http://securityboulevard.com/2026/03/fake-cleanmymac-site-installs-shub-stealer-and-backdoors-crypto-wallets/
Report summary
Submitted and final observations · captured HTTP activity
- Submitted URL
- http://securityboulevard.com/2026/03/fake-cleanmymac-site-installs-shub-stealer-and-backdoors-crypto-wallets/
- Submitted IP / ASN
172.66.146.12 AS13335 · CLOUDFLARENET
- Final URL
- https://securityboulevard.com/2026/03/fake-cleanmymac-site-installs-shub-stealer-and-backdoors-crypto-wallets/
- Final IP / ASN
172.66.146.12 AS13335 · CLOUDFLARENET
Final page
- Page title
- Fake CleanMyMac site installs SHub Stealer and backdoors crypto wallets - Security Boulevard
- Final DOM MIME
- text/html; charset=utf-8
- Final DOM size
- 652.9 KB (668557 bytes)
Detections
Activity
- HTTP requests
- 203
- Observed hosts
- 14
- Script records
- 86
Estimated HTTP data
- Sent
- ~163.0 KB
- Received
- ~7.66 MB
Page capture
Final browser state
available for this report.
Detection signals
URLQuery findings, Threat Detection Systems, and IDS alerts
Absence of findings is not a clean verdict.
Host infrastructure
Observed hosts are context, not independent maliciousness verdicts
| Host | Rank | Registered | First seen | Last seen | Sent | Received | IP | Fingerprints |
|---|---|---|---|---|---|---|---|---|
| images.squarespace-cdn.com | 38064 | 2019-01-24 | 2019-02-20 | 2026-06-22 | 650 B | 630 B | Varnish Caching Varnish is a reverse caching proxy. | |
| static.addtoany.com | 28267 | 2006-03-10 | 2012-05-21 | 2026-06-22 | 468 B | 4.3 KB | HSTS Security HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS. Cloudflare CDN Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services. | |
| securityboulevard.com | 61483 | 2011-03-05 | 2017-09-18 | 2026-05-01 | 154.8 KB | 6.35 MB | Cloudflare CDN Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services. Moxie:1.3.5.1 Widgets, Accessibility Pollyfills for XHR2 and File API Google Hosted Libraries CDN Google Hosted Libraries is a stable, reliable, high-speed, globally available content distribution network for the most popular, open-source JavaScript libraries. Yoast SEO:27.7 SEO, WordPress plugins Yoast SEO is a search engine optimisation plugin for WordPress and other platforms. Magnific Popup JavaScript libraries Magnific Popup is a responsive lightbox & dialog script with focus on performance and providing best experience for user with any device. Yoast SEO Premium:27.7 SEO Yoast SEO Premium is a search engine optimisation plugin for WordPress and other platforms. MySQL Databases MySQL is an open-source relational database management system. Max Mega Menu:3.6.2 Widgets, WordPress plugins Max Mega Menu is a popular WordPress plugin that enhances the menu functionality on WordPress websites. The Events Calendar WordPress plugins The Events Calendar is a free event management plugin for WordPress. CookieYes Cookie compliance Not recorded AddToAny Widgets AddToAny is a universal sharing platform that can be integrated into a website by use of a web widget or plugin. DataTables JavaScript libraries DataTables is a plug-in for the jQuery Javascript library adding advanced features like pagination, instant search, themes, and more to any HTML table. Underscore.js:1.13.7 JavaScript libraries Underscore.js is a JavaScript library which provides utility functions for common programming tasks. It is comparable to features provided by Prototype.js and the Ruby language, but opts for a functional programming design instead of extending object prototypes. Clipboard.js JavaScript libraries Not recorded PHP Programming languages PHP is a general-purpose scripting language used for web development. ThemeGrill ColorMag WordPress themes ThemeGrill ColorMag is most popular magazine-newspaper style WordPress theme. FitVids.JS:20150311 Widgets, Video players jQuery plugin for fluid width video embeds Slick JavaScript libraries Not recorded TinyMCE Rich text editors TinyMCE is an online rich-text editor released as open-source software. TinyMCE is designed to integrate with JavaScript libraries, Vue.js, and AngularJS as well as content management systems such as Joomla!, and WordPress. Google AdSense Advertising Google AdSense is a program run by Google through which website publishers serve advertisements that are targeted to the site content and audience. Kinsta PaaS, Hosting Kinsta is a leading managed WordPress hosting provider, prioritizing speed and security. Gravatar Miscellaneous Gravatar is a service for providing globally unique avatars. Jetpack WordPress plugins Jetpack is a popular WordPress plugin created by Automattic, the people behind WordPress.com. Cloudflare Browser Insights Analytics, RUM Cloudflare Browser Insights is a tool that measures the performance of websites from the perspective of users. Google Publisher Tag Advertising Google Publisher Tag (GPT) is an ad tagging library for Google Ad Manager which is used to dynamically build ad requests. OWL Carousel JavaScript libraries OWL Carousel is an enabled jQuery plugin that lets you create responsive carousel sliders. jQuery Migrate:3.4.1 JavaScript libraries Query Migrate is a javascript library that allows you to preserve the compatibility of your jQuery code developed for versions of jQuery older than 1.9. OneSignal Marketing automation, A/B Testing OneSignal is a customer engagement messaging solution. cdnjs CDN cdnjs is a free distributed JS library delivery service. ContentViews:4.2 Widgets, WordPress plugins ContentViews is a lightweight and user-friendly WordPress Plugin, crafted specifically for efficient content management and display. This plugin offers seamless integration with Widgets and enables users to showcase their posts, pages, or custom post types in a highly responsive grid, list, or timeline layout. AddToAny Share Buttons:1.1 WordPress plugins AddToAny Share Buttons plugin for WordPress increases traffic and engagement by helping people share your posts and pages to any service. WordPress:6.8.3 CMS, Blogs WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. Features include a plugin architecture and a template system. jQuery:3.5.1 JavaScript libraries jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax. Plupload:2.1.9 JavaScript libraries Plupload is a JavaScript API for dealing with file uploads. ColorMag:6.8.3 WordPress themes ColorMag theme is for creating news, magazine, newspaper and other kinds of publishing sites. Compatible with Elementor. Moment.js JavaScript libraries Moment.js is a free and open-source JavaScript library that removes the need to use the native JavaScript Date object directly. DoubleClick for Publishers (DFP) Advertising DoubleClick for Publishers (DFP) is a hosted ad serving platform that streamlines your ad management. Backbone.js JavaScript frameworks BackboneJS is a JavaScript library that allows to develop and structure the client side applications that run in a web browser. Google Tag Manager Tag managers Google Tag Manager is a tag management system (TMS) that allows you to quickly and easily update measurement codes and related code fragments collectively known as tags on your website or mobile app. SiteOrigin Widgets Bundle:1.70.0 WordPress plugins SiteOrigin Widgets Bundle is a WordPress plugin that gives you all the elements you need to build modern, responsive, and engaging website pages. | |
| cdnjs.cloudflare.com | 1222 | 2009-02-17 | 2012-05-23 | 2026-06-21 | 519 B | 0 B | Not recorded | |
| stats.wp.com | 22660 | 1997-03-28 | 2017-01-30 | 2026-06-22 | 460 B | 0 B | Not recorded | |
| secure.gravatar.com | 16323 | 2004-07-15 | 2012-05-22 | 2026-06-22 | 482 B | 0 B | Not recorded | |
| ajax.googleapis.com | 3691 | 2005-01-25 | 2012-05-22 | 2026-06-22 | 507 B | 88.3 KB | ||
| www.dmca.com | 442170 | 2000-05-18 | 2012-11-29 | 2026-06-20 | 564 B | 0 B | Not recorded | |
| fonts.googleapis.com | 313 | 2005-01-25 | 2012-05-23 | 2026-06-21 | 1.0 KB | 21.7 KB | HSTS Security HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS. | |
| techstronggroup.com | 1695387 | 2021-06-05 | 2021-06-09 | 2026-06-12 | 595 B | 0 B | Not recorded | |
| plausible.io | 8565 | 2018-12-30 | 2019-02-01 | 2026-06-22 | 479 B | 6.7 KB | Bunny CDN Not recorded | |
| js.hsforms.net | 43845 | 2013-09-18 | 2013-09-26 | 2026-06-25 | 930 B | 1.16 MB | Amazon Web Services PaaS Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality. HSTS Security HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS. Amazon CloudFront CDN Amazon CloudFront is a fast content delivery network (CDN) service that securely delivers data, videos, applications, and APIs to customers globally with low latency, high transfer speeds. Cloudflare CDN Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services. Cloudflare Bot Management Security Cloudflare bot management solution identifies and mitigates automated traffic to protect websites from bad bots. | |
| cdn-cookieyes.com | 9847 | 2020-04-22 | 2020-04-26 | 2026-06-22 | 1015 B | 26.3 KB | Amazon Web Services PaaS Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality. Cloudflare CDN Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services. | |
| log.cookieyes.com | 39345 | 2018-06-03 | 2022-05-25 | 2026-06-28 | 594 B | 0 B | Not recorded |