content: From a Hacker News thread on the topic: https://news.ycombinator.com/item?id=23273247  It seems like there is a lot of confusion here as to whether this is real or not. I've been able to confirm the behavior in the post by:   Using a new, random executable. Even echo $rand_int will work. Edit: What I mean here is generate your rand int beforehand and statically include it in your script.   Using a fresh filename too. Just throw a rand int at the end there. e.g. /tmp/test4329.sh   I MITMd myself while recording the network traffic and, sure enough, there is a request to ocsp.apple.com with a hash in the URL path and a bunch of binary data in the response body. Unsure what it is yet but the URL suggests it is generating a cert for the binary and checking it. See: https://en.wikipedia.org/wiki/Online_Certificate_Status_Prot... Here's the URL I saw: http://ocsp.apple.com/ocsp-devid01/ME4wTKADAgEAMEUwQzBBMAkGBSsOAwIaBQAEFDOB0e%2FbaLCFIU0u76%2BMSmlkPCpsBBRXF%2B2iz9x8mKEQ4Py%2Bhy0s8uMXVAIIfYbtkeEKZsI%3D