455dbc78067;misc=1603399993941
access-control-allow-methods: POST,GET,HEAD,OPTIONS
p3p: CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
access-control-allow-origin: https://threatpost.com
cache-control: no-store, no-cache
access-control-allow-credentials: true
content-length: 0
expires: Mon, 15 Jun 1998 00:00:00 GMT

GET
H2

200

ADTECH;apid=1A9a55e81e-14a8-11eb-8cc1-1212911483a0;cfp=1;rndc=1603399993;v=2;cmd=bid;cors=yes;alias=60201f48068436a;misc=1603399993941 Show response
adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166615/0/0/
Redirect Chain

https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166615/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=60201f48068436a;misc=1603399993941;
https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166615/0/0/ADTECH;cfp=1;rndc=1603399993;v=2;cmd=bid;cors=yes;alias=60201f48068436a;misc=1603399993941
https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166615/0/0/ADTECH;apid=1A9a55e81e-14a8-11eb-8cc1-1212911483a0;cfp=1;rndc=1603399993;v=2;cmd=bid;cors=yes;alias=60201f48068436a;misc=16...

1 KB
2 KB

151ms
151ms

XHR
application/json

2606:2800:233:97b6:26be:138a:cba8:bb01
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166615/0/0/ADTECH;apid=1A9a55e81e-14a8-11eb-8cc1-1212911483a0;cfp=1;rndc=1603399993;v=2;cmd=bid;cors=yes;alias=60201f48068436a;misc=1603399993941
Requested by: Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:233:97b6:26be:138a:cba8:bb01 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: Adtech Adserver /
Resource Hash: 684e786ec2aabe329dcd27a7a14ae377692d5eab3531febe36c4937323683a12

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 22 Oct 2020 20:53:14 GMT
server: Adtech Adserver
status: 200
access-control-allow-methods: POST,GET,HEAD,OPTIONS
p3p: CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
access-control-allow-origin: https://threatpost.com
cache-control: no-store, no-cache
access-control-allow-credentials: true
x-adtech-meta: {"Debug": {"IP": "0.0.0.0", "Selector": "pri-select009c.us-east-1.prod.adtech.aolcloud.net", "UserId": "3763985EF71F13AE63FF0E38FC4FB5D9"}}
content-type: application/json
content-length: 1469
expires: Mon, 15 Jun 1998 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 22 Oct 2020 20:53:14 GMT
server: nginx
status: 302
location: https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166615/0/0/ADTECH;apid=1A9a55e81e-14a8-11eb-8cc1-1212911483a0;cfp=1;rndc=1603399993;v=2;cmd=bid;cors=yes;alias=60201f48068436a;misc=1603399993941
access-control-allow-methods: POST,GET,HEAD,OPTIONS
p3p: CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
access-control-allow-origin: https://threatpost.com
cache-control: no-store, no-cache
access-control-allow-credentials: true
content-length: 0
expires: Mon, 15 Jun 1998 00:00:00 GMT

GET
H2

200

ADTECH;cfp=1;rndc=1603399993;v=2;cmd=bid;cors=yes;alias=61aa96550d98ad2;misc=1603399993941 Show response
adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166612/0/0/
Redirect Chain

https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166612/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=61aa96550d98ad2;misc=1603399993941;
https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166612/0/0/ADTECH;cfp=1;rndc=1603399993;v=2;cmd=bid;cors=yes;alias=61aa96550d98ad2;misc=1603399993941

1 KB
2 KB

151ms
150ms

XHR
application/json

2606:2800:233:97b6:26be:138a:cba8:bb01
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166612/0/0/ADTECH;cfp=1;rndc=1603399993;v=2;cmd=bid;cors=yes;alias=61aa96550d98ad2;misc=1603399993941
Requested by: Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:233:97b6:26be:138a:cba8:bb01 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: Adtech Adserver /
Resource Hash: 342b02f401e21e4f39970496593115e860a5bd9eef4b9d9bc5d98ef48f37de24

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 22 Oct 2020 20:53:14 GMT
server: Adtech Adserver
status: 200
access-control-allow-methods: POST,GET,HEAD,OPTIONS
p3p: CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
access-control-allow-origin: https://threatpost.com
cache-control: no-store, no-cache
access-control-allow-credentials: true
content-type: application/json
content-length: 1468
expires: Mon, 15 Jun 1998 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 22 Oct 2020 20:53:14 GMT
server: nginx
status: 302
location: https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166612/0/0/ADTECH;cfp=1;rndc=1603399993;v=2;cmd=bid;cors=yes;alias=61aa96550d98ad2;misc=1603399993941
access-control-allow-methods: POST,GET,HEAD,OPTIONS
p3p: CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
access-control-allow-origin: https://threatpost.com
cache-control: no-store, no-cache
access-control-allow-credentials: true
content-length: 0
expires: Mon, 15 Jun 1998 00:00:00 GMT

GET
H2

200

ADTECH;apid=1A9a566af0-14a8-11eb-be94-122675b00be4;cfp=1;rndc=1603399993;v=2;cmd=bid;cors=yes;alias=62a9574647bc3c4;misc=1603399993941 Show response
adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166617/0/0/
Redirect Chain

https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166617/0/0/ADTECH;v=2;cmd=bid;cors=yes;alias=62a9574647bc3c4;misc=1603399993941;
https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166617/0/0/ADTECH;cfp=1;rndc=1603399993;v=2;cmd=bid;cors=yes;alias=62a9574647bc3c4;misc=1603399993941
https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166617/0/0/ADTECH;apid=1A9a566af0-14a8-11eb-be94-122675b00be4;cfp=1;rndc=1603399993;v=2;cmd=bid;cors=yes;alias=62a9574647bc3c4;misc=16...

1 KB
2 KB

179ms
178ms

XHR
application/json

2606:2800:233:97b6:26be:138a:cba8:bb01
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166617/0/0/ADTECH;apid=1A9a566af0-14a8-11eb-be94-122675b00be4;cfp=1;rndc=1603399993;v=2;cmd=bid;cors=yes;alias=62a9574647bc3c4;misc=1603399993941
Requested by: Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:233:97b6:26be:138a:cba8:bb01 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: Adtech Adserver /
Resource Hash: 7385a9cbf08c0f579f845494c316c9e1f97657d704d5e093c3f40e8369f4bd84

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 22 Oct 2020 20:53:14 GMT
server: Adtech Adserver
status: 200
access-control-allow-methods: POST,GET,HEAD,OPTIONS
p3p: CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
access-control-allow-origin: https://threatpost.com
cache-control: no-store, no-cache
access-control-allow-credentials: true
content-type: application/json
content-length: 1468
expires: Mon, 15 Jun 1998 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 22 Oct 2020 20:53:14 GMT
server: nginx
status: 302
location: https://adserver-us.adtech.advertising.com/pubapi/3.0/10927.1/5166617/0/0/ADTECH;apid=1A9a566af0-14a8-11eb-be94-122675b00be4;cfp=1;rndc=1603399993;v=2;cmd=bid;cors=yes;alias=62a9574647bc3c4;misc=1603399993941
access-control-allow-methods: POST,GET,HEAD,OPTIONS
p3p: CP="NOI DSP DEVa OUR BUS UNI COM NAV INT"
access-control-allow-origin: https://threatpost.com
cache-control: no-store, no-cache
access-control-allow-credentials: true
content-length: 0
expires: Mon, 15 Jun 1998 00:00:00 GMT

POST
H2 200 adreq Show response
ads.servenobid.com/ 10 KB
3 KB 146ms
72ms XHR
application/json 52.210.177.43
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.servenobid.com/adreq?cb=4152
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.210.177.43 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-210-177-43.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 2ed06a02ca8267db66014165caf410f7d40f970853edf2ed3396861903afcb3a

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

date: Thu, 22 Oct 2020 20:53:14 GMT
content-encoding: gzip
amp-access-control-allow-source-origin: *
status: 200
vary: accept-encoding
content-type: application/json
access-control-allow-origin: https://threatpost.com
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
access-control-allow-credentials: true

GET
H2 200 arj Show response
teachingaids-d.openx.net/w/1.0/ 172 B
559 B 94ms
39ms XHR
application/json 34.98.64.218
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://teachingaids-d.openx.net/w/1.0/arj?ju=https%3A%2F%2Fthreatpost.com%2Fshlayer-mac-malware-extra-sneakiness%2F156669%2F%3Fweb_view%3Dtrue&ch=UTF-8&res=1600x1200x24&ifr=false&tz=-120&tws=1600x1200&be=1&bc=hb_pb_3.0.3&dddid=24bc8231-05f7-42a7-b6cb-5c82a35d3af5%2C24bc8231-05f7-42a7-b6cb-5c82a35d3af5%2C78b988aa-6399-48ae-b615-437bc9e5e15d%2C52c940f0-e5d7-488b-a3d8-862fce902293%2C52c940f0-e5d7-488b-a3d8-862fce902293&nocache=1603399993945&gdpr=0&x_gdpr_f=1&pubcid=f21b399a-87d7-443e-9896-8fed7d43a629&schain=1.0%2C1!admetricspro.com%2C1005%2C1%2C%2C%2C&aus=728x90%2C970x250%2C970x90%7C728x90%2C970x250%2C970x90%7C300x250%2C336x280%7C300x250%2C300x600%7C300x250%2C300x600&divIds=div-gpt-ad-6794670-2%2Cdiv-gpt-ad-6794670-2%2Cdiv-gpt-ad-6794670-3%2Cdiv-gpt-ad-6794670-5%2Cdiv-gpt-ad-6794670-5&auid=540932704%2C540932709%2C540932713%2C540932715%2C540932720
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.64.218 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/16.195.1 /
Resource Hash: 850b3b425d962e559df157f0f0427fd40f1e3d5cf0868e5d066ae2ba252e31bd

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 22 Oct 2020 20:53:14 GMT
content-encoding: gzip
server: OXGW/16.195.1
status: 200
vary: Accept, Accept-Encoding
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: https://threatpost.com
cache-control: private, max-age=0, no-cache
access-control-allow-credentials: true
content-type: application/json
alt-svc: clear
content-length: 163
via: 1.1 google
expires: Mon, 26 Jul 1997 05:00:00 GMT

POST
H2 200 v2 Show response
e.serverbid.com/api/ 711 B
984 B 308ms
110ms XHR
application/json 165.227.252.242
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://e.serverbid.com/api/v2
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 165.227.252.242 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: /
Resource Hash: f4b064d961dd5c30917481f9cf22f400d352737e7dac10d70e574877eef1e8ea

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

status: 200
date: Thu, 22 Oct 2020 20:53:14 GMT
access-control-allow-credentials: true
access-control-allow-origin: https://threatpost.com
content-length: 711
vary: Origin
content-type: application/json

POST
H2 200 auction Show response
tlx.3lift.com/header/ 19 B
311 B 94ms
40ms XHR
application/json 52.28.149.230
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://tlx.3lift.com/header/auction?lib=prebid&v=4.10.0&referrer=https%3A%2F%2Fthreatpost.com%2Fshlayer-mac-malware-extra-sneakiness%2F156669%2F%3Fweb_view%3Dtrue&tmax=1200&gdpr=false

Requested by

Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.28.149.230 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

0535c3bb3a17e4ac0fb7d29214d2181275662129dc2bdd2a89c35934e9fc5ba5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 22 Oct 2020 20:53:14 GMT
x-auction-status: 12, 12, 12
status: 200
content-type: application/json; charset=utf-8
access-control-allow-origin: https://threatpost.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-length: 19
x-xss-protection: 0
expires: Thu, 15 Oct 1992 20:10:00 GMT

GET
H2 200 bid Show response
c.amazon-adsystem.com/e/dtb/ 23 B
368 B 77ms
76ms XHR
text/javascript 52.222.182.122
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/e/dtb/bid?src=600&u=https%3A%2F%2Fthreatpost.com%2Fshlayer-mac-malware-extra-sneakiness%2F156669%2F%3Fweb_view%3Dtrue&pid=rsqsz8biTOrTn&cb=0&ws=1600x1200&v=7.55.00&t=1200&slots=%5B%7B%22sd%22%3A%220%22%2C%22s%22%3A%5B%22728x90%22%2C%22970x250%22%2C%22970x90%22%5D%2C%22sn%22%3A%22%2F21707124336%2FThreatPost-970x250-ATF%22%7D%2C%7B%22sd%22%3A%221%22%2C%22s%22%3A%5B%22300x250%22%2C%22336x280%22%5D%2C%22sn%22%3A%22%2F21707124336%2FThreatPost-300x250-ATF%22%7D%2C%7B%22sd%22%3A%222%22%2C%22s%22%3A%5B%22300x250%22%2C%22300x600%22%5D%2C%22sn%22%3A%22%2F21707124336%2FThreatPost-300x600-ATF%22%7D%2C%7B%22sd%22%3A%223%22%2C%22s%22%3A%5B%222x2%22%5D%2C%22sn%22%3A%22%2F21707124336%2FThreatPost-2x2-Skin%22%7D%5D&pubid=cb8cfc89-e83e-44aa-a3a2-ff78eda781ef&gdpre=0&gdprl=%7B%22status%22%3A%22tcfv2-success%22%7D
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.222.182.122 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-222-182-122.ham50.r.cloudfront.net
Software: Server /
Resource Hash: 745a085b52b8371ec6705413fca70a28c6d8bff0db480e6b124bd08c54e95ef8

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 22 Oct 2020 20:53:14 GMT
via: 1.1 6c080b1173adbaa14122fac10a76a7c7.cloudfront.net (CloudFront)
server: Server
x-amz-cf-pop: HAM50-C1
status: 200
vary: User-Agent
x-cache: Miss from cloudfront
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: https://threatpost.com
access-control-allow-credentials: true
timing-allow-origin: *
content-length: 23
x-amz-cf-id: L-tSsBdBr6eg6R9pgrT6SA7FBPxW_ZPricRk3b7sX5G_iHL9giZ1wg==

GET
H2 200 pixel;r=1203227206;source=gtm;rf=0;uh=65ce955d6ae6;uht=2;a=p-_7kVx0t9Jqj90;url=https%3A%2F%2Fthreatpost.com%2Fshlayer-mac-malware-extra-sneakiness%2F156669%2F%3Fweb_view%3Dtrue;fpan=1;fpa=P0-213159...
pixel.quantserve.com/ 35 B
371 B 15ms
8ms Image
image/gif 2620:116:800d:21:36a9:ecb:e518:b308
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pixel.quantserve.com/pixel;r=1203227206;source=gtm;rf=0;uh=65ce955d6ae6;uht=2;a=p-_7kVx0t9Jqj90;url=https%3A%2F%2Fthreatpost.com%2Fshlayer-mac-malware-extra-sneakiness%2F156669%2F%3Fweb_view%3Dtrue;fpan=1;fpa=P0-2131591697-1603399993958;ns=0;ce=1;qjs=1;qv=3364aec3-20201006003021;cm=;gdpr=0;ref=;d=threatpost.com;je=0;sr=1600x1200x24;dst=1;et=1603399993958;tzo=-120;ogl=image.https%3A%2F%2Fmedia%252Ethreatpost%252Ecom%2Fwp-content%2Fuploads%2Fsites%2F103%2F2020%2F01%2F22100148%2Ftroja%2Ctype.article%2Ctitle.Shlayer%20Mac%20Malware%20Returns%20with%20Extra%20Sneakiness%2Cdescription.Spreading%20via%20poisoned%20Google%20search%20results%252C%20this%20new%20version%20of%20Mac's%20No%252E%201%20th%2Curl.https%3A%2F%2Fthreatpost%252Ecom%2Fshlayer-mac-malware-extra-sneakiness%2F156669%2F

Requested by

Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2620:116:800d:21:36a9:ecb:e518:b308 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 22 Oct 2020 20:53:13 GMT
strict-transport-security: max-age=86400
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
status: 200
cache-control: private, no-cache, no-store, proxy-revalidate
content-type: image/gif
content-length: 35
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H3-Q050 200 recaptcha__en.js Show response
www.gstatic.com/recaptcha/releases/T9w1ROdplctW2nVKvNJYXH8o/ 341 KB
134 KB 27ms
13ms Script
text/javascript 2a00:1450:4001:816::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/T9w1ROdplctW2nVKvNJYXH8o/recaptcha__en.js

Requested by

Host: www.google.com
URL: https://www.google.com/recaptcha/api.js?hl=en&render=explicit&ver=5.5.1

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:816::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

54f3aa37078dcd01911c9da1a5fd753b5834dde5acfd90c5bd55243bba87cf6d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://threatpost.com
Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 22 Oct 2020 20:00:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 3188
status: 200
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 136962
x-xss-protection: 0
last-modified: Mon, 12 Oct 2020 04:11:53 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Fri, 22 Oct 2021 20:00:06 GMT

GET
H/1.1 200
OK v1 Show response
geo.ipify.org/api/ 428 B
1 KB 733ms
406ms XHR
application/json 64.140.160.2
WEBNX

General

Check archive.org

Show headers Download Go to

Full URL

https://geo.ipify.org/api/v1?apiKey=at_riPAQYz3EiQ6JhsH05bmtozma13RA

Requested by

Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/uspcmp.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

64.140.160.2 Los Angeles, United States, ASN18450 (WEBNX, US),

Reverse DNS

threatintelligenceplatform.com

Software

nginx /

Resource Hash

c8ea1f17bd3861e6390ac6bd062d4814525827b03d3cd02c9cdd9b182b2db4d8

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 22 Oct 2020 20:53:14 GMT
Content-Encoding: gzip
Vary: Accept-Encoding
Server: nginx
X-Frame-Options: SAMEORIGIN
Content-Type: application/json
Access-Control-Allow-Origin: *
Cache-Control: no-cache, private
Transfer-Encoding: chunked
Connection: keep-alive

GET
H2 200 flipboard.svg
assets.threatpost.com/wp-content/plugins/kaspersky-social-sharing/assets/img/ 236 B
565 B 301ms
300ms Image
image/svg+xml 2600:9000:2070:8800:2:9275:3d40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets.threatpost.com/wp-content/plugins/kaspersky-social-sharing/assets/img/flipboard.svg
Requested by: Host: assets.threatpost.com
URL: https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-includes/css/dist/block-library/style.min.css,wp-content/plugins/wds-rss-builder/includes/css/select2.min.css,wp-content/plugins/wds-rss-builder/includes/css/wds-rss.css,wp-content/plugins/honeypot-comments/public/assets/css/public.css,wp-content/plugins/kspr_twitter_pullquote/css/style.css,wp-content/plugins/pullquote-shortcode/css/pullquote-shortcode.css,wp-content/plugins/kaspersky-social-sharing/assets/css/style.css,wp-content/plugins/kaspersky-social-sharing/assets/css/custom.css&ver=4e760b19
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2070:8800:2:9275:3d40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: 506d565f94cecbb486394c545a96e8459217f8d045496b511e8c815142abfc70

Request headers

Referer: https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-includes/css/dist/block-library/style.min.css,wp-content/plugins/wds-rss-builder/includes/css/select2.min.css,wp-content/plugins/wds-rss-builder/includes/css/wds-rss.css,wp-content/plugins/honeypot-comments/public/assets/css/public.css,wp-content/plugins/kspr_twitter_pullquote/css/style.css,wp-content/plugins/pullquote-shortcode/css/pullquote-shortcode.css,wp-content/plugins/kaspersky-social-sharing/assets/css/style.css,wp-content/plugins/kaspersky-social-sharing/assets/css/custom.css&ver=4e760b19
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: public
date: Thu, 22 Oct 2020 20:53:14 GMT
content-encoding: gzip
last-modified: Thu, 22 Oct 2020 08:14:29 GMT
server: nginx
x-amz-cf-pop: HAM50-C3
etag: W/"5f913f65-ec"
x-cache: Miss from cloudfront
content-type: image/svg+xml
status: 200
cache-control: max-age=604800, public
x-amz-cf-id: nXKsvxDy6kFpmOSPg__x4hhlRtfDzlqy31smkG-sbcJH46YeaSM5eA==
via: 1.1 2a29e84e317dcbf526e3d2cf9be30bf7.cloudfront.net (CloudFront)
expires: Thu, 29 Oct 2020 20:53:14 GMT

GET
H2 200 fontawesome-webfont.woff2
assets.threatpost.com/wp-content/plugins/kaspersky-social-sharing/assets/fonts/ 75 KB
76 KB 340ms
304ms Font
font/woff2 2600:9000:2070:8800:2:9275:3d40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.threatpost.com/wp-content/plugins/kaspersky-social-sharing/assets/fonts/fontawesome-webfont.woff2?v=4.7.0
Requested by: Host: assets.threatpost.com
URL: https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-includes/css/dist/block-library/style.min.css,wp-content/plugins/wds-rss-builder/includes/css/select2.min.css,wp-content/plugins/wds-rss-builder/includes/css/wds-rss.css,wp-content/plugins/honeypot-comments/public/assets/css/public.css,wp-content/plugins/kspr_twitter_pullquote/css/style.css,wp-content/plugins/pullquote-shortcode/css/pullquote-shortcode.css,wp-content/plugins/kaspersky-social-sharing/assets/css/style.css,wp-content/plugins/kaspersky-social-sharing/assets/css/custom.css&ver=4e760b19
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2070:8800:2:9275:3d40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: 2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe

Request headers

Origin: https://threatpost.com
Referer: https://assets.threatpost.com/wp-content/plugins/bwp-minify/min/?f=wp-includes/css/dist/block-library/style.min.css,wp-content/plugins/wds-rss-builder/includes/css/select2.min.css,wp-content/plugins/wds-rss-builder/includes/css/wds-rss.css,wp-content/plugins/honeypot-comments/public/assets/css/public.css,wp-content/plugins/kspr_twitter_pullquote/css/style.css,wp-content/plugins/pullquote-shortcode/css/pullquote-shortcode.css,wp-content/plugins/kaspersky-social-sharing/assets/css/style.css,wp-content/plugins/kaspersky-social-sharing/assets/css/custom.css&ver=4e760b19
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 22 Oct 2020 20:53:14 GMT
via: 1.1 1589d05ea8998abdd2e7ba3167a84e2c.cloudfront.net (CloudFront)
x-amz-cf-pop: HAM50-C3
x-cache: Miss from cloudfront
status: 200
content-length: 77160
pragma: public
last-modified: Thu, 22 Oct 2020 08:14:27 GMT
server: nginx
etag: "5f913f63-12d68"
content-type: font/woff2
access-control-allow-origin: *
cache-control: max-age=31536000, public
accept-ranges: bytes
x-amz-cf-id: -kYmxoPQNXVuYZYbyuvOFWDPfBBFXMtDDxR8lHhZd-clQrWCU8ji6g==
expires: Fri, 22 Oct 2021 20:53:14 GMT

GET
H2 200 adsct Show response
analytics.twitter.com/i/ 31 B
651 B 177ms
130ms Script
application/javascript 104.244.42.67
TWITTER

General

Check archive.org

Show headers Download Go to

Full URL

https://analytics.twitter.com/i/adsct?type=javascript&version=1.1.0&p_id=Twitter&p_user_id=0&txn_id=ntt0j&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0&tpx_cb=twttr.conversion.loadPixels&tw_document_href=https%3A%2F%2Fthreatpost.com%2Fshlayer-mac-malware-extra-sneakiness%2F156669%2F%3Fweb_view%3Dtrue

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

104.244.42.67 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

df3e003cc30e9bdd0313100e8ee5d468070b4b34d11ad355f276a356d4b9c7bf

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 22 Oct 2020 20:53:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
status: 200, 200 OK
x-twitter-response-tags: BouncerCompliant
strict-transport-security: max-age=631138519
content-length: 57
x-xss-protection: 0
x-response-time: 108
pragma: no-cache
last-modified: Thu, 22 Oct 2020 20:53:14 GMT
server: tsa_o
x-frame-options: SAMEORIGIN
content-type: application/javascript;charset=utf-8
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash: 785314f7c3e46047a57d7e4c0fded2e2
x-transaction: 00dee8d900f1522e
expires: Tue, 31 Mar 1981 05:00:00 GMT

GET
H3-Q050 200 anchor
www.google.com/recaptcha/api2/ Frame 864A 0
0 25ms
24ms Document
text/html 2a00:1450:4001:821::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/anchor?ar=1&k=6Lfgf_8SAAAAADYbQAnKFOk7cvnWbkqo6y57-4-U&co=aHR0cHM6Ly90aHJlYXRwb3N0LmNvbTo0NDM.&hl=en&v=T9w1ROdplctW2nVKvNJYXH8o&theme=standard&size=normal&cb=7sd9rjjkmcfw

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:821::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-a39ue60lVdcYvrT7vQuvIw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: www.google.com
:scheme: https
:path: /recaptcha/api2/anchor?ar=1&k=6Lfgf_8SAAAAADYbQAnKFOk7cvnWbkqo6y57-4-U&co=aHR0cHM6Ly90aHJlYXRwb3N0LmNvbTo0NDM.&hl=en&v=T9w1ROdplctW2nVKvNJYXH8o&theme=standard&size=normal&cb=7sd9rjjkmcfw
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Response headers

status: 200
content-type: text/html; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: Mon, 01 Jan 1990 00:00:00 GMT
date: Thu, 22 Oct 2020 20:53:14 GMT
content-security-policy: script-src 'report-sample' 'nonce-a39ue60lVdcYvrT7vQuvIw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 10860
server: GSE
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 400 / Show response
graph.facebook.com/ 202 B
581 B 41ms
26ms XHR
application/json 2a03:2880:f01c:800e:face:b00c:0:2
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://graph.facebook.com/?id=https%3A%2F%2Fthreatpost.com%2Fshlayer-mac-malware-extra-sneakiness%2F156669%2F

Requested by

Host: threatpost.com
URL: https://threatpost.com/wp-includes/js/jquery/jquery.js?ver=1.12.4-wp

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:800e:face:b00c:0:2 , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

6140da23166989914be232f52675943bb623b6d1140f87d648dda5fc9482fdb0

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload

Request headers

Accept: application/json, text/javascript, */*; q=0.01
Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=15552000; preload
content-encoding: br
www-authenticate: OAuth "Facebook Platform" "invalid_request" "(#2) Service temporarily unavailable"
status: 400
x-fb-rev: 1002866293
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 149
pragma: no-cache
x-fb-debug: aVm8zLedLeL5Zi6OWF2U4U2IQq0rM3g6mnacVnHkbfEEAvUgKVX2dxgTPxUMz+RwJj5jvmuigd4auEH21DftiA==
x-fb-trace-id: Gnrkgz9aK18
date: Thu, 22 Oct 2020 20:53:14 GMT
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: *
x-fb-request-id: AS8oVVO2jstIWA81whvrQ1L
cache-control: no-store
facebook-api-version: v3.1
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 404 share
www.linkedin.com/countserv/count/ 0
0 126ms
110ms Script
text/html 2620:1ec:21::14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.linkedin.com/countserv/count/share?url=https%3A%2F%2Fthreatpost.com%2Fshlayer-mac-malware-extra-sneakiness%2F156669%2F&format=jsonp&callback=jQuery11240338730078583912_1603399993386&_=1603399993387
Requested by: Host: threatpost.com
URL: https://threatpost.com/wp-includes/js/jquery/jquery.js?ver=1.12.4-wp
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

GET
H2 200 info.json Show response
www.reddit.com/api/ 102 B
1 KB 229ms
163ms XHR
application/json 199.232.53.140
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://www.reddit.com/api/info.json?url=https%3A%2F%2Fthreatpost.com%2Fshlayer-mac-malware-extra-sneakiness%2F156669%2F

Requested by

Host: threatpost.com
URL: https://threatpost.com/wp-includes/js/jquery/jquery.js?ver=1.12.4-wp

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

199.232.53.140 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

snooserv /

Resource Hash

f4f2c0a4763f01ee2b13b4f8189e6fd5f32bd704d71fed8d0f11883de9724198

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept: application/json, text/javascript, */*; q=0.01
Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 22 Oct 2020 20:53:14 GMT
via: 1.1 varnish
x-content-type-options: nosniff
status: 200
content-length: 102
x-xss-protection: 1; mode=block
x-ua-compatible: IE=edge
x-moose: majestic
server: snooserv
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
access-control-expose-headers: X-Moose
cache-control: private, s-maxage=0, max-age=0, must-revalidate, no-store, max-age=0, must-revalidate
accept-ranges: bytes
expires: -1

GET
H3-Q050 200 anchor
www.google.com/recaptcha/api2/ Frame 916E 0
0 29ms
28ms Document
text/html 2a00:1450:4001:821::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LehhAETAAAAAAcsm2ZGDsLCqyGhesy4Yn43WNBe&co=aHR0cHM6Ly90aHJlYXRwb3N0LmNvbTo0NDM.&hl=en&v=T9w1ROdplctW2nVKvNJYXH8o&theme=light&size=normal&cb=7vvctmoy3coj

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:821::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-FCyFDGRGAP4wMl383kGoeA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: www.google.com
:scheme: https
:path: /recaptcha/api2/anchor?ar=1&k=6LehhAETAAAAAAcsm2ZGDsLCqyGhesy4Yn43WNBe&co=aHR0cHM6Ly90aHJlYXRwb3N0LmNvbTo0NDM.&hl=en&v=T9w1ROdplctW2nVKvNJYXH8o&theme=light&size=normal&cb=7vvctmoy3coj
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Response headers

status: 200
content-type: text/html; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: Mon, 01 Jan 1990 00:00:00 GMT
date: Thu, 22 Oct 2020 20:53:14 GMT
content-security-policy: script-src 'report-sample' 'nonce-FCyFDGRGAP4wMl383kGoeA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 10916
server: GSE
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

POST
H/1.1 200
OK sr Show response
capi.connatix.com/tr/ Frame A818 0
323 B 178ms
120ms XHR
multipart/form-data 18.221.6.219
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://capi.connatix.com/tr/sr?v=69601
Requested by: Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.221.6.219 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-221-6-219.us-east-2.compute.amazonaws.com
Software: openresty/1.15.8.2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: multipart/form-data

Response headers

Date: Thu, 22 Oct 2020 20:53:14 GMT
Content-Encoding: gzip
Server: openresty/1.15.8.2
Vary: Accept-Encoding
Content-Type: multipart/form-data
Access-Control-Allow-Origin: https://threatpost.com
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 20

GET
H2 200 3_media.bin Show response
vid.connatix.com/54ab44ae-2675-4cee-bcea-ec4cd9d0180b/ Frame A818 232 B
469 B 91ms
26ms XHR
application/octet-stream 151.101.114.137
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://vid.connatix.com/54ab44ae-2675-4cee-bcea-ec4cd9d0180b/3_media.bin
Requested by: Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.114.137 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 1e6cc52bffa814d7c7912cd64a2ef303e6a2f2387b428173dca05f032bfa5788

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 22 Oct 2020 20:53:14 GMT
content-encoding: gzip
age: 2109714
x-cache: HIT, HIT
status: 200
content-length: 204
x-served-by: cache-bwi5138-BWI, cache-hhn4029-HHN
last-modified: Thu, 17 Sep 2020 01:42:41 GMT
x-timer: S1603399995.534946,VS0,VE0
etag: "796c77896c9738780ae744fd3eb73483"
vary: Accept-Encoding
content-type: application/octet-stream
access-control-allow-origin: *
cache-control: max-age=31557600
accept-ranges: bytes
x-cache-hits: 1, 2

GET
H2 200 1.png
img.connatix.com/c2ecd04f-0dca-4ffa-8761-d93b34717380/ 4 KB
5 KB 37ms
34ms Image
image/webp 151.101.114.137
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.connatix.com/c2ecd04f-0dca-4ffa-8761-d93b34717380/1.png
Requested by: Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.114.137 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 98170098ad5b9e0e27bc80b4fab39889cb6437246979ee85680f64bb77d03a08

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 22 Oct 2020 20:53:14 GMT
via: 1.1 varnish, 1.1 varnish
age: 2371200
x-cache: HIT, HIT
fastly-io-info: ifsz=8114 idim=288x42 ifmt=png ofsz=4328 odim=288x42 ofmt=webp
status: 200
fastly-stats: io=1
content-encoding: gzip
content-length: 4351
x-served-by: cache-dca17721-DCA, cache-hhn4047-HHN
x-timer: S1603399994.489868,VS0,VE1
etag: "E00cBQTrMvE7BFKf7WtTa6oGFTVX3QMTXtfExBtu+i8"
vary: Accept
x-amz-request-id: 73558CDC7A440D38
access-control-allow-origin: *
cache-control: max-age=31557600
accept-ranges: bytes
content-type: image/webp
x-cache-hits: 1, 1

POST
H/1.1 200
OK ao Show response
capi.connatix.com/tr/ Frame A818 0
323 B 130ms
129ms XHR
multipart/form-data 18.221.6.219
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://capi.connatix.com/tr/ao?v=69601
Requested by: Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.221.6.219 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-221-6-219.us-east-2.compute.amazonaws.com
Software: openresty/1.15.8.2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: multipart/form-data

Response headers

Date: Thu, 22 Oct 2020 20:53:14 GMT
Content-Encoding: gzip
Server: openresty/1.15.8.2
Vary: Accept-Encoding
Content-Type: multipart/form-data
Access-Control-Allow-Origin: https://threatpost.com
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 20

POST
H/1.1 200
OK ps Show response
capi.connatix.com/tr/ Frame A818 0
323 B 128ms
128ms XHR
multipart/form-data 18.221.6.219
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://capi.connatix.com/tr/ps?v=69601
Requested by: Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.221.6.219 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-221-6-219.us-east-2.compute.amazonaws.com
Software: openresty/1.15.8.2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: multipart/form-data

Response headers

Date: Thu, 22 Oct 2020 20:53:14 GMT
Content-Encoding: gzip
Server: openresty/1.15.8.2
Vary: Accept-Encoding
Content-Type: multipart/form-data
Access-Control-Allow-Origin: https://threatpost.com
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 20

GET
H2 200 1_th.jpg
img.connatix.com/54ab44ae-2675-4cee-bcea-ec4cd9d0180b/ 2 KB
2 KB 29ms
28ms Image
image/webp 151.101.114.137
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.connatix.com/54ab44ae-2675-4cee-bcea-ec4cd9d0180b/1_th.jpg?crop=400:225,smart&width=400&height=225&format=jpeg&quality=60&fit=crop
Requested by: Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.114.137 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 3773223dc3f0b2c5f4ba6310b5eb478b52db9c305623545b0723b10a1e636b14

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 22 Oct 2020 20:53:14 GMT
via: 1.1 varnish, 1.1 varnish
age: 2411408
x-cache: HIT, HIT
fastly-io-info: ifsz=36645 idim=2560x1440 ifmt=jpeg ofsz=2098 odim=400x225 ofmt=webp
status: 200
fastly-stats: io=1
content-encoding: gzip
content-length: 2066
x-served-by: cache-dca17753-DCA, cache-hhn4047-HHN
x-timer: S1603399995.639734,VS0,VE1
etag: "iDhG33Z1a+GgxtfhSqjNbZ1Iz0hjRhSMeN4Q5WPVjm0"
vary: Accept
x-amz-request-id: 9718C29D2B1AEC8D
access-control-allow-origin: *
cache-control: max-age=31557600
accept-ranges: bytes
content-type: image/webp
x-cache-hits: 1, 1

GET
H3-Q050 200 bframe
www.google.com/recaptcha/api2/ Frame 9D15 0
0 21ms
19ms Document
text/html 2a00:1450:4001:821::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/bframe?hl=en&v=T9w1ROdplctW2nVKvNJYXH8o&k=6Lfgf_8SAAAAADYbQAnKFOk7cvnWbkqo6y57-4-U&cb=2qhmhvbt1t35

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:821::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-juKDGhCQNhrI+GKwud/lFg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: www.google.com
:scheme: https
:path: /recaptcha/api2/bframe?hl=en&v=T9w1ROdplctW2nVKvNJYXH8o&k=6Lfgf_8SAAAAADYbQAnKFOk7cvnWbkqo6y57-4-U&cb=2qhmhvbt1t35
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Response headers

status: 200
content-type: text/html; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: Mon, 01 Jan 1990 00:00:00 GMT
date: Thu, 22 Oct 2020 20:53:14 GMT
content-security-policy: script-src 'report-sample' 'nonce-juKDGhCQNhrI+GKwud/lFg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 1176
server: GSE
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-Q050 200 bframe
www.google.com/recaptcha/api2/ Frame F532 0
0 23ms
22ms Document
text/html 2a00:1450:4001:821::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/bframe?hl=en&v=T9w1ROdplctW2nVKvNJYXH8o&k=6LehhAETAAAAAAcsm2ZGDsLCqyGhesy4Yn43WNBe&cb=cralyxhfbqss

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:821::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-DkckC5+QiFaab5agclhhpg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: www.google.com
:scheme: https
:path: /recaptcha/api2/bframe?hl=en&v=T9w1ROdplctW2nVKvNJYXH8o&k=6LehhAETAAAAAAcsm2ZGDsLCqyGhesy4Yn43WNBe&cb=cralyxhfbqss
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Response headers

status: 200
content-type: text/html; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: Mon, 01 Jan 1990 00:00:00 GMT
date: Thu, 22 Oct 2020 20:53:14 GMT
content-security-policy: script-src 'report-sample' 'nonce-DkckC5+QiFaab5agclhhpg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 1171
server: GSE
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 prebid3.25.0-1.js Show response
cds.connatix.com/p/plugins/ Frame A818 286 KB
89 KB 29ms
26ms Script
application/javascript 151.101.114.137
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://cds.connatix.com/p/plugins/prebid3.25.0-1.js
Requested by: Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.114.137 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: b3e65f5bc65f920ed835a1329e8e585275e7c0e93de8a5c5642eab6300a11cef

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 22 Oct 2020 20:53:14 GMT
content-encoding: gzip
age: 3323350
x-cache: HIT, HIT
status: 200
content-length: 90468
x-served-by: cache-dca17730-DCA, cache-hhn4047-HHN
access-control-allow-origin: *
last-modified: Mon, 14 Sep 2020 09:43:49 GMT
x-timer: S1603399995.682599,VS0,VE0
etag: "9c38c88a790efaae20de0f5391a27029"
vary: Accept-Encoding
content-type: application/javascript
via: 1.1 varnish, 1.1 varnish
cache-control: max-age=31557600
accept-ranges: bytes
x-cache-hits: 2, 14449

GET
H2 200 integrator.js Show response
adservice.google.de/adsid/ 109 B
890 B 36ms
15ms Script
application/javascript 2a00:1450:4001:820::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=threatpost.com

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:820::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 22 Oct 2020 20:53:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status: 200
cache-control: private, no-cache, no-store
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 104
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 109 B
890 B 36ms
16ms Script
application/javascript 2a00:1450:4001:820::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=threatpost.com

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:820::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 22 Oct 2020 20:53:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status: 200
cache-control: private, no-cache, no-store
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 104
x-xss-protection: 0

GET
H3-Q050 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 142 KB
20 KB 473ms
443ms XHR
text/plain 216.58.208.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=2932607194856493&correlator=680373532739632&output=ldjh&impl=fifs&eid=21065138%2C21067753%2C21068030&vrg=2020101901&gdpr=0&us_privacy=1---&tfua=0&tfcd=0&guci=1.2.0.0.2.2.0.0&sc=1&sfv=1-0-37&ecs=20201022&iu_parts=21707124336%2CThreatPost-970x250-ATF%2CThreatPost-300x250-ATF%2CThreatPost-300x600-ATF%2CThreatPost-2x2-Skin&enc_prev_ius=%2F0%2F1%2C%2F0%2F2%2C%2F0%2F3%2C%2F0%2F4&prev_iu_szs=728x90%7C970x250%7C970x90%2C300x250%7C336x280%2C300x250%7C300x600%2C2x2&prev_scp=amznbid%3D2%26amznp%3D2%26hb_adid_nobid%3D636e0094d008b5f%26hb_bidder_nobid%3Dnobid%26dyn_bids%3D0.01%26hb_adid%3D636e0094d008b5f%26hb_bidder%3Dnobid%7Camznbid%3D2%26amznp%3D2%7Camznbid%3D2%26amznp%3D2%26hb_adid_nobid%3D64322604574db3c%26hb_bidder_nobid%3Dnobid%26dyn_bids%3D0.01%26hb_adid%3D64322604574db3c%26hb_bidder%3Dnobid%7Camznbid%3D2%26amznp%3D2&eri=1&cust_params=urlhost%3Dhttps%253A%252F%252Fthreatpost.com%252F%26urlpath%3D%252Fshlayer-mac-malware-extra-sneakiness%252F156669%252F%26urlquery%3Dgoogfc%26contentid%3D156669%26category%3Deditors-picks%26contenttags%3Danti-evasion%252Cfake-adobe-flash-installer%252Cgoogle-search%252Cintego%252Cmac-malware%252Cmalware-analysis%252Cnew-version%252Cpoisoned-search-results%252Cshlayer%252Cstealth&cookie_enabled=1&bc=31&abxe=1&lmt=1603399994&dt=1603399994693&dlt=1603399992693&idt=618&frm=20&biw=1600&bih=1200&oid=3&adxs=436%2C1082%2C1082%2C0&adys=10%2C257%2C1532%2C0&adks=1015519800%2C654286612%2C375389812%2C3385906655&ucis=1%7C2%7C3%7C4&ifi=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fthreatpost.com%2Fshlayer-mac-malware-extra-sneakiness%2F156669%2F%3Fweb_view%3Dtrue&dssz=55&icsg=171811933184&std=0&vis=1&dmc=8&scr_x=0&scr_y=0&psz=728x90%7C300x250%7C300x250%7C1600x2&msz=728x90%7C300x250%7C300x250%7C1600x2&ga_vid=1567673916.1603399994&ga_sid=1603399995&ga_hid=1759624720&fws=0%2C0%2C0%2C0&ohw=0%2C0%2C0%2C0&tt_state=W3siaXNzdWVyT3JpZ2luIjoiaHR0cHM6Ly9hZHNlcnZpY2UuZ29vZ2xlLmNvbSIsInN0YXRlIjowfV0.

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020101901.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

216.58.208.34 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s12-in-f34.1e100.net

Software

cafe /

Resource Hash

bf36b362e796fa643d9f49acecc59f3c9058a2a932d0de9c080a095d4b15aaa1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 22 Oct 2020 20:53:15 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 19927
x-xss-protection: 0
google-lineitem-id: -1,-1,-1,5283645110
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -1,-1,-1,138301519116
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://threatpost.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 container.html
b1ae54670d2110ccdffcb33197cc425f.safeframe.googlesyndication.com/safeframe/1-0-37/html/ 0
0 59ms
16ms Other
text/html 2a00:1450:400c:c02::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://b1ae54670d2110ccdffcb33197cc425f.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:400c:c02::84 Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

GET
H2 200 container.html
tpc.googlesyndication.com/safeframe/1-0-37/html/ 0
0 26ms
6ms Other
text/html 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://tpc.googlesyndication.com/safeframe/1-0-37/html/container.html
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

GET
H2 200 avjp Show response
teachingaids-d.openx.net/v/1.0/ Frame A818 92 B
286 B 42ms
42ms XHR
application/json 34.98.64.218
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://teachingaids-d.openx.net/v/1.0/avjp?ju=https%3A%2F%2Fthreatpost.com%2Fshlayer-mac-malware-extra-sneakiness%2F156669%2F%3Fweb_view%3Dtrue&ch=UTF-8&res=1600x1200x24&ifr=true&tz=-120&tws=1600x1200&be=1&bc=hb_pb_3.0.2&dddid=2b231f78-524b-4ce4-898f-140426ef682b&nocache=1603399994789&schain=1.0%2C1!admetricspro.com%2C1%2C1%2C%2C%2C&auid=540882778&vwd=400&vht=225
Requested by: Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid3.25.0-1.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.64.218 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/16.195.1 /
Resource Hash: 004e5faf0bf890f61697daeede9f21826affd1137fb2cb58eaf4719937a04a14

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 22 Oct 2020 20:53:14 GMT
via: 1.1 google
server: OXGW/16.195.1
status: 200
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: https://threatpost.com
cache-control: private, max-age=0, no-cache
access-control-allow-credentials: true
content-type: application/json
alt-svc: clear
content-length: 92
expires: Mon, 26 Jul 1997 05:00:00 GMT

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ Frame A818 19 B
712 B 20ms
20ms XHR
application/json 185.33.221.91
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid3.25.0-1.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.221.91 , Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

721.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

Software

nginx/1.17.9 /

Resource Hash

0c09c070833c786cb25be38bc30992b30bad578f817dbc9e34beacd8b8ea44c5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Thu, 22 Oct 2020 20:53:14 GMT
X-Proxy-Origin: 185.212.171.67; 185.212.171.67; 721.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.220.144:80
AN-X-Request-Uuid: 89615f13-82f2-44ee-8c02-0dc65b6303a1
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://threatpost.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json; charset=utf-8
Content-Length: 19
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 cygnus Show response
as-sec.casalemedia.com/ Frame A818 23 B
270 B 171ms
169ms XHR
application/json 104.111.215.135
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://as-sec.casalemedia.com/cygnus?t=900&s=435870&v=8.1&r=%7B%22id%22%3A%22536998660a197%22%2C%22imp%22%3A%5B%7B%22id%22%3A%22602f9ee396e668%22%2C%22ext%22%3A%7B%22siteID%22%3A%22435870%22%2C%22sid%22%3A%22400x225%22%7D%2C%22bidfloor%22%3A0.25%2C%22bidfloorcur%22%3A%22USD%22%2C%22video%22%3A%7B%22mimes%22%3A%5B%22video%2Fmp4%22%2C%22video%2Fwebm%22%2C%22application%2Fjavascript%22%2C%22video%2Fogg%22%2C%22video%2Fmpeg%22%5D%2C%22minduration%22%3A0%2C%22maxduration%22%3A180000%2C%22protocols%22%3A%5B1%2C2%2C3%2C4%2C5%2C6%5D%2C%22w%22%3A400%2C%22h%22%3A225%2C%22placement%22%3A1%7D%7D%5D%2C%22site%22%3A%7B%22page%22%3A%22https%3A%2F%2Fthreatpost.com%2Fshlayer-mac-malware-extra-sneakiness%2F156669%2F%3Fweb_view%3Dtrue%22%7D%2C%22ext%22%3A%7B%22source%22%3A%22prebid%22%7D%2C%22source%22%3A%7B%22ext%22%3A%7B%22schain%22%3A%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22admetricspro.com%22%2C%22hp%22%3A1%2C%22sid%22%3A%221%22%7D%5D%7D%7D%7D%7D&ac=j&sd=1&nf=1
Requested by: Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid3.25.0-1.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.111.215.135 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-215-135.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 0cebde58ed4096b547c8ed4e270987cde8227c42c4711d8a93b5b705a6a83642

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 22 Oct 2020 20:53:14 GMT
content-encoding: gzip
server: Apache
status: 200
vary: Is-Traffic-Invalid,Accept-Encoding
content-type: application/json
access-control-allow-origin: https://threatpost.com
cache-control: max-age=0, no-cache, no-store
access-control-allow-credentials: true
content-length: 43
expires: Thu, 22 Oct 2020 20:53:14 GMT

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ Frame A818 19 B
711 B 18ms
18ms XHR
application/json 185.33.221.91
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid3.25.0-1.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.221.91 , Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

721.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

Software

nginx/1.17.9 /

Resource Hash

0c09c070833c786cb25be38bc30992b30bad578f817dbc9e34beacd8b8ea44c5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Thu, 22 Oct 2020 20:53:14 GMT
X-Proxy-Origin: 185.212.171.67; 185.212.171.67; 721.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.220.45:80
AN-X-Request-Uuid: 561d987d-d6fa-4d10-ba11-bfc01c21958f
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://threatpost.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json; charset=utf-8
Content-Length: 19
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 cygnus Show response
as-sec.casalemedia.com/ Frame A818 24 B
271 B 153ms
153ms XHR
application/json 104.111.215.135
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://as-sec.casalemedia.com/cygnus?t=900&s=435871&v=8.1&r=%7B%22id%22%3A%2295708669480b3b%22%2C%22imp%22%3A%5B%7B%22id%22%3A%2210ec5ddff1a9a8c%22%2C%22ext%22%3A%7B%22siteID%22%3A%22435871%22%2C%22sid%22%3A%22400x225%22%7D%2C%22bidfloor%22%3A0.25%2C%22bidfloorcur%22%3A%22USD%22%2C%22video%22%3A%7B%22mimes%22%3A%5B%22video%2Fmp4%22%2C%22video%2Fwebm%22%2C%22application%2Fjavascript%22%2C%22video%2Fogg%22%2C%22video%2Fmpeg%22%5D%2C%22minduration%22%3A0%2C%22maxduration%22%3A180000%2C%22protocols%22%3A%5B1%2C2%2C3%2C4%2C5%2C6%5D%2C%22w%22%3A400%2C%22h%22%3A225%2C%22placement%22%3A1%7D%7D%5D%2C%22site%22%3A%7B%22page%22%3A%22https%3A%2F%2Fthreatpost.com%2Fshlayer-mac-malware-extra-sneakiness%2F156669%2F%3Fweb_view%3Dtrue%22%7D%2C%22ext%22%3A%7B%22source%22%3A%22prebid%22%7D%2C%22source%22%3A%7B%22ext%22%3A%7B%22schain%22%3A%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22admetricspro.com%22%2C%22hp%22%3A1%2C%22sid%22%3A%221%22%7D%5D%7D%7D%7D%7D&ac=j&sd=1&nf=1
Requested by: Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid3.25.0-1.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.111.215.135 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-215-135.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 4631412a99f82e318d89ced5b93362b6be7bfbfdc53b351f5cf96acc705b9c83

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 22 Oct 2020 20:53:14 GMT
content-encoding: gzip
server: Apache
status: 200
vary: Is-Traffic-Invalid,Accept-Encoding
content-type: application/json
access-control-allow-origin: https://threatpost.com
cache-control: max-age=0, no-cache, no-store
access-control-allow-credentials: true
content-length: 44
expires: Thu, 22 Oct 2020 20:53:14 GMT

POST
H2 204 translator Show response
hbopenbid.pubmatic.com/ Frame A818 0
59 B 67ms
67ms XHR
text/plain 185.64.189.112
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by: Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid3.25.0-1.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.189.112 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

status: 204
date: Thu, 22 Oct 2020 20:53:14 GMT
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
access-control-allow-origin: https://threatpost.com

GET
H2 200 avjp Show response
teachingaids-d.openx.net/v/1.0/ Frame A818 92 B
283 B 38ms
38ms XHR
application/json 34.98.64.218
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://teachingaids-d.openx.net/v/1.0/avjp?ju=https%3A%2F%2Fthreatpost.com%2Fshlayer-mac-malware-extra-sneakiness%2F156669%2F%3Fweb_view%3Dtrue&ch=UTF-8&res=1600x1200x24&ifr=true&tz=-120&tws=1600x1200&be=1&bc=hb_pb_3.0.2&dddid=81187612-83a0-4890-8ca0-66ff3f68ad05&nocache=1603399994807&schain=1.0%2C1!admetricspro.com%2C1%2C1%2C%2C%2C&auid=540882779&vwd=400&vht=225
Requested by: Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid3.25.0-1.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.64.218 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/16.195.1 /
Resource Hash: 004e5faf0bf890f61697daeede9f21826affd1137fb2cb58eaf4719937a04a14

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 22 Oct 2020 20:53:14 GMT
via: 1.1 google
server: OXGW/16.195.1
status: 200
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: https://threatpost.com
cache-control: private, max-age=0, no-cache
access-control-allow-credentials: true
content-type: application/json
alt-svc: clear
content-length: 92
expires: Mon, 26 Jul 1997 05:00:00 GMT

POST
H2 204 translator Show response
hbopenbid.pubmatic.com/ Frame A818 0
59 B 64ms
64ms XHR
text/plain 185.64.189.112
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by: Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid3.25.0-1.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.189.112 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

status: 204
date: Thu, 22 Oct 2020 20:53:14 GMT
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
access-control-allow-origin: https://threatpost.com

POST
H/1.1 204
No Content openrtb Show response
ads.adaptv.advertising.com/rtb/ Frame A818 0
215 B 105ms
30ms XHR
application/json 18.185.185.10
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.adaptv.advertising.com/rtb/openrtb?ext_id=TeachingAidsLLC
Requested by: Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid3.25.0-1.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.185.185.10 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-185-185-10.eu-central-1.compute.amazonaws.com
Software: adaptv/1.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://threatpost.com
access-control-allow-credentials: true
server: adaptv/1.0
Connection: keep-alive
content-length: 0
content-type: application/json

GET
H2 200 playlist.m3u8 Show response
vid.connatix.com/54ab44ae-2675-4cee-bcea-ec4cd9d0180b/ Frame A818 309 B
325 B 26ms
25ms XHR
application/x-mpegurl 151.101.114.137
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://vid.connatix.com/54ab44ae-2675-4cee-bcea-ec4cd9d0180b/playlist.m3u8
Requested by: Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.114.137 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 05a58707d25ec9885faf81f026410f37d3757c0689d56b7ec1fc8b2f9cffb9d1

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 22 Oct 2020 20:53:14 GMT
content-encoding: gzip
age: 67891
x-cache: HIT, HIT
status: 200
content-length: 164
x-served-by: cache-bwi5145-BWI, cache-hhn4029-HHN
last-modified: Mon, 07 Sep 2020 18:49:42 GMT
x-timer: S1603399995.831920,VS0,VE0
etag: "8a966507b13615ecdc1330a4bc9dcfe1"
vary: Accept-Encoding
content-type: application/x-mpegURL
access-control-allow-origin: *
cache-control: max-age=31557600
accept-ranges: bytes
x-cache-hits: 1, 2

GET
H2 200 0.m3u8 Show response
vid.connatix.com/54ab44ae-2675-4cee-bcea-ec4cd9d0180b/ Frame A818 5 KB
1 KB 22ms
22ms XHR
application/x-mpegurl 151.101.114.137
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://vid.connatix.com/54ab44ae-2675-4cee-bcea-ec4cd9d0180b/0.m3u8
Requested by: Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.114.137 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: ac1eed21fdddd6a981458cc46e79523f77a9b44b9b639d9df405c0d9827cc552

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 22 Oct 2020 20:53:14 GMT
content-encoding: gzip
age: 82331
x-cache: HIT, HIT
status: 200
content-length: 959
x-served-by: cache-bwi5126-BWI, cache-hhn4029-HHN
last-modified: Mon, 07 Sep 2020 18:49:41 GMT
x-timer: S1603399995.858976,VS0,VE0
etag: "3a71266b043248350b2f39a55da8294e"
vary: Accept-Encoding
content-type: application/x-mpegURL
access-control-allow-origin: *
cache-control: max-age=31557600
accept-ranges: bytes
x-cache-hits: 1, 2

OPTIONS
H2 200 0.mp4
vid.connatix.com/54ab44ae-2675-4cee-bcea-ec4cd9d0180b/ Frame 0
0 25ms
22ms Other 151.101.114.137
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://vid.connatix.com/54ab44ae-2675-4cee-bcea-ec4cd9d0180b/0.mp4
Protocol: H2
Server: 151.101.114.137 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Method: GET
Access-Control-Request-Headers: range
Origin: https://threatpost.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

status: 200
retry-after: 0
access-control-allow-origin: *
access-control-allow-methods: *
access-control-allow-headers: range
accept-ranges: bytes
date: Thu, 22 Oct 2020 20:53:14 GMT
x-served-by: cache-hhn4029-HHN
x-cache: HIT
x-cache-hits: 0
x-timer: S1603399995.888143,VS0,VE0
cache-control: max-age=31557600
content-length: 0

GET
H2 206 0.mp4 Show response
vid.connatix.com/54ab44ae-2675-4cee-bcea-ec4cd9d0180b/ Frame A818 1 KB
2 KB 24ms
23ms XHR
video/mp4 151.101.114.137
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://vid.connatix.com/54ab44ae-2675-4cee-bcea-ec4cd9d0180b/0.mp4
Requested by: Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.114.137 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: e8c207773b5b242229f77be9cde555a9cf5ced8288409f80da3d5192706e40e3

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Range: bytes=0-1428

Response headers

date: Thu, 22 Oct 2020 20:53:14 GMT
last-modified: Mon, 07 Sep 2020 18:49:41 GMT
age: 2114469
etag: "7e14a97a9fd99818d5080eb2d1b8cc43-7"
x-served-by: cache-bwi5129-BWI, cache-hhn4029-HHN
status: 206
x-cache: HIT, HIT
content-type: video/mp4
Content-Range: bytes 0-1428/32479190
cache-control: max-age=31557600
accept-ranges: bytes
x-timer: S1603399995.911391,VS0,VE0
access-control-allow-origin: *
Content-Length: 1429
x-cache-hits: 1, 1

OPTIONS
H2 200 0.mp4
vid.connatix.com/54ab44ae-2675-4cee-bcea-ec4cd9d0180b/ Frame 0
0 22ms
22ms Other 151.101.114.137
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://vid.connatix.com/54ab44ae-2675-4cee-bcea-ec4cd9d0180b/0.mp4
Protocol: H2
Server: 151.101.114.137 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Method: GET
Access-Control-Request-Headers: range
Origin: https://threatpost.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

status: 200
retry-after: 0
access-control-allow-origin: *
access-control-allow-methods: *
access-control-allow-headers: range
accept-ranges: bytes
date: Thu, 22 Oct 2020 20:53:14 GMT
x-served-by: cache-hhn4029-HHN
x-cache: HIT
x-cache-hits: 0
x-timer: S1603399995.937155,VS0,VE0
cache-control: max-age=31557600
content-length: 0

GET
H2 206 0.mp4 Show response
vid.connatix.com/54ab44ae-2675-4cee-bcea-ec4cd9d0180b/ Frame A818 444 KB
445 KB 23ms
23ms XHR
video/mp4 151.101.114.137
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://vid.connatix.com/54ab44ae-2675-4cee-bcea-ec4cd9d0180b/0.mp4
Requested by: Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.114.137 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: dd7d093a1d67babe8e574f94231253e281cf71195d34d8d7035329c655915c90

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Range: bytes=1429-456334

Response headers

date: Thu, 22 Oct 2020 20:53:14 GMT
last-modified: Mon, 07 Sep 2020 18:49:41 GMT
age: 2114469
etag: "7e14a97a9fd99818d5080eb2d1b8cc43-7"
x-served-by: cache-bwi5129-BWI, cache-hhn4029-HHN
status: 206
x-cache: HIT, HIT
content-type: video/mp4
Content-Range: bytes 1429-456334/32479190
cache-control: max-age=31557600
accept-ranges: bytes
x-timer: S1603399995.960333,VS0,VE0
access-control-allow-origin: *
Content-Length: 454906
x-cache-hits: 1, 2

OPTIONS
H2 200 0.mp4
vid.connatix.com/54ab44ae-2675-4cee-bcea-ec4cd9d0180b/ Frame 0
0 22ms
21ms Other 151.101.114.137
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://vid.connatix.com/54ab44ae-2675-4cee-bcea-ec4cd9d0180b/0.mp4
Protocol: H2
Server: 151.101.114.137 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Method: GET
Access-Control-Request-Headers: range
Origin: https://threatpost.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

status: 200
retry-after: 0
access-control-allow-origin: *
access-control-allow-methods: *
access-control-allow-headers: range
accept-ranges: bytes
date: Thu, 22 Oct 2020 20:53:15 GMT
x-served-by: cache-hhn4029-HHN
x-cache: HIT
x-cache-hits: 0
x-timer: S1603399995.060193,VS0,VE0
cache-control: max-age=31557600
content-length: 0

GET
H2 206 0.mp4 Show response
vid.connatix.com/54ab44ae-2675-4cee-bcea-ec4cd9d0180b/ Frame A818 390 KB
390 KB 25ms
25ms XHR
video/mp4 151.101.114.137
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://vid.connatix.com/54ab44ae-2675-4cee-bcea-ec4cd9d0180b/0.mp4
Requested by: Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.114.137 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 91e8f81ef3c99be20d905536aa719b1fd716ce7760080c3ca6b0cd552723535d

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Range: bytes=456335-855191

Response headers

date: Thu, 22 Oct 2020 20:53:15 GMT
last-modified: Mon, 07 Sep 2020 18:49:41 GMT
age: 2114469
etag: "7e14a97a9fd99818d5080eb2d1b8cc43-7"
x-served-by: cache-bwi5129-BWI, cache-hhn4029-HHN
status: 206
x-cache: HIT, HIT
content-type: video/mp4
Content-Range: bytes 456335-855191/32479190
cache-control: max-age=31557600
accept-ranges: bytes
x-timer: S1603399995.083969,VS0,VE0
access-control-allow-origin: *
Content-Length: 398857
x-cache-hits: 1, 3

POST
H2 200 tag
math-aids-threatpost-tagan.adlightning.com/ 0
427 B 90ms
26ms Other
text/plain 52.85.32.34
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://math-aids-threatpost-tagan.adlightning.com/tag?s=bl&d=eyJzaXRlSWQiOiJtYXRoLWFpZHMtdGhyZWF0cG9zdCIsInVybCI6Imh0dHBzOi8vdGhyZWF0cG9zdC5jb20vc2hsYXllci1tYWMtbWFsd2FyZS1leHRyYS1zbmVha2luZXNzLzE1NjY2OS8%2Fd2ViX3ZpZXc9dHJ1ZSIsImFkVW5pdCI6Ii8yMTcwNzEyNDMzNi9UaHJlYXRQb3N0LTk3MHgyNTAtQVRGXzAiLCJhZFNlcnZlckRldGFpbHMiOnsiYWR2ZXJ0aXNlcklkIjoiNDU5NDU1OTc1MiIsImNhbXBhaWduSWQiOiIyNjU0MDI1MDM5IiwiY3JlYXRpdmVJZCI6IjEzODMwMTUzNDE5OCIsImxpbmVpdGVtSWQiOiI1Mjc2MDQ3MzgyIiwiYWRTZXJ2ZXIiOiJkZnAifSwid2lkdGgiOjcyOCwiaGVpZ2h0Ijo5MCwid3YiOiIxLjAuMCs5YTRmN2NlIiwiYnYiOiIxLjAuMCs5YTRmN2NlIiwidGFnTWFya3VwIjoiPGh0bWw%2BPGhlYWQ%2BPC9oZWFkPjxib2R5PlRvbyBtYW55IHJlcXVlc3RzOiAzNC5cbjxzY3JpcHQgYXN5bmM9XCJcIiBzcmM9XCJodHRwczovL3d3dy5saW5rZWRpbi5jb20vY291bnRzZXJ2L2NvdW50L3NoYXJlP3VybD1odHRwcyUzQSUyRiUyRnRocmVhdHBvc3QuY29tJTJGc2hsYXllci1tYWMtbWFsd2FyZS1leHRyYS1zbmVha2luZXNzJTJGMTU2NjY5JTJGJmFtcDtmb3JtYXQ9anNvbnAmYW1wO2NhbGxiYWNrPWpRdWVyeTExMjQwMzM4NzMwMDc4NTgzOTEyXzE2MDMzOTk5OTMzODYmYW1wO189MTYwMzM5OTk5MzM4N1wiPjwvc2NyaXB0PlxuPHNjcmlwdCB0eXBlPVwidGV4dC9qYXZhc2NyaXB0XCIgYXN5bmM9XCJcIiBzcmM9XCJodHRwczovL3d3dy5nc3RhdGljLmNvbS9yZWNhcHRjaGEvcmVsZWFzZXMvVDl3MVJPZHBsY3RXMm5WS3ZOSllYSDhvL3JlY2FwdGNoYV9fZW4uanNcIiBjcm9zc29yaWdpbj1cImFub255bW91c1wiIGludGVncml0eT1cInNoYTM4NC0zUUZtR2E5V0JWVW5tVFRHZWhpKzFVaW4xcG1CdVMvSTVSMUNlNTJBaWl1dmlldDY1ditiSDEyZVI0K2tVVWN4XCI%2BPC9zY3JpcHQ%2BXG48c2NyaXB0IHNyYz1cImh0dHBzOi8vcnVsZXMucXVhbnRjb3VudC5jb20vcnVsZXMtcC1fN2tWeDB0OUpxajkwLmpzXCIgYXN5bmM9XCJcIj48L3NjcmlwdD5cbjxzY3JpcHQgdHlwZT1cInRleHQvamF2YXNjcmlwdFwiIGFzeW5jPVwiXCIgc3JjPVwiaHR0cHM6Ly9zdGF0aWMuYWRzLXR3aXR0ZXIuY29tL3V3dC5qc1wiPjwvc2NyaXB0PlxuPHNjcmlwdCB0eXBlPVwidGV4dC9qYXZhc2NyaXB0XCIgYXN5bmM9XCJcIiBzcmM9XCJodHRwczovL3NlY3VyZS5xdWFudHNlcnZlLmNvbS9xdWFudC5qc1wiPjwvc2NyaXB0PlxuPHNjcmlwdCB0eXBlPVwidGV4dC9qYXZhc2NyaXB0XCIgYXN5bmM9XCJcIiBzcmM9XCJodHRwczovL3d3dy5nb29nbGUtYW5hbHl0aWNzLmNvbS9hbmFseXRpY3MuanNcIj48L3NjcmlwdD5cbjxzY3JpcHQgdHlwZT1cInRleHQvamF2YXNjcmlwdFwiIGFzeW5jPVwiXCIgc3JjPVwiaHR0cHM6Ly93d3cuZ3N0YXRpYy5jb20vcmVjYXB0Y2hhL3JlbGVhc2VzL1Q5dzFST2RwbGN0VzJuVkt2TkpZWEg4by9yZWNhcHRjaGFfX2VuLmpzXCIgY3Jvc3NvcmlnaW49XCJhbm9ueW1vdXNcIiBpbnRlZ3JpdHk9XCJzaGEzODQtM1FGbUdhOVdCVlVubVRUR2VoaSsxVWluMXBtQnVTL0k1UjFDZTUyQWlpdXZpZXQ2NXYrYkgxMmVSNCtrVVVjeFwiPjwvc2NyaXB0PlxuPHNjcmlwdCBhc3luYz1cIlwiIHNyYz1cImh0dHBzOi8vd3d3Lmdvb2dsZXRhZ21hbmFnZXIuY29tL2d0bS5qcz9pZD1HVE0tUE0yOUhMRlwiPjwvc2NyaXB0PlxuPHNjcmlwdCBhc3luYz1cIlwiIHNyYz1cImh0dHBzOi8va2FzcGVyc2t5Y29udGVudGh1Yi5jb20vP2RtPWVkMWY5ZTQzNWRjODg1MjkyZWFiNjU2MjBjNTFmM2ZiJmFtcDthY3Rpb249bG9hZCZhbXA7YmxvZ2lkPTEwMyZhbXA7c2l0ZWlkPTEmYW1wO3Q9MTgwODg3NDk0NSZhbXA7YmFjaz1odHRwcyUzQSUyRiUyRnRocmVhdHBvc3QuY29tJTJGc2hsYXllci1tYWMtbWFsd2FyZS1leHRyYS1zbmVha2luZXNzJTJGMTU2NjY5JTJGJTNGd2ViX3ZpZXclM0R0cnVlXCI%2BPC9zY3JpcHQ%2BXG48c2NyaXB0IGFzeW5jPVwiXCIgc3JjPVwiLy9jLmFtYXpvbi1hZHN5c3RlbS5jb20vYWF4Mi9hcHN0YWcuanNcIj48L3NjcmlwdD5cbjxzY3JpcHQgc3JjPVwiaHR0cHM6Ly90YWdhbi5hZGxpZ2h0bmluZy5jb20vbWF0aC1haWRzLXRocmVhdHBvc3QvYmwtMDRhMzM4NS02MDMxMmY2NS5qc1wiIHR5cGU9XCJ0ZXh0L2phdmFzY3JpcHRcIiBkZWZlcj1cIlwiPjwvc2NyaXB0PlxuPHNjcmlwdCBzcmM9XCJodHRwczovL3RhZ2FuLmFkbGlnaHRuaW5nLmNvbS9tYXRoLWFpZHMtdGhyZWF0cG9zdC9iLTlhNGY3Y2UtYTdmNjA5OGMuanNcIiB0eXBlPVwidGV4dC9qYXZhc2NyaXB0XCIgZGVmZXI9XCJcIj48L3NjcmlwdD5cbjxzY3JpcHQgdHlwZT1cInRleHQvamF2YXNjcmlwdFwiPjwvc2NyaXB0PlxuPHNjcmlwdD5cbnZhciBnQU1QX3VybGhvc3QgPSAgJ2h0dHBzOi8vdGhyZWF0cG9zdC5jb20vJztcbnZhciBnQU1QX3VybHBhdGggPSAgJy9zaGxheWVyLW1hYy1tYWx3YXJlLWV4dHJhLXNuZWFraW5lc3MvMTU2NjY5Lyc7XG52YXIgZ0FNUF91cmxxdWVyeSA9ICAnZ29vZ2ZjJztcbnZhciBnQU1QX2NvbnRlbnRpZCA9ICAnMTU2NjY5JztcbnZhciBnQU1QX2NhdGVnb3J5ID0gICdlZGl0b3JzLXBpY2tzJztcbnZhciBnQU1QX2NvbnRlbnR0YWdzID0gICdhbnRpLWV2YXNpb24sZmFrZS1hZG9iZS1mbGFzaC1pbnN0YWxsZXIsZ29vZ2xlLXNlYXJjaCxpbnRlZ28sbWFjLW1hbHdhcmUsbWFsd2FyZS1hbmFseXNpcyxuZXctdmVyc2lvbixwb2lzb25lZC1zZWFyY2gtcmVzdWx0cyxzaGxheWVyLHN0ZWFsdGgnO1xuPC9zY3JpcHQ%2BXG48c2NyaXB0IHNyYz1cImh0dHBzOi8vdGFnYW4uYWRsaWdodG5pbmcuY29tL21hdGgtYWlkcy10aHJlYXRwb3N0L29wLmpzXCI%2BPC9zY3JpcHQ%2BXG48c2NyaXB0IHNyYz1cImh0dHBzOi8vcWQuYWRtZXRyaWNzcHJvLmNvbS9qcy90aHJlYXRwb3N0L3Jvcy1sYXlvdXQuanNcIj48L3NjcmlwdD5cbjxzY3JpcHQgc3JjPVwiLy93d3cuZ29vZ2xldGFnc2VydmljZXMuY29tL3RhZy9qcy9ncHQuanNcIj48L3NjcmlwdD5cbjxzY3JpcHQgc3JjPVwiaHR0cHM6Ly9zZWN1cmVwdWJhZHMuZy5kb3VibGVjbGljay5uZXQvZ3B0L3B1YmFkc19pbXBsXzIwMjAxMDE5MDEuanNcIiBpZD1cImdwdC1pbXBsLTAuODgyMTA1MTcyMTU3ODY2MVwiIG5vbmNlPVwiXCI%2BPC9zY3JpcHQ%2BXG48c2NyaXB0IHNyYz1cImh0dHBzOi8vcWQuYWRtZXRyaWNzcHJvLmNvbS9qcy90aHJlYXRwb3N0L2NtcC5qc1wiPjwvc2NyaXB0PlxuPHNjcmlwdCBzcmM9XCJodHRwczovL3FkLmFkbWV0cmljc3Byby5jb20vanMvdGhyZWF0cG9zdC91c3BjbXAuanNcIj48L3NjcmlwdD5cbjxzY3JpcHQgc3JjPVwiaHR0cHM6Ly9xZC5hZG1ldHJpY3Nwcm8uY29tL2pzL3RocmVhdHBvc3QvdGFyZ2V0aW5nLmpzXCI%2BPC9zY3JpcHQ%2BXG48c2NyaXB0IHNyYz1cImh0dHBzOi8vcWQuYWRtZXRyaWNzcHJvLmNvbS9qcy90aHJlYXRwb3N0L3ByZWJpZC5qc1wiPjwvc2NyaXB0PlxuPHNjcmlwdCBzcmM9XCJodHRwczovL3FkLmFkbWV0cmljc3Byby5jb20vanMvdGhyZWF0cG9zdC9lbmdpbmUuanNcIj48L3NjcmlwdD5cbjxzY3JpcHQ%2BXG4hZnVuY3Rpb24obil7aWYoIXdpbmRvdy5jbngpe3dpbmRvdy5jbng9e30sd2luZG93LmNueC5jbWQ9W107dmFyIHQ9bi5jcmVhdGVFbGVtZW50KCdpZnJhbWUnKTt0LmRpc3BsYXk9J25vbmUnLHQub25sb2FkPWZ1bmN0aW9uKCl7dmFyIG49dC5jb250ZW50V2luZG93LmRvY3VtZW50LGM9bi5jcmVhdGVFbGVtZW50KCdzY3JpcHQnKTtjLnNyYz0nLy9jZC5jb25uYXRpeC5jb20vY29ubmF0aXgucGxheWVyLmpzJyxjLnNldEF0dHJpYnV0ZSgnYXN5bmMnLCcxJyksYy5zZXRBdHRyaWJ1dGUoJ3R5cGUnLCd0ZXh0L2phdmFzY3JpcHQnKSxuLmJvZHkuYXBwZW5kQ2hpbGQoYyl9LG4uaGVhZC5hcHBlbmRDaGlsZCh0KX19KGRvY3VtZW50KTtcbjwvc2NyaXB0PlxuPHNjcmlwdCB0eXBlPVwiYXBwbGljYXRpb24vbGQranNvblwiPntcIkBjb250ZXh0XCI6XCJodHRwczovL3NjaGVtYS5vcmdcIixcIkB0eXBlXCI6XCJCcmVhZGNydW1iTGlzdFwiLFwiaXRlbUxpc3RFbGVtZW50XCI6W3tcIkB0eXBlXCI6XCJMaXN0SXRlbVwiLFwicG9zaXRpb25cIjoxLFwiaXRlbVwiOntcIkBpZFwiOlwiaHR0cHM6Ly90aHJlYXRwb3N0LmNvbS9cIixcIm5hbWVcIjpcIlRocmVhdHBvc3RcIn19LHtcIkB0eXBlXCI6XCJMaXN0SXRlbVwiLFwicG9zaXRpb25cIjoyLFwiaXRlbVwiOntcIkBpZFwiOlwiaHR0cHM6Ly90aHJlYXRwb3N0LmNvbS9jYXRlZ29yeS9tYWx3YXJlLTIvXCIsXCJuYW1lXCI6XCJNYWx3YXJlXCJ9fSx7XCJAdHlwZVwiOlwiTGlzdEl0ZW1cIixcInBvc2l0aW9uXCI6MyxcIml0ZW1cIjp7XCJAaWRcIjpcImh0dHBzOi8vdGhyZWF0cG9zdC5jb20vc2hsYXllci1tYWMtbWFsd2FyZS1leHRyYS1zbmVha2luZXNzLzE1NjY2OS9cIixcIm5hbWVcIjpcIlNobGF5ZXIgTWFjIE1hbHdhcmUgUmV0dXJucyB3aXRoIEV4dHJhIFNuZWFraW5lc3NcIn19XX08L3NjcmlwdD5cbjxzY3JpcHQgdHlwZT1cImFwcGxpY2F0aW9uL2xkK2pzb25cIj57XCJAY29udGV4dFwiOlwiaHR0cHM6Ly9zY2hlbWEub3JnXCIsXCJAdHlwZVwiOlwiTmV3c0FydGljbGVcIixcIm1haW5FbnRpdHlPZlBhZ2VcIjp7XCJAdHlwZVwiOlwiV2ViUGFnZVwiLFwiQGlkXCI6XCJodHRwczovL3RocmVhdHBvc3QuY29tL3NobGF5ZXItbWFjLW1hbHdhcmUtZXh0cmEtc25lYWtpbmVzcy8xNTY2NjkvXCJ9LFwiaGVhZGxpbmVcIjpcIlNobGF5ZXIgTWFjIE1hbHdhcmUgUmV0dXJucyB3aXRoIEV4dHJhIFNuZWFraW5lc3NcIixcImltYWdlXCI6W1wiaHR0cHM6Ly9tZWRpYS50aHJlYXRwb3N0LmNvbS93cC1jb250ZW50L3VwbG9hZHMvc2l0ZXMvMTAzLzIwMjAvMDEvMjIxMDAxNDgvdHJvamFuLW1hbHdhcmUuanBnXCIsXCJodHRwczovL2thc3BlcnNreWNvbnRlbnRodWIuY29tL3RocmVhdHBvc3QtZ2xvYmFsL2ZpbGVzLzIwMTkvMDIvc3Vic2NyaWJlMi5qcGdcIl0sXCJkYXRlUHVibGlzaGVkXCI6XCIyMDIwLTA2LTE3VDE3OjQ0OjMzKzAwOjAwXCIsXCJkYXRlTW9kaWZpZWRcIjpcIjIwMjAtMDYtMTlUMTQ6MzA6NDErMDA6MDBcIixcImF1dGhvclwiOntcIkB0eXBlXCI6XCJQZXJzb25cIixcIm5hbWVcIjpcIlRhcmEgU2VhbHNcIn0sXCJwdWJsaXNoZXJcIjp7XCJAdHlwZVwiOlwiT3JnYW5pemF0aW9uXCIsXCJuYW1lXCI6XCJUaHJlYXRwb3N0XCIsXCJsb2dvXCI6e1wiQHR5cGVcIjpcIkltYWdlT2JqZWN0XCIsXCJ1cmxcIjpcImh0dHBzOi8vbWVkaWEudGhyZWF0cG9zdC5jb20vd3AtY29udGVudC91cGxvYWRzL3NpdGVzLzEwMy8yMDE4LzEyLzA0MTIxNTE5L2FtcF9sb2dvLnBuZ1wiLFwid2lkdGhcIjo2MCxcImhlaWdodFwiOjYwfX0sXCJkZXNjcmlwdGlvblwiOlwiU3ByZWFkaW5nIHZpYSBwb2lzb25lZCBHb29nbGUgc2VhcmNoIHJlc3VsdHMsIHRoaXMgbmV3IHZlcnNpb24gb2YgTWFjJiMwMzk7cyBOby4gMSB0aHJlYXQgY29tZXMgd2l0aCBhZGRlZCBzdGVhbHRoLlwifTwvc2NyaXB0PlxuPHNjcmlwdCB0eXBlPVwidGV4dC9qYXZhc2NyaXB0XCIgc3JjPVwiaHR0cHM6Ly90aHJlYXRwb3N0LmNvbS93cC1pbmNsdWRlcy9qcy9qcXVlcnkvanF1ZXJ5LmpzP3Zlcj0xLjEyLjQtd3BcIiBpZD1cImpxdWVyeS1jb3JlLWpzXCI%2BPC9zY3JpcHQ%2BXG48c2NyaXB0IHR5cGU9XCJ0ZXh0L2phdmFzY3JpcHRcIiBpZD1cIm5vdGlmaWNhdGlvbl9zdHJpbmdzLWpzLWV4dHJhXCI%2BXG4vKiA8IVtDREFUQVsgKi9cbnZhciBnZHByRHluYW1pY1N0cmluZ3MgPSB7XCJub3RpZmljYXRpb25fdGV4dFwiOlwiV2UgdXNlIGNvb2tpZXMgdG8gbWFrZSB5b3VyIGV4cGVyaWVuY2Ugb2Ygb3VyIHdlYnNpdGVzIGJldHRlci4gQnkgdXNpbmcgYW5kIGZ1cnRoZXIgbmF2aWdhdGluZyB0aGlzIHdlYnNpdGUgeW91IGFjY2VwdCB0aGlzLiBEZXRhaWxlZCBpbmZvcm1hdGlvbiBh&i=1-11&t=adltag_kglayibe_5Q22w3z6xwK&r=d60ea5af3d75377ad658f061748d2ad&c=math-aids-threatpost&z=1
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/b-9a4f7ce-a7f6098c.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.85.32.34 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-85-32-34.ham50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

x-amz-version-id: D2POxJleIt92FyXaxSi7iRHuNLtujALh
via: 1.1 64cab3aa5eaf0c5f28d762c526424858.cloudfront.net (CloudFront)
etag: "d41d8cd98f00b204e9800998ecf8427e"
age: 40578
x-cache: Error from cloudfront
status: 200
content-length: 0
last-modified: Mon, 15 Jun 2020 18:35:10 GMT
server: AmazonS3
date: Thu, 22 Oct 2020 09:36:58 GMT
access-control-max-age: 3000
access-control-allow-methods: GET
content-type: text/plain
access-control-allow-origin: *
x-amz-cf-pop: HAM50-C1
accept-ranges: bytes
x-amz-cf-id: TYWjchpWXYR-7u0aT7gZX8GLjl_dkEMTFfsAnlF2C51ZL4ibbXoS7Q==

POST
H2 200 tag
math-aids-threatpost-tagan.adlightning.com/ 0
427 B 100ms
37ms Other
text/plain 52.85.32.34
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://math-aids-threatpost-tagan.adlightning.com/tag?s=bl&d=Ym91dCB0aGUgdXNlIG9mIGNvb2tpZXMgb24gdGhpcyB3ZWJzaXRlIGlzIGF2YWlsYWJsZSBieSBjbGlja2luZyBvbiA8YSBocmVmPVxcXCJodHRwczpcXC9cXC90aHJlYXRwb3N0LmNvbVxcL3dlYi1wcml2YWN5LXBvbGljeVxcL1xcXCIgdGFyZ2V0PVxcXCJfYmxhbmtcXFwiPm1vcmUgaW5mb3JtYXRpb248XFwvYT4uXCIsXCJidXR0b25fdGV4dFwiOlwiQUNDRVBUIEFORCBDTE9TRVwifTtcbi8qIF1dPiAqL1xuPC9zY3JpcHQ%2BXG48c2NyaXB0IHR5cGU9XCJ0ZXh0L2phdmFzY3JpcHRcIiBpZD1cImtzc19qcy1qcy1leHRyYVwiPlxuLyogPCFbQ0RBVEFbICovXG52YXIga3NzID0ge1widHdpdHRlcl9hY2NvdW50XCI6XCJ0aHJlYXRwb3N0XCJ9O1xuLyogXV0%2BICovXG48L3NjcmlwdD5cbjxzY3JpcHQgdHlwZT1cInRleHQvamF2YXNjcmlwdFwiIHNyYz1cIi8vYXNzZXRzLnRocmVhdHBvc3QuY29tL3dwLWNvbnRlbnQvcGx1Z2lucy9id3AtbWluaWZ5L21pbi8%2FZj13cC1jb250ZW50L3BsdWdpbnMva2FzcGVyc2t5LWNvb2tpZXMtbm90aWZpY2F0aW9uL3NjcmlwdHMvYWxlcnRfdGV4dC5qcyx3cC1jb250ZW50L3BsdWdpbnMva2FzcGVyc2t5LWNvb2tpZXMtbm90aWZpY2F0aW9uL3NjcmlwdHMvYWxlcnQuanMsd3AtY29udGVudC9wbHVnaW5zL2hvbmV5cG90LWNvbW1lbnRzL3B1YmxpYy9hc3NldHMvanMvcHVibGljLmpzLHdwLWNvbnRlbnQvcGx1Z2lucy9rc3ByX3R3aXR0ZXJfcHVsbHF1b3RlL2pzL2thc3BlcnNreS10d2l0dGVyLXB1bGxxdW90ZS5qcyx3cC1jb250ZW50L3RoZW1lcy90aHJlYXRwb3N0LTIwMTgvYXNzZXRzL2pzL21haW4uanMsd3AtY29udGVudC90aGVtZXMvdGhyZWF0cG9zdC0yMDE4L2Fzc2V0cy9qcy9sb2FkbW9yZS5qcyx3cC1jb250ZW50L3BsdWdpbnMva2FzcGVyc2t5LXNvY2lhbC1zaGFyaW5nL2Fzc2V0cy9qcy9zb2NpYWwtc2hhcmUuanMmYW1wO3Zlcj00ZTc2MGIxOVwiPjwvc2NyaXB0PlxuPHNjcmlwdCB0eXBlPVwidGV4dC9qYXZhc2NyaXB0XCI%2BXG52YXIgc05ldyA9IGRvY3VtZW50LmNyZWF0ZUVsZW1lbnQoXCJzY3JpcHRcIik7XG5zTmV3LmFzeW5jID0gdHJ1ZTtcbnNOZXcuc3JjID0gXCJodHRwczovL2thc3BlcnNreWNvbnRlbnRodWIuY29tLz9kbT1lZDFmOWU0MzVkYzg4NTI5MmVhYjY1NjIwYzUxZjNmYiZhY3Rpb249bG9hZCZibG9naWQ9MTAzJnNpdGVpZD0xJnQ9MTgwODg3NDk0NSZiYWNrPWh0dHBzJTNBJTJGJTJGdGhyZWF0cG9zdC5jb20lMkZzaGxheWVyLW1hYy1tYWx3YXJlLWV4dHJhLXNuZWFraW5lc3MlMkYxNTY2NjklMkYlM0Z3ZWJfdmlldyUzRHRydWVcIlxudmFyIHMwID0gZG9jdW1lbnQuZ2V0RWxlbWVudHNCeVRhZ05hbWUoJ3NjcmlwdCcpWzBdO1xuczAucGFyZW50Tm9kZS5pbnNlcnRCZWZvcmUoc05ldywgczApO1xuPC9zY3JpcHQ%2BXG48c2NyaXB0PihmdW5jdGlvbih3LGQscyxsLGkpe3dbbF09d1tsXXx8W107d1tsXS5wdXNoKHsnZ3RtLnN0YXJ0Jzpcbm5ldyBEYXRlKCkuZ2V0VGltZSgpLGV2ZW50OidndG0uanMnfSk7dmFyIGY9ZC5nZXRFbGVtZW50c0J5VGFnTmFtZShzKVswXSxcbmo9ZC5jcmVhdGVFbGVtZW50KHMpLGRsPWwhPSdkYXRhTGF5ZXInPycmbD0nK2w6Jyc7ai5hc3luYz10cnVlO2ouc3JjPVxuJ2h0dHBzOi8vd3d3Lmdvb2dsZXRhZ21hbmFnZXIuY29tL2d0bS5qcz9pZD0nK2krZGw7Zi5wYXJlbnROb2RlLmluc2VydEJlZm9yZShqLGYpO1xufSkod2luZG93LGRvY3VtZW50LCdzY3JpcHQnLCdkYXRhTGF5ZXInLCdHVE0tUE0yOUhMRicpOzwvc2NyaXB0PlxuPHNjcmlwdD4oZnVuY3Rpb24oKSB7XG4gICAgICAgICAgICBcInVzZSBzdHJpY3RcIjtcbiAgICAgICAgICAgIHRyeSB7XG4gICAgICAgICAgICAgICAgY29uc3QgcGxheWVyQXBpID0gd2luZG93LnBsYXllcl9pbnN0YW5jZV8xZDU2MTYwMzM5OTk5NDI5Njtcbi8vZGVza3RvcCBjbG9zZSBidXR0b24gZm9sbG93c1xucGxheWVyQXBpLm9uKGNueC5jb25maWdFdmVudHMuQWRJbXByZXNzaW9uLCBmdW5jdGlvbigpIHtcbiAgY29uc29sZS5sb2coXCJDTlgtYWQtaW1wXCIpXG4gIHRvcC5kb2N1bWVudC5nZXRFbGVtZW50c0J5Q2xhc3NOYW1lKFwiY254LXVpLXZpZGVvXCIpWzBdLnN0eWxlLmNzc1RleHQgPSBcImRpc3BsYXk6ZmxleCFpbXBvcnRhbnRcIjtcbiAgdG9wLmRvY3VtZW50LmdldEVsZW1lbnRzQnlDbGFzc05hbWUoXCJjbngtbG9nby1iYXJcIilbMF0uc3R5bGUuY3NzVGV4dCA9IFwiZGlzcGxheTpub25lXCI7XG4gIHRvcC5kb2N1bWVudC5nZXRFbGVtZW50c0J5Q2xhc3NOYW1lKFwiY254LXVpLWJ1dHRvbnNcIilbMF0uc3R5bGUuY3NzVGV4dCA9IFwiZGlzcGxheTpub25lXCI7XG4gIHRvcC5kb2N1bWVudC5nZXRFbGVtZW50c0J5Q2xhc3NOYW1lKFwiY254LXVpLXByb2dyZXNzXCIpWzBdLnN0eWxlLmNzc1RleHQgPSBcImRpc3BsYXk6bm9uZVwiO1xuICB0b3AuZG9jdW1lbnQuZ2V0RWxlbWVudHNCeUNsYXNzTmFtZShcImNueC12b2x1bWUtY29udGFpbmVyXCIpWzBdLnN0eWxlLmNzc1RleHQgPSBcImRpc3BsYXk6bm9uZVwiO1xuICB0b3AuZG9jdW1lbnQuZ2V0RWxlbWVudHNCeUNsYXNzTmFtZShcImNueC11aS12aWRlb1wiKVswXS5zdHlsZS5jc3NUZXh0ID0gXCJwb2ludGVyLWV2ZW50czpub25lXCI7XG4gIHRvcC5kb2N1bWVudC5nZXRFbGVtZW50c0J5Q2xhc3NOYW1lKFwiY254LWNsb3NlLWJ1dHRvblwiKVswXS5zdHlsZS5jc3NUZXh0ID0gXCJwb2ludGVyLWV2ZW50czphdXRvIWltcG9ydGFudFwiO1xufVxuICAgICAgICAgICAgKTtcbnBsYXllckFwaS5vbihjbnguY29uZmlnRXZlbnRzLkFkU2tpcHBlZCwgZnVuY3Rpb24oKSB7XG4gIGNvbnNvbGUubG9nKFwiQ05YLWFkLXNraXBcIilcbiAgdG9wLmRvY3VtZW50LmdldEVsZW1lbnRzQnlDbGFzc05hbWUoXCJjbngtbG9nby1iYXJcIilbMF0uc3R5bGUuY3NzVGV4dCA9IFwiZGlzcGxheTpmbGV4XCI7XG4gIHRvcC5kb2N1bWVudC5nZXRFbGVtZW50c0J5Q2xhc3NOYW1lKFwiY254LXVpLWJ1dHRvbnNcIilbMF0uc3R5bGUuY3NzVGV4dCA9IFwiZGlzcGxheTpmbGV4XCI7XG4gIHRvcC5kb2N1bWVudC5nZXRFbGVtZW50c0J5Q2xhc3NOYW1lKFwiY254LXVpLXByb2dyZXNzXCIpWzBdLnN0eWxlLmNzc1RleHQgPSBcImRpc3BsYXk6ZmxleFwiO1xuICB0b3AuZG9jdW1lbnQuZ2V0RWxlbWVudHNCeUNsYXNzTmFtZShcImNueC12b2x1bWUtY29udGFpbmVyXCIpWzBdLnN0eWxlLmNzc1RleHQgPSBcImRpc3BsYXk6ZmxleFwiO1xuICB0b3AuZG9jdW1lbnQuZ2V0RWxlbWVudHNCeUNsYXNzTmFtZShcImNueC11aS12aWRlb1wiKVswXS5zdHlsZS5jc3NUZXh0ID0gXCJwb2ludGVyLWV2ZW50czphdXRvXCI7XG4gIHRvcC5kb2N1bWVudC5nZXRFbGVtZW50c0J5Q2xhc3NOYW1lKFwiY254LWNsb3NlLWJ1dHRvblwiKVswXS5zdHlsZS5jc3NUZXh0ID0gXCJwb2ludGVyLWV2ZW50czppbmhlcml0XCI7XG59XG4gICAgICAgICAgICApO1xucGxheWVyQXBpLm9uKGNueC5jb25maWdFdmVudHMuQWRDb21wbGV0ZWQxMDAsIGZ1bmN0aW9uKCkge1xuICBjb25zb2xlLmxvZyhcIkNOWC1hZC1jb21wbGV0ZVwiKVxuICB0b3AuZG9jdW1lbnQuZ2V0RWxlbWVudHNCeUNsYXNzTmFtZShcImNueC1sb2dvLWJhclwiKVswXS5zdHlsZS5jc3NUZXh0ID0gXCJkaXNwbGF5OmZsZXhcIjtcbiAgdG9wLmRvY3VtZW50LmdldEVsZW1lbnRzQnlDbGFzc05hbWUoXCJjbngtdWktYnV0dG9uc1wiKVswXS5zdHlsZS5jc3NUZXh0ID0gXCJkaXNwbGF5OmZsZXhcIjtcbiAgdG9wLmRvY3VtZW50LmdldEVsZW1lbnRzQnlDbGFzc05hbWUoXCJjbngtdWktcHJvZ3Jlc3NcIilbMF0uc3R5bGUuY3NzVGV4dCA9IFwiZGlzcGxheTpmbGV4XCI7XG4gIHRvcC5kb2N1bWVudC5nZXRFbGVtZW50c0J5Q2xhc3NOYW1lKFwiY254LXZvbHVtZS1jb250YWluZXJcIilbMF0uc3R5bGUuY3NzVGV4dCA9IFwiZGlzcGxheTpmbGV4XCI7XG4gIHRvcC5kb2N1bWVudC5nZXRFbGVtZW50c0J5Q2xhc3NOYW1lKFwiY254LXVpLXZpZGVvXCIpWzBdLnN0eWxlLmNzc1RleHQgPSBcInBvaW50ZXItZXZlbnRzOmF1dG9cIjtcbiAgdG9wLmRvY3VtZW50LmdldEVsZW1lbnRzQnlDbGFzc05hbWUoXCJjbngtY2xvc2UtYnV0dG9uXCIpWzBdLnN0eWxlLmNzc1RleHQgPSBcInBvaW50ZXItZXZlbnRzOmluaGVyaXRcIjtcbn1cbiAgICAgICAgICAgICk7XG5cbiAgICAgICAgICAgIH1jYXRjaChlKXtcbiAgICAgICAgICAgICAgICBjb25zb2xlLndhcm4oJy0tLUNueEN1c3RvbUFwaUVycm9yLS0tJyk7XG4gICAgICAgICAgICAgICAgY29uc29sZS53YXJuKGUubWVzc2FnZSk7XG4gICAgICAgICAgICB9XG4gICAgICAgICAgfSkoKTwvc2NyaXB0PlxuPHNjcmlwdD4hZnVuY3Rpb24oKXtmdW5jdGlvbiBuKG4pe3dpbmRvd1tcImNueFwiK25dfHwod2luZG93W1wiY254XCIrbl09d2luZG93W25dLHdpbmRvd1tuXT1mdW5jdGlvbihlKXt2YXIgdD1cIlwiO3RyeXtlJiYodD1mdW5jdGlvbiBuKGUsdCl7dHJ5e2lmKCFlKXJldHVyblwiXCI7aWYoZS5jbnhJbm5lclRhZylyZXR1cm4gZS5jbnhJbm5lclRhZztpZih0PDIpe3ZhciByPXQrMTtyZXR1cm4gbihlLmNhbGxlcixyKX19Y2F0Y2gobil7cmV0dXJuXCJcIn1yZXR1cm5cIlwifShlKSl9Y2F0Y2gobil7fXZhciByPXdpbmRvd1tcImNueFwiK25dLmFwcGx5KG51bGwsYXJndW1lbnRzKTtpZih0KXt2YXIgaT13aW5kb3cuY254RW5mU3RvcmFnZTtpW25dW3RdPWlbbl1bdF18fFtdLGlbbl1bdF0ucHVzaChyKX1yZXR1cm4gcn0pfXdpbmRvdy5jbnhFbmZTdG9yYWdlPXtzZXRUaW1lb3V0Ont9LHNldEludGVydmFsOnt9LGV2ZW50TGlzdGVuZXJzOnt9LGVycm9yczpbXX07dmFyIGU9d2luZG93LmxvY2F0aW9uLmhvc3RuYW1lLnNwbGl0KFwiLlwiKSx0PXdpbmRvdy5idG9hKGVbZS5sZW5ndGgtMl0rXCIuXCIrZVtlLmxlbmd0aC0xXSk7LTE9PT1bXCJkRzE2TG1OdmJRPT1cIixcIlltbHNiR0p2WVhKa0xtTnZiUT09XCIsXCJhRzlzYkhsM2IyOWtjbVZ3YjNKMFpYSXVZMjl0XCIsXCJkbWxpWlM1amIyMD1cIixcImFHOXliM05qYjNCbExtTnZiUT09XCIsXCJZWE4wY205c2IyZDVMbU52YlE9PVwiLFwiWVdodmNtRnRhWE50Ynk1amIyMD1cIl0uaW5kZXhPZih0KSYmKCFmdW5jdGlvbigpe2NvbnN0IG49d2luZG93LkV2ZW50VGFyZ2V0P3dpbmRvdy5FdmVudFRhcmdldC5wcm90b3R5cGU6d2luZG93LmRvY3VtZW50O24uY254QWRkRXZlbnRMaXN0ZW5lcnx8KG4uY254QWRkRXZlbnRMaXN0ZW5lcj1uLmFkZEV2ZW50TGlzdGVuZXIsbi5hZGRFdmVudExpc3RlbmVyPWZ1bmN0aW9uKG4sZSx0KXt2YXIgcj10aGlzfHx3aW5kb3c7aWYoZSYmZS5jbnhJbm5lclRhZyl7dmFyIGk9d2luZG93LmNueEVuZlN0b3JhZ2U7aS5ldmVudExpc3RlbmVyc1tlLmNueElubmVyVGFnXT1pLmV2ZW50TGlzdGVuZXJzW2UuY254SW5uZXJUYWddfHxbXSxpLmV2ZW50TGlzdGVuZXJzW2UuY254SW5uZXJUYWddLnB1c2goe2VsZW1lbnQ6cix0eXBlOm4saGFuZGxlcjplLG9wdGlvbnM6dH0pfXRyeXtyLmNueEFkZEV2ZW50TGlzdGVuZXIobixlLHQpfWNhdGNoKG4pe24ubWVzc2FnZT1cImFkbHN0bl9cIituLm1lc3NhZ2UsaS5lcnJvcnMucHVzaChuKX19KX0oKSxuKFwic2V0VGltZW91dFwiKSxuKFwic2V0SW50ZXJ2YWxcIikpfSgpOzwvc2NyaXB0PlxuPHNjcmlwdCB0eXBlPVwidGV4dC9qYXZhc2NyaXB0XCIgc3JjPVwiaHR0cHM6Ly9hZHNlcnZpY2UuZ29vZ2xlLmRlL2Fkc2lkL2ludGVncmF0b3IuanM%2FZG9tYWluPXRocmVhdHBvc3QuY29tXCI%2BPC9zY3JpcHQ%2BXG48c2NyaXB0IHR5cGU9XCJ0ZXh0L2phdmFzY3JpcHRcIiBzcmM9XCJodHRwczovL2Fkc2VydmljZS5nb29nbGUuY29tL2Fkc2lkL2ludGVncmF0b3IuanM%2FZG9tYWluPXRocmVhdHBvc3QuY29tXCI%2BPC9zY3JpcHQ%2BXG48c2NyaXB0PlxuXHRcdFx0Z29vZ2xldGFnLmNtZC5wdXNoKGZ1bmN0aW9uKCkgeyBnb29nbGV0YWcuZG&i=2-11&t=adltag_kglayibe_5Q22w3z6xwK&r=d60ea5af3d75377ad658f061748d2ad&c=math-aids-threatpost&z=1
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/b-9a4f7ce-a7f6098c.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.85.32.34 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-85-32-34.ham50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

x-amz-version-id: D2POxJleIt92FyXaxSi7iRHuNLtujALh
via: 1.1 64cab3aa5eaf0c5f28d762c526424858.cloudfront.net (CloudFront)
etag: "d41d8cd98f00b204e9800998ecf8427e"
age: 40578
x-cache: Error from cloudfront
status: 200
content-length: 0
last-modified: Mon, 15 Jun 2020 18:35:10 GMT
server: AmazonS3
date: Thu, 22 Oct 2020 09:36:58 GMT
access-control-max-age: 3000
access-control-allow-methods: GET
content-type: text/plain
access-control-allow-origin: *
x-amz-cf-pop: HAM50-C1
accept-ranges: bytes
x-amz-cf-id: rSw2i01SlLMQs9ur5kTEVwBBAIVQFt60anwyIhB4_1UooMDlXxuqfQ==

POST
H2 200 tag
math-aids-threatpost-tagan.adlightning.com/ 0
427 B 103ms
40ms Other
text/plain 52.85.32.34
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://math-aids-threatpost-tagan.adlightning.com/tag?s=bl&d=lzcGxheSgnZGl2LWdwdC1hZC02Nzk0NjcwLTEnKTsgfSk7XG5cdFx0PC9zY3JpcHQ%2BXG48c2NyaXB0IHR5cGU9XCJ0ZXh0L2phdmFzY3JpcHRcIj5qUXVlcnkoZG9jdW1lbnQpLnJlYWR5KGZ1bmN0aW9uKCQpe2dmb3JtSW5pdFNwaW5uZXIoIDUsICdodHRwczovL3RocmVhdHBvc3QuY29tL3dwLWNvbnRlbnQvdGhlbWVzL3RocmVhdHBvc3QtMjAxOC9hc3NldHMvaW1hZ2VzL2xvYWRlci5zdmcnICk7alF1ZXJ5KCcjZ2Zvcm1fYWpheF9mcmFtZV81Jykub24oJ2xvYWQnLGZ1bmN0aW9uKCl7dmFyIGNvbnRlbnRzID0galF1ZXJ5KHRoaXMpLmNvbnRlbnRzKCkuZmluZCgnKicpLmh0bWwoKTt2YXIgaXNfcG9zdGJhY2sgPSBjb250ZW50cy5pbmRleE9mKCdHRl9BSkFYX1BPU1RCQUNLJykgPj0gMDtpZighaXNfcG9zdGJhY2spe3JldHVybjt9dmFyIGZvcm1fY29udGVudCA9IGpRdWVyeSh0aGlzKS5jb250ZW50cygpLmZpbmQoJyNnZm9ybV93cmFwcGVyXzUnKTt2YXIgaXNfY29uZmlybWF0aW9uID0galF1ZXJ5KHRoaXMpLmNvbnRlbnRzKCkuZmluZCgnI2dmb3JtX2NvbmZpcm1hdGlvbl93cmFwcGVyXzUnKS5sZW5ndGggPiAwO3ZhciBpc19yZWRpcmVjdCA9IGNvbnRlbnRzLmluZGV4T2YoJ2dmb3JtUmVkaXJlY3QoKXsnKSA%2BPSAwO3ZhciBpc19mb3JtID0gZm9ybV9jb250ZW50Lmxlbmd0aCA%2BIDAgJiYgISBpc19yZWRpcmVjdCAmJiAhIGlzX2NvbmZpcm1hdGlvbjt2YXIgbXQgPSBwYXJzZUludChqUXVlcnkoJ2h0bWwnKS5jc3MoJ21hcmdpbi10b3AnKSwgMTApICsgcGFyc2VJbnQoalF1ZXJ5KCdib2R5JykuY3NzKCdtYXJnaW4tdG9wJyksIDEwKSArIDEwMDtpZihpc19mb3JtKXtqUXVlcnkoJyNnZm9ybV93cmFwcGVyXzUnKS5odG1sKGZvcm1fY29udGVudC5odG1sKCkpO2lmKGZvcm1fY29udGVudC5oYXNDbGFzcygnZ2Zvcm1fdmFsaWRhdGlvbl9lcnJvcicpKXtqUXVlcnkoJyNnZm9ybV93cmFwcGVyXzUnKS5hZGRDbGFzcygnZ2Zvcm1fdmFsaWRhdGlvbl9lcnJvcicpO30gZWxzZSB7alF1ZXJ5KCcjZ2Zvcm1fd3JhcHBlcl81JykucmVtb3ZlQ2xhc3MoJ2dmb3JtX3ZhbGlkYXRpb25fZXJyb3InKTt9c2V0VGltZW91dCggZnVuY3Rpb24oKSB7IC8qIGRlbGF5IHRoZSBzY3JvbGwgYnkgNTAgbWlsbGlzZWNvbmRzIHRvIGZpeCBhIGJ1ZyBpbiBjaHJvbWUgKi8galF1ZXJ5KGRvY3VtZW50KS5zY3JvbGxUb3AoalF1ZXJ5KCcjZ2Zvcm1fd3JhcHBlcl81Jykub2Zmc2V0KCkudG9wIC0gbXQpOyB9LCA1MCApO2lmKHdpbmRvd1snZ2Zvcm1Jbml0RGF0ZXBpY2tlciddKSB7Z2Zvcm1Jbml0RGF0ZXBpY2tlcigpO31pZih3aW5kb3dbJ2dmb3JtSW5pdFByaWNlRmllbGRzJ10pIHtnZm9ybUluaXRQcmljZUZpZWxkcygpO312YXIgY3VycmVudF9wYWdlID0galF1ZXJ5KCcjZ2Zvcm1fc291cmNlX3BhZ2VfbnVtYmVyXzUnKS52YWwoKTtnZm9ybUluaXRTcGlubmVyKCA1LCAnaHR0cHM6Ly90aHJlYXRwb3N0LmNvbS93cC1jb250ZW50L3RoZW1lcy90aHJlYXRwb3N0LTIwMTgvYXNzZXRzL2ltYWdlcy9sb2FkZXIuc3ZnJyApO2pRdWVyeShkb2N1bWVudCkudHJpZ2dlcignZ2Zvcm1fcGFnZV9sb2FkZWQnLCBbNSwgY3VycmVudF9wYWdlXSk7d2luZG93WydnZl9zdWJtaXR0aW5nXzUnXSA9IGZhbHNlO31lbHNlIGlmKCFpc19yZWRpcmVjdCl7dmFyIGNvbmZpcm1hdGlvbl9jb250ZW50ID0galF1ZXJ5KHRoaXMpLmNvbnRlbnRzKCkuZmluZCgnLkdGX0FKQVhfUE9TVEJBQ0snKS5odG1sKCk7aWYoIWNvbmZpcm1hdGlvbl9jb250ZW50KXtjb25maXJtYXRpb25fY29udGVudCA9IGNvbnRlbnRzO31zZXRUaW1lb3V0KGZ1bmN0aW9uKCl7alF1ZXJ5KCcjZ2Zvcm1fd3JhcHBlcl81JykucmVwbGFjZVdpdGgoY29uZmlybWF0aW9uX2NvbnRlbnQpO2pRdWVyeShkb2N1bWVudCkuc2Nyb2xsVG9wKGpRdWVyeSgnI2dmXzUnKS5vZmZzZXQoKS50b3AgLSBtdCk7alF1ZXJ5KGRvY3VtZW50KS50cmlnZ2VyKCdnZm9ybV9jb25maXJtYXRpb25fbG9hZGVkJywgWzVdKTt3aW5kb3dbJ2dmX3N1Ym1pdHRpbmdfNSddID0gZmFsc2U7fSwgNTApO31lbHNle2pRdWVyeSgnI2dmb3JtXzUnKS5hcHBlbmQoY29udGVudHMpO2lmKHdpbmRvd1snZ2Zvcm1SZWRpcmVjdCddKSB7Z2Zvcm1SZWRpcmVjdCgpO319alF1ZXJ5KGRvY3VtZW50KS50cmlnZ2VyKCdnZm9ybV9wb3N0X3JlbmRlcicsIFs1LCBjdXJyZW50X3BhZ2VdKTt9ICk7fSApOzwvc2NyaXB0PlxuPHNjcmlwdCB0eXBlPVwidGV4dC9qYXZhc2NyaXB0XCI%2BIGpRdWVyeShkb2N1bWVudCkuYmluZCgnZ2Zvcm1fcG9zdF9yZW5kZXInLCBmdW5jdGlvbihldmVudCwgZm9ybUlkLCBjdXJyZW50UGFnZSl7aWYoZm9ybUlkID09IDUpIHtnZl9nbG9iYWxbXCJudW1iZXJfZm9ybWF0c1wiXVs1XSA9IHtcIjhcIjp7XCJwcmljZVwiOmZhbHNlLFwidmFsdWVcIjpmYWxzZX0sXCIxXCI6e1wicHJpY2VcIjpmYWxzZSxcInZhbHVlXCI6ZmFsc2V9LFwiOVwiOntcInByaWNlXCI6ZmFsc2UsXCJ2YWx1ZVwiOmZhbHNlfSxcIjJcIjp7XCJwcmljZVwiOmZhbHNlLFwidmFsdWVcIjpmYWxzZX0sXCI1XCI6e1wicHJpY2VcIjpmYWxzZSxcInZhbHVlXCI6ZmFsc2V9LFwiMTBcIjp7XCJwcmljZVwiOmZhbHNlLFwidmFsdWVcIjpmYWxzZX19O2lmKHdpbmRvd1snalF1ZXJ5J10pe2lmKCF3aW5kb3dbJ2dmX2Zvcm1fY29uZGl0aW9uYWxfbG9naWMnXSl3aW5kb3dbJ2dmX2Zvcm1fY29uZGl0aW9uYWxfbG9naWMnXSA9IG5ldyBBcnJheSgpO3dpbmRvd1snZ2ZfZm9ybV9jb25kaXRpb25hbF9sb2dpYyddWzVdID0geyBsb2dpYzogeyAwOiB7XCJmaWVsZFwiOntcImFjdGlvblR5cGVcIjpcInNob3dcIixcImxvZ2ljVHlwZVwiOlwiYWxsXCIsXCJydWxlc1wiOlt7XCJmaWVsZElkXCI6XCIyXCIsXCJvcGVyYXRvclwiOlwiaXNcIixcInZhbHVlXCI6XCJJIGFncmVlXCJ9LHtcImZpZWxkSWRcIjpcIjVcIixcIm9wZXJhdG9yXCI6XCJpc1wiLFwidmFsdWVcIjpcIkkgYWdyZWVcIn1dfSxcInNlY3Rpb25cIjpudWxsfSB9LCBkZXBlbmRlbnRzOiB7IDA6IFswXSB9LCBhbmltYXRpb246IDEsIGRlZmF1bHRzOiBbXSwgZmllbGRzOiB7XCI4XCI6WzBdLFwiMVwiOlswXSxcIjlcIjpbMF0sXCIyXCI6WzBdLFwiNVwiOlswXSxcIjEwXCI6WzBdfSB9OyBpZighd2luZG93WydnZl9udW1iZXJfZm9ybWF0J10pd2luZG93WydnZl9udW1iZXJfZm9ybWF0J10gPSAnZGVjaW1hbF9kb3QnO2pRdWVyeShkb2N1bWVudCkucmVhZHkoZnVuY3Rpb24oKXtnZl9hcHBseV9ydWxlcyg1LCBbMF0sIHRydWUpO2pRdWVyeSgnI2dmb3JtX3dyYXBwZXJfNScpLnNob3coKTtqUXVlcnkoZG9jdW1lbnQpLnRyaWdnZXIoJ2dmb3JtX3Bvc3RfY29uZGl0aW9uYWxfbG9naWMnLCBbNSwgbnVsbCwgdHJ1ZV0pO30gKTt9IGlmKHR5cGVvZiBQbGFjZWhvbGRlcnMgIT0gJ3VuZGVmaW5lZCcpe1xuICAgICAgICAgICAgICAgICAgICAgICAgUGxhY2Vob2xkZXJzLmVuYWJsZSgpO1xuICAgICAgICAgICAgICAgICAgICB9fSB9ICk7alF1ZXJ5KGRvY3VtZW50KS5iaW5kKCdnZm9ybV9wb3N0X2NvbmRpdGlvbmFsX2xvZ2ljJywgZnVuY3Rpb24oZXZlbnQsIGZvcm1JZCwgZmllbGRzLCBpc0luaXQpe30gKTs8L3NjcmlwdD5cbjxzY3JpcHQgdHlwZT1cInRleHQvamF2YXNjcmlwdFwiPiBqUXVlcnkoZG9jdW1lbnQpLnJlYWR5KGZ1bmN0aW9uKCl7alF1ZXJ5KGRvY3VtZW50KS50cmlnZ2VyKCdnZm9ybV9wb3N0X3JlbmRlcicsIFs1LCAxXSkgfSApOyA8L3NjcmlwdD5cbjxzY3JpcHQgdHlwZT1cInRleHQvamF2YXNjcmlwdFwiIHNyYz1cImh0dHBzOi8vd3d3Lmdvb2dsZS5jb20vcmVjYXB0Y2hhL2FwaS5qcz9obD1lblwiPjwvc2NyaXB0PlxuPHNjcmlwdD5cbiAgICBnb29nbGV0YWcuY21kLnB1c2goZnVuY3Rpb24oKSB7IGdvb2dsZXRhZy5kaXNwbGF5KCdkaXYtZ3B0LWFkLTY3OTQ2NzAtMycpOyB9KTtcbiAgPC9zY3JpcHQ%2BXG48c2NyaXB0PlxuICAgIGdvb2dsZXRhZy5jbWQucHVzaChmdW5jdGlvbigpIHsgZ29vZ2xldGFnLmRpc3BsYXkoJ2Rpdi1ncHQtYWQtNjc5NDY3MC01Jyk7IH0pO1xuICA8L3NjcmlwdD5cbjxzY3JpcHQgaWQ9XCI3NGMyZWMxYmM4Zjg0ZjdjYjJmZjM2NWFkMGI1ODEyM1wiPlxuXHRcdFx0XHRcdFx0XHRcdGNueC5jbWQucHVzaChmdW5jdGlvbigpIHtcblx0XHRcdFx0XHRcdFx0XHRcdGNueCh7XG5cdFx0XHRcdFx0XHRcdFx0XHRwbGF5ZXJJZDogXCJjMmVjZDA0Zi0wZGNhLTRmZmEtODc2MS1kOTNiMzQ3MTczODBcIlxuXHRcdFx0XHRcdFx0XHRcdFx0fSkucmVuZGVyKFwiNzRjMmVjMWJjOGY4NGY3Y2IyZmYzNjVhZDBiNTgxMjNcIik7XG5cdFx0XHRcdFx0XHRcdFx0fSk7XG5cdFx0XHRcdFx0XHRcdFx0PC9zY3JpcHQ%2BXG48c2NyaXB0IHR5cGU9XCJ0ZXh0L2phdmFzY3JpcHRcIj5cbiAgICAgICAgICAgIGlmICggdHlwZW9mIF9yZWNhcHRjaGFfd29yZHByZXNzX3NhdmVkY29tbWVudCAhPSAndW5kZWZpbmVkJykge1xuICAgICAgICAgICAgICAgIGRvY3VtZW50LmdldEVsZW1lbnRCeUlkKCdjb21tZW50JykudmFsdWUgPVxuICAgICAgICAgICAgICAgICAgICBfcmVjYXB0Y2hhX3dvcmRwcmVzc19zYXZlZGNvbW1lbnQ7XG4gICAgICAgICAgICB9XG4gICAgICAgICAgICA8L3NjcmlwdD5cbjxzY3JpcHQgdHlwZT1cInRleHQvamF2YXNjcmlwdFwiIHNyYz1cIi8vYXNzZXRzLnRocmVhdHBvc3QuY29tL3dwLWNvbnRlbnQvcGx1Z2lucy9id3AtbWluaWZ5L21pbi8%2FZj13cC1jb250ZW50L3BsdWdpbnMvZ3Jhdml0eWZvcm1zL2pzL2pxdWVyeS5qc29uLm1pbi5qcyZhbXA7dmVyPTRlNzYwYjE5XCIgaWQ9XCJnZm9ybV9qc29uLWpzXCI%2BPC9zY3JpcHQ%2BXG48c2NyaXB0IHR5cGU9XCJ0ZXh0L2phdmFzY3JpcHRcIiBpZD1cImdmb3JtX2dyYXZpdHlmb3Jtcy1qcy1leHRyYVwiPlxuLyogPCFbQ0RBVEFbICovXG52YXIgZ2ZfZ2xvYmFsID0ge1wiZ2ZfY3VycmVuY3lfY29uZmlnXCI6e1wibmFtZVwiOlwiVS5TLiBEb2xsYXJcIixcInN5bWJvbF9sZWZ0XCI6XCIkXCIsXCJzeW1ib2xfcmlnaHRcIjpcIlwiLFwic3ltYm9sX3BhZGRpbmdcIjpcIlwiLFwidGhvdXNhbmRfc2VwYXJhdG9yXCI6XCIsXCIsXCJkZWNpbWFsX3NlcGFyYXRvclwiOlwiLlwiLFwiZGVjaW1hbHNcIjoyfSxcImJhc2VfdXJsXCI6XCJodHRwczpcXC9cXC90aHJlYXRwb3N0LmNvbVxcL3dwLWNvbnRlbnRcXC9wbHVnaW5zXFwvZ3Jhdml0eWZvcm1zXCIsXCJudW1iZXJfZm9ybWF0c1wiOltdLFwic3Bpbm5lclVybFwiOlwiaHR0cHM6XFwvXFwvdGhyZWF0cG9zdC5jb21cXC93cC1jb250ZW50XFwvcGx1Z2luc1xcL2dyYXZpdHlmb3Jtc1xcL2ltYWdlc1xcL3NwaW5uZXIuZ2lmXCJ9O1xuLyogXV0%2BICovXG48L3NjcmlwdD5cbjxzY3JpcHQgdHlwZT1cInRleHQvamF2YXNjcmlwdFwiIHNyYz1cImh0dHBzOi8vdGhyZWF0cG9zdC5jb20vd3AtY29udGVudC9wbHVnaW5zL2dyYXZpdHlmb3Jtcy9qcy9ncmF2aXR5Zm9ybXMubWluLmpzP3Zlcj0yLjQuMTcuMTVcIiBpZD1cImdmb3JtX2dyYXZpdHlmb3Jtcy1qc1wiPjwvc2NyaXB0PlxuPHNjcmlwdCB0eXBlPVwidGV4dC9qYXZhc2NyaXB0XCIgc3JjPVwiLy9hc3NldHMudGhyZWF0cG9zdC5jb20vd3AtY29udGVudC9wbHVnaW5zL2J3cC1taW5pZnkvbWluLz9mPXdwLWNvbnRlbnQvcGx1Z2lucy9ncmF2aXR5Zm9ybXMvanMvY29uZGl0aW9uYWxfbG9naWMubWluLmpzJmFtcDt2ZXI9NGU3NjBiMTlcIiBpZD1cImdmb3JtX2NvbmRpdGlvbmFsX2xvZ2ljLWpzXCI%2BPC9zY3JpcHQ%2BXG48c2NyaXB0IHR5cGU9XCJ0ZXh0L2phdmFzY3JpcHRcIiBzcmM9XCIvL2Fzc2V0cy50aHJlYXRwb3N0LmNvbS93cC1jb250ZW50L3BsdWdpbnMvYndwLW1pbmlmeS9taW4vP2Y9d3AtY29udGVudC9wbHVnaW5zL2dyYXZpdHlmb3Jtcy9qcy9wbGFjZWhvbGRlcnMuanF1ZXJ5Lm1pbi5qcyZhbXA7dmVyPTRlNzYwYjE5XCIgaWQ9XCJnZm9ybV9wbGFjZWhvbGRlci1qc1wiPjwvc2&i=3-11&t=adltag_kglayibe_5Q22w3z6xwK&r=d60ea5af3d75377ad658f061748d2ad&c=math-aids-threatpost&z=1
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/b-9a4f7ce-a7f6098c.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.85.32.34 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-85-32-34.ham50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

x-amz-version-id: D2POxJleIt92FyXaxSi7iRHuNLtujALh
via: 1.1 64cab3aa5eaf0c5f28d762c526424858.cloudfront.net (CloudFront)
etag: "d41d8cd98f00b204e9800998ecf8427e"
age: 40578
x-cache: Error from cloudfront
status: 200
content-length: 0
last-modified: Mon, 15 Jun 2020 18:35:10 GMT
server: AmazonS3
date: Thu, 22 Oct 2020 09:36:58 GMT
access-control-max-age: 3000
access-control-allow-methods: GET
content-type: text/plain
access-control-allow-origin: *
x-amz-cf-pop: HAM50-C1
accept-ranges: bytes
x-amz-cf-id: yRSndlKCOn6NhvEXrby9k7Fl9h2ueaXJwHLiXdzKrEHEeLoidu_3bA==

POST
H2 200 tag
math-aids-threatpost-tagan.adlightning.com/ 0
426 B 103ms
41ms Other
text/plain 52.85.32.34
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://math-aids-threatpost-tagan.adlightning.com/tag?s=bl&d=NyaXB0PlxuPHNjcmlwdCB0eXBlPVwidGV4dC9qYXZhc2NyaXB0XCIgc3JjPVwiaHR0cHM6Ly93d3cuZ29vZ2xlLmNvbS9yZWNhcHRjaGEvYXBpLmpzP2hsPWVuJmFtcDtyZW5kZXI9ZXhwbGljaXQmYW1wO3Zlcj01LjUuMVwiIGlkPVwiZ2Zvcm1fcmVjYXB0Y2hhLWpzXCI%2BPC9zY3JpcHQ%2BXG48c2NyaXB0IHR5cGU9XCJ0ZXh0L2phdmFzY3JpcHRcIiBzcmM9XCIvL2Fzc2V0cy50aHJlYXRwb3N0LmNvbS93cC1jb250ZW50L3BsdWdpbnMvYndwLW1pbmlmeS9taW4vP2Y9d3AtaW5jbHVkZXMvanMvd3AtZW1iZWQubWluLmpzLHdwLWNvbnRlbnQvcGx1Z2lucy9ha2lzbWV0L19pbmMvZm9ybS5qcyZhbXA7dmVyPTRlNzYwYjE5XCI%2BPC9zY3JpcHQ%2BXG48c2NyaXB0IHR5cGU9XCJ0ZXh0L2phdmFzY3JpcHRcIj5cblx0XHRcdCggZnVuY3Rpb24oICQgKSB7XG5cdFx0XHRcdCQoIGRvY3VtZW50ICkuYmluZCggJ2dmb3JtX3Bvc3RfcmVuZGVyJywgZnVuY3Rpb24oKSB7XG5cdFx0XHRcdFx0dmFyIGdmUmVjYXB0Y2hhUG9sbGVyID0gc2V0SW50ZXJ2YWwoIGZ1bmN0aW9uKCkge1xuXHRcdFx0XHRcdFx0aWYoICEgd2luZG93LmdyZWNhcHRjaGEgfHwgISB3aW5kb3cuZ3JlY2FwdGNoYS5yZW5kZXIgKSB7XG5cdFx0XHRcdFx0XHRcdHJldHVybjtcblx0XHRcdFx0XHRcdH1cblx0XHRcdFx0XHRcdHJlbmRlclJlY2FwdGNoYSgpO1xuXHRcdFx0XHRcdFx0Y2xlYXJJbnRlcnZhbCggZ2ZSZWNhcHRjaGFQb2xsZXIgKTtcblx0XHRcdFx0XHR9LCAxMDAgKTtcblx0XHRcdFx0fSApO1xuXHRcdFx0fSApKCBqUXVlcnkgKTtcblx0XHQ8L3NjcmlwdD5cbjxzY3JpcHQgc3JjPVwiaHR0cHM6Ly9hbmFseXRpY3MudHdpdHRlci5jb20vaS9hZHNjdD90eXBlPWphdmFzY3JpcHQmYW1wO3ZlcnNpb249MS4xLjAmYW1wO3BfaWQ9VHdpdHRlciZhbXA7cF91c2VyX2lkPTAmYW1wO3R4bl9pZD1udHQwaiZhbXA7ZXZlbnRzPSU1QiU1QiUyMnBhZ2V2aWV3JTIyJTJDbnVsbCU1RCU1RCZhbXA7dHdfc2FsZV9hbW91bnQ9MCZhbXA7dHdfb3JkZXJfcXVhbnRpdHk9MCZhbXA7dHdfaWZyYW1lX3N0YXR1cz0wJmFtcDt0cHhfY2I9dHd0dHIuY29udmVyc2lvbi5sb2FkUGl4ZWxzJmFtcDt0d19kb2N1bWVudF9ocmVmPWh0dHBzJTNBJTJGJTJGdGhyZWF0cG9zdC5jb20lMkZzaGxheWVyLW1hYy1tYWx3YXJlLWV4dHJhLXNuZWFraW5lc3MlMkYxNTY2NjklMkYlM0Z3ZWJfdmlldyUzRHRydWVcIiB0eXBlPVwidGV4dC9qYXZhc2NyaXB0XCI%2BPC9zY3JpcHQ%2BXG48c2NyaXB0IHNyYz1cIi8vY2RzLmNvbm5hdGl4LmNvbS9wL3BsdWdpbnMvcHJlYmlkMy4yNS4wLTEuanNcIiBhc3luYz1cIlwiIHR5cGU9XCJ0ZXh0L2phdmFzY3JpcHRcIj48L3NjcmlwdD5cbjxzY3JpcHQgc3JjPVwiLy9jZC5jb25uYXRpeC5jb20vY29ubmF0aXgucGxheWVyLmpzXCIgYXN5bmM9XCIxXCIgdHlwZT1cInRleHQvamF2YXNjcmlwdFwiPjwvc2NyaXB0PlxuPGlmcmFtZSBzcmM9XCJodHRwczovL3d3dy5nb29nbGUuY29tL3JlY2FwdGNoYS9hcGkyL2FuY2hvcj9hcj0xJmFtcDtrPTZMZWhoQUVUQUFBQUFBY3NtMlpHRHNMQ3F5R2hlc3k0WW40M1dOQmUmYW1wO2NvPWFIUjBjSE02THk5MGFISmxZWFJ3YjNOMExtTnZiVG8wTkRNLiZhbXA7aGw9ZW4mYW1wO3Y9VDl3MVJPZHBsY3RXMm5WS3ZOSllYSDhvJmFtcDt0aGVtZT1saWdodCZhbXA7c2l6ZT1ub3JtYWwmYW1wO2NiPTd2dmN0bW95M2NvalwiIHdpZHRoPVwiMzA0XCIgaGVpZ2h0PVwiNzhcIiByb2xlPVwicHJlc2VudGF0aW9uXCIgbmFtZT1cImEtdHpycGcyeDN5ZGN4XCIgZnJhbWVib3JkZXI9XCIwXCIgc2Nyb2xsaW5nPVwibm9cIiBzYW5kYm94PVwiYWxsb3ctZm9ybXMgYWxsb3ctcG9wdXBzIGFsbG93LXNhbWUtb3JpZ2luIGFsbG93LXNjcmlwdHMgYWxsb3ctdG9wLW5hdmlnYXRpb24gYWxsb3ctbW9kYWxzIGFsbG93LXBvcHVwcy10by1lc2NhcGUtc2FuZGJveFwiPjwvaWZyYW1lPlxuPGlmcmFtZSBzcmM9XCJodHRwczovL3d3dy5nb29nbGUuY29tL3JlY2FwdGNoYS9hcGkyL2FuY2hvcj9hcj0xJmFtcDtrPTZMZmdmXzhTQUFBQUFEWWJRQW5LRk9rN2N2bldia3FvNnk1Ny00LVUmYW1wO2NvPWFIUjBjSE02THk5MGFISmxZWFJ3YjNOMExtTnZiVG8wTkRNLiZhbXA7aGw9ZW4mYW1wO3Y9VDl3MVJPZHBsY3RXMm5WS3ZOSllYSDhvJmFtcDt0aGVtZT1zdGFuZGFyZCZhbXA7c2l6ZT1ub3JtYWwmYW1wO2NiPTdzZDlyamprbWNmd1wiIHdpZHRoPVwiMzA0XCIgaGVpZ2h0PVwiNzhcIiByb2xlPVwicHJlc2VudGF0aW9uXCIgbmFtZT1cImEtbXA5OHVyazJ2eXF3XCIgZnJhbWVib3JkZXI9XCIwXCIgc2Nyb2xsaW5nPVwibm9cIiBzYW5kYm94PVwiYWxsb3ctZm9ybXMgYWxsb3ctcG9wdXBzIGFsbG93LXNhbWUtb3JpZ2luIGFsbG93LXNjcmlwdHMgYWxsb3ctdG9wLW5hdmlnYXRpb24gYWxsb3ctbW9kYWxzIGFsbG93LXBvcHVwcy10by1lc2NhcGUtc2FuZGJveFwiPjwvaWZyYW1lPlxuPGlmcmFtZSB0aXRsZT1cInJlY2FwdGNoYSBjaGFsbGVuZ2VcIiBzcmM9XCJodHRwczovL3d3dy5nb29nbGUuY29tL3JlY2FwdGNoYS9hcGkyL2JmcmFtZT9obD1lbiZhbXA7dj1UOXcxUk9kcGxjdFcyblZLdk5KWVhIOG8mYW1wO2s9NkxmZ2ZfOFNBQUFBQURZYlFBbktGT2s3Y3ZuV2JrcW82eTU3LTQtVSZhbXA7Y2I9MnFobWh2YnQxdDM1XCIgbmFtZT1cImMtbXA5OHVyazJ2eXF3XCIgZnJhbWVib3JkZXI9XCIwXCIgc2Nyb2xsaW5nPVwibm9cIiBzYW5kYm94PVwiYWxsb3ctZm9ybXMgYWxsb3ctcG9wdXBzIGFsbG93LXNhbWUtb3JpZ2luIGFsbG93LXNjcmlwdHMgYWxsb3ctdG9wLW5hdmlnYXRpb24gYWxsb3ctbW9kYWxzIGFsbG93LXBvcHVwcy10by1lc2NhcGUtc2FuZGJveFwiIHN0eWxlPVwid2lkdGg6IDEwMCU7IGhlaWdodDogMTAwJTtcIj48L2lmcmFtZT5cbjxpZnJhbWUgdGl0bGU9XCJyZWNhcHRjaGEgY2hhbGxlbmdlXCIgc3JjPVwiaHR0cHM6Ly93d3cuZ29vZ2xlLmNvbS9yZWNhcHRjaGEvYXBpMi9iZnJhbWU%2FaGw9ZW4mYW1wO3Y9VDl3MVJPZHBsY3RXMm5WS3ZOSllYSDhvJmFtcDtrPTZMZWhoQUVUQUFBQUFBY3NtMlpHRHNMQ3F5R2hlc3k0WW40M1dOQmUmYW1wO2NiPWNyYWx5eGhmYnFzc1wiIG5hbWU9XCJjLXR6cnBnMngzeWRjeFwiIGZyYW1lYm9yZGVyPVwiMFwiIHNjcm9sbGluZz1cIm5vXCIgc2FuZGJveD1cImFsbG93LWZvcm1zIGFsbG93LXBvcHVwcyBhbGxvdy1zYW1lLW9yaWdpbiBhbGxvdy1zY3JpcHRzIGFsbG93LXRvcC1uYXZpZ2F0aW9uIGFsbG93LW1vZGFscyBhbGxvdy1wb3B1cHMtdG8tZXNjYXBlLXNhbmRib3hcIiBzdHlsZT1cIndpZHRoOiAxMDAlOyBoZWlnaHQ6IDEwMCU7XCI%2BPC9pZnJhbWU%2BPC9ib2R5PjwvaHRtbD4iLCJibGFja2xpc3REYXRhIjp7ImFjdGlvbiI6MTAsImFjdGlvbkRldGFpbHMiOiJuZXdjaGljLmNvbSIsInJlcG9ydE1hcmt1cCI6dHJ1ZSwiaXRlbXMiOlt7Imhvc3RuYW1lIjoibmV3Y2hpYy5jb20iLCJ0b2tlbiI6IiIsImFjdGlvbiI6MTB9XSwibWFya3VwIjoiPCFkb2N0eXBlIGh0bWw%2BPGh0bWw%2BPGhlYWQ%2BPHNjcmlwdD52YXIganNjVmVyc2lvbiA9ICdyMjAyMDEwMjAnOzwvc2NyaXB0PjxzY3JpcHQ%2BdmFyIGdvb2dsZV9jYXNtPVtdOzwvc2NyaXB0PjxzdHlsZT5hIHsgY29sb3I6ICMwMDAwMDAgfS5pbWdfYWQ6aG92ZXIgey13ZWJraXQtZmlsdGVyOiBicmlnaHRuZXNzKDEyMCUpfTwvc3R5bGU%2BPHNjcmlwdD5mdW5jdGlvbiBzdShpZCkge3ZhciBhID0gZG9jdW1lbnQuZ2V0RWxlbWVudEJ5SWQoaWQpO3ZhciBiID0gKG5ldyBEYXRlKCkpLmdldFRpbWUoKTtpZiAoYSAmJiBhLm15dCAmJiBiKSB7dmFyIHQgPSBiIC0gYS5teXQ7aWYgKHdpbmRvdy5jc3MpIHtjc3MoaWQsJ2Nsa3QnLHQpO3JldHVybjt9dmFyIGJpID0gYS5ocmVmLmluZGV4T2YoXCImY2xrdD1cIik7aWYgKGJpID4gMCkge3ZhciBjID0gYS5ocmVmLnN1YnN0cmluZygwLCBiaSs2KTsgdmFyIGQgPSBhLmhyZWYuc3Vic3RyaW5nKGJpKzYsIGEuaHJlZi5sZW5ndGgpO3ZhciBlaSA9IGQuaW5kZXhPZihcIiZcIik7dmFyIHIgPSAnJztpZiAoZWkgPj0gMClyID0gZC5zdWJzdHJpbmcoZWksIGQubGVuZ3RoKTthLmhyZWYgPSBjICsgdCArIHI7IH0gZWxzZSB7YS5ocmVmICs9IFwiJmNsa3Q9XCIgKyB0O319fTwvc2NyaXB0PjxzY3JpcHQ%2Bd2luZG93LmRpY25mID0ge307PC9zY3JpcHQ%2BPHNjcmlwdCBkYXRhLWpjPVwiNDJcIiBkYXRhLWpjLXZlcnNpb249XCJyMjAyMDEwMjBcIj4oZnVuY3Rpb24oKXsvKiAgQ29weXJpZ2h0IFRoZSBDbG9zdXJlIExpYnJhcnkgQXV0aG9ycy4gU1BEWC1MaWNlbnNlLUlkZW50aWZpZXI6IEFwYWNoZS0yLjAgKi8gJ3VzZSBzdHJpY3QnO3dpbmRvdy52aWV3UmVxPVtdO2NvbnN0IGM9YT0%2Be2ZldGNoKGEse2tlZXBhbGl2ZTohMCxjcmVkZW50aWFsczpcImluY2x1ZGVcIixyZWRpcmVjdDpcImZvbGxvd1wiLG1ldGhvZDpcImdldFwiLG1vZGU6XCJuby1jb3JzXCJ9KS5jYXRjaCgoKT0%2Be3tjb25zdCBiPW5ldyBJbWFnZTtiLnNyYz1hLnJlcGxhY2UoXCImYW1wO1wiLFwiJlwiKTt2aWV3UmVxLnB1c2goYil9fSl9O3dpbmRvdy52dT1hPT57aWYod2luZG93LmZldGNoKWMoYSk7ZWxzZXt7Y29uc3QgYj1uZXcgSW1hZ2U7Yi5zcmM9YS5yZXBsYWNlKFwiJmFtcDtcIixcIiZcIik7dmlld1JlcS5wdXNoKGIpfX19O30pLmNhbGwodGhpcyk7PC9zY3JpcHQ%2BPHNjcmlwdCBkYXRhLWpjPVwiNTNcIiBkYXRhLWpjLXZlcnNpb249XCJyMjAyMDEwMjBcIj4oZnVuY3Rpb24oKXsvKiAgQ29weXJpZ2h0IFRoZSBDbG9zdXJlIExpYnJhcnkgQXV0aG9ycy4gU1BEWC1MaWNlbnNlLUlkZW50aWZpZXI6IEFwYWNoZS0yLjAgKi8gJ3VzZSBzdHJpY3QnO3ZhciBnPXRoaXN8fHNlbGY7ZnVuY3Rpb24gaChhLGIsYyl7cmV0dXJuIGEuY2FsbC5hcHBseShhLmJpbmQsYXJndW1lbnRzKX1mdW5jdGlvbiBrKGEsYixjKXtpZighYSl0aHJvdyBFcnJvcigpO2lmKDI8YXJndW1lbnRzLmxlbmd0aCl7dmFyIGQ9QXJyYXkucHJvdG90eXBlLnNsaWNlLmNhbGwoYXJndW1lbnRzLDIpO3JldHVybiBmdW5jdGlvbigpe3ZhciBlPUFycmF5LnByb3RvdHlwZS5zbGljZS5jYWxsKGFyZ3VtZW50cyk7QXJyYXkucHJvdG90eXBlLnVuc2hpZnQuYXBwbHkoZSxkKTtyZXR1cm4gYS5hcHBseShiLGUpfX1yZXR1cm4gZnVuY3Rpb24oKXtyZXR1cm4gYS5hcHBseShiLGFyZ3VtZW50cyl9fSBmdW5jdGlvbiBsKGEsYixjKXtGdW5jdGlvbi5wcm90b3R5cGUuYmluZCYmLTEhPUZ1bmN0aW9uLnByb3RvdHlwZS5iaW5kLnRvU3RyaW5nKCkuaW5kZXhPZihcIm5hdGl2ZSBjb2RlXCIpP2w9aDpsPWs7cmV0dXJuIGwuYXBwbHkobnVsbCxhcmd1bWVudHMpfWZ1bmN0aW9uIG4oYSxiKXthPWEuc3BsaXQoXCIuXCIpO3ZhciBjPWc7YVswXWluIGN8fFwidW5kZWZpbmVkXCI9PXR5cGVvZiBjLmV4ZWNTY3JpcHR8fGMuZXhlY1NjcmlwdChcInZhciBcIithWzBdKTtmb3IodmFyIGQ7YS5sZW5ndGgmJihkPWEuc2hpZnQoKSk7KWEubGVuZ3RofHx2b2lkIDA9PT1iP2NbZF0mJmNbZF0hPT1PYmplY3QucHJvdG90eXBlW2RdP2M9Y1tkXTpjPWNbZF09e306Y1tkXT1ifTtmdW5jdGlvbiBwKGEpe2xldCBiPSExLGM7cmV0dXJuIGZ1bmN0aW9uKCl7Ynx8KGM9YSgpLGI9ITApO3JldHVybiBjfX07ZnVuY3Rpb24gcShhKXtxW1wiIFwiXShhKTtyZXR1cm4gYX1xW1wiIFwiXT1mdW5jdGlvbigpe307dmFyIHI9e2NhcHR1cmU6ITB9LHQ9cChmdW5jdGlvbigpe2xldCBhPSExO3RyeXtjb25zdCBiPU9iamVjdC5kZWZpbmVQcm9wZXJ0eSh7fSxcInBhc3NpdmVcIix7Z2V0OmZ1bmN0aW9uKCl7YT0hMH19KTtnLmFkZEV2ZW50TGlzdGVuZXIoXCJ0ZXN0XCIsbnVsbCxiKX1jYXRjaChiKXt9cmV0dXJuIGF9KTtmdW5jdGlvbiB1KGEpe3JldHVybiBhP2EucGFzc2l2ZSYmdCgpP2E6YS5jYXB0dXJlfHwhMTohMX1mdW5jdGlvbiB4KGEsYixjLGQpe2EuYWRkRXZlbnRMaXN0ZW5l&i=4-11&t=adltag_kglayibe_5Q22w3z6xwK&r=d60ea5af3d75377ad658f061748d2ad&c=math-aids-threatpost&z=1
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/b-9a4f7ce-a7f6098c.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.85.32.34 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-85-32-34.ham50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

x-amz-version-id: D2POxJleIt92FyXaxSi7iRHuNLtujALh
via: 1.1 64cab3aa5eaf0c5f28d762c526424858.cloudfront.net (CloudFront)
etag: "d41d8cd98f00b204e9800998ecf8427e"
age: 40578
x-cache: Error from cloudfront
status: 200
content-length: 0
last-modified: Mon, 15 Jun 2020 18:35:10 GMT
server: AmazonS3
date: Thu, 22 Oct 2020 09:36:58 GMT
access-control-max-age: 3000
access-control-allow-methods: GET
content-type: text/plain
access-control-allow-origin: *
x-amz-cf-pop: HAM50-C1
accept-ranges: bytes
x-amz-cf-id: H9tPw39DBegITcae4dFfKqdjC8lMmvnKrh9UG64ebTdhpJ-_efJwKA==

POST
H2 200 tag
math-aids-threatpost-tagan.adlightning.com/ 0
428 B 104ms
42ms Other
text/plain 52.85.32.34
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://math-aids-threatpost-tagan.adlightning.com/tag?s=bl&d=ciYmYS5hZGRFdmVudExpc3RlbmVyKGIsYyx1KGQpKX07ZnVuY3Rpb24geShhLGIpe2lmKCFhfHwhYilyZXR1cm4hMTtpZihhLmNvbnRhaW5zJiYxPT1iLm5vZGVUeXBlKXJldHVybiBhPT1ifHxhLmNvbnRhaW5zKGIpO2lmKFwidW5kZWZpbmVkXCIhPXR5cGVvZiBhLmNvbXBhcmVEb2N1bWVudFBvc2l0aW9uKXJldHVybiBhPT1ifHwhIShhLmNvbXBhcmVEb2N1bWVudFBvc2l0aW9uKGIpJjE2KTtmb3IoO2ImJmEhPWI7KWI9Yi5wYXJlbnROb2RlO3JldHVybiBiPT1hfTtmdW5jdGlvbiB6KCl7dmFyIGE9QTt0cnl7dmFyIGI7aWYoYj0hIWEmJm51bGwhPWEubG9jYXRpb24uaHJlZilhOnt0cnl7cShhLmZvbyk7Yj0hMDticmVhayBhfWNhdGNoKGMpe31iPSExfXJldHVybiBifWNhdGNoKGMpe3JldHVybiExfX07dmFyIEI9ZG9jdW1lbnQ7dmFyIEQ9e307dmFyIEU9Y2xhc3N7fSxGPWNsYXNzIGV4dGVuZHMgRXtjb25zdHJ1Y3RvcihhKXtzdXBlcigpO2lmKEQhPT1EKXRocm93IEVycm9yKFwiQmFkIHNlY3JldFwiKTt0aGlzLmE9YX10b1N0cmluZygpe3JldHVybiB0aGlzLmF9fTtuZXcgRihcImFib3V0OmJsYW5rXCIpO25ldyBGKFwiYWJvdXQ6aW52YWxpZCN6VFN6XCIpO3ZhciBHPSEhd2luZG93Lmdvb2dsZV9hc3luY19pZnJhbWVfaWQ7bGV0IEE9RyYmd2luZG93LnBhcmVudHx8d2luZG93O2xldCBJPW51bGw7Y2xhc3MgSntjb25zdHJ1Y3RvcihhLGIpe3ZhciBjPShjPWcucGVyZm9ybWFuY2UpJiZjLm5vdz9jLm5vdygpOm51bGw7Y3x8KGM9KGM9Zy5wZXJmb3JtYW5jZSkmJmMubm93JiZjLnRpbWluZz9NYXRoLmZsb29yKGMubm93KCkrYy50aW1pbmcubmF2aWdhdGlvblN0YXJ0KTpEYXRlLm5vdygpKTt0aGlzLmxhYmVsPWE7dGhpcy50eXBlPWI7dGhpcy52YWx1ZT1jO3RoaXMuZHVyYXRpb249MDt0aGlzLnVuaXF1ZUlkPU1hdGgucmFuZG9tKCk7dGhpcy5zbG90SWQ9dm9pZCAwfX07Y29uc3QgSz1nLnBlcmZvcm1hbmNlLGFhPSEhKEsmJksubWFyayYmSy5tZWFzdXJlJiZLLmNsZWFyTWFya3MpLEw9cCgoKT0%2Be3ZhciBhO2lmKGE9YWEpe3ZhciBiO2lmKG51bGw9PT1JKXtJPVwiXCI7dHJ5e2E9XCJcIjt0cnl7YT1nLnRvcC5sb2NhdGlvbi5oYXNofWNhdGNoKGMpe2E9Zy5sb2NhdGlvbi5oYXNofWEmJihJPShiPWEubWF0Y2goL1xcYmRlaWQ9KFtcXGQsXSspLykpP2JbMV06XCJcIil9Y2F0Y2goYyl7fX1iPUk7YT0hIWIuaW5kZXhPZiYmMDw9Yi5pbmRleE9mKFwiMTMzN1wiKX1yZXR1cm4gYX0pO2Z1bmN0aW9uIGJhKGEpe2EmJksmJkwoKSYmKEsuY2xlYXJNYXJrcyhgZ29vZ18ke2EubGFiZWx9XyR7YS51bmlxdWVJZH1fc3RhcnRgKSxLLmNsZWFyTWFya3MoYGdvb2dfJHthLmxhYmVsfV8ke2EudW5pcXVlSWR9X2VuZGApKX0gY2xhc3MgY2F7Y29uc3RydWN0b3IoKXt2YXIgYT1NO3RoaXMuYT1bXTt0aGlzLmM9YXx8ZztsZXQgYj1udWxsO2EmJihhLmdvb2dsZV9qc19yZXBvcnRpbmdfcXVldWU9YS5nb29nbGVfanNfcmVwb3J0aW5nX3F1ZXVlfHxbXSx0aGlzLmE9YS5nb29nbGVfanNfcmVwb3J0aW5nX3F1ZXVlLGI9YS5nb29nbGVfbWVhc3VyZV9qc190aW1pbmcpO3RoaXMuYj1MKCl8fChudWxsIT1iP2I6MT5NYXRoLnJhbmRvbSgpKX1zdGFydChhLGIpe2lmKCF0aGlzLmIpcmV0dXJuIG51bGw7YT1uZXcgSihhLGIpO2I9YGdvb2dfJHthLmxhYmVsfV8ke2EudW5pcXVlSWR9X3N0YXJ0YDtLJiZMKCkmJksubWFyayhiKTtyZXR1cm4gYX19O2lmKEcmJiF6KCkpe2xldCBhPVwiLlwiK0IuZG9tYWluO3RyeXtmb3IoOzI8YS5zcGxpdChcIi5cIikubGVuZ3RoJiYheigpOylCLmRvbWFpbj1hPWEuc3Vic3RyKGEuaW5kZXhPZihcIi5cIikrMSksQT13aW5kb3cucGFyZW50fWNhdGNoKGIpe316KCl8fChBPXdpbmRvdyl9Y29uc3QgTT1BLE49bmV3IGNhO3ZhciBPPSgpPT57TS5nb29nbGVfbWVhc3VyZV9qc190aW1pbmd8fChOLmI9ITEsTi5hIT1OLmMuZ29vZ2xlX2pzX3JlcG9ydGluZ19xdWV1ZSYmKEwoKSYmQXJyYXkucHJvdG90eXBlLmZvckVhY2guY2FsbChOLmEsYmEsdm9pZCAwKSxOLmEubGVuZ3RoPTApKX07XCJudW1iZXJcIiE9PXR5cGVvZiBNLmdvb2dsZV9zcnQmJihNLmdvb2dsZV9zcnQ9TWF0aC5yYW5kb20oKSk7XCJjb21wbGV0ZVwiPT1NLmRvY3VtZW50LnJlYWR5U3RhdGU%2FTygpOk4uYiYmeChNLFwibG9hZFwiLCgpPT57TygpfSk7dmFyIFA9KGEsYixjLGQsZSk9Pnt3aW5kb3cuY3NzP3dpbmRvdy5jc3MoYixjLGQsZSx2b2lkIDApOmEmJihiPWEuaHJlZixlP2Q9YisoXCImXCIrYytcIj1cIitkKTooZT1cIiZcIitjK1wiPVwiLGM9Yi5pbmRleE9mKGUpLDA%2BYz9kPWIrZStkOihjKz1lLmxlbmd0aCxlPWIuaW5kZXhPZihcIiZcIixjKSxkPTA8PWU%2FYi5zdWJzdHJpbmcoMCxjKStkK2Iuc3Vic3RyaW5nKGUpOmIuc3Vic3RyaW5nKDAsYykrZCkpLGI9MkUzPGQubGVuZ3RoP2I6ZCxhLmhyZWY9Yil9O2xldCBRPSExLFI9ITEsUz1udWxsO3ZhciBkYT0oKT0%2Be2RvY3VtZW50LmFkZEV2ZW50TGlzdGVuZXImJngoZG9jdW1lbnQsXCJjbGlja1wiLGE9PntTPWF9LHIpfSxlYT0oKT0%2Be2NvbnN0IGE9UztyZXR1cm4gYT9RfHxSPyExOihhLnByZXZlbnREZWZhdWx0P2EucHJldmVudERlZmF1bHQoKTphLnJldHVyblZhbHVlPSExLCEwKTohMX0sZmE9KCk9Pnt4KGRvY3VtZW50LFwibW91c2Vkb3duXCIsKCk9PntRPSEwfSk7eChkb2N1bWVudCxcImtleWRvd25cIiwoKT0%2Be1I9ITB9KTtkYSgpfTt2YXIgaGE9KGEsYj0xNyk9PntpZigwPmJ8fHBhcnNlSW50KGIsMTApIT09YiliPTE3O1QoYSxiKX0saWE9KGEsYik9PntUKGEsYnx8MSl9LGphPWE9PntUKGEsMil9LGthPShhLGIpPT57VChhLGJ8fDApfTtsZXQgVT17fSxWPSEwO3ZhciBUPShhLGIpPT57dmFyIGM7aWYoYz1WKXZvaWQgMD09PVVbYV0mJihVW2FdPVtdKSwoYz1VW2FdW2JdKXx8KFVbYV1bYl09ITApO2N8fFAoZG9jdW1lbnQuZ2V0RWxlbWVudEJ5SWQoYSksYSxcIm5iXCIsYixWKX07ZnVuY3Rpb24gVyhhLGIsYyl7Y29uc3QgZD1hLmlkfHxcIlwiO1AoYSxkLFwibnhcIixiKTtQKGEsZCxcIm55XCIsYyl9Y2xhc3MgbGF7Y29uc3RydWN0b3IoKXt0aGlzLmE9dGhpcy5iPW51bGw7Qi5hZGRFdmVudExpc3RlbmVyJiZCLmFkZEV2ZW50TGlzdGVuZXIoXCJtb3VzZWRvd25cIixsKHRoaXMuYyx0aGlzKSwhMCk7eChCLFwiRE9NQ29udGVudExvYWRlZFwiLGwoZnVuY3Rpb24oKXt0aGlzLmE9Qi5nZXRFbGVtZW50QnlJZChcImNvbW1vbl8xNWNsaWNrX2FuY2hvclwiKX0sdGhpcykpfWMoYSl7dGhpcy5iPWF9fTtjb25zdCBtYT1bMCwyLDFdO2xldCBYPW51bGw7dmFyIFk9YT0%2Be2lmKGEpe3ZhciBiO3tjb25zdCBjPXdpbmRvdy5ldmVudHx8WDtjPygoYj1jLndoaWNoPzE8PG1hW2Mud2hpY2gtMV06Yy5idXR0b24pJiZjLnNoaWZ0S2V5JiYoYnw9OCksYiYmYy5hbHRLZXkmJihifD0xNiksYiYmYy5jdHJsS2V5JiYoYnw9MzIpKTpiPW51bGx9YiYmUChhLGEuaWQsXCJtYlwiLGIpfX07ZG9jdW1lbnQuYWRkRXZlbnRMaXN0ZW5lciYmZG9jdW1lbnQuYWRkRXZlbnRMaXN0ZW5lcihcIm1vdXNlZG93blwiLGE9PntYPWF9LCEwKTt3aW5kb3cubWI9WTt2YXIgWj17fSxuYT0oYSxiPTIsYz1cIlwiKT0%2Be2M9Yz9jOmE7MSE9YiYmKHZvaWQgMD09PVpbY10%2FWltjXT0xOlpbY10rKyk7MCE9YiYmWltjXSYmUChkb2N1bWVudC5nZXRFbGVtZW50QnlJZChhKSxhLFwibm1cIixaW2NdKX07bihcImluaXRfc3NiXCIsKGEsYixjLGQsZSxvYSk9PnthJiYoZmEoKSxuKFwiYWNjYmtcIixlYSkpO2ImJihvYSYmKFY9ITEpLG4oXCJjbGFcIixoYSksbihcImNsbFwiLGlhKSxuKFwiY2xiXCIsamEpLG4oXCJjbGhcIixrYSkpO2lmKGMpe2NvbnN0IEM9bmV3IGxhO24oXCJ4eVwiLChmLEgsdik9Pnt7dmFyIG09dnx8SDtjb25zdCB3PWZ8fEMuYjt3JiZIJiZtJiYheShDLmEsdy50YXJnZXQpJiYoZj1CLnF1ZXJ5U2VsZWN0b3IoXCJhLm9uZS1wb2ludC1maXZlLWNsaWNrLnJoYnV0dG9uXCIpLCFmfHwoZi5jbGFzc0xpc3Q%2FZi5jbGFzc0xpc3QuY29udGFpbnMoXCJwcmVleHBhbmRlZFwiKTowPD1BcnJheS5wcm90b3R5cGUuaW5kZXhPZi5jYWxsKGYuY2xhc3NMaXN0P2YuY2xhc3NMaXN0OihcInN0cmluZ1wiPT10eXBlb2YgZi5jbGFzc05hbWU%2FZi5jbGFzc05hbWU6Zi5nZXRBdHRyaWJ1dGUmJmYuZ2V0QXR0cmlidXRlKFwiY2xhc3NcIil8fFwiXCIpLm1hdGNoKC9cXFMrL2cpfHxbXSxcInByZWV4cGFuZGVkXCIsdm9pZCAwKSl8fCAheShmLHcudGFyZ2V0KSkmJih2PU1hdGgucm91bmQody5jbGllbnRYLW0ub2Zmc2V0TGVmdCksbT1NYXRoLnJvdW5kKHcuY2xpZW50WS1tLm9mZnNldFRvcCksVyhILHYsbSksQy5hJiZXKEMuYSx2LG0pLGYmJlcoZix2LG0pKX19KX1kJiZuKFwibWJcIixZKTtlJiZuKFwic3NcIixuYSl9KTt9KS5jYWxsKHRoaXMpOzwvc2NyaXB0PjxzY3JpcHQ%2BaW5pdF9zc2IodHJ1ZSxmYWxzZSx0cnVlLHRydWUsdHJ1ZSxmYWxzZSk7PC9zY3JpcHQ%2BPHNjcmlwdD5pZiAodHlwZW9mKHNzKSA9PT0gXCJ1bmRlZmluZWRcIikgeyBzcyA9IGZ1bmN0aW9uKCl7fTsgfWZ1bmN0aW9uIHN0KGlkKSB7dmFyIGEgPSBkb2N1bWVudC5nZXRFbGVtZW50QnlJZChpZCk7aWYgKGEpIHthLm15dCA9IChuZXcgRGF0ZSgpKS5nZXRUaW1lKCk7eHkod2luZG93LmV2ZW50LCBhLCBkb2N1bWVudC5ib2R5KTttYihhKTt9fWZ1bmN0aW9uIGhhKGEseCl7ICBpZiAoYWNjYmsoKSkgcmV0dXJuO3N1KGEpO31mdW5jdGlvbiBpYShhLGUseCkge2lmIChhY2NiaygpKSByZXR1cm47c3UoYSk7fWZ1bmN0aW9uIGphKGEseCkge2lmIChhY2NiaygpKSByZXR1cm47c3UoYSk7fWZ1bmN0aW9uIGdhKG8sZSx4KSB7aWYgKGRvY3VtZW50LmdldEVsZW1lbnRCeUlkKSB7dmFyIGE9by5pZC5zdWJzdHJpbmcoMSkscD1cIlwiLHI9XCJcIixnPWUudGFyZ2V0LHQsZixoO2lmIChnKSB7dD1nLmlkO2Y9Zy5wYXJlbnROb2RlO2lmIChmKSB7cD1mLmlkO2g9Zi5wYXJlbnROb2RlO2lmIChoKXI9aC5pZDt9fSBlbHNlIHtoPWUuc3JjRWxlbWVudDtmPWgucGFyZW50Tm9kZTtpZiAoZilwPWYuaWQ7dD1oLmlkO31pZiAodD09YXx8cD09YXx8cj09YSlyZXR1cm4gdHJ1ZTtpYShhLGUseCk7d2luZG93Lm9wZW4oZG9jdW1lbnQuZ2V0RWxlbWVudEJ5SWQoYSkuaHJlZik7fX08L3NjcmlwdD48c2NyaXB0Pjwvc2NyaXB0PjxzdHlsZT5odG1sLCBib2R5IHt3aWR0aDoxMDAlO2hlaWdodDoxMDAlO31ib2R5IHtkaXNwbGF5OnRhYmxlO3RleHQtYWxpZ246Y2VudGVyO30jZ29vZ2xlLWNlbnRlci1kaXYge2Rpc3BsYXk6dGFibGUtY2VsbDt2ZXJ0aWNhbC1hbGlnbjptaWRkbGU7Zm9udC1zaXplOiAwO2xpbmUtaGVpZ2h0OiAwO30jZ29vZ2xlX2ltYWdlX2RpdiB7IGRpc3BsYXk6aW5saW5lLWJsb2NrOyB9PC9zdHlsZT48bWV0YSBkYXRhLWFzb2NoLW1ldGE9J1tbW1wiYnRuQ2xrXCIsW251bGwsbnVsbCxudWxsLG51bGwsOF1dLFtcImFkMFwiLFtudWxsLFwiaHR0cHM6Ly9nb29nbGVhZHMuZy5kb3VibGVjbGljay5uZXQvYWNsaz9zYT1sXFx1MDAyNmFpPUN5aU0xT3ZHUlg5aTJNSU9abFFlWHBxM29CT0xNcDlKZm9zVGV2clFNeDRLajVwSU9FQUVnMFlmU0lHQ1JoSk9GX0JlZ0FhM2Npb2dEeUFFQzRBSUFxQU1CeUFPWkJLb0VwZ0pQMEtDVG9qalBWLXgxb2R0dUdMcV9vX3pzZm5QUXk0T3N6SkhPZTJzQ3RYc0l1NktSSmJudWRoclJPRWwzR0dpWUd3cktTelkyYmpZM3BMMmh2YWhHeXdkMHVQQVpTalFrQzVXQkoydFh5MEpEc2V1SHYzTm9GUXljZDB4ODIxdk9La1JVNDRaaFliVWx5Skp4UkhqZktLeENtN3FEazNDZ2M4ejRhWi1XU21Bb0Y4T1hQdndhaFZRTU1aMy0wQ1I1VC1GUnJIQy1HcE80NGI2bndQZkZqNUIyaHJfNWlJT01Bdk9xcEFwcnJxZUotN2lJVzV6Q0VpZHh3cndRQTJ3bEZ5SVNRd3hqNk9rNWk4RzBxcHZYeUpiZkFmVkdYaW1vU0pzdkxIZlAxRkRWeURtTVdhc0FzRGd1TjlhX2JJWDlRMkRvSEctZEN2TS1hSDZzMW1xdm5i&i=5-11&t=adltag_kglayibe_5Q22w3z6xwK&r=d60ea5af3d75377ad658f061748d2ad&c=math-aids-threatpost&z=1
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/b-9a4f7ce-a7f6098c.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.85.32.34 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-85-32-34.ham50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

x-amz-version-id: D2POxJleIt92FyXaxSi7iRHuNLtujALh
via: 1.1 64cab3aa5eaf0c5f28d762c526424858.cloudfront.net (CloudFront)
etag: "d41d8cd98f00b204e9800998ecf8427e"
age: 40578
x-cache: Error from cloudfront
status: 200
content-length: 0
last-modified: Mon, 15 Jun 2020 18:35:10 GMT
server: AmazonS3
date: Thu, 22 Oct 2020 09:36:58 GMT
access-control-max-age: 3000
access-control-allow-methods: GET
content-type: text/plain
access-control-allow-origin: *
x-amz-cf-pop: HAM50-C1
accept-ranges: bytes
x-amz-cf-id: Pd1ZGPLj2AHLkXqYBg87zpg-1iKBBEdJL8WvY_qMqJqmkB0SrOt4Vw==

POST
H2 200 tag
math-aids-threatpost-tagan.adlightning.com/ 0
427 B 111ms
50ms Other
text/plain 52.85.32.34
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://math-aids-threatpost-tagan.adlightning.com/tag?s=bl&d=OV81UzJyM0JPZXM4WHgxdmJPX25JRE5rRGVrOW9xQlhIN1prbTI2amVxdlYzOUJBREFCTlNoNGNHWkEtQUVBYUFHQW9BSDJvREhhNmdIanM0YnFBZlZ5UnVvQjVQWUc2Z0h1Z2FvQl9EWkc2Z0g4dGticUFmdWxyRUNxQWVtdmh1b0ItelZHNmdIODlFYnFBZnMxUnVvQjViWUc2Z0h3dG9iMkFjQjBnZ0pDSURoZ0VBUUFSZ2Q4Z2diWVdSNExYTjFZbk41YmkwM01qWXpOVGN6TkRRMk9EQTBNRGM0c1FuMUlVdVpQVkVvRElBS0E1Z0xBY2dMQWRnVERBXFx1MDAyNmFlPTFcXHUwMDI2bnVtPTFcXHUwMDI2Y2lkPUNBQVNQZVJvbGNNWXY5T2VwQmlHeFdSQ3UwejFmZ2dLSEZoNnkxUzc0SmhQSG1GU2p2Z2JhV3ltUjdSTG9qSFlJT21GNXdDSC1OODZ0MzBueXB0UUd0c1xcdTAwMjZzaWc9QU9ENjRfMmN6MTZGZE1MaXR4SGhKSzV6dEdyTXhHbXhmUVxcdTAwMjZjbGllbnQ9Y2EtcHViLTk2ODU3MzQ0NDU0NzY4MTRcXHUwMDI2YWR1cmw9aHR0cHM6Ly93d3cubmV3Y2hpYy5jb20vdGhlbWUtbWFjLXQtMzQxNjgzLyUzRmNsZWFuU3FsJTNEODUlMjZ1dG1fc291cmNlJTNEZ29vZ2xlJTI2dXRtX21lZGl1bSUzRGNwY19hZHMxJTI2dXRtX2NhbXBhaWduJTNEY25ldy1tY2wtcC1jbDE2ODMtd29yLWF1MTQtOTclMjZ1dG1fY29udGVudCUzRGxlZXIlMjZ1dG1fZGVzaWduJTNEJTI2dXRtX2hvJTNEMjItNjUlMjZnY2xpZCUzREVBSWFJUW9iQ2hNSTJMdjl1SXJKN0FJVmcwemxDaDBYVXd0TkVBRVlBU0FBRWdLenZfRF9Cd0VcIixudWxsLG51bGwsMTcsbnVsbCxudWxsLFtudWxsLFwiaHR0cHM6Ly93d3cubmV3Y2hpYy5jb20vdGhlbWUtbWFjLXQtMzQxNjgzLz9jbGVhblNxbD04NVwiLFwiXCJdLFwiaHR0cHM6Ly9nb29nbGVhZHMuZy5kb3VibGVjbGljay5uZXQvcGFnZWFkL2NvbnZlcnNpb24vP2FpPUN5aU0xT3ZHUlg5aTJNSU9abFFlWHBxM29CT0xNcDlKZm9zVGV2clFNeDRLajVwSU9FQUVnMFlmU0lHQ1JoSk9GX0JlZ0FhM2Npb2dEeUFFQzRBSUFxQU1CeUFPWkJLb0VwZ0pQMEtDVG9qalBWLXgxb2R0dUdMcV9vX3pzZm5QUXk0T3N6SkhPZTJzQ3RYc0l1NktSSmJudWRoclJPRWwzR0dpWUd3cktTelkyYmpZM3BMMmh2YWhHeXdkMHVQQVpTalFrQzVXQkoydFh5MEpEc2V1SHYzTm9GUXljZDB4ODIxdk9La1JVNDRaaFliVWx5Skp4UkhqZktLeENtN3FEazNDZ2M4ejRhWi1XU21Bb0Y4T1hQdndhaFZRTU1aMy0wQ1I1VC1GUnJIQy1HcE80NGI2bndQZkZqNUIyaHJfNWlJT01Bdk9xcEFwcnJxZUotN2lJVzV6Q0VpZHh3cndRQTJ3bEZ5SVNRd3hqNk9rNWk4RzBxcHZYeUpiZkFmVkdYaW1vU0pzdkxIZlAxRkRWeURtTVdhc0FzRGd1TjlhX2JJWDlRMkRvSEctZEN2TS1hSDZzMW1xdm5iOV81UzJyM0JPZXM4WHgxdmJPX25JRE5rRGVrOW9xQlhIN1prbTI2amVxdlYzOUJBREFCTlNoNGNHWkEtQUVBYUFHQW9BSDJvREhhNmdIanM0YnFBZlZ5UnVvQjVQWUc2Z0h1Z2FvQl9EWkc2Z0g4dGticUFmdWxyRUNxQWVtdmh1b0ItelZHNmdIODlFYnFBZnMxUnVvQjViWUc2Z0h3dG9iMkFjQjBnZ0pDSURoZ0VBUUFSZ2Q4Z2diWVdSNExYTjFZbk41YmkwM01qWXpOVGN6TkRRMk9EQTBNRGM0c1FuMUlVdVpQVkVvRElBS0E1Z0xBY2dMQWRnVERBXFx1MDAyNnNpZ2g9TWJsTkJxOV9hZ1lcXHUwMDI2Y2lkPUNBUVNQd0NOSXJMTVFlQnZyYmJxSkVpR3FFQmx0elZ5N2NUYXhkTkVzM2xZUEpWYUoxalVwV0wwb3NSaHk5ZmJsOTlxQ2hMNktlcFFnQnFlTGJ5cDh4OEhOZ1wiLG51bGwsXCJfYmxhbmtcIl1dXSwxLG51bGwsbnVsbCxcImF3MFwiLG51bGwsbnVsbCwxXSc%2BPC9oZWFkPjxib2R5IGxlZnRNYXJnaW49XCIwXCIgdG9wTWFyZ2luPVwiMFwiIG1hcmdpbndpZHRoPVwiMFwiIG1hcmdpbmhlaWdodD1cIjBcIiBzdHlsZT1cImJhY2tncm91bmQtY29sb3I6dHJhbnNwYXJlbnRcIiA%2BPGRpdiBpZD1cImdvb2dsZS1jZW50ZXItZGl2XCI%2BPGRpdiBpZD1cImdvb2dsZV9pbWFnZV9kaXZcInN0eWxlPVwiaGVpZ2h0OiAyNTBweDsgd2lkdGg6IDk3MHB4OyBvdmVyZmxvdzpoaWRkZW47IHBvc2l0aW9uOnJlbGF0aXZlXCJjbGFzcz1cIkdvb2dsZUFjdGl2ZVZpZXdFbGVtZW50XCJkYXRhLWdvb2dsZS1hdi1jeG49XCJodHRwczovL3BhZ2VhZDIuZ29vZ2xlc3luZGljYXRpb24uY29tL3Bjcy9hY3RpdmV2aWV3P3hhaT1BS0FPanN1VkxtVmNBYTVVV29UbjFhemtwdVpySGQyS1gyY21FRkV0ZmY5c1ZJQy1YUUlYRDFaTVlyc0R3UHdCdHR5cnRtQl9LTGx1RFZOdWI2WGlFaGV6Vk5Qelo0Ukt6NWExRml1aXdTRndsYWJGT0QxNFBrQ2tkUnJGdUt4VWtRJmFtcDtzYWk9QU1mbC1ZU3lTSHR6RE5RMWJKNzg4SUFJU0lRNUhKdzl3VkVLdmQzU3dCSkFGLWNHMWVCeXZVR1REbnZxdmlpQmZoNzhDLXpPeXFnMDJBczBQajRQZkJNc0pncVlCZGl5c2tOekhnMDFzcVVNVmh2YTg4Vy1FWlcwZl9BOXRydWUwcElFJmFtcDtzaWc9Q2cwQXJLSlN6RjlPbHdVdXk5b2dFQUUmYW1wO2NpZD1DQUFTUGVSb2xjTVl2OU9lcEJpR3hXUkN1MHoxZmdnS0hGaDZ5MVM3NEpoUEhtRlNqdmdiYVd5bVI3UkxvakhZSU9tRjV3Q0gtTjg2dDMwbnlwdFFHdHNcImRhdGEtZ29vZ2xlLWF2LWFkaz1cIjEwMTU1MTk4MDBcImRhdGEtZ29vZ2xlLWF2LW1ldGFkYXRhPVwibGE9MSZhbXA7eGRpPTAmYW1wO1wiZGF0YS1nb29nbGUtYXYtb3ZlcnJpZGU9XCItMVwiZGF0YS1nb29nbGUtYXYtZG09XCIyXCJkYXRhLWdvb2dsZS1hdi1pbW1lZGlhdGUgZGF0YS1nb29nbGUtYXYtYWlkPVwiMFwiZGF0YS1nb29nbGUtYXYtbmFpZD1cIjFcImRhdGEtZ29vZ2xlLWF2LXNsaWZ0PVwiXCJkYXRhLWdvb2dsZS1hdi1jcG1hdj1cIlwiZGF0YS1nb29nbGUtYXYtYnRyPVwiXCJkYXRhLWdvb2dsZS1hdi1pdHBsPVwiNFwiZGF0YS1nb29nbGUtYXYtcnM9XCI0XCJkYXRhLWdvb2dsZS1hdi1mbGFncz1cIlsmcXVvdDt5fiZxdW90O11cIj48c2NyaXB0PnZ1KFwiaHR0cHM6Ly9zZWN1cmVwdWJhZHMuZy5kb3VibGVjbGljay5uZXQvcGFnZWFkL2Fkdmlldz9haVxceDNkQ0duWlZPdkdSWDlpMk1JT1psUWVYcHEzb0JPTE1wOUpmb3NUZXZyUU14NEtqNXBJT0VBRWcwWWZTSUdDUmhKT0ZfQmVnQWEzY2lvZ0R5QUVDNEFJQXFBTUJ5QU9aQktvRW93SlAwS0NUb2pqUFYteDFvZHR1R0xxX29fenNmblBReTRPc3pKSE9lMnNDdFhzSXU2S1JKYm51ZGhyUk9FbDNHR2lZR3dyS1N6WTJialkzcEwyaHZhaEd5d2QwdVBBWlNqUWtDNVdCSjJ0WHkwSkRzZXVIdjNOb0ZReWNkMHg4MjF2T0trUlU0NFpoWWJVbHlKSnhSSGpmS0t4Q203cURrM0NnYzh6NGFaLVdTbUFvRjhPWFB2d2FoVlFNTVozLTBDUjVULUZSckhDLUdwTzQ0YjZud1BmRmo1QjJocl81aUlPTUF2T3FwQXBycnFlSi03aUlXNXpDRWlkeHdyd1FBMndsRnlJU1F3eGo2T2s1aThHMHFwdlh5SmJmQWZWR1hpbW9TSnN2TEhmUDFGRFZ5RG1NV2FzQXNEZ3VOOWFfYklYOVEyRG9IRy1kQ3ZNLWFINnMxbXF2bmI5XzVTMnIzQk9lczhYeDF2Yk9fbklETmtDY2tkUzR6dW9kU01oUXFJNXF1dXJBQk5TaDRjR1pBLUFFQVpJRkJBZ0VHQUdTQlFRSUJSZ0VvQVlDZ0FmYWdNZHJxQWVPemh1b0I5WEpHNmdIazlnYnFBZTZCcWdIOE5rYnFBZnkyUnVvQi02V3NRS29CNmEtRzZnSDdOVWIyQWNCOGdjRUVMalNFTklJQ1FpQTRZQkFFQUVZSGZJSUcyRmtlQzF6ZFdKemVXNHROekkyTXpVM016UTBOamd3TkRBM09JQUtBOGdMQWJJTUZIQjFZaTA1TmpnMU56TTBORFExTkRjMk9ERTB3Z3dDQ0FIWUV3d1xceDI2c2lnaFxceDNkMEtBd0xSU2ZnWndcXHgyNnRwZFxceDNkQUdXaEptdmFiT1lWN2JkcmJDWmtDeDBKWFRod0hzZUMzOVpidkt2NzY1VWlROUlocmdcIik8L3NjcmlwdD48YSBpZD1cImF3MFwiIHRhcmdldD1cIl9ibGFua1wiIGhyZWY9XCJodHRwczovL2dvb2dsZWFkcy5nLmRvdWJsZWNsaWNrLm5ldC9hY2xrP3NhPWwmYWk9Q3lpTTFPdkdSWDlpMk1JT1psUWVYcHEzb0JPTE1wOUpmb3NUZXZyUU14NEtqNXBJT0VBRWcwWWZTSUdDUmhKT0ZfQmVnQWEzY2lvZ0R5QUVDNEFJQXFBTUJ5QU9aQktvRXBnSlAwS0NUb2pqUFYteDFvZHR1R0xxX29fenNmblBReTRPc3pKSE9lMnNDdFhzSXU2S1JKYm51ZGhyUk9FbDNHR2lZR3dyS1N6WTJialkzcEwyaHZhaEd5d2QwdVBBWlNqUWtDNVdCSjJ0WHkwSkRzZXVIdjNOb0ZReWNkMHg4MjF2T0trUlU0NFpoWWJVbHlKSnhSSGpmS0t4Q203cURrM0NnYzh6NGFaLVdTbUFvRjhPWFB2d2FoVlFNTVozLTBDUjVULUZSckhDLUdwTzQ0YjZud1BmRmo1QjJocl81aUlPTUF2T3FwQXBycnFlSi03aUlXNXpDRWlkeHdyd1FBMndsRnlJU1F3eGo2T2s1aThHMHFwdlh5SmJmQWZWR1hpbW9TSnN2TEhmUDFGRFZ5RG1NV2FzQXNEZ3VOOWFfYklYOVEyRG9IRy1kQ3ZNLWFINnMxbXF2bmI5XzVTMnIzQk9lczhYeDF2Yk9fbklETmtEZWs5b3FCWEg3WmttMjZqZXF2VjM5QkFEQUJOU2g0Y0daQS1BRUFhQUdBb0FIMm9ESGE2Z0hqczRicUFmVnlSdW9CNVBZRzZnSHVnYW9CX0RaRzZnSDh0a2JxQWZ1bHJFQ3FBZW12aHVvQi16Vkc2Z0g4OUVicUFmczFSdW9CNWJZRzZnSHd0b2IyQWNCMGdnSkNJRGhnRUFRQVJnZDhnZ2JZV1I0TFhOMVluTjViaTAzTWpZek5UY3pORFEyT0RBME1EYzRzUW4xSVV1WlBWRW9ESUFLQTVnTEFjZ0xBZGdUREEmYWU9MSZudW09MSZjaWQ9Q0FBU1BlUm9sY01ZdjlPZXBCaUd4V1JDdTB6MWZnZ0tIRmg2eTFTNzRKaFBIbUZTanZnYmFXeW1SN1JMb2pIWUlPbUY1d0NILU44NnQzMG55cHRRR3RzJnNpZz1BT0Q2NF8yY3oxNkZkTUxpdHhIaEpLNXp0R3JNeEdteGZRJmNsaWVudD1jYS1wdWItOTY4NTczNDQ0NTQ3NjgxNCZhZHVybD1odHRwczovL3d3dy5uZXdjaGljLmNvbS90aGVtZS1tYWMtdC0zNDE2ODMvJTNGY2xlYW5TcWwlM0Q4NSUyNnV0bV9zb3VyY2UlM0Rnb29nbGUlMjZ1dG1fbWVkaXVtJTNEY3BjX2FkczElMjZ1dG1fY2FtcGFpZ24lM0RjbmV3LW1jbC1wLWNsMTY4My13b3ItYXUxNC05NyUyNnV0bV9jb250ZW50JTNEbGVlciUyNnV0bV9kZXNpZ24lM0QlMjZ1dG1faG8lM0QyMi02NSUyNmdjbGlkJTNERUFJYUlRb2JDaE1JMkx2OXVJcko3QUlWZzB6bENoMFhVd3RORUFFWUFTQUFFZ0t6dl9EX0J3RVwiIGRhdGEtYXNvY2gtdGFyZ2V0cz1cImFkMFwiID48aW1nIHNyYz1cImh0dHBzOi8vdHBjLmdvb2dsZXN5bmRpY2F0aW9uLmNvbS9zaW1nYWQvMTAzMzAxMTY2Mjc5NjI3ODE3NjM%2Fc3FwPTRzcVB5UVE3UWprcU54QUJIUUFBdEVJZ0FTZ0JNQWs0QTBEd2t3bFlBV0JmY0FLQUFRR0lBUUdkQVFBQWdELW9BUUd3QVlDdDRnUzRBVl9GQVMyeW5UNCZhbXA7cnM9QU9nYTRxbk51VzRpUkhPWTdUTVlCVTFJSEJBRWRhSlVpd1wiIGJvcmRlcj1cIjBcIiB3aWR0aD1cIjk3MFwiIGFsdD1cIlwiIGNsYXNzPVwiaW1nX2FkXCIgIC8%2BPC9hPjxzdHlsZT5kaXZ7bWFyZ2luOjA7cGFkZGluZzowO30uYWJnY3tkaXNwbGF5OmJsb2NrO2hlaWdodDoxNXB4O3Bvc2l0aW9uOmFic29sdXRlO3JpZ2h0OjE3cHg7dG9wOjFweDt0ZXh0LXJlbmRlcmluZzpnZW9tZXRyaWNQcmVjaXNpb247ei1pbmRleDoyMTQ3NDgzNjQ2O30uYWJnYntkaXNwbGF5OmlubGluZS1ibG9jaztoZWlnaHQ6MTVweDt9LmFiZ2MsLmphciAuYWJnYywuamFyIC5jYmJ7b3BhY2l0eToxO30uYWJnY3tjdXJzb3I6cG9pbnRlcjt9LmNiYntjdXJzb3I6cG9pbnRlcjtoZWlnaHQ6MTVweDt3aWR0aDoxNXB4O3otaW5kZXg6MjE0NzQ4MzY0NjtiYWNrZ3JvdW5kLWNvbG9yOiNmZmZmZmY7b3BhY2l0eTowO30uY2JiIHN2Z3twb3NpdGlvbjphYnNvbHV0ZTt0b3A6MDtyaWdodDowO2hlaWdodDoxNXB4O3dpZHRoOjE1cHg7c3Ryb2tlOiMwMGFlY2Q7c3Ryb2tlLXdpZHRoOjEuMjU7fS5jYmI6aG92ZXJ7Y3Vyc29yOnBvaW50ZXI7fS5jYmI6aG92ZXJ7YmFja2dyb3VuZC1jb2xvcjojNTg1ODVhO30uY2JiOmhvdmVyIHN2Z3tzdHJva2U6I2ZmZmZmZjt9LmFiZ2J7cG9zaXRpb246YWJzb2x1dGU7cmlnaHQ6MHB4O3RvcDowcHg7fS5jYmJ7cG9zaXRpb246YWJzb2x1dGU7cmlnaHQ6MXB4O3RvcDoxcHg7fS5hYmdze2Rpc3BsYXk6bm9uZTtoZWlnaHQ6MTAwJTt9Lm&i=6-11&t=adltag_kglayibe_5Q22w3z6xwK&r=d60ea5af3d75377ad658f061748d2ad&c=math-aids-threatpost&z=1
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/b-9a4f7ce-a7f6098c.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.85.32.34 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-85-32-34.ham50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

x-amz-version-id: D2POxJleIt92FyXaxSi7iRHuNLtujALh
via: 1.1 64cab3aa5eaf0c5f28d762c526424858.cloudfront.net (CloudFront)
etag: "d41d8cd98f00b204e9800998ecf8427e"
age: 40578
x-cache: Error from cloudfront
status: 200
content-length: 0
last-modified: Mon, 15 Jun 2020 18:35:10 GMT
server: AmazonS3
date: Thu, 22 Oct 2020 09:36:58 GMT
access-control-max-age: 3000
access-control-allow-methods: GET
content-type: text/plain
access-control-allow-origin: *
x-amz-cf-pop: HAM50-C1
accept-ranges: bytes
x-amz-cf-id: zB1qF-Pwb_1OjzrPaxl8BFPcKm1xT84E67Ag9BwZ9BcMEGw3aTJ8AQ==

POST
H2 200 tag
math-aids-threatpost-tagan.adlightning.com/ 0
426 B 38ms
35ms Other
text/plain 52.85.32.34
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://math-aids-threatpost-tagan.adlightning.com/tag?s=bl&d=FiZ2x7dGV4dC1kZWNvcmF0aW9uOm5vbmU7fS5hYmdzIHN2ZywuYWJnYiBzdmd7ZGlzcGxheTppbmxpbmUtYmxvY2s7aGVpZ2h0OjE1cHg7d2lkdGg6YXV0bzt2ZXJ0aWNhbC1hbGlnbjp0b3A7fS5hYmdjIC5pbC13cmFwe2JhY2tncm91bmQtY29sb3I6I2ZmZmZmZjtoZWlnaHQ6MTVweDt3aGl0ZS1zcGFjZTpub3dyYXA7fS5hYmdjIC5pbC13cmFwLmV4cHtib3JkZXItYm90dG9tLWxlZnQtcmFkaXVzOjVweDt9LmFiZ2MgLmlsLXRleHQsLmFiZ2MgLmlsLWljb257ZGlzcGxheTppbmxpbmUtYmxvY2s7fS5hYmdjIC5pbC10ZXh0e3BhZGRpbmctcmlnaHQ6MXB4O3BhZGRpbmctbGVmdDo1cHg7aGVpZ2h0OjE1cHg7d2lkdGg6NTVweDt9LmFiZ2MgLmlsLWljb257aGVpZ2h0OjE1cHg7d2lkdGg6MTVweDt9LmFiZ2MgLmlsLXRleHQgc3Zne2ZpbGw6IzAwMDAwMDt9LmFiZ2MgLmlsLWljb24gc3Zne2ZpbGw6IzAwYWVjZH08L3N0eWxlPjxkaXYgaWQ9XCJhYmdjXCIgY2xhc3M9XCJhYmdjXCIgZGlyPVwibHRyXCIgYXJpYS1oaWRkZW49XCJ0cnVlXCI%2BPGRpdiBpZD1cImFiZ2JcIiBjbGFzcz1cImFiZ2JcIj48ZGl2IGNsYXNzPVwiaWwtd3JhcFwiPjxkaXYgY2xhc3M9XCJpbC1pY29uXCI%2BPHN2ZyB4bWxucz1cImh0dHA6Ly93d3cudzMub3JnLzIwMDAvc3ZnXCIgeG1sbnM6eGxpbms9XCJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hsaW5rXCIgdmlld0JveD1cIjAgMCAxNSAxNVwiPjxjaXJjbGUgY3g9XCI2XCIgY3k9XCI2XCIgcj1cIjAuNjdcIj48L2NpcmNsZT48cGF0aCBkPVwiTTQuMiwxMS4zUTMuMywxMS44LDMuMywxMC43NUwzLjMsNC4xUTMuMywzLjEsNC4zLDMuNUwxMC40LDcuMFExMi4wLDcuNSwxMC40LDguMEw2LjY1LDEwLjBMNi42NSw3Ljc1YTAuNjUsMC42NSwwLDEsMCwtMS4zLDBMNS4zNSwxMC43NWEwLjksMC45LDAsMCwwLDEuMywwLjhMMTIuNyw4LjJRMTMuNyw3LjUsMTIuNyw2LjdMMy4zLDEuNlEyLjIsMS4zLDEuOCwyLjVMMS44LDEyLjVRMi4yLDEzLjksMy4zLDEzLjNMNC44LDEyLjVBMC4zLDAuMywwLDEsMCw0LjIsMTEuM1pcIj48L3BhdGg%2BPC9zdmc%2BPC9kaXY%2BPC9kaXY%2BPC9kaXY%2BPGRpdiBpZD1cImFiZ3NcIiBjbGFzcz1cImFiZ3NcIj48YSBpZD1cImFiZ2xcIiBjbGFzcz1cImFiZ2xcIiBocmVmPVwiaHR0cHM6Ly9hZHNzZXR0aW5ncy5nb29nbGUuY29tL3doeXRoaXNhZD9yZWFzb25zPUFCM2FmR0VBQUFXQVcxdGJXMjUxYkd3c1d6SXNNVEJkTEc1MWJHd3NiblZzYkN4MGNuVmxMRnNpTkRrM0lsMWRMRnR1ZFd4c0xDSm9kSFJ3Y3pvdkwyZHZiMmRzWldGa2N5NW5MbVJ2ZFdKc1pXTnNhV05yTG01bGRDOXdZV2RsWVdRdlkyOXVkbVZ5YzJsdmJpOF9ZV2s5UTNscFRURlBka2RTV0RscE1rMUpUMXBzVVdWWWNIRXpiMEpQVEUxd09VcG1iM05VWlhaeVVVMTRORXRxTlhCSlQwVkJSV2N3V1daVFNVZERVbWhLVDBaZlFtVm5RV0V6WTJsdlowUjVRVVZETkVGSlFYRkJUVUo1UVU5YVFrdHZSWEJuU2xBd1MwTlViMnBxVUZZdGVERnZaSFIxUjB4eFgyOWZlbk5tYmxCUmVUUlBjM3BLU0U5bE1uTkRkRmh6U1hVMlMxSktZbTUxWkdoeVVrOUZiRE5IUjJsWlIzZHlTMU42V1RKaWFsa3pjRXd5YUhaaGFFZDVkMlF3ZFZCQldsTnFVV3RETlZkQ1NqSjBXSGt3U2tSelpYVklkak5PYjBaUmVXTmtNSGc0TWpGMlQwdHJVbFUwTkZwb1dXSlZiSGxLU25oU1NHcG1TMHQ0UTIwM2NVUnJNME5uWXpoNk5HRmFMVmRUYlVGdlJqaFBXRkIyZDJGb1ZsRk5UVm96TFRCRFVqVlVMVVpTY2toRExVZHdUelEwWWpadWQxQm1SbW8xUWpKb2NsODFhVWxQVFVGMlQzRndRWEJ5Y25GbFNpMDNhVWxYTlhwRFJXbGtlSGR5ZDFGQk1uZHNSbmxKVTFGM2VHbzJUMnMxYVRoSE1IRndkbGg1U21KbVFXWldSMWhwYlc5VFNuTjJURWhtVURGR1JGWjVSRzFOVjJGelFYTkVaM1ZPT1dGZllrbFlPVkV5Ukc5SVJ5MWtRM1pOTFdGSU5uTXhiWEYyYm1JNVh6VlRNbkl6UWs5bGN6aFllREYyWWs5ZmJrbEVUbXRFWldzNWIzRkNXRWczV210dE1qWnFaWEYyVmpNNVFrRkVRVUpPVTJnMFkwZGFRUzFCUlVGaFFVZEJiMEZJTW05RVNHRTJaMGhxY3pSaWNVRm1WbmxTZFc5Q05WQlpSelpuU0hWbllXOUNYMFJhUnpablNEaDBhMkp4UVdaMWJISkZRM0ZCWlcxMmFIVnZRaTE2VmtjMlowZzRPVVZpY1VGbWN6RlNkVzlDTldKWlJ6Wm5TSGQwYjJJeVFXTkNNR2RuU2tOSlJHaG5SVUZSUVZKblpEaG5aMkpaVjFJMFRGaE9NVmx1VGpWaWFUQXpUV3BaZWs1VVkzcE9SRkV5VDBSQk1FMUVZelJ6VVc0eFNWVjFXbEJXUlc5RVNVRkxRVFZuVEVGaloweEJaR2RVUkVGY2RUQXdNalp6YVdkb1BVMWliRTVDY1RsZllXZFpYSFV3TURJMlkybGtQVU5CVVZOUWQwTk9TWEpNVFZGbFFuWnlZbUp4U2tWcFIzRkZRbXgwZWxaNU4yTlVZWGhrVGtWek0yeFpVRXBXWVVveGFsVndWMHd3YjNOU2FIazVabUpzT1RseFEyaE1Oa3RsY0ZGblFuRmxUR0o1Y0RoNE9FaE9aeUlzVzI1MWJHd3NiblZzYkN4dWRXeHNMQ0pvZEhSd2N6b3ZMMlJwYzNCc1lYbGhaSE10Wm05eWJXRjBjeTVuYjI5bmJHVjFjMlZ5WTI5dWRHVnVkQzVqYjIwdllXUnpMM0J5WlhacFpYY3ZZMjl1ZEdWdWRDNXFjejlqYkdsbGJuUTlkM1JoWEhVd01ESTJiMkptZFhOallYUmxaRU4xYzNSdmJXVnlTV1E5TXpJMU5qZzBOemt6TlZ4MU1EQXlObU55WldGMGFYWmxTV1E5TkRZME16QXlORFl6TWpZelhIVXdNREkyZG1WeWMybHZia2xrUFRCY2RUQXdNalpoWkVkeWIzVndRM0psWVhScGRtVkpaRDAwTWpZME1EY3dOell6T0RaY2RUQXdNalpvZEcxc1VHRnlaVzUwU1dROWNISmxkaTB3WEhVd01ESTJhR1ZwWjJoMFBUSTFNRngxTURBeU5uZHBaSFJvUFRrM01GeDFNREF5Tm5OcFp6MUJRMmxXUWw5Nk1saHZTVmQxV1VSNlkyeFNVV1J1VjFaR1pIaGxVMmhGZUVWUklsMHNiblZzYkN4dWRXeHNMREVzSWpaVlRVNWthRmhzYUhSQlNXOXpWR1YyY2xGTlJVcG1TV2x5VlhCSFRHVmhOVzF6YVVNeU5XeGtNazV2WVZkTmRWa3lPWFJOWjJOSlFsSk5XV3RVVFZWUmFHUnFXVk14ZDJSWFNYUlBWRmswVGxSamVrNUVVVEJPVkZFelRtcG5lRTVGWjFOWFFVcDNRVmxKUWtOeWVYSjNTMUE0WDE5ZlgxOTNSU0lzSWpFeE1URTNNVGMxT0RNeElsMWRYU3hiTVN3eExERmRYVkxCWmZabDFjUlExNUwwa0lXcjdzZHpMZlBjT0lMVFJ5X2xMRmh3VExnN3BHZVVvbHh0ODU1QTdfZEtSaWstWFVha3ZhZzRFaHZ5NlNmekxkcU5CLUdNMEgySmlVMGx2ZUEyVk9uYkl4ZVpyQWNOZmJ1Nmd1WUFwbTdQOU1ac2ZUXzh0YlNaT0d3Z1pHdDgybTBKdEtSVWVFWVJNU09HeG05SUtucVpUOEVRMDlEUWRuNGlOanlDN0c2ZkQ2cF94Wm1jdzV1MGdIalIxVm5VdG5aRnNQNHVSLVJTVWMyaHlTRURPWDh2dkxXNnFjek52S1VmTHA2dEZ3dVJVMUs5NHdjYlRuS0lwaFZIdm9NRUsyWEJXRzJsOXVkNUhwT1J3MlBIZEZyTzlGdV9OMUliWmlyVExuU1lxV29JcFVsTjd6UzU3RFlRZUJVSEtCSl9XcmZESEc4LDBma3ZSMkNxSHBOZzVhbHdfQldHc0EmYW1wO3NvdXJjZT1kaXNwbGF5XCIgdGFyZ2V0PVwiX2JsYW5rXCI%2BPGRpdiBjbGFzcz1cImlsLXdyYXAgZXhwXCI%2BPGRpdiBjbGFzcz1cImlsLXRleHRcIj48c3ZnIHhtbG5zPVwiaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmdcIiB4bWxuczp4bGluaz1cImh0dHA6Ly93d3cudzMub3JnLzE5OTkveGxpbmtcIiB2aWV3Qm94PVwiMCAwIDU5IDE2XCI%2BPHBhdGggZD1cIk00LjUxIDQuMjRMOC4wMiAxMi44M0w2LjczIDEyLjgzTDUuNzIgMTAuMjFMMi4xNCAxMC4yMUwxLjE5IDEyLjgzTC0wLjAxIDEyLjgzTDMuMjkgNC4yNEw0LjUxIDQuMjRaTTIuNDYgOS4zMUw1LjM4IDkuMzFMNS4zOCA5LjMxUTQuMzIgNi41MiA0LjE5IDYuMTRMNC4xOSA2LjE0TDQuMTkgNi4xNFE0LjA1IDUuNzcgMy44OSA1LjEzTDMuODkgNS4xM0wzLjg2IDUuMTNMMy44NiA1LjEzUTMuNzAgNiAzLjQyIDYuNzRMMy40MiA2Ljc0TDIuNDYgOS4zMVpNMTMuODMgNC4yNEwxMy44MyAxMi44M0wxMi44NSAxMi44M0wxMi44NSAxMi4wNEwxMi44MyAxMi4wNEwxMi44MyAxMi4wNFExMi4yNiAxMi45NyAxMS4xMSAxMi45N0wxMS4xMSAxMi45N0wxMS4xMSAxMi45N1E5Ljk3IDEyLjk3IDkuMjAgMTIuMDdMOS4yMCAxMi4wN0w5LjIwIDEyLjA3UTguNDQgMTEuMTYgOC40NCA5LjcyTDguNDQgOS43Mkw4LjQ0IDkuNzJROC40NCA4LjIxIDkuMTYgNy4zNEw5LjE2IDcuMzRMOS4xNiA3LjM0UTkuODggNi40NyAxMS4wNiA2LjQ3TDExLjA2IDYuNDdMMTEuMDYgNi40N1ExMi4xOCA2LjQ3IDEyLjc2IDcuMzJMMTIuNzYgNy4zMkwxMi43OCA3LjMyTDEyLjc4IDQuMjRMMTMuODMgNC4yNFpNMTEuMjIgMTIuMTFMMTEuMjIgMTIuMTFMMTEuMjIgMTIuMTFRMTEuOTEgMTIuMTEgMTIuMzkgMTEuNTRMMTIuMzkgMTEuNTRMMTIuMzkgMTEuNTRRMTIuODcgMTAuOTcgMTIuODcgOS44MUwxMi44NyA5LjgxTDEyLjg3IDkuODFRMTIuODcgOC42OCAxMi40MyA4LjAwTDEyLjQzIDguMDBMMTIuNDMgOC4wMFExMS45OSA3LjMzIDExLjE3IDcuMzNMMTEuMTcgNy4zM0wxMS4xNyA3LjMzUTEwLjM1IDcuMzMgOS45MyA3Ljk5TDkuOTMgNy45OUw5LjkzIDcuOTlROS41MiA4LjY1IDkuNTIgOS43Mkw5LjUyIDkuNzJMOS41MiA5LjcyUTkuNTIgMTAuNDkgOS43NCAxMS4wM0w5Ljc0IDExLjAzTDkuNzQgMTEuMDNROS45NyAxMS41NyAxMC4zNyAxMS44NEwxMC4zNyAxMS44NEwxMC4zNyAxMS44NFExMC43OCAxMi4xMSAxMS4yMiAxMi4xMVpNMjEuNzQgOS44MUwyMi44OCAxMC4xMEwyMi44OCAxMC4xMFEyMi41MCAxMS41NSAyMS41NyAxMi4yNkwyMS41NyAxMi4yNkwyMS41NyAxMi4yNlEyMC42MyAxMi45NyAxOS4zMiAxMi45N0wxOS4zMiAxMi45N0wxOS4zMiAxMi45N1ExNy4yMSAxMi45NyAxNi4yNSAxMS42NUwxNi4yNSAxMS42NUwxNi4yNSAxMS42NVExNS4yOSAxMC4zMyAxNS4yOSA4LjQ3TDE1LjI5IDguNDdMMTUuMjkgOC40N1ExNS4yOSA2LjQyIDE2LjQyIDUuMjVMMTYuNDIgNS4yNUwxNi40MiA1LjI1UTE3LjU1IDQuMDkgMTkuMzQgNC4wOUwxOS4zNCA0LjA5TDE5LjM0IDQuMDlRMjAuNTkgNC4wOSAyMS40OCA0LjczTDIxLjQ4IDQuNzNMMjEuNDggNC43M1EyMi4zNyA1LjM3IDIyLjczIDYuNjBMMjIuNzMgNi42MEwyMS42MiA2Ljg2TDIxLjYyIDYuODZRMjEuMzMgNS45NiAyMC43NiA1LjUxTDIwLjc2IDUuNTFMMjAuNzYgNS41MVEyMC4xOSA1LjA2IDE5LjMyIDUuMDZMMTkuMzIgNS4wNkwxOS4zMiA1LjA2UTE3LjkyIDUuMDYgMTcuMTkgNS45OUwxNy4xOSA1Ljk5TDE3LjE5IDUuOTlRMTYuNDYgNi45MSAxNi40NiA4LjQ2TDE2LjQ2IDguNDZMMTYuNDYgOC40NlExNi40NiAxMC4yNSAxNy4yMyAxMS4xM0wxNy4yMyAxMS4xM0wxNy4yMyAxMS4xM1ExNy45OSAxMiAxOS4yMiAxMkwxOS4yMiAxMkwxOS4yMiAxMlEyMC4yMyAxMiAyMC44NiAxMS40NkwyMC44NiAxMS40NkwyMC44NiAxMS40NlEyMS40OSAxMC45MSAyMS43NCA5LjgxTDIxLjc0IDkuODFaTTI5LjIzIDguODlMMjkuMjMgMTIuODNMMjguMTcgMTIuODNMMjguMTcgOC45MEwyOC4xNyA4LjkwUTI4LjE3IDguMTQgMjcuODQgNy43NkwyNy44NCA3Ljc2TDI3Ljg0IDcuNzZRMjcuNTEgNy4zOCAyNi44NiA3LjM4TDI2Ljg2IDcuMzhMMjYuODYgNy4zOFEyNi4yMSA3LjM4IDI1LjcxIDcuODNMMjUuNzEgNy44M0wyNS43MSA3LjgzUTI1LjIwIDguMjcgMjUuMjAgOS40M0wyNS4yMCA5LjQzTDI1LjIwIDEyLjgzTDI0LjE1IDEyLjgzTDI0LjE1IDQuMjRMMjUuMjAgNC4yNEwyNS4yMCA3LjMyTDI1LjIwIDcuMzJRMjUuOTUgNi40NyAyNy4wOCA2LjQ3TDI3LjA4IDYuNDdMMjcuMDggNi40N1EyNy42OCA2LjQ3IDI4LjIzIDYuNzFMMjguMjMgNi43MUwyOC4yMyA2LjcxUTI4Ljc4IDYuOTYgMjkuMDAgNy40N0wyOS4wMCA3LjQ3TDI5LjAwIDcuNDdRMjkuMjMgNy45OCAyOS4yMyA4Ljg5TDI5LjIzIDguODlaTTMzLjM1IDYuNDdMMzMuMzUgNi40N0wzMy4zNSA2LjQ3UTM0LjYxIDYuNDcgMzUuNDQgNy4yOUwzNS40NCA3LjI5TDM1LjQ0IDcuMjlRMzYuMjcgOC4xMSAzNi4yNy&i=7-11&t=adltag_kglayibe_5Q22w3z6xwK&r=d60ea5af3d75377ad658f061748d2ad&c=math-aids-threatpost&z=1
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/b-9a4f7ce-a7f6098c.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.85.32.34 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-85-32-34.ham50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

x-amz-version-id: D2POxJleIt92FyXaxSi7iRHuNLtujALh
via: 1.1 64cab3aa5eaf0c5f28d762c526424858.cloudfront.net (CloudFront)
etag: "d41d8cd98f00b204e9800998ecf8427e"
age: 40578
x-cache: Error from cloudfront
status: 200
content-length: 0
last-modified: Mon, 15 Jun 2020 18:35:10 GMT
server: AmazonS3
date: Thu, 22 Oct 2020 09:36:58 GMT
access-control-max-age: 3000
access-control-allow-methods: GET
content-type: text/plain
access-control-allow-origin: *
x-amz-cf-pop: HAM50-C1
accept-ranges: bytes
x-amz-cf-id: DodWuwLFQtZsz1wf0Ihn4kbL1DKnqf2w0c494BLaOf77URrlokIRhg==

POST
H2 200 tag
math-aids-threatpost-tagan.adlightning.com/ 0
426 B 40ms
37ms Other
text/plain 52.85.32.34
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://math-aids-threatpost-tagan.adlightning.com/tag?s=bl&d=A5LjYyTDM2LjI3IDkuNjJMMzYuMjcgOS42MlEzNi4yNyAxMS40NiAzNS4zNyAxMi4yMUwzNS4zNyAxMi4yMUwzNS4zNyAxMi4yMVEzNC40OCAxMi45NyAzMy4zNSAxMi45N0wzMy4zNSAxMi45N0wzMy4zNSAxMi45N1EzMi4xNyAxMi45NyAzMS4zMSAxMi4xOUwzMS4zMSAxMi4xOUwzMS4zMSAxMi4xOVEzMC40NCAxMS40MSAzMC40NCA5LjcyTDMwLjQ0IDkuNzJMMzAuNDQgOS43MlEzMC40NCA4LjA4IDMxLjI4IDcuMjdMMzEuMjggNy4yN0wzMS4yOCA3LjI3UTMyLjEyIDYuNDcgMzMuMzUgNi40N1pNMzMuMzUgMTIuMTFMMzMuMzUgMTIuMTFMMzMuMzUgMTIuMTFRMzQuMjUgMTIuMTEgMzQuNzIgMTEuNDRMMzQuNzIgMTEuNDRMMzQuNzIgMTEuNDRRMzUuMTkgMTAuNzcgMzUuMTkgOS42OEwzNS4xOSA5LjY4TDM1LjE5IDkuNjhRMzUuMTkgOC41MSAzNC42NiA3LjkyTDM0LjY2IDcuOTJMMzQuNjYgNy45MlEzNC4xMyA3LjMzIDMzLjM1IDcuMzNMMzMuMzUgNy4zM0wzMy4zNSA3LjMzUTMyLjU1IDcuMzMgMzIuMDMgNy45M0wzMi4wMyA3LjkzTDMyLjAzIDcuOTNRMzEuNTIgOC41MyAzMS41MiA5LjcyTDMxLjUyIDkuNzJMMzEuNTIgOS43MlEzMS41MiAxMC45MCAzMi4wNCAxMS41MEwzMi4wNCAxMS41MEwzMi4wNCAxMS41MFEzMi41NyAxMi4xMSAzMy4zNSAxMi4xMVpNMzguNTUgNi42MUwzOC41NSAxMi44M0wzNy40OSAxMi44M0wzNy40OSA2LjYxTDM4LjU1IDYuNjFaTTM4LjU1IDQuMjRMMzguNTUgNS40M0wzNy40OSA1LjQzTDM3LjQ5IDQuMjRMMzguNTUgNC4yNFpNNDQuMjAgMTAuNTVMNDUuMjUgMTAuNjhMNDUuMjUgMTAuNjhRNDUuMDUgMTEuODcgNDQuMzEgMTIuNDJMNDQuMzEgMTIuNDJMNDQuMzEgMTIuNDJRNDMuNTggMTIuOTcgNDIuNjYgMTIuOTdMNDIuNjYgMTIuOTdMNDIuNjYgMTIuOTdRNDEuMzAgMTIuOTcgNDAuNTYgMTIuMDhMNDAuNTYgMTIuMDhMNDAuNTYgMTIuMDhRMzkuODMgMTEuMjAgMzkuODMgOS43M0wzOS44MyA5LjczTDM5LjgzIDkuNzNRMzkuODMgOC41MiA0MC4yNSA3Ljc5TDQwLjI1IDcuNzlMNDAuMjUgNy43OVE0MC42OCA3LjA2IDQxLjMxIDYuNzZMNDEuMzEgNi43Nkw0MS4zMSA2Ljc2UTQxLjk1IDYuNDcgNDIuNjYgNi40N0w0Mi42NiA2LjQ3TDQyLjY2IDYuNDdRNDMuNjIgNi40NyA0NC4zMCA2Ljk3TDQ0LjMwIDYuOTdMNDQuMzAgNi45N1E0NC45OCA3LjQ2IDQ1LjE0IDguNDNMNDUuMTQgOC40M0w0NC4xMiA4LjU5TDQ0LjEyIDguNTlRNDMuOTYgNy45NiA0My42MSA3LjY1TDQzLjYxIDcuNjVMNDMuNjEgNy42NVE0My4yNSA3LjMzIDQyLjcwIDcuMzNMNDIuNzAgNy4zM0w0Mi43MCA3LjMzUTQxLjgyIDcuMzMgNDEuMzYgNy45Nkw0MS4zNiA3Ljk2TDQxLjM2IDcuOTZRNDAuOTAgOC41OCA0MC45MCA5LjcxTDQwLjkwIDkuNzFMNDAuOTAgOS43MVE0MC45MCAxMC44NiA0MS4zNSAxMS40OEw0MS4zNSAxMS40OEw0MS4zNSAxMS40OFE0MS44MCAxMi4xMSA0Mi42NCAxMi4xMUw0Mi42NCAxMi4xMUw0Mi42NCAxMi4xMVE0My4zMiAxMi4xMSA0My43MSAxMS43Mkw0My43MSAxMS43Mkw0My43MSAxMS43MlE0NC4xMCAxMS4zMyA0NC4yMCAxMC41NUw0NC4yMCAxMC41NVpNNTEuNTYgOS45OEw1MS41NiA5Ljk4TDQ2LjkwIDkuOThMNDYuOTAgOS45OFE0Ni45NyAxMS4wMiA0Ny40OSAxMS41Nkw0Ny40OSAxMS41Nkw0Ny40OSAxMS41NlE0OC4wMiAxMi4xMSA0OC44MCAxMi4xMUw0OC44MCAxMi4xMUw0OC44MCAxMi4xMVE0OS40MSAxMi4xMSA0OS44MiAxMS43OUw0OS44MiAxMS43OUw0OS44MiAxMS43OVE1MC4yMyAxMS40NyA1MC40NCAxMC44Mkw1MC40NCAxMC44Mkw1MS41MyAxMC45Nkw1MS41MyAxMC45NlE1MS4yNiAxMS45MyA1MC41NiAxMi40NUw1MC41NiAxMi40NUw1MC41NiAxMi40NVE0OS44NiAxMi45NyA0OC44MCAxMi45N0w0OC44MCAxMi45N0w0OC44MCAxMi45N1E0Ny40MCAxMi45NyA0Ni42MSAxMi4xMUw0Ni42MSAxMi4xMUw0Ni42MSAxMi4xMVE0NS44MyAxMS4yNiA0NS44MyA5Ljc3TDQ1LjgzIDkuNzdMNDUuODMgOS43N1E0NS44MyA4LjMwIDQ2LjU5IDcuMzhMNDYuNTkgNy4zOEw0Ni41OSA3LjM4UTQ3LjM2IDYuNDcgNDguNzQgNi40N0w0OC43NCA2LjQ3TDQ4Ljc0IDYuNDdRNDkuNDIgNi40NyA1MC4wNSA2Ljc3TDUwLjA1IDYuNzdMNTAuMDUgNi43N1E1MC42OCA3LjA3IDUxLjEyIDcuNzhMNTEuMTIgNy43OEw1MS4xMiA3Ljc4UTUxLjU2IDguNTAgNTEuNTYgOS45OFpNNDYuOTYgOS4xMkw1MC40OCA5LjEyTDUwLjQ4IDkuMTJRNTAuNDEgOC4xNyA0OS44OSA3Ljc1TDQ5Ljg5IDcuNzVMNDkuODkgNy43NVE0OS4zNyA3LjMzIDQ4Ljc0IDcuMzNMNDguNzQgNy4zM0w0OC43NCA3LjMzUTQ4IDcuMzMgNDcuNTIgNy44M0w0Ny41MiA3LjgzTDQ3LjUyIDcuODNRNDcuMDQgOC4zMyA0Ni45NiA5LjEyTDQ2Ljk2IDkuMTJaTTU3LjMzIDguMjFMNTYuMzAgOC4zNUw1Ni4zMCA4LjM1UTU2LjIzIDcuODQgNTUuODkgNy41OEw1NS44OSA3LjU4TDU1Ljg5IDcuNThRNTUuNTUgNy4zMyA1NC45NCA3LjMzTDU0Ljk0IDcuMzNMNTQuOTQgNy4zM1E1NC4zMyA3LjMzIDUzLjk2IDcuNTRMNTMuOTYgNy41NEw1My45NiA3LjU0UTUzLjU5IDcuNzQgNTMuNTkgOC4xM0w1My41OSA4LjEzTDUzLjU5IDguMTNRNTMuNTkgOC41MCA1My44OSA4LjY2TDUzLjg5IDguNjZMNTMuODkgOC42NlE1NC4xOCA4LjgyIDU1LjA1IDkuMDVMNTUuMDUgOS4wNUw1NS4wNSA5LjA1UTU2LjA0IDkuMzAgNTYuNTMgOS40OUw1Ni41MyA5LjQ5TDU2LjUzIDkuNDlRNTcuMDIgOS42OSA1Ny4yOSAxMC4wM0w1Ny4yOSAxMC4wM0w1Ny4yOSAxMC4wM1E1Ny41NiAxMC4zOCA1Ny41NiAxMS4wMEw1Ny41NiAxMS4wMEw1Ny41NiAxMS4wMFE1Ny41NiAxMS44NCA1Ni44OCAxMi40MEw1Ni44OCAxMi40MEw1Ni44OCAxMi40MFE1Ni4yMCAxMi45NyA1NS4wNyAxMi45N0w1NS4wNyAxMi45N0w1NS4wNyAxMi45N1E1My44OCAxMi45NyA1My4yMiAxMi40N0w1My4yMiAxMi40N0w1My4yMiAxMi40N1E1Mi41NSAxMS45NyA1Mi40MCAxMC45N0w1Mi40MCAxMC45N0w1My40NSAxMC44MUw1My40NSAxMC44MVE1My41MyAxMS40NiA1My45MyAxMS43OEw1My45MyAxMS43OEw1My45MyAxMS43OFE1NC4zMyAxMi4xMSA1NS4wNSAxMi4xMUw1NS4wNSAxMi4xMUw1NS4wNSAxMi4xMVE1NS43NSAxMi4xMSA1Ni4xMiAxMS44Mkw1Ni4xMiAxMS44Mkw1Ni4xMiAxMS44MlE1Ni40OCAxMS41MyA1Ni40OCAxMS4xMUw1Ni40OCAxMS4xMUw1Ni40OCAxMS4xMVE1Ni40OCAxMC44MyA1Ni4zMSAxMC42Nkw1Ni4zMSAxMC42Nkw1Ni4zMSAxMC42NlE1Ni4xNCAxMC40OSA1NS44OSAxMC40MEw1NS44OSAxMC40MEw1NS44OSAxMC40MFE1NS42MyAxMC4zMiA1NC43NCAxMC4xMEw1NC43NCAxMC4xMEw1NC43NCAxMC4xMFE1My40MiA5Ljc5IDUzLjAwIDkuMzNMNTMuMDAgOS4zM0w1My4wMCA5LjMzUTUyLjU3IDguODggNTIuNTcgOC4yNkw1Mi41NyA4LjI2TDUyLjU3IDguMjZRNTIuNTcgNy40OCA1My4xOSA2Ljk3TDUzLjE5IDYuOTdMNTMuMTkgNi45N1E1My44MSA2LjQ3IDU0Ljg2IDYuNDdMNTQuODYgNi40N0w1NC44NiA2LjQ3UTU1Ljk3IDYuNDcgNTYuNTkgNi45MUw1Ni41OSA2LjkxTDU2LjU5IDYuOTFRNTcuMjEgNy4zNCA1Ny4zMyA4LjIxTDU3LjMzIDguMjFaXCIvPjwvc3ZnPjwvZGl2PjxkaXYgY2xhc3M9XCJpbC1pY29uXCI%2BPHN2ZyB4bWxucz1cImh0dHA6Ly93d3cudzMub3JnLzIwMDAvc3ZnXCIgeG1sbnM6eGxpbms9XCJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hsaW5rXCIgdmlld0JveD1cIjAgMCAxNSAxNVwiPjxjaXJjbGUgY3g9XCI2XCIgY3k9XCI2XCIgcj1cIjAuNjdcIj48L2NpcmNsZT48cGF0aCBkPVwiTTQuMiwxMS4zUTMuMywxMS44LDMuMywxMC43NUwzLjMsNC4xUTMuMywzLjEsNC4zLDMuNUwxMC40LDcuMFExMi4wLDcuNSwxMC40LDguMEw2LjY1LDEwLjBMNi42NSw3Ljc1YTAuNjUsMC42NSwwLDEsMCwtMS4zLDBMNS4zNSwxMC43NWEwLjksMC45LDAsMCwwLDEuMywwLjhMMTIuNyw4LjJRMTMuNyw3LjUsMTIuNyw2LjdMMy4zLDEuNlEyLjIsMS4zLDEuOCwyLjVMMS44LDEyLjVRMi4yLDEzLjksMy4zLDEzLjNMNC44LDEyLjVBMC4zLDAuMywwLDEsMCw0LjIsMTEuM1pcIj48L3BhdGg%2BPC9zdmc%2BPC9kaXY%2BPC9kaXY%2BPC9hPjwvZGl2PjwvZGl2PjxkaXYgaWQ9XCJjYmJcIiBjbGFzcz1cImNiYlwiIGFyaWEtaGlkZGVuPVwidHJ1ZVwiPjxzdmcgeG1sbnM9XCJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2Z1wiIHhtbG5zOnhsaW5rPVwiaHR0cDovL3d3dy53My5vcmcvMTk5OS94bGlua1wiIHZpZXdCb3g9XCIwIDAgMTUgMTVcIj48cGF0aCBkPVwiTTMuMjUsMy4yNWw4LjUsOC41TTExLjc1LDMuMjVsLTguNSw4LjVcIi8%2BPC9zdmc%2BPC9kaXY%2BPHN0eWxlPi5tdXRlX3BhbmVse3otaW5kZXg6MjE0NzQ4MzY0Njt9LmFiZ2Fje3Bvc2l0aW9uOmFic29sdXRlO2xlZnQ6MHB4O3RvcDowcHg7ei1pbmRleDoyMTQ3NDgzNjQ2O2Rpc3BsYXk6bm9uZTt3aWR0aDoxMDAlO2hlaWdodDoxMDAlO2JhY2tncm91bmQtY29sb3I6I0ZBRkFGQTt9Lm1sc2N7aGVpZ2h0OjEwMCU7ZGlzcGxheTpmbGV4O2p1c3RpZnktY29udGVudDpjZW50ZXI7YWxpZ24taXRlbXM6Y2VudGVyO30ubWxze2FuaW1hdGlvbjptbHNrZiAycyBsaW5lYXIgaW5maW5pdGU7aGVpZ2h0OjUwJTt3aWR0aDo1MCU7fS5tbHNke3N0cm9rZS1kYXNoYXJyYXk6MSwxODk7c3Ryb2tlLWRhc2hvZmZzZXQ6MDthbmltYXRpb246bWxzZGtmIDEuNHMgZWFzZS1pbi1vdXQgaW5maW5pdGU7fUBrZXlmcmFtZXMgbWxza2Z7MTAwJXt0cmFuc2Zvcm06cm90YXRlKDM2MGRlZyk7fX1Aa2V5ZnJhbWVzIG1sc2RrZnswJXtzdHJva2UtZGFzaGFycmF5OjEsMTg5O3N0cm9rZS1kYXNob2Zmc2V0OjA7fTUwJXtzdHJva2UtZGFzaGFycmF5OjEzNCwxODk7c3Ryb2tlLWRhc2hvZmZzZXQ6LTUzcHg7fTEwMCV7c3Ryb2tlLWRhc2hhcnJheToxMzQsMTg5O3N0cm9rZS1kYXNob2Zmc2V0Oi0xODhweDt9fTwvc3R5bGU%2BPGRpdiBpZD1cIm11dGVfcGFuZWxcIiBjbGFzcz1cIm11dGVfcGFuZWxcIiBhcmlhLWhpZGRlbj1cInRydWVcIj48ZGl2IGlkPVwiYWJnYWNcIiBjbGFzcz1cImFiZ2FjXCIgYXJpYS1oaWRkZW49XCJ0cnVlXCI%2BPGRpdiBpZD1cIm1sc2NcIiBjbGFzcz1cIm1sc2NcIj48c3ZnIGNsYXNzPVwibWxzXCIgdmlld0JveD1cIjUwIDUwIDEwMCAxMDBcIj48Y2lyY2xlIGNsYXNzPVwibWxzZFwiIGN4PVwiMTAwXCIgY3k9XCIxMDBcIiByPVwiMzBcIiBmaWxsPVwibm9uZVwiIHN0cm9rZT1cIiM5RTlFOUVcIiBzdHJva2Utd2lkdGg9XCIzXCIvPjwvc3ZnPjwvZGl2PjwvZGl2PjwvZGl2PjxzY3JpcHQgZGF0YS1qYz1cIjYwXCIgc3JjPVwiaHR0cHM6Ly90cGMuZ29vZ2xlc3luZGljYXRpb24uY29tL3BhZ2VhZC9qcy9yMjAyMDEwMjAvcjIwMTEwOTE0L2FiZ19saXRlX2Z5MjAxOS5qc1wiIGRhdGEtamMtdmVyc2lvbj1cInIyMDIwMTAyMFwiPjwvc2NyaXB0PjxzY3JpcHQ%2BYnVpbGRBdHRyaWJ1dGlvbihbW251bGwsXCJodHRwczovL2dvb2dsZWFkcy5nLmRvdWJsZWNsaWNrLm5ldC9wYWdlYWQvaW1hZ2VzL210YWQveF9ibHVlLnBuZ1wiLG51bGwsXCJodHRwczovL2dvb2dsZWFkcy5nLmRvdWJsZWNsaWNrLm5ldC9wYWdlYWQvaW1hZ2VzL210YWQveF9ibHVlLnBuZ1wiLFwiaHR0cHM6Ly9nb29nbGVhZHMuZy5kb3VibGVjbGljay5uZXQvcGFnZWFkL2NvbnZlcnNpb24vP2FpPUN5aU0xT3ZHUlg5aTJNSU9abFFlWHBxM29CT0xNcDlKZm9zVGV2clFNeDRLajVwSU9FQUVnMFlmU0lHQ1JoSk9GX0JlZ0FhM2Npb2dEeUFFQzRBSUFxQU1CeUFPWkJLb0VwZ0pQMEtDVG9qalBWLXgxb2R0dUdMcV9vX3pzZm5QUXk0T3N6SkhPZTJzQ3RYc0l1NktSSmJudWRoclJPRWwzR0dpWUd3cktTelkyYmpZM3BMMmh2YWhHeXdkMHVQQVpTalFrQzVXQkoydFh5MEpEc2V1SHYzTm9GUXljZDB4ODIxdk9La1JVNDRaaFliVWx5Skp4UkhqZktLeENt&i=8-11&t=adltag_kglayibe_5Q22w3z6xwK&r=d60ea5af3d75377ad658f061748d2ad&c=math-aids-threatpost&z=1
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/b-9a4f7ce-a7f6098c.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.85.32.34 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-85-32-34.ham50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

x-amz-version-id: D2POxJleIt92FyXaxSi7iRHuNLtujALh
via: 1.1 64cab3aa5eaf0c5f28d762c526424858.cloudfront.net (CloudFront)
etag: "d41d8cd98f00b204e9800998ecf8427e"
age: 40578
x-cache: Error from cloudfront
status: 200
content-length: 0
last-modified: Mon, 15 Jun 2020 18:35:10 GMT
server: AmazonS3
date: Thu, 22 Oct 2020 09:36:58 GMT
access-control-max-age: 3000
access-control-allow-methods: GET
content-type: text/plain
access-control-allow-origin: *
x-amz-cf-pop: HAM50-C1
accept-ranges: bytes
x-amz-cf-id: -nXTinEst5jioKBczI0GtVg8cbAxP5wj7SbGIn1BoK5bcRlOfHh6Cw==

POST
H2 200 tag
math-aids-threatpost-tagan.adlightning.com/ 0
427 B 41ms
38ms Other
text/plain 52.85.32.34
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://math-aids-threatpost-tagan.adlightning.com/tag?s=bl&d=N3FEazNDZ2M4ejRhWi1XU21Bb0Y4T1hQdndhaFZRTU1aMy0wQ1I1VC1GUnJIQy1HcE80NGI2bndQZkZqNUIyaHJfNWlJT01Bdk9xcEFwcnJxZUotN2lJVzV6Q0VpZHh3cndRQTJ3bEZ5SVNRd3hqNk9rNWk4RzBxcHZYeUpiZkFmVkdYaW1vU0pzdkxIZlAxRkRWeURtTVdhc0FzRGd1TjlhX2JJWDlRMkRvSEctZEN2TS1hSDZzMW1xdm5iOV81UzJyM0JPZXM4WHgxdmJPX25JRE5rRGVrOW9xQlhIN1prbTI2amVxdlYzOUJBREFCTlNoNGNHWkEtQUVBYUFHQW9BSDJvREhhNmdIanM0YnFBZlZ5UnVvQjVQWUc2Z0h1Z2FvQl9EWkc2Z0g4dGticUFmdWxyRUNxQWVtdmh1b0ItelZHNmdIODlFYnFBZnMxUnVvQjViWUc2Z0h3dG9iMkFjQjBnZ0pDSURoZ0VBUUFSZ2Q4Z2diWVdSNExYTjFZbk41YmkwM01qWXpOVGN6TkRRMk9EQTBNRGM0c1FuMUlVdVpQVkVvRElBS0E1Z0xBY2dMQWRnVERBXFx1MDAyNnNpZ2g9TWJsTkJxOV9hZ1lcXHUwMDI2Y2lkPUNBUVNQd0NOSXJMTVFlQnZyYmJxSkVpR3FFQmx0elZ5N2NUYXhkTkVzM2xZUEpWYUoxalVwV0wwb3NSaHk5ZmJsOTlxQ2hMNktlcFFnQnFlTGJ5cDh4OEhOZ1wiLFwiNlVNTmRoWGxodEFJb3NUZXZyUU1FSmZJaXJVcEdMZWE1bXNpQzI1bGQyTm9hV011WTI5dE1nY0lCUk1Za1RNVVFoZGpZUzF3ZFdJdE9UWTROVGN6TkRRME5UUTNOamd4TkVnU1dBSndBWUlCQ3J5cndLUDhfX19fX3dFXCIsW1widXNlcl9mZWVkYmFja19tZW51X2ludGVyYWN0aW9uXCIsXCJcIiwwXSxudWxsLG51bGwsbnVsbCxudWxsLFwiV2hhdCB3YXMgd3Jvbmcgd2l0aCB0aGlzIGFkP1wiLG51bGwsXCJodHRwczovL2dvb2dsZWFkcy5nLmRvdWJsZWNsaWNrLm5ldC9wYWdlYWQvaW1hZ2VzL210YWQvYmFja19ibHVlLnBuZ1wiLFwiVGhhbmtzIGZvciB0aGUgZmVlZGJhY2shXCIsXCJXZeKAmWxsIHJldmlldyB0aGlzIGFkIHRvIGltcHJvdmUgdGhlIGV4cGVyaWVuY2UgaW4gdGhlIGZ1dHVyZS5cIixcIlRoYW5rcyBmb3IgdGhlIGZlZWRiYWNrIVwiLFwiV2XigJlsbCB1c2UgeW91ciBmZWVkYmFjayB0byByZXZpZXcgYWRzIG9uIHRoaXMgc2l0ZS5cIixcIkNBQVNQZVJvbGNNWXY5T2VwQmlHeFdSQ3UwejFmZ2dLSEZoNnkxUzc0SmhQSG1GU2p2Z2JhV3ltUjdSTG9qSFlJT21GNXdDSC1OODZ0MzBueXB0UUd0c1wiLG51bGwsbnVsbCxcIkNsb3NpbmcgYWQ6ICUxJGRcIixcIkFkQ2hvaWNlc1wiLFwiaHR0cHM6Ly9nb29nbGVhZHMuZy5kb3VibGVjbGljay5uZXQvcGFnZWFkL2ltYWdlcy9tdGFkL2FkX2Nob2ljZXNfYmx1ZS5wbmdcIixcImh0dHBzOi8vd3d3Lmdvb2dsZS5jb20vdXJsP2N0PWFiZ1xcdTAwMjZxPWh0dHBzOi8vd3d3Lmdvb2dsZS5jb20vYWRzZW5zZS9zdXBwb3J0L2Jpbi9yZXF1ZXN0LnB5JTNGY29udGFjdCUzRGFiZ19hZmMlMjZ1cmwlM0RodHRwczovL3RocmVhdHBvc3QuY29tL3NobGF5ZXItbWFjLW1hbHdhcmUtZXh0cmEtc25lYWtpbmVzcy8xNTY2NjkvJTI1M0Z3ZWJfdmlldyUyNTNEdHJ1ZSUyNmdsJTNETkwlMjZobCUzRGVuJTI2Y2xpZW50JTNEY2EtcHViLTk2ODU3MzQ0NDU0NzY4MTQlMjZhaTAlM0RDeWlNMU92R1JYOWkyTUlPWmxRZVhwcTNvQk9MTXA5SmZvc1RldnJRTXg0S2o1cElPRUFFZzBZZlNJR0NSaEpPRl9CZWdBYTNjaW9nRHlBRUM0QUlBcUFNQnlBT1pCS29FcGdKUDBLQ1RvampQVi14MW9kdHVHTHFfb196c2ZuUFF5NE9zekpIT2Uyc0N0WHNJdTZLUkpibnVkaHJST0VsM0dHaVlHd3JLU3pZMmJqWTNwTDJodmFoR3l3ZDB1UEFaU2pRa0M1V0JKMnRYeTBKRHNldUh2M05vRlF5Y2QweDgyMXZPS2tSVTQ0WmhZYlVseUpKeFJIamZLS3hDbTdxRGszQ2djOHo0YVotV1NtQW9GOE9YUHZ3YWhWUU1NWjMtMENSNVQtRlJySEMtR3BPNDRiNm53UGZGajVCMmhyXzVpSU9NQXZPcXBBcHJycWVKLTdpSVc1ekNFaWR4d3J3UUEyd2xGeUlTUXd4ajZPazVpOEcwcXB2WHlKYmZBZlZHWGltb1NKc3ZMSGZQMUZEVnlEbU1XYXNBc0RndU45YV9iSVg5UTJEb0hHLWRDdk0tYUg2czFtcXZuYjlfNVMycjNCT2VzOFh4MXZiT19uSUROa0RlazlvcUJYSDdaa20yNmplcXZWMzlCQURBQk5TaDRjR1pBLUFFQWFBR0FvQUgyb0RIYTZnSGpzNGJxQWZWeVJ1b0I1UFlHNmdIdWdhb0JfRFpHNmdIOHRrYnFBZnVsckVDcUFlbXZodW9CLXpWRzZnSDg5RWJxQWZzMVJ1b0I1YllHNmdId3RvYjJBY0IwZ2dKQ0lEaGdFQVFBUmdkOGdnYllXUjRMWE4xWW5ONWJpMDNNall6TlRjek5EUTJPREEwTURjNHNRbjFJVXVaUFZFb0RJQUtBNWdMQWNnTEFkZ1REQVxcdTAwMjZ1c2c9QUZRakNOSC16d05nTVlsUUtKQnYyelVwMG1xSUctUTl1UVwiLFwiaHR0cHM6Ly9nb29nbGVhZHMuZy5kb3VibGVjbGljay5uZXQvcGFnZWFkL2ltYWdlcy9tdGFkL3hfYmx1ZS5wbmdcIiwwLFtbXCJTZW5kIGZlZWRiYWNrXCIsW1widXNlcl9mZWVkYmFja19tZW51X29wdGlvblwiLFwiMVwiLDFdLFtcIldoYXQgd2FzIHdyb25nIHdpdGggdGhpcyBhZD9cIixbW1wiTm90IGludGVyZXN0ZWQgaW4gdGhpcyBhZFwiLFtcIm11dGVfc3VydmV5X29wdGlvblwiLFwiN1wiLDFdXSxbXCJBZCB3YXMgaW5hcHByb3ByaWF0ZVwiLFtcIm11dGVfc3VydmV5X29wdGlvblwiLFwiOFwiLDFdXSxbXCJBZCBjb3ZlcmVkIGNvbnRlbnRcIixbXCJtdXRlX3N1cnZleV9vcHRpb25cIixcIjNcIiwxXV0sW1wiQWQgd2FzIHRvbyBwZXJzb25hbFwiLFtcIm11dGVfc3VydmV5X29wdGlvblwiLFwiMTZcIiwxXV1dXSxbXCJ1c2VyX2ZlZWRiYWNrX3VuZG9cIixcIjFcIiwxXV1dLFtcImh0dHBzOi8vZ29vZ2xlYWRzLmcuZG91YmxlY2xpY2submV0L3BhZ2VhZC9pbWFnZXMvYWRjaG9pY2VzL2ljb254Mi0wMDAwMDAucG5nXCIsXCJBZENob2ljZXNcIixcIkFkIGNsb3NlZCBieSAlMSRzXCIsbnVsbCxcImh0dHBzOi8vd3d3LmdzdGF0aWMuY29tL2ltYWdlcy9icmFuZGluZy9nb29nbGVsb2dvLzJ4L2dvb2dsZWxvZ29fZGFya19jb2xvcl84NHgyOGRwLnBuZ1wiLFwiU2VuZCBmZWVkYmFja1wiLFwiVGhhbmtzLiBGZWVkYmFjayBpbXByb3ZlcyBHb29nbGUgYWRzXCIsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLG51bGwsXCJTZWUgbXkgR29vZ2xlIGFkIHNldHRpbmdzXCIsbnVsbCxcImh0dHBzOi8vd3d3LmdzdGF0aWMuY29tXCIsXCJcIixcIkFkcyBieSAlMSRzXCIsXCJBZCBzZXR0aW5nc1wiLFwiaHR0cHM6Ly9hZHNzZXR0aW5ncy5nb29nbGUuY29tXCIsXCJQb2xpdGljYWwgQWRcIixudWxsLG51bGwsMF0sXCJBQjNhZkdFQUFBV0FXMXRiVzI1MWJHd3NXeklzTVRCZExHNTFiR3dzYm5Wc2JDeDBjblZsTEZzaU5EazNJbDFkTEZ0dWRXeHNMQ0pvZEhSd2N6b3ZMMmR2YjJkc1pXRmtjeTVuTG1SdmRXSnNaV05zYVdOckxtNWxkQzl3WVdkbFlXUXZZMjl1ZG1WeWMybHZiaThfWVdrOVEzbHBUVEZQZGtkU1dEbHBNazFKVDFwc1VXVlljSEV6YjBKUFRFMXdPVXBtYjNOVVpYWnlVVTE0TkV0cU5YQkpUMFZCUldjd1dXWlRTVWREVW1oS1QwWmZRbVZuUVdFelkybHZaMFI1UVVWRE5FRkpRWEZCVFVKNVFVOWFRa3R2UlhCblNsQXdTME5VYjJwcVVGWXRlREZ2WkhSMVIweHhYMjlmZW5ObWJsQlJlVFJQYzNwS1NFOWxNbk5EZEZoelNYVTJTMUpLWW01MVpHaHlVazlGYkROSFIybFpSM2R5UzFONldUSmlhbGt6Y0V3eWFIWmhhRWQ1ZDJRd2RWQkJXbE5xVVd0RE5WZENTakowV0hrd1NrUnpaWFZJZGpOT2IwWlJlV05rTUhnNE1qRjJUMHRyVWxVME5GcG9XV0pWYkhsS1NuaFNTR3BtUzB0NFEyMDNjVVJyTTBObll6aDZOR0ZhTFZkVGJVRnZSamhQV0ZCMmQyRm9WbEZOVFZvekxUQkRValZVTFVaU2NraERMVWR3VHpRMFlqWnVkMUJtUm1vMVFqSm9jbDgxYVVsUFRVRjJUM0Z3UVhCeWNuRmxTaTAzYVVsWE5YcERSV2xrZUhkeWQxRkJNbmRzUm5sSlUxRjNlR28yVDJzMWFUaEhNSEZ3ZGxoNVNtSm1RV1pXUjFocGJXOVRTbk4yVEVobVVERkdSRlo1UkcxTlYyRnpRWE5FWjNWT09XRmZZa2xZT1ZFeVJHOUlSeTFrUTNaTkxXRklObk14YlhGMmJtSTVYelZUTW5JelFrOWxjemhZZURGMllrOWZia2xFVG10RVpXczViM0ZDV0VnM1dtdHRNalpxWlhGMlZqTTVRa0ZFUVVKT1UyZzBZMGRhUVMxQlJVRmhRVWRCYjBGSU1tOUVTR0UyWjBocWN6UmljVUZtVm5sU2RXOUNOVkJaUnpablNIVm5ZVzlDWDBSYVJ6Wm5TRGgwYTJKeFFXWjFiSEpGUTNGQlpXMTJhSFZ2UWkxNlZrYzJaMGc0T1VWaWNVRm1jekZTZFc5Q05XSlpSelpuU0hkMGIySXlRV05DTUdkblNrTkpSR2huUlVGUlFWSm5aRGhuWjJKWlYxSTBURmhPTVZsdVRqVmlhVEF6VFdwWmVrNVVZM3BPUkZFeVQwUkJNRTFFWXpSelVXNHhTVlYxV2xCV1JXOUVTVUZMUVRWblRFRmpaMHhCWkdkVVJFRmNkVEF3TWpaemFXZG9QVTFpYkU1Q2NUbGZZV2RaWEhVd01ESTJZMmxrUFVOQlVWTlFkME5PU1hKTVRWRmxRblp5WW1KeFNrVnBSM0ZGUW14MGVsWjVOMk5VWVhoa1RrVnpNMnhaVUVwV1lVb3hhbFZ3VjB3d2IzTlNhSGs1Wm1Kc09UbHhRMmhNTmt0bGNGRm5RbkZsVEdKNWNEaDRPRWhPWnlJc1cyNTFiR3dzYm5Wc2JDeHVkV3hzTENKb2RIUndjem92TDJScGMzQnNZWGxoWkhNdFptOXliV0YwY3k1bmIyOW5iR1YxYzJWeVkyOXVkR1Z1ZEM1amIyMHZZV1J6TDNCeVpYWnBaWGN2WTI5dWRHVnVkQzVxY3o5amJHbGxiblE5ZDNSaFhIVXdNREkyYjJKbWRYTmpZWFJsWkVOMWMzUnZiV1Z5U1dROU16STFOamcwTnprek5WeDFNREF5Tm1OeVpXRjBhWFpsU1dROU5EWTBNekF5TkRZek1qWXpYSFV3TURJMmRtVnljMmx2Ymtsa1BUQmNkVEF3TWpaaFpFZHliM1Z3UTNKbFlYUnBkbVZKWkQwME1qWTBNRGN3TnpZek9EWmNkVEF3TWpab2RHMXNVR0Z5Wlc1MFNXUTljSEpsZGkwd1hIVXdNREkyYUdWcFoyaDBQVEkxTUZ4MU1EQXlObmRwWkhSb1BUazNNRngxTURBeU5uTnBaejFCUTJsV1FsOTZNbGh2U1ZkMVdVUjZZMnhTVVdSdVYxWkdaSGhsVTJoRmVFVlJJbDBzYm5Wc2JDeHVkV3hzTERFc0lqWlZUVTVrYUZoc2FIUkJTVzl6VkdWMmNsRk5SVXBtU1dseVZYQkhUR1ZoTlcxemFVTXlOV3hrTWs1dllWZE5kVmt5T1hSTloyTkpRbEpOV1d0VVRWVlJhR1JxV1ZNeGQyUlhTWFJQVkZrMFRsUmplazVFVVRCT1ZGRXpUbXBuZUU1RloxTlhRVXAzUVZsSlFrTnllWEozUzFBNFgxOWZYMTkzUlNJc0lqRXhNVEUzTVRjMU9ETXhJbDFkWFN4Yk1Td3hMREZkWFZMQlpmWmwxY1JRMTVMMGtJV3I3c2R6TGZQY09JTFRSeV9sTEZod1RMZzdwR2VVb2x4dDg1NUE3X2RLUmlrLVhVYWt2YWc0RWh2eTZTZnpMZHFOQi1HTTBIMkppVTBsdmVBMlZPbmJJeGVackFjTmZidTZndVlBcG03UDlNWnNmVF84dGJTWk9Hd2daR3Q4Mm0wSnRLUlVlRVlSTVNPR3htOUlLbnFaVDhFUTA5RFFkbjRpTmp5QzdHNmZENnBfeFptY3c1dTBnSGpSMVZuVXRuWkZzUDR1Ui1SU1VjMmh5U0VET1g4dnZMVzZxY3pOdktVZkxwNnRGd3VSVTFLOTR3Y2JUbktJcGhWSHZvTUVLMlhCV0cybDl1ZDVIcE9SdzJQSGRGck85RnVfTjFJYlppclRMblNZcVdvSXBVbE43elM1N0RZUWVCVUhLQkpfV3JmREhHOCwwZmt2UjJDcUhwTmc1YWx3X0JXR3NBXCIsXCJodHRwczovL2Fkc3NldHRpbmdzLmdvb2dsZS5jb20vd2h5dGhpc2FkP3JlYXNvbnM9QUIzYWZHRUFBQVdBVzF0YlcyNTFiR3dzV3pJc01UQmRMRzUxYkd3c2JuVnNiQ3gwY25WbExGc2lORGszSWwxZExGdHVkV3hzTENKb2RIUndjem92TDJkdmIyZHNaV0ZrY3k1bkxtUnZkV0pzWldOc2FXTnJMbTVsZEM5d1lXZGxZV1F2WTI5dWRtVnljMmx2Ymk4X1lXazlRM2xwVFRGUGRrZFNXRGxwTWsxSlQxcHNVV1ZZY0hFemIwSlBURTF3T1VwbWIzTlVaWFp5VVUxNE5FdHFOWEJKVDBWQlJXY3dXV1pUU1VkRFVtaEtUMFpmUW1WblFXRXpZMmx2WjBSNVFVVkRORUZKUVhGQlRVSjVRVTlhUWt0dlJYQm5TbEF3UzBOVWIycHFVRll0ZURGdlpIUjFSMHh4WDI5ZmVuTm1ibEJSZVRSUGMzcEtTRTlsTW5ORGRGaHpTWFUyUzFKS1ltNTFaR2h5VWs5RmJETkhSMmxaUjNkeVMxTjZXVEppYWxremNFd3lhSFpoYUVkNWQyUXdkVkJCV2xOcVVXdEROVmRDU2pKMFdIa3dTa1J6WlhWSWRqTk9iMFpSZVdOa01IZzRNakYyVDB0clVsVTBORnBvV1dKVmJIbEtTbmhT&i=9-11&t=adltag_kglayibe_5Q22w3z6xwK&r=d60ea5af3d75377ad658f061748d2ad&c=math-aids-threatpost&z=1
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/b-9a4f7ce-a7f6098c.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.85.32.34 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-85-32-34.ham50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

x-amz-version-id: D2POxJleIt92FyXaxSi7iRHuNLtujALh
via: 1.1 64cab3aa5eaf0c5f28d762c526424858.cloudfront.net (CloudFront)
etag: "d41d8cd98f00b204e9800998ecf8427e"
age: 40578
x-cache: Error from cloudfront
status: 200
content-length: 0
last-modified: Mon, 15 Jun 2020 18:35:10 GMT
server: AmazonS3
date: Thu, 22 Oct 2020 09:36:58 GMT
access-control-max-age: 3000
access-control-allow-methods: GET
content-type: text/plain
access-control-allow-origin: *
x-amz-cf-pop: HAM50-C1
accept-ranges: bytes
x-amz-cf-id: Dp0EtIlwpW4zlzuFNt_kOV4F4BAnzBXhZJyAGetQlef3G3bMuONKuQ==

POST
H2 200 tag
math-aids-threatpost-tagan.adlightning.com/ 0
428 B 43ms
41ms Other
text/plain 52.85.32.34
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://math-aids-threatpost-tagan.adlightning.com/tag?s=bl&d=U0dwbVMwdDRRMjAzY1VSck0wTm5Zemg2TkdGYUxWZFRiVUZ2UmpoUFdGQjJkMkZvVmxGTlRWb3pMVEJEVWpWVUxVWlNja2hETFVkd1R6UTBZalp1ZDFCbVJtbzFRakpvY2w4MWFVbFBUVUYyVDNGd1FYQnljbkZsU2kwM2FVbFhOWHBEUldsa2VIZHlkMUZCTW5kc1JubEpVMUYzZUdvMlQyczFhVGhITUhGd2RsaDVTbUptUVdaV1IxaHBiVzlUU25OMlRFaG1VREZHUkZaNVJHMU5WMkZ6UVhORVozVk9PV0ZmWWtsWU9WRXlSRzlJUnkxa1EzWk5MV0ZJTm5NeGJYRjJibUk1WHpWVE1uSXpRazlsY3poWWVERjJZazlmYmtsRVRtdEVaV3M1YjNGQ1dFZzNXbXR0TWpacVpYRjJWak01UWtGRVFVSk9VMmcwWTBkYVFTMUJSVUZoUVVkQmIwRklNbTlFU0dFMlowaHFjelJpY1VGbVZubFNkVzlDTlZCWlJ6Wm5TSFZuWVc5Q1gwUmFSelpuU0RoMGEySnhRV1oxYkhKRlEzRkJaVzEyYUhWdlFpMTZWa2MyWjBnNE9VVmljVUZtY3pGU2RXOUNOV0paUnpablNIZDBiMkl5UVdOQ01HZG5Ta05KUkdoblJVRlJRVkpuWkRobloySlpWMUkwVEZoT01WbHVUalZpYVRBelRXcFplazVVWTNwT1JGRXlUMFJCTUUxRVl6UnpVVzR4U1ZWMVdsQldSVzlFU1VGTFFUVm5URUZqWjB4QlpHZFVSRUZjZFRBd01qWnphV2RvUFUxaWJFNUNjVGxmWVdkWlhIVXdNREkyWTJsa1BVTkJVVk5RZDBOT1NYSk1UVkZsUW5aeVltSnhTa1ZwUjNGRlFteDBlbFo1TjJOVVlYaGtUa1Z6TTJ4WlVFcFdZVW94YWxWd1Ywd3diM05TYUhrNVptSnNPVGx4UTJoTU5rdGxjRkZuUW5GbFRHSjVjRGg0T0VoT1p5SXNXMjUxYkd3c2JuVnNiQ3h1ZFd4c0xDSm9kSFJ3Y3pvdkwyUnBjM0JzWVhsaFpITXRabTl5YldGMGN5NW5iMjluYkdWMWMyVnlZMjl1ZEdWdWRDNWpiMjB2WVdSekwzQnlaWFpwWlhjdlkyOXVkR1Z1ZEM1cWN6OWpiR2xsYm5ROWQzUmhYSFV3TURJMmIySm1kWE5qWVhSbFpFTjFjM1J2YldWeVNXUTlNekkxTmpnME56a3pOVngxTURBeU5tTnlaV0YwYVhabFNXUTlORFkwTXpBeU5EWXpNall6WEhVd01ESTJkbVZ5YzJsdmJrbGtQVEJjZFRBd01qWmhaRWR5YjNWd1EzSmxZWFJwZG1WSlpEMDBNalkwTURjd056WXpPRFpjZFRBd01qWm9kRzFzVUdGeVpXNTBTV1E5Y0hKbGRpMHdYSFV3TURJMmFHVnBaMmgwUFRJMU1GeDFNREF5Tm5kcFpIUm9QVGszTUZ4MU1EQXlObk5wWnoxQlEybFdRbDk2TWxodlNWZDFXVVI2WTJ4U1VXUnVWMVpHWkhobFUyaEZlRVZSSWwwc2JuVnNiQ3h1ZFd4c0xERXNJalpWVFU1a2FGaHNhSFJCU1c5elZHVjJjbEZOUlVwbVNXbHlWWEJIVEdWaE5XMXphVU15Tld4a01rNXZZVmROZFZreU9YUk5aMk5KUWxKTldXdFVUVlZSYUdScVdWTXhkMlJYU1hSUFZGazBUbFJqZWs1RVVUQk9WRkV6VG1wbmVFNUZaMU5YUVVwM1FWbEpRa055ZVhKM1MxQTRYMTlmWDE5M1JTSXNJakV4TVRFM01UYzFPRE14SWwxZFhTeGJNU3d4TERGZFhWTEJaZlpsMWNSUTE1TDBrSVdyN3NkekxmUGNPSUxUUnlfbExGaHdUTGc3cEdlVW9seHQ4NTVBN19kS1Jpay1YVWFrdmFnNEVodnk2U2Z6TGRxTkItR00wSDJKaVUwbHZlQTJWT25iSXhlWnJBY05mYnU2Z3VZQXBtN1A5TVpzZlRfOHRiU1pPR3dnWkd0ODJtMEp0S1JVZUVZUk1TT0d4bTlJS25xWlQ4RVEwOURRZG40aU5qeUM3RzZmRDZwX3habWN3NXUwZ0hqUjFWblV0blpGc1A0dVItUlNVYzJoeVNFRE9YOHZ2TFc2cWN6TnZLVWZMcDZ0Rnd1UlUxSzk0d2NiVG5LSXBoVkh2b01FSzJYQldHMmw5dWQ1SHBPUncyUEhkRnJPOUZ1X04xSWJaaXJUTG5TWXFXb0lwVWxON3pTNTdEWVFlQlVIS0JKX1dyZkRIRzgsMGZrdlIyQ3FIcE5nNWFsd19CV0dzQVxcdTAwMjZzb3VyY2U9ZGlzcGxheVwiLFwiV2h5IHRoaXMgYWQ%2FXCIsMV0sbnVsbCxudWxsLDAsbnVsbCwxLDAsMSwwLDAsMCwwLDAsMCwwLG51bGwsMCwxLDAsbnVsbCxbW1wiamFrZV91aV9leHRlbnNpb25cIixcImpha2VfZGVmYXVsdF91aVwiXV0sMjUwLDk3MCwwLG51bGwsbnVsbCwwLG51bGwsbnVsbCxcInJpZ2h0XCIsMF0pOzwvc2NyaXB0PjxpZnJhbWUgdGl0bGU9XCJCbGFua1wiIGZyYW1lYm9yZGVyPTAgaGVpZ2h0PTAgd2lkdGg9MCBzcmM9XCJodHRwczovL2dvb2dsZWFkcy5nLmRvdWJsZWNsaWNrLm5ldC9wYWdlYWQvZHJ0L3M%2Fdj1yMjAxMjAyMTFcIiBzdHlsZT1cInBvc2l0aW9uOmFic29sdXRlXCIgYXJpYS1oaWRkZW49XCJ0cnVlXCI%2BPC9pZnJhbWU%2BPC9kaXY%2BPC9kaXY%2BPHNjcmlwdCBkYXRhLWpjPVwiMjJcIiBzcmM9XCJodHRwczovL3RwYy5nb29nbGVzeW5kaWNhdGlvbi5jb20vcGFnZWFkL2pzL3IyMDIwMTAyMC9yMjAxMTA5MTQvY2xpZW50L3dpbmRvd19mb2N1c19meTIwMTkuanNcIiBhc3luYyBkYXRhLWpjLXZlcnNpb249XCJyMjAyMDEwMjBcIiBkYXRhLWpjcC11cmw9XCJodHRwczovL2dvb2dsZWFkcy5nLmRvdWJsZWNsaWNrLm5ldC9wYWdlYWQvY29udmVyc2lvbi8%2FYWk9Q3lpTTFPdkdSWDlpMk1JT1psUWVYcHEzb0JPTE1wOUpmb3NUZXZyUU14NEtqNXBJT0VBRWcwWWZTSUdDUmhKT0ZfQmVnQWEzY2lvZ0R5QUVDNEFJQXFBTUJ5QU9aQktvRXBnSlAwS0NUb2pqUFYteDFvZHR1R0xxX29fenNmblBReTRPc3pKSE9lMnNDdFhzSXU2S1JKYm51ZGhyUk9FbDNHR2lZR3dyS1N6WTJialkzcEwyaHZhaEd5d2QwdVBBWlNqUWtDNVdCSjJ0WHkwSkRzZXVIdjNOb0ZReWNkMHg4MjF2T0trUlU0NFpoWWJVbHlKSnhSSGpmS0t4Q203cURrM0NnYzh6NGFaLVdTbUFvRjhPWFB2d2FoVlFNTVozLTBDUjVULUZSckhDLUdwTzQ0YjZud1BmRmo1QjJocl81aUlPTUF2T3FwQXBycnFlSi03aUlXNXpDRWlkeHdyd1FBMndsRnlJU1F3eGo2T2s1aThHMHFwdlh5SmJmQWZWR1hpbW9TSnN2TEhmUDFGRFZ5RG1NV2FzQXNEZ3VOOWFfYklYOVEyRG9IRy1kQ3ZNLWFINnMxbXF2bmI5XzVTMnIzQk9lczhYeDF2Yk9fbklETmtEZWs5b3FCWEg3WmttMjZqZXF2VjM5QkFEQUJOU2g0Y0daQS1BRUFhQUdBb0FIMm9ESGE2Z0hqczRicUFmVnlSdW9CNVBZRzZnSHVnYW9CX0RaRzZnSDh0a2JxQWZ1bHJFQ3FBZW12aHVvQi16Vkc2Z0g4OUVicUFmczFSdW9CNWJZRzZnSHd0b2IyQWNCMGdnSkNJRGhnRUFRQVJnZDhnZ2JZV1I0TFhOMVluTjViaTAzTWpZek5UY3pORFEyT0RBME1EYzRzUW4xSVV1WlBWRW9ESUFLQTVnTEFjZ0xBZGdUREEmYW1wO3NpZ2g9TWJsTkJxOV9hZ1kmYW1wO2NpZD1DQVFTUHdDTklyTE1RZUJ2cmJicUpFaUdxRUJsdHpWeTdjVGF4ZE5FczNsWVBKVmFKMWpVcFdMMG9zUmh5OWZibDk5cUNoTDZLZXBRZ0JxZUxieXA4eDhITmdcIiBkYXRhLWpjcC1nd3MtaWQ9XCJcIiBkYXRhLWpjcC1xZW0taWQ9XCJDTmk3X2JpS3lld0NGWU5NNVFvZEYxTUxUUVwiPjwvc2NyaXB0PjxzY3JpcHQgc3JjPVwiaHR0cHM6Ly93d3cuZ29vZ2xldGFnc2VydmljZXMuY29tL2FjdGl2ZXZpZXcvanMvY3VycmVudC9vc2RfbGlzdGVuZXIuanM%2FY2FjaGU9cjIwMTEwOTE0cnhsaWRhcmxpc3RlbmVyY29udHJvbFwiPjwvc2NyaXB0PjxzY3JpcHQgdHlwZT1cInRleHQvamF2YXNjcmlwdFwiPm9zZGxmbSgtMSwnJywnQjJmdk1PdkdSWDlpMk1JT1psUWVYcHEzb0JBQ2l4TjYtdEF3QUFCQUJPQUhJQVFMZ0FnRElBNWtFNEFRQm9BWUMwZ2dIQ0lEaGdFQVFBY0lUQmhpdDNJcUlBdycsJycsMTAxNTUxOTgwMCx0cnVlLCdsYVxceDNkMVxceDI2eGRpXFx4M2QwXFx4MjYnLDMsJ0NBQVNQZVJvbGNNWXY5T2VwQmlHeFdSQ3UwejFmZ2dLSEZoNnkxUzc0SmhQSG1GU2p2Z2JhV3ltUjdSTG9qSFlJT21GNXdDSC1OODZ0MzBueXB0UUd0cycsJ2h0dHBzOi8vcGFnZWFkMi5nb29nbGVzeW5kaWNhdGlvbi5jb20vcGNzL2FjdGl2ZXZpZXc%2FeGFpXFx4M2RBS0FPanN1VkxtVmNBYTVVV29UbjFhemtwdVpySGQyS1gyY21FRkV0ZmY5c1ZJQy1YUUlYRDFaTVlyc0R3UHdCdHR5cnRtQl9LTGx1RFZOdWI2WGlFaGV6Vk5Qelo0Ukt6NWExRml1aXdTRndsYWJGT0QxNFBrQ2tkUnJGdUt4VWtRXFx4MjZzYWlcXHgzZEFNZmwtWVN5U0h0ekROUTFiSjc4OElBSVNJUTVISnc5d1ZFS3ZkM1N3QkpBRi1jRzFlQnl2VUdURG52cXZpaUJmaDc4Qy16T3lxZzAyQXMwUGo0UGZCTXNKZ3FZQmRpeXNrTnpIZzAxc3FVTVZodmE4OFctRVpXMGZfQTl0cnVlMHBJRVxceDI2c2lnXFx4M2RDZzBBcktKU3pGOU9sd1V1eTlvZ0VBRVxceDI2Y2lkXFx4M2RDQUFTUGVSb2xjTVl2OU9lcEJpR3hXUkN1MHoxZmdnS0hGaDZ5MVM3NEpoUEhtRlNqdmdiYVd5bVI3UkxvakhZSU9tRjV3Q0gtTjg2dDMwbnlwdFFHdHMnLCcnKTs8L3NjcmlwdD48c2NyaXB0IGRhdGEtamM9XCIyM1wiIHNyYz1cImh0dHBzOi8vdHBjLmdvb2dsZXN5bmRpY2F0aW9uLmNvbS9wYWdlYWQvanMvcjIwMjAxMDIwL3IyMDExMDkxNC9jbGllbnQvcXNfY2xpY2tfcHJvdGVjdGlvbl9meTIwMTkuanNcIiBkYXRhLWpjLXZlcnNpb249XCJyMjAyMDEwMjBcIj48L3NjcmlwdD48c2NyaXB0Pmdvb2dxc2NwLmluaXQoW1tbW251bGwsNTAwLDk5LDIsOSxudWxsLG51bGwsbnVsbCwxXV1dXSk7PC9zY3JpcHQ%2BPGltZyBzcmM9XCIvL3d3dy5nb29nbGUuY29tL2Fkcy9tZWFzdXJlbWVudC9sP2ViY2lkPUFMaDdDYVNCeWhNNUM4RGNMUVpSb2JDdWdzQjRoMWFMelROQVB0SHZzQm1UYjRnMXJvenNUWE5FbkQtLXNWVjh1V0hoSklWSzdKb2xcIiBzdHlsZT1cImRpc3BsYXk6bm9uZTtcIiBhbHQ9XCJcIj48L2ltZz48ZGl2IHN0eWxlPVwiYm90dG9tOjA7cmlnaHQ6MDt3aWR0aDo5NzBweDtoZWlnaHQ6MjUwcHg7YmFja2dyb3VuZDppbml0aWFsICFpbXBvcnRhbnQ7cG9zaXRpb246YWJzb2x1dGUgIWltcG9ydGFudDttYXgtd2lkdGg6MTAwJSAhaW1wb3J0YW50O21heC1oZWlnaHQ6MTAwJSAhaW1wb3J0YW50O3BvaW50ZXItZXZlbnRzOm5vbmUgIWltcG9ydGFudDtpbWFnZS1yZW5kZXJpbmc6cGl4ZWxhdGVkICFpbXBvcnRhbnQ7ei1pbmRleDoyMTQ3NDgzNjQ3O2JhY2tncm91bmQtaW1hZ2U6dXJsKCdkYXRhOmltYWdlL3BuZztiYXNlNjQsaVZCT1J3MEtHZ29BQUFBTlNVaEVVZ0FBQUNzQUFBQVdCQU1BQUFDcmwzaUFBQUFBQmxCTVZFVUFBQUQrQWNpV21aeldBQUFBQW5SU1RsTUFBcGlkckJRQUFBQjlTVVJCVkJqVGJaQ0JFc0F3QkVQakQvei8xNjZDMEczdXBxeVJld1g4aDJYQW9sUUhPRzlQZHZmcHFJRE5tWlBuSm1TUldWZTNWYmpVNkx5OVJWSXpSYUtnNSthR3RCaHZ6Njg0MEIwZngxZXlscVdqa1F0OGs2UmxsUitRMGk5U3c1TE9CbXNoL0tNdHREZGVHOVRjVnJlN0NLVHhYdnJGM2R1SmVBQklNUVd2Q0p0dDNnQUFBQUJKUlU1RXJrSmdnZz09JykgIWltcG9ydGFudDtcIj48L2Rpdj48c2NyaXB0IGRhdGEtamM9XCI3MFwiIHNyYz1cImh0dHBzOi8vdHBjLmdvb2dsZXN5bmRpY2F0aW9uLmNvbS9wYWdlYWQvanMvcjIwMjAxMDIwL3IyMDExMDkxNC9jbGllbnQvb25lX2NsaWNrX2hhbmRsZXJfb25lX2FmbWFfZnkyMDE5LmpzXCIgYXN5bmMgZGF0YS1qYy12ZXJzaW9uPVwicjIwMjAxMDIwXCIgZGF0YS1qY3AtZXh0cmEtbWV0YT1cIltdXCIgZGF0YS1qY3AtYXN5bmMtY2xpY2stdGltZW91dD1cIjMwMFwiIGRhdGEtamNwLWJsb2NrLW5vbi10cnVzdGVkLWV2ZW50PVwiZmFsc2VcIiBkYXRhLWpjcC1pb3Mtc3RvcmUtb3ZlcmxheT1cImZhbHNlXCIgZGF0YS1qY3AtcHJlZmV0Y2gtaW9zLXN0b3JlLW92ZXJsYXk9XCJmYWxzZVwiPjwvc2NyaXB0PiA8L2JvZHk%2BPC9odG1sPiIsIm1ldGhvZEJsb2NrZWQiOiJpbml0aWFsREZQU0Ytd3JpdGUifSwiYmxvY2tlZCI6dHJ1ZSwiY2FsbFN0YWNrIjoiRXJyb3JcbiAgICBhdCBhQyAoaHR0cHM6Ly90YWdhbi5hZGxpZ2h0bmluZy5jb20vbWF0aC1haWRzLXRocmVhdHBvc3QvYi05YTRmN2NlLWE3ZjYwOThjLmpzOjE6MjAyNzApXG4gICAgYXQgYU0gKGh0dHBzOi8vdGFnYW4uYWRsaWdodG5pbmcuY29tL21hdGgtYWlkcy10aHJlYXRwb3N0L2ItOWE0ZjdjZS1hN2Y2MDk4Yy5qczoxOjIzODI4KVxuICAgIGF0IGh0dHBzOi8vdGFnYW4uYWRsaWdodG5pbmcuY29tL21hdGgtYWlkcy10aHJlYXRwb3N0L29wLmpzOjE6MjkxMzZcbiAgICBhdCBPYmplY3QuYmVmb3JlSW5zZXJ0IChodHRwczovL3&i=10-11&t=adltag_kglayibe_5Q22w3z6xwK&r=d60ea5af3d75377ad658f061748d2ad&c=math-aids-threatpost&z=1
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/b-9a4f7ce-a7f6098c.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.85.32.34 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-85-32-34.ham50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

x-amz-version-id: D2POxJleIt92FyXaxSi7iRHuNLtujALh
via: 1.1 64cab3aa5eaf0c5f28d762c526424858.cloudfront.net (CloudFront)
etag: "d41d8cd98f00b204e9800998ecf8427e"
age: 40578
x-cache: Error from cloudfront
status: 200
content-length: 0
last-modified: Mon, 15 Jun 2020 18:35:10 GMT
server: AmazonS3
date: Thu, 22 Oct 2020 09:36:58 GMT
access-control-max-age: 3000
access-control-allow-methods: GET
content-type: text/plain
access-control-allow-origin: *
x-amz-cf-pop: HAM50-C1
accept-ranges: bytes
x-amz-cf-id: dfPmPQXEtr3kTyyDjUNjYnXazXi3fTO9jV2Q19JTel23CzrIDxZWdw==

POST
H2 200 tag
math-aids-threatpost-tagan.adlightning.com/ 0
427 B 44ms
42ms Other
text/plain 52.85.32.34
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://math-aids-threatpost-tagan.adlightning.com/tag?s=bl&d=RhZ2FuLmFkbGlnaHRuaW5nLmNvbS9tYXRoLWFpZHMtdGhyZWF0cG9zdC9vcC5qczoxOjI5ODA3KVxuICAgIGF0IEhUTUxEaXZFbGVtZW50LmJCLjxjb21wdXRlZD4uYkIuPGNvbXB1dGVkPi5iQi48Y29tcHV0ZWQ%2BIFthcyBhcHBlbmRDaGlsZF0gKGh0dHBzOi8vdGFnYW4uYWRsaWdodG5pbmcuY29tL21hdGgtYWlkcy10aHJlYXRwb3N0L29wLmpzOjE6MzczNzEpXG4gICAgYXQgRnQgKGh0dHBzOi8vc2VjdXJlcHViYWRzLmcuZG91YmxlY2xpY2submV0L2dwdC9wdWJhZHNfaW1wbF8yMDIwMTAxOTAxLmpzOjY6MTU0NjUwKVxuICAgIGF0IG5ldyBIdCAoaHR0cHM6Ly9zZWN1cmVwdWJhZHMuZy5kb3VibGVjbGljay5uZXQvZ3B0L3B1YmFkc19pbXBsXzIwMjAxMDE5MDEuanM6NjoxNTE3NjApXG4gICAgYXQgaHcgKGh0dHBzOi8vc2VjdXJlcHViYWRzLmcuZG91YmxlY2xpY2submV0L2dwdC9wdWJhZHNfaW1wbF8yMDIwMTAxOTAxLmpzOjY6MjAzMTM0KVxuICAgIGF0IE53LmwgKGh0dHBzOi8vc2VjdXJlcHViYWRzLmcuZG91YmxlY2xpY2submV0L2dwdC9wdWJhZHNfaW1wbF8yMDIwMTAxOTAxLmpzOjY6MjA5ODY4KVxuICAgIGF0IEh3IChodHRwczovL3NlY3VyZXB1YmFkcy5nLmRvdWJsZWNsaWNrLm5ldC9ncHQvcHViYWRzX2ltcGxfMjAyMDEwMTkwMS5qczo2OjIwNzg4OCkiLCJpbnRlcm1lZGlhdGVNYXJrdXAiOiIifQ%3D%3D&i=11-11&t=adltag_kglayibe_5Q22w3z6xwK&r=d60ea5af3d75377ad658f061748d2ad&c=math-aids-threatpost&z=1
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/b-9a4f7ce-a7f6098c.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 52.85.32.34 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-85-32-34.ham50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

x-amz-version-id: D2POxJleIt92FyXaxSi7iRHuNLtujALh
via: 1.1 64cab3aa5eaf0c5f28d762c526424858.cloudfront.net (CloudFront)
etag: "d41d8cd98f00b204e9800998ecf8427e"
age: 40578
x-cache: Error from cloudfront
status: 200
content-length: 0
last-modified: Mon, 15 Jun 2020 18:35:10 GMT
server: AmazonS3
date: Thu, 22 Oct 2020 09:36:58 GMT
access-control-max-age: 3000
access-control-allow-methods: GET
content-type: text/plain
access-control-allow-origin: *
x-amz-cf-pop: HAM50-C1
accept-ranges: bytes
x-amz-cf-id: hKg7K08iv4qoCrhMosF4_JOgxwP9XwHjoTZVLm_HCC_liZll-myUYw==

GET
H3-Q050 200 container.html
b1ae54670d2110ccdffcb33197cc425f.safeframe.googlesyndication.com/safeframe/1-0-37/html/ Frame 3672 0
0 30ms
16ms Document
text/html 2a00:1450:400c:c02::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://b1ae54670d2110ccdffcb33197cc425f.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400c:c02::84 Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: b1ae54670d2110ccdffcb33197cc425f.safeframe.googlesyndication.com
:scheme: https
:path: /safeframe/1-0-37/html/container.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Response headers

status: 200
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
timing-allow-origin: *
content-length: 2973
date: Thu, 22 Oct 2020 20:53:15 GMT
expires: Fri, 22 Oct 2021 20:53:15 GMT
cache-control: public, immutable, max-age=31536000
last-modified: Thu, 21 Nov 2019 16:01:11 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-Q050 200 osd.js Show response
www.googletagservices.com/activeview/js/current/ 72 KB
28 KB 61ms
46ms Script
text/javascript 2a00:1450:4001:820::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd.js?cb=%2Fr20100101

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020101901.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:820::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f6c6a084d20419521fdd0a581b80e41c5d73aeafd60a0224e7776a6826060625

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 22 Oct 2020 20:53:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1603280362352039"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 27607
x-xss-protection: 0
expires: Thu, 22 Oct 2020 20:53:15 GMT

GET
H3-Q050 200 container.html
b1ae54670d2110ccdffcb33197cc425f.safeframe.googlesyndication.com/safeframe/1-0-37/html/ Frame 8905 0
0 16ms
16ms Document
text/html 2a00:1450:400c:c02::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://b1ae54670d2110ccdffcb33197cc425f.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400c:c02::84 Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: b1ae54670d2110ccdffcb33197cc425f.safeframe.googlesyndication.com
:scheme: https
:path: /safeframe/1-0-37/html/container.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Response headers

status: 200
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
timing-allow-origin: *
content-length: 2973
date: Thu, 22 Oct 2020 20:53:15 GMT
expires: Fri, 22 Oct 2021 20:53:15 GMT
last-modified: Thu, 21 Nov 2019 16:01:11 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, immutable, max-age=31536000
age: 0
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-Q050 200 container.html
b1ae54670d2110ccdffcb33197cc425f.safeframe.googlesyndication.com/safeframe/1-0-37/html/ Frame 909E 0
0 17ms
14ms Document
text/html 2a00:1450:400c:c02::84
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://b1ae54670d2110ccdffcb33197cc425f.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400c:c02::84 Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: b1ae54670d2110ccdffcb33197cc425f.safeframe.googlesyndication.com
:scheme: https
:path: /safeframe/1-0-37/html/container.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Response headers

status: 200
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
timing-allow-origin: *
content-length: 2973
date: Thu, 22 Oct 2020 20:53:15 GMT
expires: Fri, 22 Oct 2021 20:53:15 GMT
last-modified: Thu, 21 Nov 2019 16:01:11 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, immutable, max-age=31536000
age: 0
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 bl-04a3385-60312f65.js Show response
tagan.adlightning.com/math-aids-threatpost/ Frame 3809 95 KB
27 KB 45ms
42ms Script
application/javascript 54.192.206.94
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/math-aids-threatpost/bl-04a3385-60312f65.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 54.192.206.94 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-54-192-206-94.ham50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: c717b127e11b9121f5480b91aa00c66637c4b25bad4cc9e09be9e3b452087ede

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 22 Oct 2020 19:58:09 GMT
content-encoding: gzip
age: 3307
x-cache: Hit from cloudfront
status: 200
content-length: 27322
x-amz-meta-git_commit: 04a3385
last-modified: Thu, 22 Oct 2020 19:57:42 GMT
server: AmazonS3
etag: "514d1bb7215c5e149ec8109d385f60b3"
x-amz-version-id: OUQ3wCnzBD141g0QnkPbuoj58Ey7CM1z
via: 1.1 20997ca80e84f6ddda445ba948f015bd.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: HAM50-C3
accept-ranges: bytes
content-type: application/javascript
x-amz-cf-id: x9NtV8NWIIoQKQ08wcpjSo0axNuDhEqUQj-SmO5W4fWZffp_vQkFlQ==

GET
H2 200 b-9a4f7ce-a7f6098c.js Show response
tagan.adlightning.com/math-aids-threatpost/ Frame 3809 61 KB
21 KB 46ms
43ms Script
application/javascript 54.192.206.94
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagan.adlightning.com/math-aids-threatpost/b-9a4f7ce-a7f6098c.js
Requested by: Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 54.192.206.94 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-54-192-206-94.ham50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 0119689800eadf6270855a19b65d74251e7da6be5e4686f36c15bf81281ddb4c

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Fri, 16 Oct 2020 23:36:58 GMT
content-encoding: gzip
age: 508578
x-cache: Hit from cloudfront
status: 200
content-length: 20808
x-amz-meta-git_commit: 9a4f7ce
last-modified: Tue, 18 Aug 2020 17:45:57 GMT
server: AmazonS3
etag: "98ae1c21c96b68b5f173604d82c35d5d"
x-amz-version-id: PzdVsYQ0bdCd7Kp..jKBw4vE53Z4BW7z
via: 1.1 20997ca80e84f6ddda445ba948f015bd.cloudfront.net (CloudFront)
cache-control: max-age=31536000
x-amz-cf-pop: HAM50-C3
accept-ranges: bytes
content-type: application/javascript
x-amz-cf-id: rzxujqmf1uHP-Layw7SM91gRZvrbqSM1H_mvIMzytYsVjUqXTSckJg==

GET
H3-Q050 200 7464639028652035684
tpc.googlesyndication.com/simgad/ Frame 3809 330 B
455 B 53ms
37ms Image
image/png 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/7464639028652035684

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f19e7ee6cdf20bd478c037707c447b7cd469051de4dadeac32a795efb463c2e2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 21 Oct 2020 01:25:35 GMT
x-content-type-options: nosniff
age: 156460
x-dns-prefetch-control: off
status: 200
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 330
x-xss-protection: 0
last-modified: Tue, 28 Jan 2020 23:02:00 GMT
server: sffe
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 21 Oct 2021 01:25:35 GMT

GET
H3-Q050 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20201020/r20110914/ Frame 3809 17 KB
7 KB 49ms
33ms Script
text/javascript 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20201020/r20110914/abg_lite_fy2019.js

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

730a35406038cc57ea6bd2defe63f53dc881741e8b7a46ade69a86a2f16904a6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 21 Oct 2020 21:53:55 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 82760
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
content-disposition: attachment; filename="f.txt"
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7201
x-xss-protection: 0
server: cafe
etag: 14407858973007821136
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 04 Nov 2020 21:53:55 GMT

GET
H3-Q050 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20201020/r20110914/client/ Frame 3809 3 KB
2 KB 48ms
32ms Script
text/javascript 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20201020/r20110914/client/window_focus_fy2019.js

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d2da3bdfb97c04360c684feeaac2a007c4a391f0b7623a0294f5c8eb3a91afc4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 21 Oct 2020 21:52:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 82862
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
content-disposition: attachment; filename="f.txt"
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1335
x-xss-protection: 0
server: cafe
etag: 1884878862150193934
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 04 Nov 2020 21:52:13 GMT

GET
H3-Q050 200 osd_listener.js Show response
www.googletagservices.com/activeview/js/current/ Frame 3809 75 KB
28 KB 50ms
49ms Script
text/javascript 2a00:1450:4001:820::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914rxlidarlistenercontrol

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:820::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

aef5db68e9c0d1d356b829a3b564e53b6af0119706fba4c7bb8c4091ae948b1e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 22 Oct 2020 20:53:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1603280362352039"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 28907
x-xss-protection: 0
expires: Thu, 22 Oct 2020 20:53:15 GMT

GET
H2 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 8 KB
7 KB 69ms
17ms XHR
application/json 2a00:1450:4001:820::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=2020101901&st=env

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2020101901.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:820::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

6a76aa61c0110375ed38f64040890a891459986b3a2c72d3c9c774986e86d679

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 22 Oct 2020 20:53:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
status: 200
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 6335
x-xss-protection: 0

POST
H/1.1 200
OK mq Show response
capi.connatix.com/tr/ Frame A818 0
323 B 124ms
124ms XHR
multipart/form-data 18.221.6.219
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://capi.connatix.com/tr/mq?v=69601
Requested by: Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.221.6.219 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-221-6-219.us-east-2.compute.amazonaws.com
Software: openresty/1.15.8.2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: multipart/form-data

Response headers

Date: Thu, 22 Oct 2020 20:53:15 GMT
Content-Encoding: gzip
Server: openresty/1.15.8.2
Vary: Accept-Encoding
Content-Type: multipart/form-data
Access-Control-Allow-Origin: https://threatpost.com
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 20

GET
H3-Q050 200 view
securepubads.g.doubleclick.net/pcs/ Frame 3809 0
0 88ms
88ms Fetch
image/gif 216.58.208.34
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsuFj6EHXNE7KZcSyw4EMr0SbK2G_KZZJbZkfCHUxTkZJTiqGtgDiQOxtRaob_OyGXwzms2e_KTDpsf0erZIW6WBRAZhDXZNT2876y6Wf7uSxNqKdxPVoXsgk_au-lqAfLtz3vK4BI0g9VStnZetT5O0n-ucbs_vP8GGwv9hqTm57DHy_8jo0fsfSjcCTnoK-3UvkoiEJPtJ3FB8rm_gpsAS_gC3Kd4CQJCIHqQE8jPOpDo7cLFE3LEXEjme2iO5fIEQ49WzcP4FsMnBtnOWHw&sai=AMfl-YQ5JHOc5Q3ZYVmgBN83qnbf4lytHOGGgT4Kes60FigmcCGTlwVk1HHWXlEfJ7d0yxnL8b9Kp7SKohPupkpmt__XzxNMUqQsQH-47MYAqsJf-4Sm1gQeQIObzgCPnvJ3&sig=Cg0ArKJSzJ6KJbCwTb-pEAE&adurl=

Requested by

Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

216.58.208.34 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s12-in-f34.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 22 Oct 2020 20:53:15 GMT
x-content-type-options: nosniff
server: cafe
status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
content-type: image/gif
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H3-Q050 200 view
securepubads.g.doubleclick.net/pcs/ Frame 3809 0
21 B 65ms
64ms Image
image/gif 216.58.208.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsu05NLY8kANvWH2v6GiNh0162WljAhNq6uAYwhRHjma-MzPGRHwNrEi0iryU4IRwDE-DqJey-slCVPKJTdQNAA5TF4QJtnQN5O7MUKHf6iUnYuMSCSXB59ZA3N7OO7wpxPaJFCviAivqovkcwbAlIeBrWVLtTtUpxNSNPCbkC9KGE2BGCCmek-PGKpa4YljkpKgMJ9in1rQDUANmRPhUwTfV4T-oGuv5hP_RvZ2fFtpfD3jDsVSWXwfhFrqjX2Dv9DnqWoLfCZ7nBbsZd_TVyuA&sai=AMfl-YQ74qTXXLyoGDsoHrwomXJRIDHQDuNoZAyrBMTsN7YIaggIxpF_x3ob-3gQNsUcmNwVqkfRzvdlPYpM8dOdRhZvVhaJebjYB3CAm0C9sprP1SxRT_kLYJvY3BIkHkyA&sig=Cg0ArKJSzMIDmFQ924qWEAE&adurl=

Requested by

Host: threatpost.com
URL: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

216.58.208.34 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s12-in-f34.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 22 Oct 2020 20:53:15 GMT
x-content-type-options: nosniff
server: cafe
status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
content-type: image/gif
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame 3809 211 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: eceb5dda9ae13230bad3dd67c30f2dd6a46837ac9d438d4c1f5af5f2ef197206

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/png

GET
H3-Q050 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
6 KB 56ms
55ms Script
text/javascript 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a32b89473df6ced5953684278e431ae4a01141364fab23812960a0d69c5ab3ee

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 22 Oct 2020 20:53:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1601937181905197"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6302
x-xss-protection: 0
expires: Thu, 22 Oct 2020 20:53:15 GMT

GET
H3-Q050 200 runner.html
tpc.googlesyndication.com/sodar/sodar2/218/ Frame 415D 0
0 6ms
6ms Document
text/html 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/218/runner.html

Requested by

Host: tagan.adlightning.com
URL: https://tagan.adlightning.com/math-aids-threatpost/op.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/sodar2/218/runner.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Response headers

status: 200
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
content-length: 4867
date: Thu, 22 Oct 2020 20:17:14 GMT
expires: Fri, 22 Oct 2021 20:17:14 GMT
last-modified: Fri, 25 Sep 2020 19:26:06 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 2161
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-Q050 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
195 B 40ms
39ms Image
image/gif 2a00:1450:4001:820::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=218&t=2&li=gpt_2020101901&jk=2932607194856493&bg=!LyylLAzNAAUZK2QAGVjbmDvF5X0-MgIAAABtUgAAABEKAI0EC5XfXBBsQsEHC-3EnquLs8VectM1eeDw7H1dBWkjmME7tP2BwaLzwtkCmc4HKBpimxVtlzTwn6UM7BehK9QML98Xm4kek25Gfk3vaErgBBmOP2bGUERTTbX2o1-HMx9XWYRVaEIqoW78HeDKYTtAlrKKOUE9X4u2jXubbn5Gic4Wn3yBTp4YQ2PsgAKZAaeeWw3Sp9LKvFwQ_uubrnKQFdQQFgHCuU--jDmfhB_bjupQoXzo-ysyrzyE9YQHTEXUtt2WGnLXK2OSkTDS7lhnRtbWKtqa2keHxwYTvqczu42gb8DDzz7Sx216_pZAstVnLPWSk9WsjOdrqvZmmiNykMYOFiOXtJtrkChvT28rkm5MSnNtx0LS9qjKdAyMagDquiwcC_3qsyJR0Fts_AnRXY_BkeRaf2VMy-WtOk9lkJcNp5RzT7VXLoY_2gxQ4EdQVBtSyfK_F7C1tJUwuxY1_cVgGGIiH7_ThNpJ4rJ-kRT1dmWBmLrzjIVBumPGvD-9yL7pkjFEvki9zj4gvDnPrx5OICKOgYVf3_G73vzAFpIMeGFPeIYV346_mfaTUhLp9hD-bho_dpYDEv-gVyF7jkQ5zPb4mOWX2TGSPVR4DCMmmUvh-bsNG1OrOMIXOWC77VzqEMTAc8LAIgWvoTxZMgIfkfPuX5Acu46XtuaFn3_WHvLfufurrEumXK6ajnA1ul3gOCnVmLjTcjEsfDxMJPlxz0xiSlSJ7m47-iP0cpe1s4ITVMs

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:820::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 22 Oct 2020 20:53:15 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 204
cache-control: no-cache, must-revalidate
content-type: image/gif
alt-svc: h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H/1.1 200
OK sv Show response
capi.connatix.com/tr/ Frame A818 0
323 B 116ms
116ms XHR
multipart/form-data 18.221.6.219
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://capi.connatix.com/tr/sv?v=69601
Requested by: Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.221.6.219 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-221-6-219.us-east-2.compute.amazonaws.com
Software: openresty/1.15.8.2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: multipart/form-data

Response headers

Date: Thu, 22 Oct 2020 20:53:16 GMT
Content-Encoding: gzip
Server: openresty/1.15.8.2
Vary: Accept-Encoding
Content-Type: multipart/form-data
Access-Control-Allow-Origin: https://threatpost.com
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 20

GET
H/1.1 200
OK async_usersync.html
acdn.adnxs.com/dmp/ Frame 12F5 0
0 91ms
32ms Document
text/html 151.101.113.108
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://acdn.adnxs.com/dmp/async_usersync.html
Requested by: Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid3.25.0-1.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.113.108 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx/1.13.10 /
Resource Hash

Request headers

Host: acdn.adnxs.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Connection: keep-alive
Content-Length: 17037
Server: nginx/1.13.10
Content-Type: text/html
Last-Modified: Tue, 24 Mar 2020 15:52:19 GMT
ETag: W/"5e7a2cb3-cefd"
Expires: Fri, 04 Sep 2020 06:04:52 GMT
Cache-Control: max-age=86402
Access-Control-Allow-Origin: *
Content-Encoding: gzip
Via: 1.1 varnish 1.1 varnish
Accept-Ranges: bytes
Date: Thu, 22 Oct 2020 20:53:17 GMT
Age: 53208
X-Served-By: cache-lga21981-LGA, cache-hhn4029-HHN
X-Cache: HIT, HIT
X-Cache-Hits: 1, 642874
X-Timer: S1603399998.897544,VS0,VE0
Vary: Accept-Encoding

GET
H2 200 ixmatch.html
js-sec.indexww.com/um/ Frame BFA6 0
0 24ms
22ms Document
text/html 104.111.215.135
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://js-sec.indexww.com/um/ixmatch.html
Requested by: Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid3.25.0-1.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.111.215.135 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-215-135.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash

Request headers

:method: GET
:authority: js-sec.indexww.com
:scheme: https
:path: /um/ixmatch.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 200
server: Apache
last-modified: Tue, 06 Oct 2020 14:04:48 GMT
etag: "e20015-8f4-5b10114f2003a"
accept-ranges: bytes
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
content-encoding: gzip
content-length: 1136
date: Thu, 22 Oct 2020 20:53:17 GMT

GET
H/1.1 200
OK showad.js
ads.pubmatic.com/AdServer/js/ Frame D395 0
0 84ms
33ms Document
text/html 104.111.215.68
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/showad.js
Requested by: Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid3.25.0-1.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.111.215.68 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-215-68.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash

Request headers

Host: ads.pubmatic.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Server: Apache/2.2.15 (CentOS)
Last-Modified: Wed, 21 Oct 2020 18:57:52 GMT
ETag: "13006b6-94f8-5b232eca8cf5e"
Accept-Ranges: bytes
Content-Encoding: gzip
P3P: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
Content-Length: 13837
Content-Type: text/html; charset=UTF-8
X-Akamai-Path-Stats: [1:109:891]
Cache-Control: public, max-age=79947
Expires: Fri, 23 Oct 2020 19:05:44 GMT
Date: Thu, 22 Oct 2020 20:53:17 GMT
Connection: keep-alive
Vary: Accept-Encoding

GET
H2 200 pd
u.openx.net/w/1.0/ Frame F045 0
0 34ms
33ms Document
text/html 34.98.64.218
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://u.openx.net/w/1.0/pd
Requested by: Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid3.25.0-1.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.64.218 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/16.195.1 /
Resource Hash

Request headers

:method: GET
:authority: u.openx.net
:scheme: https
:path: /w/1.0/pd
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: i=f21b399a-87d7-443e-9896-8fed7d43a629|1603399994
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 200
vary: Accept, Accept-Encoding
set-cookie: i=f21b399a-87d7-443e-9896-8fed7d43a629|1603399994; Version=1; Expires=Fri, 22-Oct-2021 20:53:17 GMT; Max-Age=31536000; Secure; Domain=.openx.net; Path=/; SameSite=None pd=v2|1603399997|gekin0vNiygu; Version=1; Expires=Fri, 06-Nov-2020 20:53:17 GMT; Max-Age=1296000; Secure; Domain=.openx.net; Path=/; SameSite=None
server: OXGW/16.195.1
p3p: CP="CUR ADM OUR NOR STA NID"
date: Thu, 22 Oct 2020 20:53:17 GMT
content-type: text/html
content-length: 420
content-encoding: gzip
via: 1.1 google
alt-svc: clear

GET
H/1.1 200
OK showad.js
ads.pubmatic.com/AdServer/js/ Frame FF27 0
0 85ms
27ms Document
text/html 104.111.215.68
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/showad.js
Requested by: Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid3.25.0-1.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.111.215.68 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-215-68.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash

Request headers

Host: ads.pubmatic.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Server: Apache/2.2.15 (CentOS)
Last-Modified: Wed, 21 Oct 2020 18:57:52 GMT
ETag: "13006b6-94f8-5b232eca8cf5e"
Accept-Ranges: bytes
Content-Encoding: gzip
P3P: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
Content-Length: 13837
Content-Type: text/html; charset=UTF-8
X-Akamai-Path-Stats: [1:109:891]
Cache-Control: public, max-age=79947
Expires: Fri, 23 Oct 2020 19:05:44 GMT
Date: Thu, 22 Oct 2020 20:53:17 GMT
Connection: keep-alive
Vary: Accept-Encoding

GET
H2 200 pd
u.openx.net/w/1.0/ Frame 2D79 0
0 34ms
34ms Document
text/html 34.98.64.218
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://u.openx.net/w/1.0/pd
Requested by: Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid3.25.0-1.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.64.218 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/16.195.1 /
Resource Hash

Request headers

:method: GET
:authority: u.openx.net
:scheme: https
:path: /w/1.0/pd
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: i=f21b399a-87d7-443e-9896-8fed7d43a629|1603399994
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 200
vary: Accept, Accept-Encoding
set-cookie: i=f21b399a-87d7-443e-9896-8fed7d43a629|1603399994; Version=1; Expires=Fri, 22-Oct-2021 20:53:17 GMT; Max-Age=31536000; Secure; Domain=.openx.net; Path=/; SameSite=None pd=v2|1603399997|gekin0vNiygu; Version=1; Expires=Fri, 06-Nov-2020 20:53:17 GMT; Max-Age=1296000; Secure; Domain=.openx.net; Path=/; SameSite=None
server: OXGW/16.195.1
p3p: CP="CUR ADM OUR NOR STA NID"
date: Thu, 22 Oct 2020 20:53:17 GMT
content-type: text/html
content-length: 420
content-encoding: gzip
via: 1.1 google
alt-svc: clear

GET
H/1.1 200
OK async_usersync.html
acdn.adnxs.com/dmp/ Frame 7A4C 0
0 79ms
26ms Document
text/html 151.101.113.108
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://acdn.adnxs.com/dmp/async_usersync.html
Requested by: Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid3.25.0-1.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.113.108 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx/1.13.10 /
Resource Hash

Request headers

Host: acdn.adnxs.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Connection: keep-alive
Content-Length: 17037
Server: nginx/1.13.10
Content-Type: text/html
Last-Modified: Tue, 24 Mar 2020 15:52:19 GMT
ETag: W/"5e7a2cb3-cefd"
Expires: Fri, 04 Sep 2020 06:04:52 GMT
Cache-Control: max-age=86402
Access-Control-Allow-Origin: *
Content-Encoding: gzip
Via: 1.1 varnish 1.1 varnish
Accept-Ranges: bytes
Date: Thu, 22 Oct 2020 20:53:17 GMT
Age: 53208
X-Served-By: cache-lga21981-LGA, cache-hhn4074-HHN
X-Cache: HIT, HIT
X-Cache-Hits: 1, 670439
X-Timer: S1603399998.910094,VS0,VE0
Vary: Accept-Encoding

GET
H2 200 ixmatch.html
js-sec.indexww.com/um/ Frame DA7E 0
0 23ms
22ms Document
text/html 104.111.215.135
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://js-sec.indexww.com/um/ixmatch.html
Requested by: Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid3.25.0-1.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.111.215.135 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-215-135.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash

Request headers

:method: GET
:authority: js-sec.indexww.com
:scheme: https
:path: /um/ixmatch.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 200
server: Apache
last-modified: Tue, 06 Oct 2020 14:04:48 GMT
etag: "e20015-8f4-5b10114f2003a"
accept-ranges: bytes
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
content-encoding: gzip
content-length: 1136
date: Thu, 22 Oct 2020 20:53:17 GMT

GET
H2 200 %7Bcombo_uid%7D
pr-bh.ybp.yahoo.com/sync/adaptv_ortb/ Frame A818 43 B
837 B 131ms
42ms Image
image/gif 2a00:1288:110:c305::8000
YAHOO-IRD

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pr-bh.ybp.yahoo.com/sync/adaptv_ortb/%7Bcombo_uid%7D

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a00:1288:110:c305::8000 , United Kingdom, ASN34010 (YAHOO-IRD, GB),

Reverse DNS

Software

ATS /

Resource Hash

48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 22 Oct 2020 20:53:17 GMT
referrer-policy: strict-origin-when-cross-origin
server: ATS
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security: max-age=31536000
content-type: image/gif
status: 200
x-xss-protection: 1; mode=block
content-length: 43
x-content-type-options: nosniff
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1

204
No Content

sync
ups.analytics.yahoo.com/ups/55986/ Frame A818
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/m7y5t93k?gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fpixel.advertising.com%2Fups%2F55986%2Fsync%3Fuid%3D%24%7BUSER_ID%7D%26_origin%3D0&gdpr=0&gdpr_consent=
https://sync-tm.everesttech.net/ct/upi/pid/m7y5t93k?gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fpixel.advertising.com%2Fups%2F55986%2Fsync%3Fuid%3D%24%7BUSER_ID%7D%26_origin%3D0&gdpr=0&gdpr_consent=&_...
https://pixel.advertising.com/ups/55986/sync?uid=X5HxPgAAAJ8FG3bL&_origin=0&gdpr=0&gdpr_consent=&_test=X5HxPgAAAJ8FG3bL
https://ups.analytics.yahoo.com/ups/55986/sync?uid=X5HxPgAAAJ8FG3bL&_origin=0&gdpr=0&gdpr_consent=&_test=X5HxPgAAAJ8FG3bL&apid=1A9a566af0-14a8-11eb-be94-122675b00be4

0
975 B

28ms
27ms

Image
text/plain

3.126.56.137
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ups.analytics.yahoo.com/ups/55986/sync?uid=X5HxPgAAAJ8FG3bL&_origin=0&gdpr=0&gdpr_consent=&_test=X5HxPgAAAJ8FG3bL&apid=1A9a566af0-14a8-11eb-be94-122675b00be4

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

3.126.56.137 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

ATS/7.1.2.113 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 22 Oct 2020 20:53:18 GMT
Server: ATS/7.1.2.113
Connection: keep-alive
Age: 0
Strict-Transport-Security: max-age=31536000
P3P: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

Redirect headers

status: 302
date: Thu, 22 Oct 2020 20:53:18 GMT
location: https://ups.analytics.yahoo.com/ups/55986/sync?uid=X5HxPgAAAJ8FG3bL&_origin=0&gdpr=0&gdpr_consent=&_test=X5HxPgAAAJ8FG3bL&apid=1A9a566af0-14a8-11eb-be94-122675b00be4
content-length: 0
strict-transport-security: max-age=31536000
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H/1.1

204
No Content

sync
ups.analytics.yahoo.com/ups/57304/ Frame A818
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=adaptv_dbm&google_cm&google_sc
https://pixel.advertising.com/ups/57304/sync?uid=CAESEG20LSDDSK70WOg_cAoRODs&google_cver=1
https://ups.analytics.yahoo.com/ups/57304/sync?uid=CAESEG20LSDDSK70WOg_cAoRODs&google_cver=1&apid=1A9a566af0-14a8-11eb-be94-122675b00be4

0
963 B

88ms
25ms

Image
text/plain

3.126.56.137
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ups.analytics.yahoo.com/ups/57304/sync?uid=CAESEG20LSDDSK70WOg_cAoRODs&google_cver=1&apid=1A9a566af0-14a8-11eb-be94-122675b00be4

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

3.126.56.137 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

ATS/7.1.2.113 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 22 Oct 2020 20:53:18 GMT
Server: ATS/7.1.2.113
Connection: keep-alive
Age: 0
Strict-Transport-Security: max-age=31536000
P3P: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

Redirect headers

status: 302
date: Thu, 22 Oct 2020 20:53:17 GMT
location: https://ups.analytics.yahoo.com/ups/57304/sync?uid=CAESEG20LSDDSK70WOg_cAoRODs&google_cver=1&apid=1A9a566af0-14a8-11eb-be94-122675b00be4
content-length: 0
strict-transport-security: max-age=31536000
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H2

204

sync
pixel.advertising.com/ups/55953/ Frame A818
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=adaptv&ttd_tpi=1
https://match.adsrvr.org/track/cmb/generic?ttd_pid=adaptv&ttd_tpi=1
https://pixel.advertising.com/ups/55953/sync?uid=3c55703f-950e-4cbe-888f-820693f3afa9&_origin=1&gdpr=1&gdpr_consent=&piggybackCookie=3c55703f-950e-4cbe-888f-820693f3afa9

0
124 B

25ms
25ms

Image
text/plain

3.124.119.192
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pixel.advertising.com/ups/55953/sync?uid=3c55703f-950e-4cbe-888f-820693f3afa9&_origin=1&gdpr=1&gdpr_consent=&piggybackCookie=3c55703f-950e-4cbe-888f-820693f3afa9

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

3.124.119.192 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 204
date: Thu, 22 Oct 2020 20:53:18 GMT
strict-transport-security: max-age=31536000
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

Redirect headers

pragma: no-cache
date: Thu, 22 Oct 2020 20:53:17 GMT
x-aspnet-version: 4.0.30319
status: 302
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://pixel.advertising.com/ups/55953/sync?uid=3c55703f-950e-4cbe-888f-820693f3afa9&_origin=1&gdpr=1&gdpr_consent=&piggybackCookie=3c55703f-950e-4cbe-888f-820693f3afa9
cache-control: private,no-cache, must-revalidate
content-type: text/html
content-length: 369

POST
H/1.1 200
OK abt Show response
capi.connatix.com/tr/ Frame A818 0
323 B 117ms
117ms XHR
multipart/form-data 18.221.6.219
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://capi.connatix.com/tr/abt?v=69601
Requested by: Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.221.6.219 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-221-6-219.us-east-2.compute.amazonaws.com
Software: openresty/1.15.8.2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: multipart/form-data

Response headers

Date: Thu, 22 Oct 2020 20:53:19 GMT
Content-Encoding: gzip
Server: openresty/1.15.8.2
Vary: Accept-Encoding
Content-Type: multipart/form-data
Access-Control-Allow-Origin: https://threatpost.com
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 20

GET
H2 200 sync.html
public.servenobid.com/ Frame A7E3 0
0 67ms
19ms Document
text/html 2620:1ec:bdf::10
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://public.servenobid.com/sync.html
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:bdf::10 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash

Request headers

:method: GET
:authority: public.servenobid.com
:scheme: https
:path: /sync.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Response headers

status: 200
cache-control: max-age=86400
content-type: text/html
content-encoding: br
last-modified: Tue, 20 Oct 2020 23:27:37 GMT
accept-ranges: bytes
etag: "60c7d81779caee94eca54f716f095f91"
server: AmazonS3
x-cache: TCP_HIT
x-amz-id-2: t+tuN1vmlMcVfVc814xHj8eeWoYTMX9DgDBJjzWP0sx/OhPy/VLtLzODtEmNxKCVm4t2HxLMzOg=
x-amz-request-id: 5DFC5EB507289ECA
x-azure-ref-originshield: 0s3SRXwAAAADmx+vo4VpqTLAQCErBBXFdTE9OMjFFREdFMDIxNQA4NGU3ZGZhMi0xNDQyLTQzMzQtYjM0Zi1lNDJkM2Y3ZGRhZDk=
x-azure-ref: 0P/GRXwAAAAA7SWVovVoxRq3RtjHNNmjlQlJVMzBFREdFMDQwOAA4NGU3ZGZhMi0xNDQyLTQzMzQtYjM0Zi1lNDJkM2Y3ZGRhZDk=
date: Thu, 22 Oct 2020 20:53:19 GMT

GET
H2

200

sync
eb2.3lift.com/ Frame A0C9
Redirect Chain

https://eb2.3lift.com/sync?
https://eb2.3lift.com/sync?&ld=1

0
0

27ms
23ms

Document
text/html

54.93.144.106
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://eb2.3lift.com/sync?&ld=1
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.93.144.106 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash

Request headers

:method: GET
:authority: eb2.3lift.com
:scheme: https
:path: /sync?&ld=1
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: tluid=3576232886053331111
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Response headers

status: 200
date: Thu, 22 Oct 2020 20:53:19 GMT
content-type: text/html; charset=utf-8
content-length: 495
set-cookie: sync=CgoIgQIQq8LZkNUuCgoIoQEQq8LZkNUuCgoI4gEQq8LZkNUuCgoI5gEQq8LZkNUuCgoIhwIQq8LZkNUuCgkIORCrwtmQ1S4KCQg6EKvC2ZDVLgoJCAsQq8LZkNUuCgkIXxCrwtmQ1S4KCQgfEKvC2ZDVLg==; Max-Age=7776000; Expires=Wed, 20 Jan 2021 20:53:19 GMT; Path=/sync; Domain=.3lift.com; SameSite=None; Secure tluid=3576232886053331111; Max-Age=7776000; Expires=Wed, 20 Jan 2021 20:53:19 GMT; Path=/; Domain=.3lift.com; SameSite=None; Secure
content-encoding: gzip
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
cache-control: no-cache, no-store, must-revalidate

Redirect headers

status: 302
date: Thu, 22 Oct 2020 20:53:19 GMT
content-length: 0
set-cookie: tluid=3576232886053331111; Max-Age=7776000; Expires=Wed, 20 Jan 2021 20:53:19 GMT; Path=/; Domain=.3lift.com; SameSite=None; Secure
location: /sync?&ld=1
cache-control: no-cache, no-store, must-revalidate
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H/1.1 200
OK showad.js
ads.pubmatic.com/AdServer/js/ Frame 3046 0
0 29ms
28ms Document
text/html 104.111.215.68
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/showad.js
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.111.215.68 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-215-68.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash

Request headers

Host: ads.pubmatic.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Cookie: KTPCACOOKIE=YES; KCCH=YES; pi=156858:2; KADUSERCOOKIE=82A1920A-2E47-4603-961B-1AE14D14B624; chkChromeAb67Sec=1; DPSync3=1604534400%3A201_197_219%7C1603411200%3A174; SyncRTB3=1604534400%3A13_54_56_7_220_21; KRTBCOOKIE_80=16514-CAESEB6DNjhpSztTAEkRrvSLPt0&KRTB&22987-CAESEB6DNjhpSztTAEkRrvSLPt0&KRTB&23025-CAESEB6DNjhpSztTAEkRrvSLPt0; PugT=1603399998; PUBMDCID=3; SPugT=1603399998; KRTBCOOKIE_391=22924-6053347492634300308; KRTBCOOKIE_377=22918-3c55703f-950e-4cbe-888f-820693f3afa9&KRTB&23031-3c55703f-950e-4cbe-888f-820693f3afa9; KRTBCOOKIE_27=16735-uid:2fa95f91-f13d-4100-b31c-969bda18d522&KRTB&16736-uid:2fa95f91-f13d-4100-b31c-969bda18d522&KRTB&23019-uid:2fa95f91-f13d-4100-b31c-969bda18d522&KRTB&23114-uid:2fa95f91-f13d-4100-b31c-969bda18d522
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Response headers

Server: Apache/2.2.15 (CentOS)
Last-Modified: Wed, 21 Oct 2020 18:57:52 GMT
ETag: "13006b6-94f8-5b232eca8cf5e"
Accept-Ranges: bytes
Content-Encoding: gzip
P3P: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
Content-Length: 13837
Content-Type: text/html; charset=UTF-8
X-Akamai-Path-Stats: [1:109:891]
Cache-Control: public, max-age=79945
Expires: Fri, 23 Oct 2020 19:05:44 GMT
Date: Thu, 22 Oct 2020 20:53:19 GMT
Connection: keep-alive
Vary: Accept-Encoding

GET
H2 200 pd
eu-u.openx.net/w/1.0/ Frame 3BBA 0
0 33ms
33ms Document
text/html 34.98.64.218
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://eu-u.openx.net/w/1.0/pd?plm=6&ph=e1b1f5e1-3c2c-4287-9806-317cfbf3bd12&gdpr=0
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.64.218 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/16.195.1 /
Resource Hash

Request headers

:method: GET
:authority: eu-u.openx.net
:scheme: https
:path: /w/1.0/pd?plm=6&ph=e1b1f5e1-3c2c-4287-9806-317cfbf3bd12&gdpr=0
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: i=f21b399a-87d7-443e-9896-8fed7d43a629|1603399994; pd=v2|1603399997|gekin0vNiygu
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Response headers

status: 200
vary: Accept, Accept-Encoding
set-cookie: i=f21b399a-87d7-443e-9896-8fed7d43a629|1603399994; Version=1; Expires=Fri, 22-Oct-2021 20:53:19 GMT; Max-Age=31536000; Secure; Domain=.openx.net; Path=/; SameSite=None pd=v2|1603399997.2|kiiygevNgun0.mWgqsLommOns; Version=1; Expires=Fri, 06-Nov-2020 20:53:19 GMT; Max-Age=1296000; Secure; Domain=.openx.net; Path=/; SameSite=None
server: OXGW/16.195.1
p3p: CP="CUR ADM OUR NOR STA NID"
date: Thu, 22 Oct 2020 20:53:19 GMT
content-type: text/html
content-length: 316
content-encoding: gzip
via: 1.1 google
alt-svc: clear

GET
H/1.1

200
OK

2000891.html
serverbid-sync.nyc3.cdn.digitaloceanspaces.com/ss/ Frame 1E11
Redirect Chain

https://sync.serverbid.com/ss/2000891.html
https://serverbid-sync.nyc3.cdn.digitaloceanspaces.com/ss/2000891.html

0
0

127ms
26ms

Document
text/html

205.185.216.42
HIGHWINDS3

General

Check archive.org

Show headers Download Go to

Full URL

https://serverbid-sync.nyc3.cdn.digitaloceanspaces.com/ss/2000891.html

Requested by

Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

205.185.216.42 Phoenix, United States, ASN20446 (HIGHWINDS3, US),

Reverse DNS

map2.hwcdn.net

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload

Request headers

Host: serverbid-sync.nyc3.cdn.digitaloceanspaces.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Response headers

Date: Thu, 22 Oct 2020 20:53:20 GMT
Connection: Keep-Alive
Cache-Control: max-age=12642
Content-Length: 4947
Content-Type: text/html
Last-Modified: Wed, 20 Nov 2019 20:29:05 GMT
Accept-Ranges: bytes
ETag: "1b0ebac83fe30af80513039edbdf566f"
x-amz-request-id: tx00000000000001030eb24-005f90d122-3ef0e77-nyc3a
Strict-Transport-Security: max-age=15552000; includeSubDomains; preload
Vary: Access-Control-Request-Headers,Access-Control-Request-Method,Origin
X-HW: 1603400000.dop034.lo4.t,1603400000.cds001.lo4.shn,1603400000.dop034.lo4.t,1603400000.cds210.lo4.c

Redirect headers

status: 302
content-length: 0
location: https://serverbid-sync.nyc3.cdn.digitaloceanspaces.com/ss/2000891.html
cache-control: no-cache

GET
H/1.1 200
OK usync.html
eus.rubiconproject.com/ Frame BDF5 0
0 74ms
22ms Document
text/html 104.111.230.142
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.html
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.111.230.142 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-230-142.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash

Request headers

Host: eus.rubiconproject.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Cookie: rsid=1|GN74NFAAofzfRDO61scyIVzmvJ5aKbHTjjBrIpefbksb8dj5YjiPXMXyZb6CieTOKRivvDW4XC3GGCjSXyf/K1KrngFWuVYFyhx5P5iRRkN5zGTGXOMAbP+vG/+NWVuQHr2e+hR/OCifyZBuO/1WxvUs; ses2=; vis2=300372^1; ses15=; vis15=300372^1; khaos=KGLAYHEU-K-A4ZV; audit=1|hLZGFuTafB3yxped848SUjyTC4TA8Crxh45a2CXHi4rxnt1BqOGPlUD3pCcW8TpHcpj76PKZXj8oT2OqK/B16qwRNgFmLHdP
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Response headers

Server: Apache/2.2.15 (CentOS)
Last-Modified: Mon, 28 Sep 2020 17:02:39 GMT
ETag: "4000c-123-5b062a240e9c0"
Accept-Ranges: bytes
Content-Encoding: gzip
Content-Length: 238
Content-Type: text/html; charset=UTF-8
Date: Thu, 22 Oct 2020 20:53:19 GMT
Connection: keep-alive
Vary: Accept-Encoding

GET
H2 200 ixmatch.html
js-sec.indexww.com/um/ Frame E0C4 0
0 24ms
21ms Document
text/html 104.111.215.135
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://js-sec.indexww.com/um/ixmatch.html
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.111.215.135 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-215-135.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash

Request headers

:method: GET
:authority: js-sec.indexww.com
:scheme: https
:path: /um/ixmatch.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Response headers

status: 200
server: Apache
last-modified: Tue, 06 Oct 2020 14:04:48 GMT
etag: "e20015-8f4-5b10114f2003a"
accept-ranges: bytes
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
content-encoding: gzip
content-length: 1136
date: Thu, 22 Oct 2020 20:53:19 GMT

GET
H/1.1 200
OK async_usersync.html
acdn.adnxs.com/dmp/ Frame 92B0 0
0 23ms
23ms Document
text/html 151.101.113.108
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://acdn.adnxs.com/dmp/async_usersync.html
Requested by: Host: qd.admetricspro.com
URL: https://qd.admetricspro.com/js/threatpost/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.113.108 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx/1.13.10 /
Resource Hash

Request headers

Host: acdn.adnxs.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true

Response headers

Connection: keep-alive
Content-Length: 17037
Server: nginx/1.13.10
Content-Type: text/html
Last-Modified: Tue, 24 Mar 2020 15:52:19 GMT
ETag: W/"5e7a2cb3-cefd"
Expires: Fri, 04 Sep 2020 06:04:52 GMT
Cache-Control: max-age=86402
Access-Control-Allow-Origin: *
Content-Encoding: gzip
Via: 1.1 varnish 1.1 varnish
Accept-Ranges: bytes
Date: Thu, 22 Oct 2020 20:53:19 GMT
Age: 53210
X-Served-By: cache-lga21981-LGA, cache-hhn4074-HHN
X-Cache: HIT, HIT
X-Cache-Hits: 1, 670452
X-Timer: S1603400000.753219,VS0,VE0
Vary: Accept-Encoding

GET
H2 204 sync
pixel.advertising.com/ups/56465/ 0
124 B 28ms
25ms Image
text/plain 3.124.119.192
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pixel.advertising.com/ups/56465/sync?_origin=0&redir=true&gdpr=1&gdpr_consent=

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

3.124.119.192 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 204
date: Thu, 22 Oct 2020 20:53:19 GMT
strict-transport-security: max-age=31536000
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H2

204

sync
pixel.advertising.com/ups/55946/
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=adtech_dbm&google_cm&google_hm=MUE5YTU1ZDI5OC0xNGE4LTExZWItOWJhYi0xMmUxZWE0ODkwNGE%3D&gdpr=1&gdpr_consent=&_origin=0
https://pixel.advertising.com/ups/55946/sync?uid=CAESEGx3FviE0sr3PeMTOM-M7AI&gdpr=1&gdpr_consent=&_origin=0&google_cver=1

0
124 B

25ms
24ms

Image
text/plain

3.124.119.192
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pixel.advertising.com/ups/55946/sync?uid=CAESEGx3FviE0sr3PeMTOM-M7AI&gdpr=1&gdpr_consent=&_origin=0&google_cver=1

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

3.124.119.192 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 204
date: Thu, 22 Oct 2020 20:53:19 GMT
strict-transport-security: max-age=31536000
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

Redirect headers

pragma: no-cache
date: Thu, 22 Oct 2020 20:53:19 GMT
server: HTTP server (unknown)
status: 302
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://pixel.advertising.com/ups/55946/sync?uid=CAESEGx3FviE0sr3PeMTOM-M7AI&gdpr=1&gdpr_consent=&_origin=0&google_cver=1
cache-control: no-cache, must-revalidate
content-type: text/html; charset=UTF-8
alt-svc: h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27="googleads.g.doubleclick.net:443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 334
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 generic
match.adsrvr.org/track/cmf/ 70 B
264 B 34ms
32ms Image
image/gif 52.49.73.64
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.adsrvr.org/track/cmf/generic?ttd_pid=aoladtech&gdpr=1&gdpr_consent=
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.49.73.64 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 22 Oct 2020 20:53:19 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
status: 200
cache-control: private,no-cache, must-revalidate
content-type: image/gif
content-length: 70

GET
H2 204 current
aol-match.dotomi.com/match/bounce/ 0
104 B 123ms
79ms Image
text/plain 2a02:fa8:8806:20::2010
VCLK-EU-

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://aol-match.dotomi.com/match/bounce/current?networkId=60&version=1&nuid=1A9a55d298-14a8-11eb-9bab-12e1ea48904a&gdpr=1&gdpr_consent=&rurl=https%3A%2F%2Fpixel.advertising.com%2Fups%2F55853%2Fsync%3Fuid%3D%24UID%26_origin%3D0%26gdpr%3D1%26gdpr_consent%3D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2a02:fa8:8806:20::2010 , Sweden, ASN41041 (VCLK-EU-, SE),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 204
pragma: no-cache
date: Thu, 22 Oct 2020 20:53:19 GMT
cache-control: no-cache, private, max-age=0, no-store
server: nginx
expires: 0

GET
H2

204

setuid
prebid.a-mo.net/
Redirect Chain

https://ssum.casalemedia.com/usermatchredir?s=191503&cb=https%3A%2F%2Fprebid.a-mo.net%2Fsetuid%3FA%3D4c762ce2-848e-4530-919a-2f9644948974%26D%3D%26bidder%3Dindex_rtb%26uid%3D
https://prebid.a-mo.net/setuid?A=4c762ce2-848e-4530-919a-2f9644948974&D=&bidder=index_rtb&uid=X5HxPcbh-dEHVn286ftlbQAA%261209

0
117 B

96ms
96ms

Image
text/plain

136.144.59.88
PACKET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://prebid.a-mo.net/setuid?A=4c762ce2-848e-4530-919a-2f9644948974&D=&bidder=index_rtb&uid=X5HxPcbh-dEHVn286ftlbQAA%261209
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 136.144.59.88 , United States, ASN54825 (PACKET, US),
Reverse DNS
Software: envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 204
date: Thu, 22 Oct 2020 20:53:19 GMT
cache-control: max-age=0, private, must-revalidate
x-envoy-upstream-service-time: 3
server: envoy

Redirect headers

pragma: no-cache
date: Thu, 22 Oct 2020 20:53:19 GMT
server: Apache
status: 302
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
location: https://prebid.a-mo.net/setuid?A=4c762ce2-848e-4530-919a-2f9644948974&D=&bidder=index_rtb&uid=X5HxPcbh-dEHVn286ftlbQAA%261209
cache-control: max-age=0, no-cache, no-store
content-type: text/html; charset=iso-8859-1
content-length: 321
expires: Thu, 22 Oct 2020 20:53:19 GMT

GET
H2

204

sync
pixel.advertising.com/ups/55965/
Redirect Chain

https://pixel.quantserve.com/pixel/p-NcBg8UA4xqUFp.gif?idmatch=0&gdpr=1&gdpr_consent=
https://pixel.advertising.com/ups/55965/sync?_origin=0&gdpr=1&uid=v8DVRuyX306nw4lOupHBEriS1RGnldRB6Z7k-uLF

0
124 B

25ms
24ms

Image
text/plain

3.124.119.192
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pixel.advertising.com/ups/55965/sync?_origin=0&gdpr=1&uid=v8DVRuyX306nw4lOupHBEriS1RGnldRB6Z7k-uLF

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

3.124.119.192 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 204
date: Thu, 22 Oct 2020 20:53:19 GMT
strict-transport-security: max-age=31536000
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

Redirect headers

pragma: no-cache
date: Thu, 22 Oct 2020 20:53:19 GMT
status: 302
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
location: https://pixel.advertising.com/ups/55965/sync?_origin=0&gdpr=1&uid=v8DVRuyX306nw4lOupHBEriS1RGnldRB6Z7k-uLF
cache-control: private, no-cache, no-store, proxy-revalidate
strict-transport-security: max-age=86400
content-length: 0
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H2 403 /
c1.adform.net/serving/cookie/match/ 0
187 B 31ms
29ms Image
text/plain 37.157.6.241
ADFORM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://c1.adform.net/serving/cookie/match/?CC=1&party=15&gdpr=1&gdpr_consent=&curl=https%3A%2F%2Fpixel.advertising.com%2Fups%2F55944%2Fsync%3Fuid%3D%24UID%26_origin%3D0%26gdpr%3d1%26gdpr_consent%3d

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

37.157.6.241 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 22 Oct 2020 20:53:19 GMT
server: nginx
status: 403
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
content-length: 0
expires: -1

GET
H2

204

setuid
prebid.a-mo.net/
Redirect Chain

https://ap.lijit.com/pixel?redir=https%3A%2F%2Fprebid.a-mo.net%2Fsetuid%3FA%3D4c762ce2-848e-4530-919a-2f9644948974%26D%3D%26bidder%3Dsovrn%26uid%3D%24UID
https://prebid.a-mo.net/setuid?A=4c762ce2-848e-4530-919a-2f9644948974&D=&bidder=sovrn&uid=8da88ec2cb1a5a30be9082b2

0
141 B

104ms
104ms

Image
text/plain

136.144.59.88
PACKET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://prebid.a-mo.net/setuid?A=4c762ce2-848e-4530-919a-2f9644948974&D=&bidder=sovrn&uid=8da88ec2cb1a5a30be9082b2
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 136.144.59.88 , United States, ASN54825 (PACKET, US),
Reverse DNS
Software: envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://threatpost.com/shlayer-mac-malware-extra-sneakiness/156669/?web_view=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 204
date: Thu, 22 Oct 2020 20:53:19 GMT
cache-control: max-age=0, private, must-revalidate
x-envoy-upstream-service-time: 2
server: envoy

Redirect headers

Date: Thu, 22 Oct 2020 20:53:19 GMT
Server: nginx
Location: https://prebid.a-mo.net/setuid?A=4c762ce2-848e-4530-919a-2f9644948974&D=&bidder=sovrn&uid=8da88ec2cb1a5a30be9082b2
Access-Control-Allow-Methods: GET, POST, DELETE, PUT
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: true
X-Sovrn-Pod: ad_ap3ams1
Access-Control-Allow-Headers: X-Requested-With, Content-Type
Content-Length: 0

POST
H/1.1 200
OK st Show response
capi.connatix.com/tr/ Frame A818 0
323 B 127ms
126ms XHR
multipart/form-data 18.221.6.219
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://capi.connatix.com/tr/st?v=69601
Requested by: Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.221.6.219 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-221-6-219.us-east-2.compute.amazonaws.com
Software: openresty/1.15.8.2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: multipart/form-data

Response headers

Date: Thu, 22 Oct 2020 20:53:21 GMT
Content-Encoding: gzip
Server: openresty/1.15.8.2
Vary: Accept-Encoding
Content-Type: multipart/form-data
Access-Control-Allow-Origin: https://threatpost.com
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 20

GET
H2 200 avjp Show response
teachingaids-d.openx.net/v/1.0/ Frame A818 92 B
283 B 43ms
42ms XHR
application/json 34.98.64.218
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://teachingaids-d.openx.net/v/1.0/avjp?ju=https%3A%2F%2Fthreatpost.com%2Fshlayer-mac-malware-extra-sneakiness%2F156669%2F%3Fweb_view%3Dtrue&ch=UTF-8&res=1600x1200x24&ifr=true&tz=-120&tws=1600x1200&be=1&bc=hb_pb_3.0.2&dddid=a8c0f588-32d9-4406-a5b8-6710daaffa27&nocache=1603400004665&schain=1.0%2C1!admetricspro.com%2C1%2C1%2C%2C%2C&auid=540882778&vwd=400&vht=225
Requested by: Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid3.25.0-1.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.64.218 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/16.195.1 /
Resource Hash: 004e5faf0bf890f61697daeede9f21826affd1137fb2cb58eaf4719937a04a14

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 22 Oct 2020 20:53:24 GMT
via: 1.1 google
server: OXGW/16.195.1
status: 200
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: https://threatpost.com
cache-control: private, max-age=0, no-cache
access-control-allow-credentials: true
content-type: application/json
alt-svc: clear
content-length: 92
expires: Mon, 26 Jul 1997 05:00:00 GMT

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ Frame A818 19 B
712 B 25ms
25ms XHR
application/json 185.33.221.91
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid3.25.0-1.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.221.91 , Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

721.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

Software

nginx/1.17.9 /

Resource Hash

0c09c070833c786cb25be38bc30992b30bad578f817dbc9e34beacd8b8ea44c5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Thu, 22 Oct 2020 20:53:24 GMT
X-Proxy-Origin: 185.212.171.67; 185.212.171.67; 721.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.223.132:80
AN-X-Request-Uuid: 4dbf462c-b4be-4d6b-82d6-309909749524
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://threatpost.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json; charset=utf-8
Content-Length: 19
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 cygnus Show response
as-sec.casalemedia.com/ Frame A818 24 B
271 B 141ms
141ms XHR
application/json 104.111.215.135
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://as-sec.casalemedia.com/cygnus?t=900&s=435870&v=8.1&r=%7B%22id%22%3A%22314f6e6a130fb5%22%2C%22imp%22%3A%5B%7B%22id%22%3A%223216365e9fd31d5%22%2C%22ext%22%3A%7B%22siteID%22%3A%22435870%22%2C%22sid%22%3A%22400x225%22%7D%2C%22bidfloor%22%3A0.25%2C%22bidfloorcur%22%3A%22USD%22%2C%22video%22%3A%7B%22mimes%22%3A%5B%22video%2Fmp4%22%2C%22video%2Fwebm%22%2C%22application%2Fjavascript%22%2C%22video%2Fogg%22%2C%22video%2Fmpeg%22%5D%2C%22minduration%22%3A0%2C%22maxduration%22%3A180000%2C%22protocols%22%3A%5B1%2C2%2C3%2C4%2C5%2C6%5D%2C%22w%22%3A400%2C%22h%22%3A225%2C%22placement%22%3A1%7D%7D%5D%2C%22site%22%3A%7B%22page%22%3A%22https%3A%2F%2Fthreatpost.com%2Fshlayer-mac-malware-extra-sneakiness%2F156669%2F%3Fweb_view%3Dtrue%22%7D%2C%22ext%22%3A%7B%22source%22%3A%22prebid%22%7D%2C%22source%22%3A%7B%22ext%22%3A%7B%22schain%22%3A%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22admetricspro.com%22%2C%22hp%22%3A1%2C%22sid%22%3A%221%22%7D%5D%7D%7D%7D%7D&ac=j&sd=1&nf=1
Requested by: Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid3.25.0-1.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.111.215.135 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-215-135.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 44ec320c98189b9314e3c4b068b44e22d5fc334b58a4b3a1d2b6d74dca598184

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 22 Oct 2020 20:53:24 GMT
content-encoding: gzip
server: Apache
status: 200
vary: Is-Traffic-Invalid,Accept-Encoding
content-type: application/json
access-control-allow-origin: https://threatpost.com
cache-control: max-age=0, no-cache, no-store
access-control-allow-credentials: true
content-length: 44
expires: Thu, 22 Oct 2020 20:53:24 GMT

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ Frame A818 19 B
712 B 16ms
16ms XHR
application/json 185.33.221.91
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid3.25.0-1.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.221.91 , Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

721.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

Software

nginx/1.17.9 /

Resource Hash

0c09c070833c786cb25be38bc30992b30bad578f817dbc9e34beacd8b8ea44c5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Thu, 22 Oct 2020 20:53:24 GMT
X-Proxy-Origin: 185.212.171.67; 185.212.171.67; 721.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.222.245:80
AN-X-Request-Uuid: 4fec9139-3331-4b91-9ade-5ae17e0b5049
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://threatpost.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json; charset=utf-8
Content-Length: 19
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 cygnus Show response
as-sec.casalemedia.com/ Frame A818 25 B
301 B 107ms
107ms XHR
application/json 104.111.215.135
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://as-sec.casalemedia.com/cygnus?t=900&s=435871&v=8.1&r=%7B%22id%22%3A%2235007fce75a929b%22%2C%22imp%22%3A%5B%7B%22id%22%3A%2236547b74afc6872%22%2C%22ext%22%3A%7B%22siteID%22%3A%22435871%22%2C%22sid%22%3A%22400x225%22%7D%2C%22bidfloor%22%3A0.25%2C%22bidfloorcur%22%3A%22USD%22%2C%22video%22%3A%7B%22mimes%22%3A%5B%22video%2Fmp4%22%2C%22video%2Fwebm%22%2C%22application%2Fjavascript%22%2C%22video%2Fogg%22%2C%22video%2Fmpeg%22%5D%2C%22minduration%22%3A0%2C%22maxduration%22%3A180000%2C%22protocols%22%3A%5B1%2C2%2C3%2C4%2C5%2C6%5D%2C%22w%22%3A400%2C%22h%22%3A225%2C%22placement%22%3A1%7D%7D%5D%2C%22site%22%3A%7B%22page%22%3A%22https%3A%2F%2Fthreatpost.com%2Fshlayer-mac-malware-extra-sneakiness%2F156669%2F%3Fweb_view%3Dtrue%22%7D%2C%22ext%22%3A%7B%22source%22%3A%22prebid%22%7D%2C%22source%22%3A%7B%22ext%22%3A%7B%22schain%22%3A%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22admetricspro.com%22%2C%22hp%22%3A1%2C%22sid%22%3A%221%22%7D%5D%7D%7D%7D%7D&ac=j&sd=1&nf=1
Requested by: Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid3.25.0-1.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.111.215.135 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-215-135.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: cdf06a8c15c30812bf4e4a2dff5a6ff0c40be8c30a3f1948701c8be540af14ed

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 22 Oct 2020 20:53:24 GMT
content-encoding: gzip
server: Apache
status: 200
vary: Is-Traffic-Invalid,Accept-Encoding
content-type: application/json
access-control-allow-origin: https://threatpost.com
cache-control: max-age=0, no-cache, no-store
access-control-allow-credentials: true
content-length: 45
x-akamai-path-stats: [3:423:79577]
expires: Thu, 22 Oct 2020 20:53:24 GMT

POST
H2 204 translator Show response
hbopenbid.pubmatic.com/ Frame A818 0
59 B 40ms
39ms XHR
text/plain 185.64.189.112
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by: Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid3.25.0-1.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.189.112 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

status: 204
date: Thu, 22 Oct 2020 20:53:23 GMT
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
access-control-allow-origin: https://threatpost.com

GET
H2 200 avjp Show response
teachingaids-d.openx.net/v/1.0/ Frame A818 92 B
283 B 37ms
37ms XHR
application/json 34.98.64.218
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://teachingaids-d.openx.net/v/1.0/avjp?ju=https%3A%2F%2Fthreatpost.com%2Fshlayer-mac-malware-extra-sneakiness%2F156669%2F%3Fweb_view%3Dtrue&ch=UTF-8&res=1600x1200x24&ifr=true&tz=-120&tws=1600x1200&be=1&bc=hb_pb_3.0.2&dddid=278b7f04-1863-4b87-abc1-95d7bcf10064&nocache=1603400004677&schain=1.0%2C1!admetricspro.com%2C1%2C1%2C%2C%2C&auid=540882779&vwd=400&vht=225
Requested by: Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid3.25.0-1.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.64.218 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/16.195.1 /
Resource Hash: 004e5faf0bf890f61697daeede9f21826affd1137fb2cb58eaf4719937a04a14

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 22 Oct 2020 20:53:24 GMT
via: 1.1 google
server: OXGW/16.195.1
status: 200
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: https://threatpost.com
cache-control: private, max-age=0, no-cache
access-control-allow-credentials: true
content-type: application/json
alt-svc: clear
content-length: 92
expires: Mon, 26 Jul 1997 05:00:00 GMT

POST
H2 204 translator Show response
hbopenbid.pubmatic.com/ Frame A818 0
59 B 38ms
37ms XHR
text/plain 185.64.189.112
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by: Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid3.25.0-1.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.189.112 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

status: 204
date: Thu, 22 Oct 2020 20:53:24 GMT
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
access-control-allow-origin: https://threatpost.com

POST
H/1.1 204
No Content openrtb Show response
ads.adaptv.advertising.com/rtb/ Frame A818 0
215 B 32ms
32ms XHR
application/json 18.185.185.10
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.adaptv.advertising.com/rtb/openrtb?ext_id=TeachingAidsLLC
Requested by: Host: cds.connatix.com
URL: https://cds.connatix.com/p/plugins/prebid3.25.0-1.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.185.185.10 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-185-185-10.eu-central-1.compute.amazonaws.com
Software: adaptv/1.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://threatpost.com
access-control-allow-credentials: true
server: adaptv/1.0
Connection: keep-alive
content-length: 0
content-type: application/json

OPTIONS
H2 200 0.mp4
vid.connatix.com/54ab44ae-2675-4cee-bcea-ec4cd9d0180b/ Frame 0
0 22ms
22ms Other 151.101.114.137
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://vid.connatix.com/54ab44ae-2675-4cee-bcea-ec4cd9d0180b/0.mp4
Protocol: H2
Server: 151.101.114.137 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Method: GET
Access-Control-Request-Headers: range
Origin: https://threatpost.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

status: 200
retry-after: 0
access-control-allow-origin: *
access-control-allow-methods: *
access-control-allow-headers: range
accept-ranges: bytes
date: Thu, 22 Oct 2020 20:53:26 GMT
x-served-by: cache-hhn4029-HHN
x-cache: HIT
x-cache-hits: 0
x-timer: S1603400006.159062,VS0,VE0
cache-control: max-age=31557600
content-length: 0

GET
H2 206 0.mp4 Show response
vid.connatix.com/54ab44ae-2675-4cee-bcea-ec4cd9d0180b/ Frame A818 407 KB
407 KB 26ms
26ms XHR
video/mp4 151.101.114.137
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://vid.connatix.com/54ab44ae-2675-4cee-bcea-ec4cd9d0180b/0.mp4
Requested by: Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.114.137 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 3edf0837f49625ad64af84f2a4d223b69ea99fb468ebbb2ece40286dbe64b6a1

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Range: bytes=855192-1271452

Response headers

date: Thu, 22 Oct 2020 20:53:26 GMT
last-modified: Mon, 07 Sep 2020 18:49:41 GMT
age: 2114480
etag: "7e14a97a9fd99818d5080eb2d1b8cc43-7"
x-served-by: cache-bwi5129-BWI, cache-hhn4029-HHN
status: 206
x-cache: HIT, HIT
content-type: video/mp4
Content-Range: bytes 855192-1271452/32479190
cache-control: max-age=31557600
accept-ranges: bytes
x-timer: S1603400006.182710,VS0,VE0
access-control-allow-origin: *
Content-Length: 416261
x-cache-hits: 1, 4

Verdicts & Comments Add Verdict or Comment

296 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

5 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.threatpost.com/	1970-01-19 22:47:48	Name: __qca Value: P0-2131591697-1603399993958
.threatpost.com/	1970-01-19 13:23:20	Name: _gat_UA-35676203-21 Value: 1
threatpost.com/	1970-01-29 13:21:53	Name: usprivacy Value: 1---
.threatpost.com/	1970-01-19 13:24:46	Name: _gid Value: GA1.2.1038893946.1603399994
.threatpost.com/	1970-01-20 06:54:31	Name: _ga Value: GA1.2.1567673916.1603399994

59 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/ros-layout.js(Line 372) Message: gBrowserWidth =1600
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/ros-layout.js(Line 397) Message: OpenX Slot defined for /21707124336/ThreatPost-970x250-ATF div-gpt-ad-6794670-2
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/ros-layout.js(Line 397) Message: OpenX Slot defined for /21707124336/ThreatPost-300x250-ATF div-gpt-ad-6794670-3
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/ros-layout.js(Line 397) Message: OpenX Slot defined for /21707124336/ThreatPost-300x600-ATF div-gpt-ad-6794670-5
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/ros-layout.js(Line 397) Message: OpenX Slot defined for /21707124336/ThreatPost-2x2-Skin div-gpt-ad-6794670-1
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/cmp.js(Line 27) Message: %cCMP: Startup v270 color: #555599
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/uspcmp.js(Line 8) Message: uspapi: uspapi_init() - v0.105
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/uspcmp.js(Line 8) Message: USP: Locale=en-us gdpr= false
console-api	warning	URL: https://qd.admetricspro.com/js/threatpost/prebid.js(Line 3) Message: fun-hooks: referenced 'registerAdserver' but it was never created
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: ENGINE: gAMPidentityLinkID not present, prebid configured without identyLink
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: ENGINE: gSChainNodes found, prebid configured with 1 supply chain object(s)
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: ENGINE: final pbjs config
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: [object Object]
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: Initial Ad Load
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: sendBidRequests(): LOOP gGDPRTCData.cmpStatus=undefined
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: CMP not ready, rescheduling sendBidRequests(): gGDPRTCData.cmpStatus=loading
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: sendBidRequests(): LOOP gGDPRTCData.cmpStatus=undefined
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: CMP not ready, rescheduling sendBidRequests(): gGDPRTCData.cmpStatus=loading
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: sendBidRequests(): LOOP gGDPRTCData.cmpStatus=undefined
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: CMP not ready, rescheduling sendBidRequests(): gGDPRTCData.cmpStatus=loading
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: sendBidRequests(): LOOP gGDPRTCData.cmpStatus=undefined
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: CMP not ready, rescheduling sendBidRequests(): gGDPRTCData.cmpStatus=loading
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: sendBidRequests(): LOOP gGDPRTCData.cmpStatus=undefined
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: CMP not ready, rescheduling sendBidRequests(): gGDPRTCData.cmpStatus=loading
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: sendBidRequests(): LOOP gGDPRTCData.cmpStatus=undefined
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: CMP not ready, rescheduling sendBidRequests(): gGDPRTCData.cmpStatus=loading
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/cmp.js(Line 27) Message: %cCMP: GVL version is 45 color: #555599
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/cmp.js(Line 27) Message: __uspLaunch begin
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/cmp.js(Line 27) Message: CMP: No existing consent found in cookie, local or session storage
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/cmp.js(Line 27) Message: CMP: checking non TCF vendor cookie
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/cmp.js(Line 27) Message: CMP: No existing non-TCF consent found in cookie, local or session storage
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: CMP response tcData.eventStatus=cmpuishown tcData.cmpStatus=loaded
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: CMP response tcData.eventStatus=cmpuishown tcData.cmpStatus=loaded
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/cmp.js(Line 27) Message: CMP: Locale=en-us gdpr= false
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/cmp.js(Line 27) Message: CMP: GDPR does not apply
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: CMP response tcData.eventStatus=useractioncomplete tcData.cmpStatus=loaded
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: sendBidRequests(): LOOP gGDPRTCData.cmpStatus=useractioncomplete
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: sendBidRequests() gPBJSTimeoutTimer=null pbjs.adserverRequestSent=undefined
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/uspcmp.js(Line 8) Message: uspapi: No existing consent found in cookie, local or session storage
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: Amazon bids returned, count=4
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: [object Object],[object Object],[object Object],[object Object]
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/uspcmp.js(Line 8) Message: uspapi: No existing consent found in cookie, local or session storage
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: pbjs bids returned
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: gPBJSTimeoutTimer cleared
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: sendAdserverRequest(): pbjsBidsBack
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: sendAdserverRequest()
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: pbjs.getAdserverTargeting: >> Amazon >> Prebid
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: [object Object]
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: pbjs.getBidResponses:
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: [object Object]
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: gThisRefreshSlots=
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: [object Object],[object Object],[object Object],[object Object]
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: sendAdserverRequest(): ---> Calling googletag.pubads().refresh()
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/uspcmp.js(Line 8) Message: uspapi: No existing consent found in cookie, local or session storage
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/engine.js(Line 5) Message: console.groupEnd
console-api	warning	URL: https://cds.connatix.com/p/plugins/prebid3.25.0-1.js(Line 3) Message: fun-hooks: referenced 'registerAdserver' but it was never created
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/uspcmp.js(Line 8) Message: uspapi: geo IP found region North Holland
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/uspcmp.js(Line 8) Message: uspapi: USP does not apply to North Holland
console-api	log	URL: https://qd.admetricspro.com/js/threatpost/uspcmp.js(Line 8) Message: uspapi: Setting not applicable signal

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

acdn.adnxs.com
ads.adaptv.advertising.com
ads.pubmatic.com
ads.servenobid.com
adserver-us.adtech.advertising.com
adservice.google.com
adservice.google.de
analytics.twitter.com
aol-match.dotomi.com
ap.lijit.com
as-sec.casalemedia.com
assets.threatpost.com
b1ae54670d2110ccdffcb33197cc425f.safeframe.googlesyndication.com
c.amazon-adsystem.com
c1.adform.net
capi.connatix.com
cd.connatix.com
cds.connatix.com
cm.g.doubleclick.net
e.serverbid.com
eb2.3lift.com
eu-u.openx.net
eus.rubiconproject.com
fastlane.rubiconproject.com
geo.ipify.org
graph.facebook.com
hbopenbid.pubmatic.com
htlb.casalemedia.com
ib.adnxs.com
img.connatix.com
js-sec.indexww.com
kasperskycontenthub.com
match.adsrvr.org
math-aids-threatpost-tagan.adlightning.com
media.threatpost.com
pagead2.googlesyndication.com
pixel.advertising.com
pixel.quantserve.com
pr-bh.ybp.yahoo.com
prebid.a-mo.net
public.servenobid.com
qd.admetricspro.com
rules.quantcount.com
secure.quantserve.com
securepubads.g.doubleclick.net
serverbid-sync.nyc3.cdn.digitaloceanspaces.com
ssum.casalemedia.com
static.ads-twitter.com
stats.g.doubleclick.net
sync-tm.everesttech.net
sync.serverbid.com
t.co
tagan.adlightning.com
teachingaids-d.openx.net
threatpost.com
tlx.3lift.com
tpc.googlesyndication.com
u.openx.net
ups.analytics.yahoo.com
vid.connatix.com
www.google-analytics.com
www.google.com
www.google.de
www.googletagmanager.com
www.googletagservices.com
www.gstatic.com
www.linkedin.com
www.reddit.com
104.111.215.135
104.111.215.68
104.111.230.142
104.244.42.5
104.244.42.67
136.144.59.88
151.101.112.157
151.101.113.108
151.101.114.137
151.101.114.49
165.227.252.242
178.128.135.80
18.185.185.10
18.221.6.219
185.33.221.91
185.64.189.112
199.232.53.140
205.185.216.42
216.58.208.34
2600:9000:2070:8800:2:9275:3d40:93a1
2600:9000:2093:1a00:6:44e3:f8c0:93a1
2600:9000:2204:d400:0:5c46:4f40:93a1
2606:2800:233:97b6:26be:138a:cba8:bb01
2606:4700:e6::ac40:c502
2620:116:800d:21:36a9:ecb:e518:b308
2620:1ec:21::14
2620:1ec:bdf::10
2a00:1288:110:c305::8000
2a00:1450:4001:801::2001
2a00:1450:4001:816::2003
2a00:1450:4001:818::2003
2a00:1450:4001:820::2002
2a00:1450:4001:821::2004
2a00:1450:4001:824::2008
2a00:1450:4001:824::200e
2a00:1450:400c:c02::84
2a00:1450:400c:c04::9a
2a02:fa8:8806:20::2010
2a03:2880:f01c:800e:face:b00c:0:2
3.124.119.192
3.126.56.137
34.98.64.218
35.173.160.135
37.157.6.241
52.210.177.43
52.222.182.122
52.28.149.230
52.49.73.64
52.85.32.34
54.192.206.94
54.93.144.106
64.140.160.2
69.173.144.143
72.251.249.9
004e5faf0bf890f61697daeede9f21826affd1137fb2cb58eaf4719937a04a14
0119689800eadf6270855a19b65d74251e7da6be5e4686f36c15bf81281ddb4c
01864580e1f385dc4512aed0de4b324cc1a04812709e7020e857612fc0ce9f4c
018890d3981a383d72be4b1847c01c9743907947577befbcc6fc01ebb70a6319
039f2a12a4fefd4b33bcae31f1f2f17d12cf51f4e6301792ada3885f412a2761
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
0535c3bb3a17e4ac0fb7d29214d2181275662129dc2bdd2a89c35934e9fc5ba5
05a58707d25ec9885faf81f026410f37d3757c0689d56b7ec1fc8b2f9cffb9d1
06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844
06fc565587b8b700936a1677218cb269a6cc31ca5f701eb45461e86a3d54d5c7
0c09c070833c786cb25be38bc30992b30bad578f817dbc9e34beacd8b8ea44c5
0cebde58ed4096b547c8ed4e270987cde8227c42c4711d8a93b5b705a6a83642
0eb6e092b4af892f8a7c5c81d4b0ce2e0fc9b9a5430743609e41f478a91f9b5a
172314ff74044b918766ed4763279b5e8798622087c0a2930f59c9d44662213d
1979349603f68a2eb375e5f86d93ba0ebd57db1b2c3f8aabd7edc88a77783daf
1abce1725c88478746e2533d2e423d0ac6e81b0db5e3156a884cf853e725e062
1ae61ed61290f9bf2619f52667aafa622c805072c75765025f0b61a23862005f
1db21d816296e6939ba1f42962496e4134ae2b0081e26970864c40c6d02bb1df
1e6cc52bffa814d7c7912cd64a2ef303e6a2f2387b428173dca05f032bfa5788
21e46fe44c6929876f5a413c843ae516c0ddfd1aad3e8e33446b7bc0a6781b08
25d6fd3b4dcdc05593cab2b4157e21194ada84e5b0de832011246e65d15fe8a9
2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe
2de77164bb9924542e1dea4ee4a0ff27d40b51a3d7939dac7db11a95045c9b7d
2ed06a02ca8267db66014165caf410f7d40f970853edf2ed3396861903afcb3a
3097d0444becd9d089b52b7074072f19201525de874d0775012572fb375b7838
342b02f401e21e4f39970496593115e860a5bd9eef4b9d9bc5d98ef48f37de24
3435531b595fb1b2b529346e1df8c979a1fd727f56ea8c0d792316035440cac5
373f38b6afa32da2444063cd9121fe75256c3626caaf3ea0bc23b31b1bc0cd87
3773223dc3f0b2c5f4ba6310b5eb478b52db9c305623545b0723b10a1e636b14
392cc23864e1d5ec27dc6db139581ea3da476624b962fb3b1f866248f554ae64
39af7c1116fb967a330e8770f775e6b5ee871add01ed45c98a1634911cebfb0a
3e3bed6d3324b9b6076462d26269e9ac5f39df2627a1554dffa00e071e5cec28
3edf0837f49625ad64af84f2a4d223b69ea99fb468ebbb2ece40286dbe64b6a1
41f3222c29889fb48f5dca1d481858e5339a759655510c256ef4edf56c80f7f5
420508fc523520f35de5c851905543294123d7676b5a5668744691f2abe9e730
426706009141ad5502475bac13c268944bc54a6e772d44bf48f653f711d5915d
44ec320c98189b9314e3c4b068b44e22d5fc334b58a4b3a1d2b6d74dca598184
45ddc09b0ad6ab916bd9a0282070b161045e186fc025303f4aa1aa821fc45ac7
4631412a99f82e318d89ced5b93362b6be7bfbfdc53b351f5cf96acc705b9c83
48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438
4d41abdd58cec4c7ff4616601cddb196e4682236db617868f4dfb35aa38a6155
4edf4e4d19fa8ec8abf42e728012fb704a7d8e49a25bbf778b77abd20d90b8ce
506d565f94cecbb486394c545a96e8459217f8d045496b511e8c815142abfc70
54f3aa37078dcd01911c9da1a5fd753b5834dde5acfd90c5bd55243bba87cf6d
56645b53476828932f7160c4542515ae13a10bc3cddf8304e1a41fe8cff39207
5876f68bf30a82eb99d9ec29e561f5c925ea347243c3e022021dd87823c65813
5a46bc08cb30a8b919e04b954cef146b705221482eb16c2d94fb72f2605671ac
5a7ed822968963e31d88424c96387ad9f4fd4f4b5a5b581a33f65e3784d162cf
60863e86aa7743d1ac841da7f473a05cd57fba81d661cef658e385437f80d5ef
6140da23166989914be232f52675943bb623b6d1140f87d648dda5fc9482fdb0
680c268c211b81fee63bd2133ddeca118e1bb9ba9f5ad107e98b3c4d230bf28c
684e786ec2aabe329dcd27a7a14ae377692d5eab3531febe36c4937323683a12
6a76aa61c0110375ed38f64040890a891459986b3a2c72d3c9c774986e86d679
6cdc57f82f4b0d09e5b4e584ca4736cd3871f20563d4ce25120b057d8ffb4eb2
6ceb2be119d08740867f19d7f3e5c2230050de29e4eb48a588b86af1a5b7db57
730a35406038cc57ea6bd2defe63f53dc881741e8b7a46ade69a86a2f16904a6
73339d824e344121a3039b2e0e9c9353fb8132e005bb6d53249814c213520d5d
7385a9cbf08c0f579f845494c316c9e1f97657d704d5e093c3f40e8369f4bd84
745a085b52b8371ec6705413fca70a28c6d8bff0db480e6b124bd08c54e95ef8
747a03fee397ff9cf8a76308966b2cc28f4dd00160af7610bc81ccfcb2836fab
7e2b472509d9e149690aba45c5917ebdd2f52471b98d414c2726301b90e08f21
8247f4332667950989fe6bf790f87723343db2ec83d975503e9c5dc13a6eb5dc
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
850b3b425d962e559df157f0f0427fd40f1e3d5cf0868e5d066ae2ba252e31bd
859faa9b9ed0990288b2f393a102b1fe2668ac79088b113b6f0beaee521221eb
87d73170be9a2e277c57d324c4e05ec0ac60ed3c0191fa29e7a31133b4c4c119
89ce08431545cd3c6d42419d99ee0152027a68c1d0c7c82838cc9a51d9d52451
8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0
91e8f81ef3c99be20d905536aa719b1fd716ce7760080c3ca6b0cd552723535d
921743387e87c4cdca2d5dfe49779a7a1aa1dae8acc34d29a3ca46ee319710da
966490fdaadd070a1e129ca0923fae17f952134c626eab3c6b40f403ccf98938
97a1cb0b1df32c383294ba92e91b9b265534612541621a4d2c46f55100a71c95
98170098ad5b9e0e27bc80b4fab39889cb6437246979ee85680f64bb77d03a08
9ce22df2022b031ce875389b0bc7bbf51cfad0269a259cc67932eed80ec036cd
9d80ceda41f19afaa0d772d357ce922e21d82d58d4100feeb90ed853aef69804
9f4d5cca9c79886cc27246836d97c89aaf7853b2a42b09801660cb9a3df67424
a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8
a32b89473df6ced5953684278e431ae4a01141364fab23812960a0d69c5ab3ee
a9d2b2df99c1a115d5394c70a898d8801092208dc582f8bd6fb01b35c30d6b22
aa64fa30a3263fa3105736228a6feaaa4f7d32d8ef96b12e56f6fb95511b66a7
ac1eed21fdddd6a981458cc46e79523f77a9b44b9b639d9df405c0d9827cc552
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
ae00ae9c862bc8b8923efd1d9a18befa912678a869d4dd01179a59ed3de731be
aef5db68e9c0d1d356b829a3b564e53b6af0119706fba4c7bb8c4091ae948b1e
b0209d39595432d762f6ba2a81dc0bffa6a6e1ed9021ba24ffa06c3c7e4bcb02
b3e65f5bc65f920ed835a1329e8e585275e7c0e93de8a5c5642eab6300a11cef
bf36b362e796fa643d9f49acecc59f3c9058a2a932d0de9c080a095d4b15aaa1
c717b127e11b9121f5480b91aa00c66637c4b25bad4cc9e09be9e3b452087ede
c8ea1f17bd3861e6390ac6bd062d4814525827b03d3cd02c9cdd9b182b2db4d8
ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356
cdf06a8c15c30812bf4e4a2dff5a6ff0c40be8c30a3f1948701c8be540af14ed
d2da3bdfb97c04360c684feeaac2a007c4a391f0b7623a0294f5c8eb3a91afc4
d62a7b7ec5313469ebff5c006b9068dc44d6d1c122cf787ffa29a10113b34060
db26d6c8b9587ef47481a29cf0980a5573a3bb19a83bd6e74bdbec7b049f4c22
dd7d093a1d67babe8e574f94231253e281cf71195d34d8d7035329c655915c90
de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af
df3e003cc30e9bdd0313100e8ee5d468070b4b34d11ad355f276a356d4b9c7bf
e198f86287ebb0423c6cfd5c2dfdef2c2b2a8356b70578499250d9a0d59d1ded
e2d7133e621e56f0d57a39f36ec3fa2a93fd5e33cf167d01fe9cf56fb4d04eed
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e4058d4ee9da1ceaddfa91ddb63650ba67285f1bbfee487d9dfe648bced669a0
e4443984e1267cc313a18e4e42509bc17ea3781c4d873422200ba01fbcacf3eb
e6e8da7667cb5883b577c5d18614e703eacbe633b38112033220fe53c33d4009
e8c207773b5b242229f77be9cde555a9cf5ced8288409f80da3d5192706e40e3
ec95a631650981cd2ff2eecd07118042dee23fc0a3fd6ed70926fa3d94e4e5d3
eceb5dda9ae13230bad3dd67c30f2dd6a46837ac9d438d4c1f5af5f2ef197206
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f19e7ee6cdf20bd478c037707c447b7cd469051de4dadeac32a795efb463c2e2
f4b064d961dd5c30917481f9cf22f400d352737e7dac10d70e574877eef1e8ea
f4f2c0a4763f01ee2b13b4f8189e6fd5f32bd704d71fed8d0f11883de9724198
f6c6a084d20419521fdd0a581b80e41c5d73aeafd60a0224e7776a6826060625
f75166e3f70100b65a6ce1d4128bc15286e92b19a546fa7709f739e9bcfe52c6
f8a2b5b62eb722c3379b30cf0cc58d3176ee6be48036d6ad2aa838d2029c4189
faefd75f566b8481b9eea893e2e2796142041e2c792327347cd225847a89b734
fe00a828c8984aa432d60646922198377e78dba43b704e73ab70d1fd4b9458e9

threatpost.com Open in urlscan Pro 35.173.160.135 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

199 Requests

100 %HTTPS

37 %IPv6

41 Domains

68 Subdomains

53 IPs

8 Countries

3306 kBTransfer

6983 kBSize

5 Cookies

14 Outgoing links

Redirected requests

199 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

threatpost.com Open in urlscan Pro
35.173.160.135 Public Scan

Screenshot
Live screenshot

Full Image

199
Requests

100 %
HTTPS

37 %
IPv6

41
Domains

68
Subdomains

53
IPs

8
Countries

3306 kB
Transfer

6983 kB
Size

5
Cookies

199 HTTP transactions
1 data transactions