blog.securolytics.io Open in urlscan Pro
54.173.173.29 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://blog.securolytics.io/2017/05/split-tunnel-smtp-exploit-explained/
Submission: On May 30 via manual (May 30th 2017, 5:03:26 am UTC) from IN

Summary HTTP 72 Redirects Links 27 Behaviour Indicators

Summary

This website contacted 13 IPs in 3 countries across 11 domains to perform 72 HTTP transactions. The main IP is 54.173.173.29, located in Ashburn, United States and belongs to AMAZON-AES - Amazon.com, Inc., US. The main domain is blog.securolytics.io.
TLS certificate: Issued by COMODO RSA Organization Validation Se... on June 13th 2016. Valid for: a year.

This is the only time blog.securolytics.io was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
43	54.173.173.29 54.173.173.29	14618 (AMAZON-AES) (AMAZON-AES - Amazon.com)
2	198.232.125.123 198.232.125.123	3257 (GTT-BACKB...) (GTT-BACKBONE GTT)
2	2a00:1450:400... 2a00:1450:4001:816::200a	15169 (GOOGLE) (GOOGLE - Google Inc.)
2	2400:cb00:204... 2400:cb00:2048:1::6814:6e27	13335 (CLOUDFLAR...) (CLOUDFLARENET - CloudFlare)
1	8.40.222.106 8.40.222.106	2639 (ZOHO-AS) (ZOHO-AS - ZOHO)
4	2a00:1450:400... 2a00:1450:4001:816::200e	15169 (GOOGLE) (GOOGLE - Google Inc.)
2	8.40.222.111 8.40.222.111	2639 (ZOHO-AS) (ZOHO-AS - ZOHO)
5	2a00:1450:400... 2a00:1450:4001:816::2003	15169 (GOOGLE) (GOOGLE - Google Inc.)
1	2a00:1450:400... 2a00:1450:400c:c04::9d	15169 (GOOGLE) (GOOGLE - Google Inc.)
2	178.162.208.180 178.162.208.180	28753 (LEASEWEB-) (LEASEWEB-)
5	8.40.222.123 8.40.222.123	2639 (ZOHO-AS) (ZOHO-AS - ZOHO)
1	74.201.154.73 74.201.154.73	2639 (ZOHO-AS) (ZOHO-AS - ZOHO)
72	13

43 54.173.173.29 (Ashburn, United States)

ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
PTR: ec2-54-173-173-29.compute-1.amazonaws.com

blog.securolytics.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 198.232.125.123 (Los Angeles, United States)

ASN3257 (GTT-BACKBONE GTT, DE)
PTR: 123-125-232-198.static.unitasglobal.net

maxcdn.bootstrapcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:816::200a (Ireland)

ASN15169 (GOOGLE - Google Inc., US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2400:cb00:2048:1::6814:6e27 (United States)

ASN13335 (CLOUDFLARENET - CloudFlare, Inc., US)

static.addtoany.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 8.40.222.106 (United States)

ASN2639 (ZOHO-AS - ZOHO, US)

crm.zoho.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:816::200e (Ireland)

ASN15169 (GOOGLE - Google Inc., US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 8.40.222.111 (United States)

ASN2639 (ZOHO-AS - ZOHO, US)

salesiq.zoho.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a00:1450:4001:816::2003 (Ireland)

ASN15169 (GOOGLE - Google Inc., US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:400c:c04::9d (Ireland)

ASN15169 (GOOGLE - Google Inc., US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 178.162.208.180 (Germany)

ASN28753 (LEASEWEB-, DE)
PTR: sni.de-aurora-dc.cldsrv.biz

teknas.piwikpro.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 8.40.222.123 (United States)

ASN2639 (ZOHO-AS - ZOHO, US)

css.zohostatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
js.zohostatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
img.zohostatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 74.201.154.73 (United States)

ASN2639 (ZOHO-AS - ZOHO, US)

img.zohostatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
43	securolytics.io blog.securolytics.io	5 MB
6	zohostatic.com css.zohostatic.com js.zohostatic.com img.zohostatic.com	80 KB
5	gstatic.com fonts.gstatic.com	99 KB
4	google-analytics.com www.google-analytics.com	24 KB
3	zoho.com crm.zoho.com salesiq.zoho.com	13 KB
2	piwikpro.com teknas.piwikpro.com	21 KB
2	addtoany.com static.addtoany.com	24 KB
2	googleapis.com fonts.googleapis.com	2 KB
2	bootstrapcdn.com maxcdn.bootstrapcdn.com	70 KB
1	doubleclick.net stats.g.doubleclick.net	53 B
0	zohopublic.com Failed salesiq.zohopublic.com Failed
72	11

	Domain	Requested by
43	blog.securolytics.io	blog.securolytics.io
5	fonts.gstatic.com	blog.securolytics.io
4	www.google-analytics.com	blog.securolytics.io
3	img.zohostatic.com	js.zohostatic.com blog.securolytics.io
2	js.zohostatic.com	salesiq.zoho.com
2	teknas.piwikpro.com	blog.securolytics.io
2	salesiq.zoho.com	blog.securolytics.io
2	static.addtoany.com	blog.securolytics.io static.addtoany.com
2	fonts.googleapis.com	blog.securolytics.io
2	maxcdn.bootstrapcdn.com	blog.securolytics.io
1	css.zohostatic.com	salesiq.zoho.com
1	stats.g.doubleclick.net	blog.securolytics.io
1	crm.zoho.com	blog.securolytics.io
0	salesiq.zohopublic.com Failed	js.zohostatic.com
72	14

This site contains links to these domains. Also see Links.

Domain
www.esmc.org
securolytics.io
securol.yt
www.virustotal.com
christianacare.org
www.youtube.com
infosechotspot.com
kristieraynormi.wordpress.com
eddieharrisnj.wordpress.com
institute.org
www.addtoany.com

Subject Issuer	Validity	Valid
*.securolytics.io COMODO RSA Organization Validation Secure Server CA	`2016-06-13` - `2017-06-13`	a year	crt.sh
*.bootstrapcdn.com RapidSSL SHA256 CA	`2016-10-13` - `2017-10-13`	a year	crt.sh
*.googleapis.com Google Internet Authority G2	`2017-05-24` - `2017-08-16`	3 months	crt.sh
ssl472428.cloudflaressl.com COMODO ECC Domain Validation Secure Server CA 2	`2016-12-15` - `2017-10-25`	10 months	crt.sh
*.zoho.com COMODO SHA-256 Domain Validation Secure Server CA	`2017-02-17` - `2019-05-28`	2 years	crt.sh
*.google-analytics.com Google Internet Authority G2	`2017-05-24` - `2017-08-16`	3 months	crt.sh
*.google.com Google Internet Authority G2	`2017-05-24` - `2017-08-16`	3 months	crt.sh
*.g.doubleclick.net Google Internet Authority G2	`2017-05-24` - `2017-08-16`	3 months	crt.sh
*.piwikpro.com COMODO RSA Domain Validation Secure Server CA	`2017-05-08` - `2018-08-08`	a year	crt.sh
*.zohostatic.com COMODO SHA-256 Organization Validation Secure Server CA	`2016-12-19` - `2019-04-10`	2 years	crt.sh

This page contains 3 frames:

Primary Page: https://blog.securolytics.io/2017/05/split-tunnel-smtp-exploit-explained/
Frame ID: 6410.1
Requests: 71 HTTP requests in this frame

Frame: https://static.addtoany.com/menu/sm.16.html
Frame ID: 6410.2
Requests: 1 HTTP requests in this frame

Frame: https://salesiq.zohopublic.com/teknas/drawchat.ls?src=script&type=float&referrer=&pagetitle=Securolytics%20%7C%20Blog&embedname=securolytics&cpage=aHR0cHM6Ly9ibG9nLnNlY3Vyb2x5dGljcy5pby8yMDE3LzA1L3NwbGl0LXR1bm5lbC1zbXRwLWV4cGxvaXQtZXhwbGFpbmVkLw%3D%3D&autochat=false&lang=en&loadedtime=1496120596490
Frame ID: 6410.3
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Statistics

72
Requests

97 %
HTTPS

42 %
IPv6

11
Domains

14
Subdomains

13
IPs

3
Countries

5273 kB
Transfer

5608 kB
Size

12
Cookies

27 Outgoing links

These are links going to different origins than the main page.

URL: http://www.esmc.org/
Title: Excelsior Springs Hospital

Search URL Search Domain Scan URL

URL: https://securolytics.io/free-tools/exploitable-port-scanner/
Title: Securolytics Exploitable IoT Scanner

Search URL Search Domain Scan URL

URL: http://securol.yt/microsoft-ExchangeBuilds
Title: List of Microsoft Exchange Build Numbers

Search URL Search Domain Scan URL

URL: https://www.virustotal.com/en/file/39cb85066f09ece243c60fd192877ef6fa1162ff0b83ac8bec16e6df495ee7af/analysis/1495234308/
Title: VirusTotal’s URL Analysis

Search URL Search Domain Scan URL

URL: https://christianacare.org/
Title: Christiana Care Health System

Search URL Search Domain Scan URL

URL: http://securol.yt/microsoft-MHA
Title: Try Microsoft’s Message Header Analyzer Tool

Search URL Search Domain Scan URL

URL: http://securol.yt/2017-IBM-X-Force-TII
Title: X-Force

Search URL Search Domain Scan URL

URL: http://securol.yt/oqGYiK
Title: 2017 Data Breach Industry Forecast

Search URL Search Domain Scan URL

URL: https://www.youtube.com/watch?v=PZvVjHXIKIY
Title: Google Phishing:

Search URL Search Domain Scan URL

URL: http://securol.yt/OrDLfb
Title: Risk Management Framework

Search URL Search Domain Scan URL

URL: http://securol.yt/EO-13800
Title: Executive Order 13800

Search URL Search Domain Scan URL

URL: https://securolytics.io/enforce/
Title: securolytics.io/enforce

Search URL Search Domain Scan URL

URL: http://infosechotspot.com/split-tunnel-smtp-exploit-bypasses-email-security-gateways/
Title: InfoSecHotSpot

Search URL Search Domain Scan URL

URL: https://kristieraynormi.wordpress.com/2016/12/22/stannscio-david-moufarrege-3/
Title: @StAnnsCIO David Moufarrege | Kristie Raynor's Blog

Search URL Search Domain Scan URL

URL: https://eddieharrisnj.wordpress.com/2016/12/22/stannscio-david-moufarrege-3/
Title: @StAnnsCIO David Moufarrege | Eddie Harris Blog

Search URL Search Domain Scan URL

URL: http://institute.org/
Title: JC

Search URL Search Domain Scan URL

URL: https://securolytics.io/free-tools
Title: Free Tools

Search URL Search Domain Scan URL

URL: https://securolytics.io/products/enforce/
Title: Products

Search URL Search Domain Scan URL

URL: https://securolytics.io/industry-solutions/accounting/
Title: Solutions

Search URL Search Domain Scan URL

URL: https://securolytics.io/customers/
Title: customers

Search URL Search Domain Scan URL

URL: https://securolytics.io/partners/
Title: Partners

Search URL Search Domain Scan URL

URL: https://securolytics.io/company/about-us/
Title: Company

Search URL Search Domain Scan URL

URL: http://securol.yt/wfacebook

Search URL Search Domain Scan URL

URL: http://securol.yt/wtwitter

Search URL Search Domain Scan URL

URL: http://securol.yt/wlinkedin

Search URL Search Domain Scan URL

URL: https://securolytics.io/company/about-us/#contact-us
Title: Contact Us

Search URL Search Domain Scan URL

URL: https://www.addtoany.com/
Title: AddToAny

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request 27

http://blog.securolytics.io/wp-content/uploads/2017/05/split-tunnel-smtp-attack2-image-karen-kedda.png
https://blog.securolytics.io/wp-content/uploads/2017/05/split-tunnel-smtp-attack2-image-karen-kedda.png

Request 37

http://blog.securolytics.io/wp-content/uploads/2017/05/split-tunnel-smtp-attack2-image-cip.png
https://blog.securolytics.io/wp-content/uploads/2017/05/split-tunnel-smtp-attack2-image-cip.png

Request 39

http://blog.securolytics.io/wp-content/uploads/2017/05/securolytics-NIST-risk-management-framework.gif
https://blog.securolytics.io/wp-content/uploads/2017/05/securolytics-NIST-risk-management-framework.gif

72 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request / Show response
blog.securolytics.io/2017/05/split-tunnel-smtp-exploit-explained/ 73 KB
73 KB 749ms
421ms Document
text/html 54.173.173.29
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.securolytics.io/2017/05/split-tunnel-smtp-exploit-explained/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

54.173.173.29 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),

Reverse DNS

ec2-54-173-173-29.compute-1.amazonaws.com

Software

Apache/2.2.31 (Amazon) / PHP/5.6.30

Resource Hash

832f4c005adacc0be0855de8bd9cc3937ca1363a3121e84edab98706b2334140

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; preload

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate, sdch, br
Host: blog.securolytics.io
Accept-Language: en-US,en;q=0.8
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Cache-Control: no-cache
Connection: keep-alive
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36

Response headers

X-Pingback: https://blog.securolytics.io/xmlrpc.php
Date: Tue, 30 May 2017 05:03:11 GMT
Server: Apache/2.2.31 (Amazon)
X-Powered-By: PHP/5.6.30
Strict-Transport-Security: max-age=63072000; preload
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: close
Link: <https://blog.securolytics.io/wp-json/>; rel="https://api.w.org/" <https://blog.securolytics.io/?p=983>; rel=shortlink

GET
H2 200 font-awesome.min.css
maxcdn.bootstrapcdn.com/font-awesome/4.4.0/css/ 26 KB
7 KB 33ms
6ms Stylesheet
text/css 198.232.125.123
GTT-BACKBONE GTT

General

Check archive.org

Show headers Download Go to

Full URL: https://maxcdn.bootstrapcdn.com/font-awesome/4.4.0/css/font-awesome.min.css
Requested by: Host: blog.securolytics.io
URL: https://blog.securolytics.io/2017/05/split-tunnel-smtp-exploit-explained/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 198.232.125.123 Los Angeles, United States, ASN3257 (GTT-BACKBONE GTT, DE),
Reverse DNS: 123-125-232-198.static.unitasglobal.net
Software: NetDNA-cache/2.2 /
Resource Hash: 936ffccdc35bc55221e669d0e76034af76ba8c080c1b1149144dbbd3b5311829

Request headers

:path: /font-awesome/4.4.0/css/font-awesome.min.css
pragma: no-cache
accept-encoding: gzip, deflate, sdch, br
accept-language: en-US,en;q=0.8
user-agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36
accept: text/css,*/*;q=0.1
cache-control: no-cache
:authority: maxcdn.bootstrapcdn.com
referer: https://blog.securolytics.io/2017/05/split-tunnel-smtp-exploit-explained/
:scheme: https
:method: GET
Referer: https://blog.securolytics.io/2017/05/split-tunnel-smtp-exploit-explained/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36

Response headers

date: Tue, 30 May 2017 05:03:11 GMT
content-encoding: gzip
last-modified: Tue, 28 Jul 2015 22:47:56 GMT
server: NetDNA-cache/2.2
status: 200
etag: W/"0831cba6a670e405168b84aa20798347"
vary: Accept-Encoding
x-cache: HIT
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=31104000
x-hello-human: Say hello back! @getBootstrapCDN on Twitter
expires: Fri, 25 May 2018 05:03:11 GMT

GET
H/1.1 200
OK stylesheet.css
blog.securolytics.io/wp-content/themes/cloudstat/css/league-gothic/ 620 B
620 B 295ms
97ms Stylesheet
text/css 54.173.173.29
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.securolytics.io/wp-content/themes/cloudstat/css/league-gothic/stylesheet.css

Requested by

Host: blog.securolytics.io
URL: https://blog.securolytics.io/2017/05/split-tunnel-smtp-exploit-explained/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

54.173.173.29 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),

Reverse DNS

ec2-54-173-173-29.compute-1.amazonaws.com

Software

Apache/2.2.31 (Amazon) /

Resource Hash

59d8be33249f70db42ba649db05211213d176d3c45b0528796787a25668e51a3

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; preload

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate, sdch, br
Host: blog.securolytics.io
Accept-Language: en-US,en;q=0.8
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36
Accept: text/css,*/*;q=0.1
Referer: https://blog.securolytics.io/2017/05/split-tunnel-smtp-exploit-explained/
Connection: keep-alive
Cache-Control: no-cache
Referer: https://blog.securolytics.io/2017/05/split-tunnel-smtp-exploit-explained/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36

Response headers

Date: Tue, 30 May 2017 05:03:11 GMT
Last-Modified: Tue, 20 Sep 2016 09:27:49 GMT
Server: Apache/2.2.31 (Amazon)
ETag: "81e7f-26c-53ced0ac46ae3"
Strict-Transport-Security: max-age=63072000; preload
Content-Type: text/css
Connection: close
Accept-Ranges: bytes
Content-Length: 620

GET
H2 200 css
fonts.googleapis.com/ 753 B
344 B 33ms
16ms Stylesheet
text/css 2a00:1450:4001:816::200a
Google Inc.

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Fjalla+One

Requested by

Host: blog.securolytics.io
URL: https://blog.securolytics.io/2017/05/split-tunnel-smtp-exploit-explained/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a00:1450:4001:816::200a , Ireland, ASN15169 (GOOGLE - Google Inc., US),

Reverse DNS

Software

ESF /

Resource Hash

706e5b2dfc346c82f9a2feb0b29aad87c922cd0b07b8b25f04abc6d9d510cfa0

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

:path: /css?family=Fjalla+One
pragma: no-cache
accept-encoding: gzip, deflate, sdch, br
accept-language: en-US,en;q=0.8
user-agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36
accept: text/css,*/*;q=0.1
cache-control: no-cache
:authority: fonts.googleapis.com
referer: https://blog.securolytics.io/2017/05/split-tunnel-smtp-exploit-explained/
:scheme: https
x-client-data: CIi2yQEIpLbJAQ==
:method: GET
Referer: https://blog.securolytics.io/2017/05/split-tunnel-smtp-exploit-explained/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36

Response headers

date: Tue, 30 May 2017 05:03:11 GMT
content-encoding: br
last-modified: Tue, 30 May 2017 05:03:11 GMT
server: ESF
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
status: 200
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="38,37,36,35"
x-xss-protection: 1; mode=block
expires: Tue, 30 May 2017 05:03:11 GMT

GET
H2 200 css
fonts.googleapis.com/ 13 KB
1 KB 34ms
18ms Stylesheet
text/css 2a00:1450:4001:816::200a
Google Inc.

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Lato%3A300%2C400%2C700%2C900%2C300italic%2C400italic%7CRoboto%3A400%2C300%2C500%2C700&subset=latin%2Clatin-ext

Requested by

Host: blog.securolytics.io
URL: https://blog.securolytics.io/2017/05/split-tunnel-smtp-exploit-explained/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a00:1450:4001:816::200a , Ireland, ASN15169 (GOOGLE - Google Inc., US),

Reverse DNS

Software

ESF /

Resource Hash

72fbe85629bc27977fd8684d84b51f659de98bb453d420938f6d8fc30f1238fa

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

:path: /css?family=Lato%3A300%2C400%2C700%2C900%2C300italic%2C400italic%7CRoboto%3A400%2C300%2C500%2C700&subset=latin%2Clatin-ext
pragma: no-cache
accept-encoding: gzip, deflate, sdch, br
accept-language: en-US,en;q=0.8
user-agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36
accept: text/css,*/*;q=0.1
cache-control: no-cache
:authority: fonts.googleapis.com
referer: https://blog.securolytics.io/2017/05/split-tunnel-smtp-exploit-explained/
:scheme: https
x-client-data: CIi2yQEIpLbJAQ==
:method: GET
Referer: https://blog.securolytics.io/2017/05/split-tunnel-smtp-exploit-explained/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36

Response headers

date: Tue, 30 May 2017 05:03:11 GMT
content-encoding: br
last-modified: Tue, 30 May 2017 05:03:11 GMT
server: ESF
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
status: 200
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="38,37,36,35"
x-xss-protection: 1; mode=block
expires: Tue, 30 May 2017 05:03:11 GMT

GET
H/1.1 200
OK style.css
blog.securolytics.io/wp-content/themes/cloudstat/ 17 KB
17 KB 295ms
97ms Stylesheet
text/css 54.173.173.29
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.securolytics.io/wp-content/themes/cloudstat/style.css?ver=4.6.1

Requested by

Host: blog.securolytics.io
URL: https://blog.securolytics.io/2017/05/split-tunnel-smtp-exploit-explained/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

54.173.173.29 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),

Reverse DNS

ec2-54-173-173-29.compute-1.amazonaws.com

Software

Apache/2.2.31 (Amazon) /

Resource Hash

b3b4d55dfe55b3f2000383a5c30d0e78709947144b79b54ebb0f22ef8f02f0e6

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; preload

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate, sdch, br
Host: blog.securolytics.io
Accept-Language: en-US,en;q=0.8
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36
Accept: text/css,*/*;q=0.1
Referer: https://blog.securolytics.io/2017/05/split-tunnel-smtp-exploit-explained/
Connection: keep-alive
Cache-Control: no-cache
Referer: https://blog.securolytics.io/2017/05/split-tunnel-smtp-exploit-explained/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36

Response headers

Date: Tue, 30 May 2017 05:03:11 GMT
Last-Modified: Sun, 21 May 2017 21:43:13 GMT
Server: Apache/2.2.31 (Amazon)
ETag: "80081-4293-5500fa43a767b"
Strict-Transport-Security: max-age=63072000; preload
Content-Type: text/css
Connection: close
Accept-Ranges: bytes
Content-Length: 17043

GET
H/1.1 200
OK responsive.css
blog.securolytics.io/wp-content/themes/cloudstat/css/ 3 KB
3 KB 296ms
98ms Stylesheet
text/css 54.173.173.29
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.securolytics.io/wp-content/themes/cloudstat/css/responsive.css?ver=4.6.1

Requested by

Host: blog.securolytics.io
URL: https://blog.securolytics.io/2017/05/split-tunnel-smtp-exploit-explained/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

54.173.173.29 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),

Reverse DNS

ec2-54-173-173-29.compute-1.amazonaws.com

Software

Apache/2.2.31 (Amazon) /

Resource Hash

e216c3dbcf029f288611866cec3f460fc2fc2e50529b80d111ce0dc600297e9f

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; preload

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate, sdch, br
Host: blog.securolytics.io
Accept-Language: en-US,en;q=0.8
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36
Accept: text/css,*/*;q=0.1
Referer: https://blog.securolytics.io/2017/05/split-tunnel-smtp-exploit-explained/
Connection: keep-alive
Cache-Control: no-cache
Referer: https://blog.securolytics.io/2017/05/split-tunnel-smtp-exploit-explained/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36

Response headers

Date: Tue, 30 May 2017 05:03:11 GMT
Last-Modified: Tue, 20 Sep 2016 09:27:49 GMT
Server: Apache/2.2.31 (Amazon)
ETag: "81e80-cb3-53ced0ac46ae3"
Strict-Transport-Security: max-age=63072000; preload
Content-Type: text/css
Connection: close
Accept-Ranges: bytes
Content-Length: 3251

GET
H/1.1 200
OK addtoany.min.css
blog.securolytics.io/wp-content/plugins/add-to-any/ 1 KB
1 KB 298ms
98ms Stylesheet
text/css 54.173.173.29
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.securolytics.io/wp-content/plugins/add-to-any/addtoany.min.css?ver=1.14

Requested by

Host: blog.securolytics.io
URL: https://blog.securolytics.io/2017/05/split-tunnel-smtp-exploit-explained/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

54.173.173.29 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),

Reverse DNS

ec2-54-173-173-29.compute-1.amazonaws.com

Software

Apache/2.2.31 (Amazon) /

Resource Hash

60ddbdc59a12fddd73e6764e5b95f301e81f1104004ffc1519c1064c45ed41b7

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; preload

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate, sdch, br
Host: blog.securolytics.io
Accept-Language: en-US,en;q=0.8
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36
Accept: text/css,*/*;q=0.1
Referer: https://blog.securolytics.io/2017/05/split-tunnel-smtp-exploit-explained/
Connection: keep-alive
Cache-Control: no-cache
Referer: https://blog.securolytics.io/2017/05/split-tunnel-smtp-exploit-explained/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36

Response headers

Date: Tue, 30 May 2017 05:03:11 GMT
Last-Modified: Fri, 19 May 2017 02:02:34 GMT
Server: Apache/2.2.31 (Amazon)
ETag: "827d6-590-54fd6ea32dc08"
Strict-Transport-Security: max-age=63072000; preload
Content-Type: text/css
Connection: close
Accept-Ranges: bytes
Content-Length: 1424

GET
H/1.1 200
OK jquery.js Show response
blog.securolytics.io/wp-includes/js/jquery/ 95 KB
95 KB 302ms
100ms Script
text/javascript 54.173.173.29
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.securolytics.io/wp-includes/js/jquery/jquery.js?ver=1.12.4

Requested by

Host: blog.securolytics.io
URL: https://blog.securolytics.io/2017/05/split-tunnel-smtp-exploit-explained/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

54.173.173.29 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),

Reverse DNS

ec2-54-173-173-29.compute-1.amazonaws.com

Software

Apache/2.2.31 (Amazon) /

Resource Hash

fc48d1d80ece71a79a7b39877f4104d49d3da6c3665cf6dc203000fb7df4447e

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; preload

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate, sdch, br
Host: blog.securolytics.io
Accept-Language: en-US,en;q=0.8
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36
Accept: */*
Referer: https://blog.securolytics.io/2017/05/split-tunnel-smtp-exploit-explained/
Connection: keep-alive
Cache-Control: no-cache
Referer: https://blog.securolytics.io/2017/05/split-tunnel-smtp-exploit-explained/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36

Response headers

Date: Tue, 30 May 2017 05:03:11 GMT
Last-Modified: Fri, 28 Oct 2016 09:29:51 GMT
Server: Apache/2.2.31 (Amazon)
ETag: "820cf-17ba0-53fe9800ac769"
Strict-Transport-Security: max-age=63072000; preload
Content-Type: text/javascript
Connection: close
Accept-Ranges: bytes
Content-Length: 97184

GET
H/1.1 200
OK jquery-migrate.min.js Show response
blog.securolytics.io/wp-includes/js/jquery/ 10 KB
10 KB 396ms
100ms Script
text/javascript 54.173.173.29
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.securolytics.io/wp-includes/js/jquery/jquery-migrate.min.js?ver=1.4.1

Requested by

Host: blog.securolytics.io
URL: https://blog.securolytics.io/2017/05/split-tunnel-smtp-exploit-explained/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

54.173.173.29 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),

Reverse DNS

ec2-54-173-173-29.compute-1.amazonaws.com

Software

Apache/2.2.31 (Amazon) /

Resource Hash

48eb8b500ae6a38617b5738d2b3faec481922a7782246e31d2755c034a45cd5d

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; preload

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate, sdch, br
Host: blog.securolytics.io
Accept-Language: en-US,en;q=0.8
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36
Accept: */*
Referer: https://blog.securolytics.io/2017/05/split-tunnel-smtp-exploit-explained/
Connection: keep-alive
Cache-Control: no-cache
Referer: https://blog.securolytics.io/2017/05/split-tunnel-smtp-exploit-explained/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36

Response headers

Date: Tue, 30 May 2017 05:03:12 GMT
Last-Modified: Fri, 28 Oct 2016 09:29:51 GMT
Server: Apache/2.2.31 (Amazon)
ETag: "820c9-2748-53fe9800ab7c9"
Strict-Transport-Security: max-age=63072000; preload
Content-Type: text/javascript
Connection: close
Accept-Ranges: bytes
Content-Length: 10056

GET
H/1.1 200
OK tracking-analytics-events.js Show response
blog.securolytics.io/wp-content/plugins/google-analytics-dashboard-for-wp/front/js/ 3 KB
3 KB 591ms
99ms Script
text/javascript 54.173.173.29
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.securolytics.io/wp-content/plugins/google-analytics-dashboard-for-wp/front/js/tracking-analytics-events.js?ver=5.0.0.1

Requested by

Host: blog.securolytics.io
URL: https://blog.securolytics.io/2017/05/split-tunnel-smtp-exploit-explained/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

54.173.173.29 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),

Reverse DNS

ec2-54-173-173-29.compute-1.amazonaws.com

Software

Apache/2.2.31 (Amazon) /

Resource Hash

1cc76c442c3305274ee60298de111323c122f1b276f03c2d5336e85b7230a58a

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; preload

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate, sdch, br
Host: blog.securolytics.io
Accept-Language: en-US,en;q=0.8
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36
Accept: */*
Referer: https://blog.securolytics.io/2017/05/split-tunnel-smtp-exploit-explained/
Connection: keep-alive
Cache-Control: no-cache
Referer: https://blog.securolytics.io/2017/05/split-tunnel-smtp-exploit-explained/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36

Response headers

Date: Tue, 30 May 2017 05:03:12 GMT
Last-Modified: Tue, 23 May 2017 20:16:47 GMT
Server: Apache/2.2.31 (Amazon)
ETag: "80ce6-d00-55036aac8a42d"
Strict-Transport-Security: max-age=63072000; preload
Content-Type: text/javascript
Connection: close
Accept-Ranges: bytes
Content-Length: 3328

GET
H/1.1 200
OK addtoany.min.js Show response
blog.securolytics.io/wp-content/plugins/add-to-any/ 135 B
135 B 592ms
99ms Script
text/javascript 54.173.173.29
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.securolytics.io/wp-content/plugins/add-to-any/addtoany.min.js?ver=1.0

Requested by

Host: blog.securolytics.io
URL: https://blog.securolytics.io/2017/05/split-tunnel-smtp-exploit-explained/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

54.173.173.29 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),

Reverse DNS

ec2-54-173-173-29.compute-1.amazonaws.com

Software

Apache/2.2.31 (Amazon) /

Resource Hash

8636944aec2fea7c4306f8cfbb484bd1cb5465e4713a266172f6eab0681e3efa

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; preload

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate, sdch, br
Host: blog.securolytics.io
Accept-Language: en-US,en;q=0.8
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36
Accept: */*
Referer: https://blog.securolytics.io/2017/05/split-tunnel-smtp-exploit-explained/
Connection: keep-alive
Cache-Control: no-cache
Referer: https://blog.securolytics.io/2017/05/split-tunnel-smtp-exploit-explained/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36

Response headers

Date: Tue, 30 May 2017 05:03:12 GMT
Last-Modified: Fri, 19 May 2017 02:02:34 GMT
Server: Apache/2.2.31 (Amazon)
ETag: "82791-87-54fd6ea32bcc8"
Strict-Transport-Security: max-age=63072000; preload
Content-Type: text/javascript
Connection: close
Accept-Ranges: bytes
Content-Length: 135

GET
H2 200 page.js Show response
static.addtoany.com/menu/ 72 KB
24 KB 50ms
14ms Script
application/javascript 2400:cb00:2048:1::6814:6e27
CloudFlare

General

Check archive.org

Show headers Download Go to

Full URL

https://static.addtoany.com/menu/page.js

Requested by

Host: blog.securolytics.io
URL: https://blog.securolytics.io/2017/05/split-tunnel-smtp-exploit-explained/

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2400:cb00:2048:1::6814:6e27 , United States, ASN13335 (CLOUDFLARENET - CloudFlare, Inc., US),

Reverse DNS

Software

cloudflare-nginx /

Resource Hash

8f3e743527460788368f79b4c2929ca8c356b798362d9c1b77ea34fce5f894cb

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

:path: /menu/page.js
pragma: no-cache
accept-encoding: gzip, deflate, sdch, br
accept-language: en-US,en;q=0.8
user-agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36
accept: */*
cache-control: no-cache
:authority: static.addtoany.com
referer: https://blog.securolytics.io/2017/05/split-tunnel-smtp-exploit-explained/
:scheme: https
:method: GET
Referer: https://blog.securolytics.io/2017/05/split-tunnel-smtp-exploit-explained/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36

Response headers

date: Tue, 30 May 2017 05:03:12 GMT
via: 1.1 vhost.phx2.nearlyfreespeech.net:3128 (squid/2.7.STABLE7)
x-content-type-options: nosniff
cf-cache-status: HIT
cf-h2-pushed: </menu/svg/icons.21.svg.js>
p3p: CP="ALL DSP COR CURa ADMa DEVa TAIa PSAa PSDa OUR IND UNI COM NAV INT"
status: 200
content-encoding: gzip
vary: Accept-Encoding
last-modified: Tue, 02 May 2017 06:14:44 GMT
server: cloudflare-nginx
etag: W/"11ec5-54e8474bb065b"
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-type: application/javascript
cache-control: public, max-age=172800
set-cookie: __cfduid=d03b90c2e4fc8f35bb644af273eb471f51496120592; expires=Wed, 30-May-18 05:03:12 GMT; path=/; domain=.addtoany.com; HttpOnly
cf-ray: 366f2545fe0e6457-FRA
expires: Thu, 01 Jun 2017 05:03:12 GMT

GET
H/1.1 200
OK securolytics-logo.png
blog.securolytics.io/wp-content/themes/cloudstat/images/ 20 KB
20 KB 301ms
99ms Image
image/png 54.173.173.29
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blog.securolytics.io/wp-content/themes/cloudstat/images/securolytics-logo.png

Requested by

Host: blog.securolytics.io
URL: https://blog.securolytics.io/2017/05/split-tunnel-smtp-exploit-explained/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

54.173.173.29 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),

Reverse DNS

ec2-54-173-173-29.compute-1.amazonaws.com

Software

Apache/2.2.31 (Amazon) /

Resource Hash

9ce819250a5b5d71a296e407dbfe80d3fed19921872264d2273756fd5fbb8361

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; preload

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate, sdch, br
Host: blog.securolytics.io
Accept-Language: en-US,en;q=0.8
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36
Accept: image/webp,image/*,*/*;q=0.8
Referer: https://blog.securolytics.io/2017/05/split-tunnel-smtp-exploit-explained/
Connection: keep-alive
Cache-Control: no-cache
Referer: https://blog.securolytics.io/2017/05/split-tunnel-smtp-exploit-explained/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36

Response headers

Date: Tue, 30 May 2017 05:03:12 GMT
Last-Modified: Fri, 28 Oct 2016 17:47:00 GMT
Server: Apache/2.2.31 (Amazon)
ETag: "81e88-4e7d-53ff071fcd313"
Strict-Transport-Security: max-age=63072000; preload
Content-Type: image/png
Connection: close
Accept-Ranges: bytes
Content-Length: 20093

GET
H/1.1 200
OK split-tunnel-smtp-exploit-header.png
blog.securolytics.io/wp-content/uploads/2017/05/ 108 KB
108 KB 302ms
100ms Image
image/png 54.173.173.29
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blog.securolytics.io/wp-content/uploads/2017/05/split-tunnel-smtp-exploit-header.png

Requested by

Host: blog.securolytics.io
URL: https://blog.securolytics.io/2017/05/split-tunnel-smtp-exploit-explained/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

54.173.173.29 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),

Reverse DNS

ec2-54-173-173-29.compute-1.amazonaws.com

Software

Apache/2.2.31 (Amazon) /

Resource Hash

b25baec24139ed33efcf25bdb82ceb8597cf00250aaa4bbc675b96f08db235f5

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; preload

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate, sdch, br
Host: blog.securolytics.io
Accept-Language: en-US,en;q=0.8
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36
Accept: image/webp,image/*,*/*;q=0.8
Referer: https://blog.securolytics.io/2017/05/split-tunnel-smtp-exploit-explained/
Connection: keep-alive
Cache-Control: no-cache
Referer: https://blog.securolytics.io/2017/05/split-tunnel-smtp-exploit-explained/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36

Response headers

Date: Tue, 30 May 2017 05:03:12 GMT
Last-Modified: Tue, 23 May 2017 15:27:00 GMT
Server: Apache/2.2.31 (Amazon)
ETag: "e8c-1ae7e-550329e6dd7a6"
Strict-Transport-Security: max-age=63072000; preload
Content-Type: image/png
Connection: close
Accept-Ranges: bytes
Content-Length: 110206

GET
H/1.1 200
OK securolytics-split-tunnel-smtp-exploit.gif
blog.securolytics.io/wp-content/uploads/2017/05/ 52 KB
52 KB 593ms
99ms Image
image/gif 54.173.173.29
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blog.securolytics.io/wp-content/uploads/2017/05/securolytics-split-tunnel-smtp-exploit.gif

Requested by

Host: blog.securolytics.io
URL: https://blog.securolytics.io/2017/05/split-tunnel-smtp-exploit-explained/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

54.173.173.29 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),

Reverse DNS

ec2-54-173-173-29.compute-1.amazonaws.com

Software

Apache/2.2.31 (Amazon) /

Resource Hash

13b1331b7bbe9beae07d7b7d8664e668efb8c747d7c5cf30869521d1a76bee52

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; preload

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate, sdch, br
Host: blog.securolytics.io
Accept-Language: en-US,en;q=0.8
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36
Accept: image/webp,image/*,*/*;q=0.8
Referer: https://blog.securolytics.io/2017/05/split-tunnel-smtp-exploit-explained/
Connection: keep-alive
Cache-Control: no-cache
Referer: https://blog.securolytics.io/2017/05/split-tunnel-smtp-exploit-explained/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36

Response headers

Date: Tue, 30 May 2017 05:03:12 GMT
Last-Modified: Tue, 23 May 2017 17:39:33 GMT
Server: Apache/2.2.31 (Amazon)
ETag: "e9b-d005-55034788261b0"
Strict-Transport-Security: max-age=63072000; preload
Content-Type: image/gif
Connection: close
Accept-Ranges: bytes
Content-Length: 53253

GET
H/1.1 200
OK split-tunnel-smtp-attack1-image-1.png
blog.securolytics.io/wp-content/uploads/2017/05/ 141 KB
141 KB 695ms
98ms Image
image/png 54.173.173.29
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blog.securolytics.io/wp-content/uploads/2017/05/split-tunnel-smtp-attack1-image-1.png

Requested by

Host: blog.securolytics.io
URL: https://blog.securolytics.io/2017/05/split-tunnel-smtp-exploit-explained/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

54.173.173.29 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),

Reverse DNS

ec2-54-173-173-29.compute-1.amazonaws.com

Software

Apache/2.2.31 (Amazon) /

Resource Hash

f5bac3290c345d66a947d2c5e2491eafe21f5314be8599f79b5edf61b766275c

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; preload

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate, sdch, br
Host: blog.securolytics.io
Accept-Language: en-US,en;q=0.8
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36
Accept: image/webp,image/*,*/*;q=0.8
Referer: https://blog.securolytics.io/2017/05/split-tunnel-smtp-exploit-explained/
Connection: keep-alive
Cache-Control: no-cache
Referer: https://blog.securolytics.io/2017/05/split-tunnel-smtp-exploit-explained/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36

Response headers

Date: Tue, 30 May 2017 05:03:12 GMT
Last-Modified: Fri, 19 May 2017 16:41:35 GMT
Server: Apache/2.2.31 (Amazon)
ETag: "18-235f1-54fe331ca9641"
Strict-Transport-Security: max-age=63072000; preload
Content-Type: image/png
Connection: close
Accept-Ranges: bytes
Content-Length: 144881

GET
H/1.1 200
OK split-tunnel-smtp-attack1-image-2.png
blog.securolytics.io/wp-content/uploads/2017/05/ 49 KB
49 KB 792ms
98ms Image
image/png 54.173.173.29
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blog.securolytics.io/wp-content/uploads/2017/05/split-tunnel-smtp-attack1-image-2.png

Requested by

Host: blog.securolytics.io
URL: https://blog.securolytics.io/2017/05/split-tunnel-smtp-exploit-explained/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

54.173.173.29 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),

Reverse DNS

ec2-54-173-173-29.compute-1.amazonaws.com

Software

Apache/2.2.31 (Amazon) /

Resource Hash

bb183733e8446a35b2411ebfbcd39332550c755a01b9776f00665b3489b4253c

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; preload

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate, sdch, br
Host: blog.securolytics.io
Accept-Language: en-US,en;q=0.8
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36
Accept: image/webp,image/*,*/*;q=0.8
Referer: https://blog.securolytics.io/2017/05/split-tunnel-smtp-exploit-explained/
Connection: keep-alive
Cache-Control: no-cache
Referer: https://blog.securolytics.io/2017/05/split-tunnel-smtp-exploit-explained/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36

Response headers

Date: Tue, 30 May 2017 05:03:13 GMT
Last-Modified: Fri, 19 May 2017 16:41:35 GMT
Server: Apache/2.2.31 (Amazon)
ETag: "36-c4a0-54fe331d05307"
Strict-Transport-Security: max-age=63072000; preload
Content-Type: image/png
Connection: close
Accept-Ranges: bytes
Content-Length: 50336

GET
H/1.1 200
OK split-tunnel-smtp-attack1-image-3.png
blog.securolytics.io/wp-content/uploads/2017/05/ 235 KB
235 KB 839ms
104ms Image
image/png 54.173.173.29
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blog.securolytics.io/wp-content/uploads/2017/05/split-tunnel-smtp-attack1-image-3.png

Requested by

Host: blog.securolytics.io
URL: https://blog.securolytics.io/2017/05/split-tunnel-smtp-exploit-explained/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

54.173.173.29 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),

Reverse DNS

ec2-54-173-173-29.compute-1.amazonaws.com

Software

Apache/2.2.31 (Amazon) /

Resource Hash

656a3dd3b522339d3f43e72c53286457ebd5133e213d2da1299a351d729a8c7e

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; preload

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate, sdch, br
Host: blog.securolytics.io
Accept-Language: en-US,en;q=0.8
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36
Accept: image/webp,image/*,*/*;q=0.8
Referer: https://blog.securolytics.io/2017/05/split-tunnel-smtp-exploit-explained/
Connection: keep-alive
Cache-Control: no-cache
Referer: https://blog.securolytics.io/2017/05/split-tunnel-smtp-exploit-explained/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36

Response headers

Date: Tue, 30 May 2017 05:03:13 GMT
Last-Modified: Fri, 19 May 2017 16:41:35 GMT
Server: Apache/2.2.31 (Amazon)
ETag: "29cc-3abf7-54fe331d6cb4d"
Strict-Transport-Security: max-age=63072000; preload
Content-Type: image/png
Connection: close
Accept-Ranges: bytes
Content-Length: 240631

GET
H/1.1 200
OK split-tunnel-smtp-attack1-image-4.png
blog.securolytics.io/wp-content/uploads/2017/05/ 266 KB
266 KB 688ms
99ms Image
image/png 54.173.173.29
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blog.securolytics.io/wp-content/uploads/2017/05/split-tunnel-smtp-attack1-image-4.png

Requested by

Host: blog.securolytics.io
URL: https://blog.securolytics.io/2017/05/split-tunnel-smtp-exploit-explained/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

54.173.173.29 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),

Reverse DNS

ec2-54-173-173-29.compute-1.amazonaws.com

Software

Apache/2.2.31 (Amazon) /

Resource Hash

364c1ea76a5b1037cd712f96c07be3c9d08ce50eb226d0758a13b9471fa50f35

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; preload

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate, sdch, br
Host: blog.securolytics.io
Accept-Language: en-US,en;q=0.8
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36
Accept: image/webp,image/*,*/*;q=0.8
Referer: https://blog.securolytics.io/2017/05/split-tunnel-smtp-exploit-explained/
Cookie: _ga=GA1.2.1641080908.1496120592; _gid=GA1.2.1065285530.1496120592; _gat=1; gclid=undefined
Connection: keep-alive
Cache-Control: no-cache
Referer: https://blog.securolytics.io/2017/05/split-tunnel-smtp-exploit-explained/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36

Response headers

Date: Tue, 30 May 2017 05:03:13 GMT
Last-Modified: Fri, 19 May 2017 17:20:53 GMT
Server: Apache/2.2.31 (Amazon)
ETag: "29ce-4298a-54fe3be63ef1a"
Strict-Transport-Security: max-age=63072000; preload
Content-Type: image/png
Connection: close
Accept-Ranges: bytes
Content-Length: 272778

GET
H/1.1 200
OK split-tunnel-smtp-attack1-image-5.png
blog.securolytics.io/wp-content/uploads/2017/05/ 253 KB
253 KB 499ms
100ms Image
image/png 54.173.173.29
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blog.securolytics.io/wp-content/uploads/2017/05/split-tunnel-smtp-attack1-image-5.png

Requested by

Host: blog.securolytics.io
URL: https://blog.securolytics.io/2017/05/split-tunnel-smtp-exploit-explained/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

54.173.173.29 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),

Reverse DNS

ec2-54-173-173-29.compute-1.amazonaws.com

Software

Apache/2.2.31 (Amazon) /

Resource Hash

04b2aa89e5dd20337ca3083ba08b5cb7621930665b012ef852ab1bb3f816f4c7

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; preload

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate, sdch, br
Host: blog.securolytics.io
Accept-Language: en-US,en;q=0.8
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36
Accept: image/webp,image/*,*/*;q=0.8
Referer: https://blog.securolytics.io/2017/05/split-tunnel-smtp-exploit-explained/
Cookie: _ga=GA1.2.1641080908.1496120592; _gid=GA1.2.1065285530.1496120592; _gat=1; gclid=undefined
Connection: keep-alive
Cache-Control: no-cache
Referer: https://blog.securolytics.io/2017/05/split-tunnel-smtp-exploit-explained/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36

Response headers

Date: Tue, 30 May 2017 05:03:13 GMT
Last-Modified: Fri, 19 May 2017 19:00:12 GMT
Server: Apache/2.2.31 (Amazon)
ETag: "29d0-3f3f8-54fe521924e91"
Strict-Transport-Security: max-age=63072000; preload
Content-Type: image/png
Connection: close
Accept-Ranges: bytes
Content-Length: 259064

GET
H/1.1 200
OK split-tunnel-smtp-attack1-image-6.png
blog.securolytics.io/wp-content/uploads/2017/05/ 246 KB
246 KB 542ms
100ms Image
image/png 54.173.173.29
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blog.securolytics.io/wp-content/uploads/2017/05/split-tunnel-smtp-attack1-image-6.png

Requested by

Host: blog.securolytics.io
URL: https://blog.securolytics.io/2017/05/split-tunnel-smtp-exploit-explained/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

54.173.173.29 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),

Reverse DNS

ec2-54-173-173-29.compute-1.amazonaws.com

Software

Apache/2.2.31 (Amazon) /

Resource Hash

0496ffd71472af755edab2dc201d07a382b92856335769bad8c83a8e245435b4

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; preload

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate, sdch, br
Host: blog.securolytics.io
Accept-Language: en-US,en;q=0.8
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36
Accept: image/webp,image/*,*/*;q=0.8
Referer: https://blog.securolytics.io/2017/05/split-tunnel-smtp-exploit-explained/
Cookie: _ga=GA1.2.1641080908.1496120592; _gid=GA1.2.1065285530.1496120592; _gat=1; gclid=undefined
Connection: keep-alive
Cache-Control: no-cache
Referer: https://blog.securolytics.io/2017/05/split-tunnel-smtp-exploit-explained/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36

Response headers

Date: Tue, 30 May 2017 05:03:13 GMT
Last-Modified: Fri, 19 May 2017 22:28:20 GMT
Server: Apache/2.2.31 (Amazon)
ETag: "29d1-3d887-54fe809e774a5"
Strict-Transport-Security: max-age=63072000; preload
Content-Type: image/png
Connection: close
Accept-Ranges: bytes
Content-Length: 252039

GET
H/1.1 200
OK split-tunnel-smtp-attack1-image-7.png
blog.securolytics.io/wp-content/uploads/2017/05/ 116 KB
116 KB 399ms
99ms Image
image/png 54.173.173.29
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blog.securolytics.io/wp-content/uploads/2017/05/split-tunnel-smtp-attack1-image-7.png

Requested by

Host: blog.securolytics.io
URL: https://blog.securolytics.io/2017/05/split-tunnel-smtp-exploit-explained/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

54.173.173.29 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),

Reverse DNS

ec2-54-173-173-29.compute-1.amazonaws.com

Software

Apache/2.2.31 (Amazon) /

Resource Hash

9b9266812d50859b2c1c3029a780ebfdd18e3057aa82ed8561328729e9d233d2

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; preload

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate, sdch, br
Host: blog.securolytics.io
Accept-Language: en-US,en;q=0.8
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36
Accept: image/webp,image/*,*/*;q=0.8
Referer: https://blog.securolytics.io/2017/05/split-tunnel-smtp-exploit-explained/
Cookie: _ga=GA1.2.1641080908.1496120592; _gid=GA1.2.1065285530.1496120592; _gat=1; gclid=undefined; _pk_id.49.8ee7=6decf5c307a2b16b.1496120593.1.1496120593.1496120593.; _pk_ses.49.8ee7=*
Connection: keep-alive
Cache-Control: no-cache
Referer: https://blog.securolytics.io/2017/05/split-tunnel-smtp-exploit-explained/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36

Response headers

Date: Tue, 30 May 2017 05:03:13 GMT
Last-Modified: Sat, 20 May 2017 00:19:54 GMT
Server: Apache/2.2.31 (Amazon)
ETag: "29d2-1ce84-54fe998e0a974"
Strict-Transport-Security: max-age=63072000; preload
Content-Type: image/png
Connection: close
Accept-Ranges: bytes
Content-Length: 118404

GET
H/1.1 200
OK split-tunnel-smtp-attack1-image-8.png
blog.securolytics.io/wp-content/uploads/2017/05/ 111 KB
111 KB 486ms
99ms Image
image/png 54.173.173.29
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blog.securolytics.io/wp-content/uploads/2017/05/split-tunnel-smtp-attack1-image-8.png

Requested by

Host: blog.securolytics.io
URL: https://blog.securolytics.io/2017/05/split-tunnel-smtp-exploit-explained/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

54.173.173.29 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),

Reverse DNS

ec2-54-173-173-29.compute-1.amazonaws.com

Software

Apache/2.2.31 (Amazon) /

Resource Hash

d3cd2c511950c7a0b74607dc9f955a24e1885f16ba06bc7dae477f7f63cc71dc

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; preload

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate, sdch, br
Host: blog.securolytics.io
Accept-Language: en-US,en;q=0.8
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36
Accept: image/webp,image/*,*/*;q=0.8
Referer: https://blog.securolytics.io/2017/05/split-tunnel-smtp-exploit-explained/
Cookie: _ga=GA1.2.1641080908.1496120592; _gid=GA1.2.1065285530.1496120592; _gat=1; gclid=undefined; _pk_id.49.8ee7=6decf5c307a2b16b.1496120593.1.1496120593.1496120593.; _pk_ses.49.8ee7=*
Connection: keep-alive
Cache-Control: no-cache
Referer: https://blog.securolytics.io/2017/05/split-tunnel-smtp-exploit-explained/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36

Response headers

Date: Tue, 30 May 2017 05:03:13 GMT
Last-Modified: Sat, 20 May 2017 00:20:54 GMT
Server: Apache/2.2.31 (Amazon)
ETag: "29d3-1ba00-54fe99c71b352"
Strict-Transport-Security: max-age=63072000; preload
Content-Type: image/png
Connection: close
Accept-Ranges: bytes
Content-Length: 113152

GET
H/1.1 200
OK split-tunnel-smtp-attack1-image-9.png
blog.securolytics.io/wp-content/uploads/2017/05/ 170 KB
170 KB 300ms
100ms Image
image/png 54.173.173.29
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blog.securolytics.io/wp-content/uploads/2017/05/split-tunnel-smtp-attack1-image-9.png

Requested by

Host: blog.securolytics.io
URL: https://blog.securolytics.io/2017/05/split-tunnel-smtp-exploit-explained/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

54.173.173.29 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),

Reverse DNS

ec2-54-173-173-29.compute-1.amazonaws.com

Software

Apache/2.2.31 (Amazon) /

Resource Hash

1e9655daa20e02fa31bc82b2dd17804611050568d525882f9165a3cff37207ae

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; preload

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate, sdch, br
Host: blog.securolytics.io
Accept-Language: en-US,en;q=0.8
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36
Accept: image/webp,image/*,*/*;q=0.8
Referer: https://blog.securolytics.io/2017/05/split-tunnel-smtp-exploit-explained/
Cookie: _ga=GA1.2.1641080908.1496120592; _gid=GA1.2.1065285530.1496120592; _gat=1; gclid=undefined; _pk_id.49.8ee7=6decf5c307a2b16b.1496120593.1.1496120593.1496120593.; _pk_ses.49.8ee7=*
Connection: keep-alive
Cache-Control: no-cache
Referer: https://blog.securolytics.io/2017/05/split-tunnel-smtp-exploit-explained/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36

Response headers

Date: Tue, 30 May 2017 05:03:13 GMT
Last-Modified: Sat, 20 May 2017 00:20:55 GMT
Server: Apache/2.2.31 (Amazon)
ETag: "29d4-2a854-54fe99c8a3caa"
Strict-Transport-Security: max-age=63072000; preload
Content-Type: image/png
Connection: close
Accept-Ranges: bytes
Content-Length: 174164

GET
H/1.1 200
OK split-tunnel-smtp-attack1-image-10.png
blog.securolytics.io/wp-content/uploads/2017/05/ 234 KB
234 KB 298ms
99ms Image
image/png 54.173.173.29
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blog.securolytics.io/wp-content/uploads/2017/05/split-tunnel-smtp-attack1-image-10.png

Requested by

Host: blog.securolytics.io
URL: https://blog.securolytics.io/2017/05/split-tunnel-smtp-exploit-explained/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

54.173.173.29 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),

Reverse DNS

ec2-54-173-173-29.compute-1.amazonaws.com

Software

Apache/2.2.31 (Amazon) /

Resource Hash

7e8268de2407cdd825119f98d7448b1fbe06aedcfbdbff44ad5c9ac19fb3c2b0

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; preload

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate, sdch, br
Host: blog.securolytics.io
Accept-Language: en-US,en;q=0.8
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36
Accept: image/webp,image/*,*/*;q=0.8
Referer: https://blog.securolytics.io/2017/05/split-tunnel-smtp-exploit-explained/
Cookie: _ga=GA1.2.1641080908.1496120592; _gid=GA1.2.1065285530.1496120592; _gat=1; gclid=undefined; _pk_id.49.8ee7=6decf5c307a2b16b.1496120593.1.1496120593.1496120593.; _pk_ses.49.8ee7=*
Connection: keep-alive
Cache-Control: no-cache
Referer: https://blog.securolytics.io/2017/05/split-tunnel-smtp-exploit-explained/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36

Response headers

Date: Tue, 30 May 2017 05:03:14 GMT
Last-Modified: Sat, 20 May 2017 00:12:50 GMT
Server: Apache/2.2.31 (Amazon)
ETag: "29d5-3a746-54fe97f9de3f9"
Strict-Transport-Security: max-age=63072000; preload
Content-Type: image/png
Connection: close
Accept-Ranges: bytes
Content-Length: 239430

GET
H/1.1 200
OK split-tunnel-smtp-attack1-image-11.png
blog.securolytics.io/wp-content/uploads/2017/05/ 269 KB
269 KB 295ms
98ms Image
image/png 54.173.173.29
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blog.securolytics.io/wp-content/uploads/2017/05/split-tunnel-smtp-attack1-image-11.png

Requested by

Host: blog.securolytics.io
URL: https://blog.securolytics.io/2017/05/split-tunnel-smtp-exploit-explained/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

54.173.173.29 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),

Reverse DNS

ec2-54-173-173-29.compute-1.amazonaws.com

Software

Apache/2.2.31 (Amazon) /

Resource Hash

05cc856acea257ee6e07c3817b1893e7fae9f98e5ccfd1687cc3e1e6ae706f58

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; preload

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate, sdch, br
Host: blog.securolytics.io
Accept-Language: en-US,en;q=0.8
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36
Accept: image/webp,image/*,*/*;q=0.8
Referer: https://blog.securolytics.io/2017/05/split-tunnel-smtp-exploit-explained/
Cookie: _ga=GA1.2.1641080908.1496120592; _gid=GA1.2.1065285530.1496120592; _gat=1; gclid=undefined; _pk_id.49.8ee7=6decf5c307a2b16b.1496120593.1.1496120593.1496120593.; _pk_ses.49.8ee7=*
Connection: keep-alive
Cache-Control: no-cache
Referer: https://blog.securolytics.io/2017/05/split-tunnel-smtp-exploit-explained/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36

Response headers

Date: Tue, 30 May 2017 05:03:14 GMT
Last-Modified: Sat, 20 May 2017 02:07:28 GMT
Server: Apache/2.2.31 (Amazon)
ETag: "29d6-4350f-54feb19993592"
Strict-Transport-Security: max-age=63072000; preload
Content-Type: image/png
Connection: close
Accept-Ranges: bytes
Content-Length: 275727

GET
H/1.1 200
OK split-tunnel-smtp-attack1-image-12.png
blog.securolytics.io/wp-content/uploads/2017/05/ 253 KB
253 KB 301ms
100ms Image
image/png 54.173.173.29
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blog.securolytics.io/wp-content/uploads/2017/05/split-tunnel-smtp-attack1-image-12.png

Requested by

Host: blog.securolytics.io
URL: https://blog.securolytics.io/2017/05/split-tunnel-smtp-exploit-explained/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

54.173.173.29 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),

Reverse DNS

ec2-54-173-173-29.compute-1.amazonaws.com

Software

Apache/2.2.31 (Amazon) /

Resource Hash

0d0ca75d8b81e9a9435143496bccb504c16e52b06d208474df944675338e25b0

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; preload

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate, sdch, br
Host: blog.securolytics.io
Accept-Language: en-US,en;q=0.8
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36
Accept: image/webp,image/*,*/*;q=0.8
Referer: https://blog.securolytics.io/2017/05/split-tunnel-smtp-exploit-explained/
Cookie: _ga=GA1.2.1641080908.1496120592; _gid=GA1.2.1065285530.1496120592; _gat=1; gclid=undefined; _pk_id.49.8ee7=6decf5c307a2b16b.1496120593.1.1496120593.1496120593.; _pk_ses.49.8ee7=*
Connection: keep-alive
Cache-Control: no-cache
Referer: https://blog.securolytics.io/2017/05/split-tunnel-smtp-exploit-explained/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36

Response headers

Date: Tue, 30 May 2017 05:03:14 GMT
Last-Modified: Sat, 20 May 2017 02:07:29 GMT
Server: Apache/2.2.31 (Amazon)
ETag: "29d7-3f473-54feb19a3863d"
Strict-Transport-Security: max-age=63072000; preload
Content-Type: image/png
Connection: close
Accept-Ranges: bytes
Content-Length: 259187

GET
H/1.1

200
OK

split-tunnel-smtp-attack2-image-karen-kedda.png
blog.securolytics.io/wp-content/uploads/2017/05/
Redirect Chain

http://blog.securolytics.io/wp-content/uploads/2017/05/split-tunnel-smtp-attack2-image-karen-kedda.png
https://blog.securolytics.io/wp-content/uploads/2017/05/split-tunnel-smtp-attack2-image-karen-kedda.png

43 KB
43 KB

893ms
99ms

Image
image/png

54.173.173.29
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blog.securolytics.io/wp-content/uploads/2017/05/split-tunnel-smtp-attack2-image-karen-kedda.png

Requested by

Host: blog.securolytics.io
URL: https://blog.securolytics.io/2017/05/split-tunnel-smtp-exploit-explained/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

54.173.173.29 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),

Reverse DNS

ec2-54-173-173-29.compute-1.amazonaws.com

Software

Apache/2.2.31 (Amazon) /

Resource Hash

7fe7e1954511737e3bd3b01759c1d7d2a8a83bb781424c9753bc62ce38e27d35

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; preload

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate, sdch, br
Host: blog.securolytics.io
Accept-Language: en-US,en;q=0.8
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36
Accept: image/webp,image/*,*/*;q=0.8
Cache-Control: no-cache
Connection: keep-alive
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36

Response headers

Date: Tue, 30 May 2017 05:03:13 GMT
Last-Modified: Sun, 21 May 2017 22:24:52 GMT
Server: Apache/2.2.31 (Amazon)
ETag: "29d8-acb8-5501039318d3a"
Strict-Transport-Security: max-age=63072000; preload
Content-Type: image/png
Connection: close
Accept-Ranges: bytes
Content-Length: 44216

Redirect headers

Location: https://blog.securolytics.io/wp-content/uploads/2017/05/split-tunnel-smtp-attack2-image-karen-kedda.png
Non-Authoritative-Reason: HSTS

GET
H/1.1 200
OK split-tunnel-smtp-attack2-image-13.png
blog.securolytics.io/wp-content/uploads/2017/05/ 116 KB
116 KB 301ms
100ms Image
image/png 54.173.173.29
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blog.securolytics.io/wp-content/uploads/2017/05/split-tunnel-smtp-attack2-image-13.png

Requested by

Host: blog.securolytics.io
URL: https://blog.securolytics.io/2017/05/split-tunnel-smtp-exploit-explained/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

54.173.173.29 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),

Reverse DNS

ec2-54-173-173-29.compute-1.amazonaws.com

Software

Apache/2.2.31 (Amazon) /

Resource Hash

92ee709b26e30297904101ba16fa41918211a258f7131c2ae6f107064999e71d

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; preload

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate, sdch, br
Host: blog.securolytics.io
Accept-Language: en-US,en;q=0.8
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36
Accept: image/webp,image/*,*/*;q=0.8
Referer: https://blog.securolytics.io/2017/05/split-tunnel-smtp-exploit-explained/
Cookie: _ga=GA1.2.1641080908.1496120592; _gid=GA1.2.1065285530.1496120592; _gat=1; gclid=undefined; _pk_id.49.8ee7=6decf5c307a2b16b.1496120593.1.1496120593.1496120593.; _pk_ses.49.8ee7=*
Connection: keep-alive
Cache-Control: no-cache
Referer: https://blog.securolytics.io/2017/05/split-tunnel-smtp-exploit-explained/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36

Response headers

Date: Tue, 30 May 2017 05:03:14 GMT
Last-Modified: Sun, 21 May 2017 22:25:54 GMT
Server: Apache/2.2.31 (Amazon)
ETag: "29da-1d10c-550103ce5423d"
Strict-Transport-Security: max-age=63072000; preload
Content-Type: image/png
Connection: close
Accept-Ranges: bytes
Content-Length: 119052

GET
H/1.1 200
OK split-tunnel-smtp-attack2-image-14.png
blog.securolytics.io/wp-content/uploads/2017/05/ 119 KB
119 KB 296ms
98ms Image
image/png 54.173.173.29
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blog.securolytics.io/wp-content/uploads/2017/05/split-tunnel-smtp-attack2-image-14.png

Requested by

Host: blog.securolytics.io
URL: https://blog.securolytics.io/2017/05/split-tunnel-smtp-exploit-explained/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

54.173.173.29 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),

Reverse DNS

ec2-54-173-173-29.compute-1.amazonaws.com

Software

Apache/2.2.31 (Amazon) /

Resource Hash

42b010e422f1596bf93abca206531d06ee11016128d4dcb60ad1575ff08522ea

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; preload

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate, sdch, br
Host: blog.securolytics.io
Accept-Language: en-US,en;q=0.8
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36
Accept: image/webp,image/*,*/*;q=0.8
Referer: https://blog.securolytics.io/2017/05/split-tunnel-smtp-exploit-explained/
Cookie: _ga=GA1.2.1641080908.1496120592; _gid=GA1.2.1065285530.1496120592; _gat=1; gclid=undefined; _pk_id.49.8ee7=6decf5c307a2b16b.1496120593.1.1496120593.1496120593.; _pk_ses.49.8ee7=*
Connection: keep-alive
Cache-Control: no-cache
Referer: https://blog.securolytics.io/2017/05/split-tunnel-smtp-exploit-explained/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36

Response headers

Date: Tue, 30 May 2017 05:03:14 GMT
Last-Modified: Sun, 21 May 2017 22:25:58 GMT
Server: Apache/2.2.31 (Amazon)
ETag: "29db-1dbfa-550103d18b64f"
Strict-Transport-Security: max-age=63072000; preload
Content-Type: image/png
Connection: close
Accept-Ranges: bytes
Content-Length: 121850

GET
H/1.1 200
OK split-tunnel-smtp-attack2-image-15.png
blog.securolytics.io/wp-content/uploads/2017/05/ 64 KB
64 KB 298ms
99ms Image
image/png 54.173.173.29
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blog.securolytics.io/wp-content/uploads/2017/05/split-tunnel-smtp-attack2-image-15.png

Requested by

Host: blog.securolytics.io
URL: https://blog.securolytics.io/2017/05/split-tunnel-smtp-exploit-explained/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

54.173.173.29 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),

Reverse DNS

ec2-54-173-173-29.compute-1.amazonaws.com

Software

Apache/2.2.31 (Amazon) /

Resource Hash

5a5fbbb175422ea3de8f4ad888047dbead43b912bc5eb7b4f28354caa1799e45

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; preload

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate, sdch, br
Host: blog.securolytics.io
Accept-Language: en-US,en;q=0.8
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36
Accept: image/webp,image/*,*/*;q=0.8
Referer: https://blog.securolytics.io/2017/05/split-tunnel-smtp-exploit-explained/
Cookie: _ga=GA1.2.1641080908.1496120592; _gid=GA1.2.1065285530.1496120592; _gat=1; gclid=undefined; _pk_id.49.8ee7=6decf5c307a2b16b.1496120593.1.1496120593.1496120593.; _pk_ses.49.8ee7=*
Connection: keep-alive
Cache-Control: no-cache
Referer: https://blog.securolytics.io/2017/05/split-tunnel-smtp-exploit-explained/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36

Response headers

Date: Tue, 30 May 2017 05:03:14 GMT
Last-Modified: Sun, 21 May 2017 22:26:01 GMT
Server: Apache/2.2.31 (Amazon)
ETag: "29dc-ff3b-550103d42d3b9"
Strict-Transport-Security: max-age=63072000; preload
Content-Type: image/png
Connection: close
Accept-Ranges: bytes
Content-Length: 65339

GET
H/1.1 200
OK split-tunnel-smtp-attack2-image-16.png
blog.securolytics.io/wp-content/uploads/2017/05/ 52 KB
52 KB 293ms
98ms Image
image/png 54.173.173.29
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blog.securolytics.io/wp-content/uploads/2017/05/split-tunnel-smtp-attack2-image-16.png

Requested by

Host: blog.securolytics.io
URL: https://blog.securolytics.io/2017/05/split-tunnel-smtp-exploit-explained/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

54.173.173.29 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),

Reverse DNS

ec2-54-173-173-29.compute-1.amazonaws.com

Software

Apache/2.2.31 (Amazon) /

Resource Hash

d4398dec1afbadd50ad056364ec2b16411ab97670c6e09824001a18cc5cb5b14

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; preload

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate, sdch, br
Host: blog.securolytics.io
Accept-Language: en-US,en;q=0.8
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36
Accept: image/webp,image/*,*/*;q=0.8
Referer: https://blog.securolytics.io/2017/05/split-tunnel-smtp-exploit-explained/
Cookie: _ga=GA1.2.1641080908.1496120592; _gid=GA1.2.1065285530.1496120592; _gat=1; gclid=undefined; _pk_id.49.8ee7=6decf5c307a2b16b.1496120593.1.1496120593.1496120593.; _pk_ses.49.8ee7=*
Connection: keep-alive
Cache-Control: no-cache
Referer: https://blog.securolytics.io/2017/05/split-tunnel-smtp-exploit-explained/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36

Response headers

Date: Tue, 30 May 2017 05:03:14 GMT
Last-Modified: Sun, 21 May 2017 22:26:03 GMT
Server: Apache/2.2.31 (Amazon)
ETag: "29dd-cec3-550103d6bb8a1"
Strict-Transport-Security: max-age=63072000; preload
Content-Type: image/png
Connection: close
Accept-Ranges: bytes
Content-Length: 52931

GET
H/1.1 200
OK split-tunnel-smtp-attack2-image-17.png
blog.securolytics.io/wp-content/uploads/2017/05/ 304 KB
304 KB 293ms
97ms Image
image/png 54.173.173.29
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blog.securolytics.io/wp-content/uploads/2017/05/split-tunnel-smtp-attack2-image-17.png

Requested by

Host: blog.securolytics.io
URL: https://blog.securolytics.io/2017/05/split-tunnel-smtp-exploit-explained/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

54.173.173.29 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),

Reverse DNS

ec2-54-173-173-29.compute-1.amazonaws.com

Software

Apache/2.2.31 (Amazon) /

Resource Hash

c1bfe2ce2c579ef311772d733be01ef4755ecd7b6e77eafbe8accc97ab69e03e

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; preload

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate, sdch, br
Host: blog.securolytics.io
Accept-Language: en-US,en;q=0.8
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36
Accept: image/webp,image/*,*/*;q=0.8
Referer: https://blog.securolytics.io/2017/05/split-tunnel-smtp-exploit-explained/
Cookie: _ga=GA1.2.1641080908.1496120592; _gid=GA1.2.1065285530.1496120592; _gat=1; gclid=undefined; _pk_id.49.8ee7=6decf5c307a2b16b.1496120593.1.1496120593.1496120593.; _pk_ses.49.8ee7=*
Connection: keep-alive
Cache-Control: no-cache
Referer: https://blog.securolytics.io/2017/05/split-tunnel-smtp-exploit-explained/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36

Response headers

Date: Tue, 30 May 2017 05:03:14 GMT
Last-Modified: Sun, 21 May 2017 23:22:14 GMT
Server: Apache/2.2.31 (Amazon)
ETag: "29de-4c0ca-550110656b2d1"
Strict-Transport-Security: max-age=63072000; preload
Content-Type: image/png
Connection: close
Accept-Ranges: bytes
Content-Length: 311498

GET
H/1.1 200
OK split-tunnel-smtp-attack2-image-18.png
blog.securolytics.io/wp-content/uploads/2017/05/ 268 KB
268 KB 295ms
98ms Image
image/png 54.173.173.29
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blog.securolytics.io/wp-content/uploads/2017/05/split-tunnel-smtp-attack2-image-18.png

Requested by

Host: blog.securolytics.io
URL: https://blog.securolytics.io/2017/05/split-tunnel-smtp-exploit-explained/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

54.173.173.29 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),

Reverse DNS

ec2-54-173-173-29.compute-1.amazonaws.com

Software

Apache/2.2.31 (Amazon) /

Resource Hash

b3fd007756b962c69239df8596e330919c2136d15de08a1a3b6535716986bb38

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; preload

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate, sdch, br
Host: blog.securolytics.io
Accept-Language: en-US,en;q=0.8
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36
Accept: image/webp,image/*,*/*;q=0.8
Referer: https://blog.securolytics.io/2017/05/split-tunnel-smtp-exploit-explained/
Cookie: _ga=GA1.2.1641080908.1496120592; _gid=GA1.2.1065285530.1496120592; _gat=1; gclid=undefined; _pk_id.49.8ee7=6decf5c307a2b16b.1496120593.1.1496120593.1496120593.; _pk_ses.49.8ee7=*
Connection: keep-alive
Cache-Control: no-cache
Referer: https://blog.securolytics.io/2017/05/split-tunnel-smtp-exploit-explained/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36

Response headers

Date: Tue, 30 May 2017 05:03:14 GMT
Last-Modified: Sun, 21 May 2017 23:22:18 GMT
Server: Apache/2.2.31 (Amazon)
ETag: "29df-42ea3-55011068eca68"
Strict-Transport-Security: max-age=63072000; preload
Content-Type: image/png
Connection: close
Accept-Ranges: bytes
Content-Length: 274083

GET
H/1.1 200
OK split-tunnel-smtp-attack2-image-19.png
blog.securolytics.io/wp-content/uploads/2017/05/ 97 KB
97 KB 297ms
99ms Image
image/png 54.173.173.29
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blog.securolytics.io/wp-content/uploads/2017/05/split-tunnel-smtp-attack2-image-19.png

Requested by

Host: blog.securolytics.io
URL: https://blog.securolytics.io/2017/05/split-tunnel-smtp-exploit-explained/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

54.173.173.29 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),

Reverse DNS

ec2-54-173-173-29.compute-1.amazonaws.com

Software

Apache/2.2.31 (Amazon) /

Resource Hash

6ab9af5c668665d6c6affd09941367d714c7efdedc286887e9e60fdea865d1b5

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; preload

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate, sdch, br
Host: blog.securolytics.io
Accept-Language: en-US,en;q=0.8
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36
Accept: image/webp,image/*,*/*;q=0.8
Referer: https://blog.securolytics.io/2017/05/split-tunnel-smtp-exploit-explained/
Cookie: _ga=GA1.2.1641080908.1496120592; _gid=GA1.2.1065285530.1496120592; _gat=1; gclid=undefined; _pk_id.49.8ee7=6decf5c307a2b16b.1496120593.1.1496120593.1496120593.; _pk_ses.49.8ee7=*
Connection: keep-alive
Cache-Control: no-cache
Referer: https://blog.securolytics.io/2017/05/split-tunnel-smtp-exploit-explained/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36

Response headers

Date: Tue, 30 May 2017 05:03:14 GMT
Last-Modified: Mon, 22 May 2017 02:51:27 GMT
Server: Apache/2.2.31 (Amazon)
ETag: "29e0-182b1-55013f28645cc"
Strict-Transport-Security: max-age=63072000; preload
Content-Type: image/png
Connection: close
Accept-Ranges: bytes
Content-Length: 98993

GET
H/1.1 200
OK split-tunnel-smtp-attack2-image-20.png
blog.securolytics.io/wp-content/uploads/2017/05/ 71 KB
71 KB 296ms
99ms Image
image/png 54.173.173.29
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blog.securolytics.io/wp-content/uploads/2017/05/split-tunnel-smtp-attack2-image-20.png

Requested by

Host: blog.securolytics.io
URL: https://blog.securolytics.io/2017/05/split-tunnel-smtp-exploit-explained/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

54.173.173.29 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),

Reverse DNS

ec2-54-173-173-29.compute-1.amazonaws.com

Software

Apache/2.2.31 (Amazon) /

Resource Hash

2fff935dcf212377cb836950f4826b3258b8ac891c638864a353fbec2634469f

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; preload

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate, sdch, br
Host: blog.securolytics.io
Accept-Language: en-US,en;q=0.8
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36
Accept: image/webp,image/*,*/*;q=0.8
Referer: https://blog.securolytics.io/2017/05/split-tunnel-smtp-exploit-explained/
Cookie: _ga=GA1.2.1641080908.1496120592; _gid=GA1.2.1065285530.1496120592; _gat=1; gclid=undefined; _pk_id.49.8ee7=6decf5c307a2b16b.1496120593.1.1496120593.1496120593.; _pk_ses.49.8ee7=*
Connection: keep-alive
Cache-Control: no-cache
Referer: https://blog.securolytics.io/2017/05/split-tunnel-smtp-exploit-explained/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36

Response headers

Date: Tue, 30 May 2017 05:03:14 GMT
Last-Modified: Mon, 22 May 2017 02:51:29 GMT
Server: Apache/2.2.31 (Amazon)
ETag: "29e1-11df6-55013f2adf232"
Strict-Transport-Security: max-age=63072000; preload
Content-Type: image/png
Connection: close
Accept-Ranges: bytes
Content-Length: 73206

GET
H/1.1 200
OK split-tunnel-smtp-attack2-image-23.png
blog.securolytics.io/wp-content/uploads/2017/05/ 81 KB
81 KB 299ms
100ms Image
image/png 54.173.173.29
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blog.securolytics.io/wp-content/uploads/2017/05/split-tunnel-smtp-attack2-image-23.png

Requested by

Host: blog.securolytics.io
URL: https://blog.securolytics.io/2017/05/split-tunnel-smtp-exploit-explained/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

54.173.173.29 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),

Reverse DNS

ec2-54-173-173-29.compute-1.amazonaws.com

Software

Apache/2.2.31 (Amazon) /

Resource Hash

d55d8902a42cbeab90e4fbf63e349fd4ec2ed031630a153d177f9c5872af8ebc

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; preload

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate, sdch, br
Host: blog.securolytics.io
Accept-Language: en-US,en;q=0.8
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36
Accept: image/webp,image/*,*/*;q=0.8
Referer: https://blog.securolytics.io/2017/05/split-tunnel-smtp-exploit-explained/
Cookie: _ga=GA1.2.1641080908.1496120592; _gid=GA1.2.1065285530.1496120592; _gat=1; gclid=undefined; _pk_id.49.8ee7=6decf5c307a2b16b.1496120593.1.1496120593.1496120593.; _pk_ses.49.8ee7=*
Connection: keep-alive
Cache-Control: no-cache
Referer: https://blog.securolytics.io/2017/05/split-tunnel-smtp-exploit-explained/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36

Response headers

Date: Tue, 30 May 2017 05:03:14 GMT
Last-Modified: Mon, 22 May 2017 05:07:09 GMT
Server: Apache/2.2.31 (Amazon)
ETag: "29e2-14255-55015d7dfbd17"
Strict-Transport-Security: max-age=63072000; preload
Content-Type: image/png
Connection: close
Accept-Ranges: bytes
Content-Length: 82517

GET
H/1.1

200
OK

split-tunnel-smtp-attack2-image-cip.png
blog.securolytics.io/wp-content/uploads/2017/05/
Redirect Chain

http://blog.securolytics.io/wp-content/uploads/2017/05/split-tunnel-smtp-attack2-image-cip.png
https://blog.securolytics.io/wp-content/uploads/2017/05/split-tunnel-smtp-attack2-image-cip.png

40 KB
40 KB

1078ms
97ms

Image
image/png

54.173.173.29
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blog.securolytics.io/wp-content/uploads/2017/05/split-tunnel-smtp-attack2-image-cip.png

Requested by

Host: blog.securolytics.io
URL: https://blog.securolytics.io/2017/05/split-tunnel-smtp-exploit-explained/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

54.173.173.29 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),

Reverse DNS

ec2-54-173-173-29.compute-1.amazonaws.com

Software

Apache/2.2.31 (Amazon) /

Resource Hash

d82e93a1c95cd066f7e4dab5dc294079b60ec979a85114624b888407b2b7d863

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; preload

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate, sdch, br
Host: blog.securolytics.io
Accept-Language: en-US,en;q=0.8
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36
Accept: image/webp,image/*,*/*;q=0.8
Cache-Control: no-cache
Connection: keep-alive
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36

Response headers

Date: Tue, 30 May 2017 05:03:13 GMT
Last-Modified: Mon, 22 May 2017 05:41:54 GMT
Server: Apache/2.2.31 (Amazon)
ETag: "29e5-a131-55016541de0cc"
Strict-Transport-Security: max-age=63072000; preload
Content-Type: image/png
Connection: close
Accept-Ranges: bytes
Content-Length: 41265

Redirect headers

Location: https://blog.securolytics.io/wp-content/uploads/2017/05/split-tunnel-smtp-attack2-image-cip.png
Non-Authoritative-Reason: HSTS

GET
H/1.1 200
OK split-tunnel-smtp-attack2-image-24.png
blog.securolytics.io/wp-content/uploads/2017/05/ 279 KB
279 KB 298ms
99ms Image
image/png 54.173.173.29
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blog.securolytics.io/wp-content/uploads/2017/05/split-tunnel-smtp-attack2-image-24.png

Requested by

Host: blog.securolytics.io
URL: https://blog.securolytics.io/2017/05/split-tunnel-smtp-exploit-explained/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

54.173.173.29 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),

Reverse DNS

ec2-54-173-173-29.compute-1.amazonaws.com

Software

Apache/2.2.31 (Amazon) /

Resource Hash

0f0139d7507f98a4d1182810db05ef9ec1fc197f4def7c441b862ad52f348a6c

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; preload

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate, sdch, br
Host: blog.securolytics.io
Accept-Language: en-US,en;q=0.8
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36
Accept: image/webp,image/*,*/*;q=0.8
Referer: https://blog.securolytics.io/2017/05/split-tunnel-smtp-exploit-explained/
Cookie: _ga=GA1.2.1641080908.1496120592; _gid=GA1.2.1065285530.1496120592; _gat=1; gclid=undefined; _pk_id.49.8ee7=6decf5c307a2b16b.1496120593.1.1496120593.1496120593.; _pk_ses.49.8ee7=*
Connection: keep-alive
Cache-Control: no-cache
Referer: https://blog.securolytics.io/2017/05/split-tunnel-smtp-exploit-explained/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36

Response headers

Date: Tue, 30 May 2017 05:03:15 GMT
Last-Modified: Mon, 22 May 2017 05:28:47 GMT
Server: Apache/2.2.31 (Amazon)
ETag: "29e4-45a15-550162532c5f6"
Strict-Transport-Security: max-age=63072000; preload
Content-Type: image/png
Connection: close
Accept-Ranges: bytes
Content-Length: 285205

GET
H/1.1

200
OK

securolytics-NIST-risk-management-framework.gif
blog.securolytics.io/wp-content/uploads/2017/05/
Redirect Chain

http://blog.securolytics.io/wp-content/uploads/2017/05/securolytics-NIST-risk-management-framework.gif
https://blog.securolytics.io/wp-content/uploads/2017/05/securolytics-NIST-risk-management-framework.gif

11 KB
11 KB

1021ms
98ms

Image
image/gif

54.173.173.29
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blog.securolytics.io/wp-content/uploads/2017/05/securolytics-NIST-risk-management-framework.gif

Requested by

Host: blog.securolytics.io
URL: https://blog.securolytics.io/2017/05/split-tunnel-smtp-exploit-explained/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

54.173.173.29 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),

Reverse DNS

ec2-54-173-173-29.compute-1.amazonaws.com

Software

Apache/2.2.31 (Amazon) /

Resource Hash

b2b481c5fc3f15b3678f5be2051d357d17650ddc54b226ec3ce33e598b0ab855

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; preload

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate, sdch, br
Host: blog.securolytics.io
Accept-Language: en-US,en;q=0.8
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36
Accept: image/webp,image/*,*/*;q=0.8
Cache-Control: no-cache
Connection: keep-alive
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36

Response headers

Date: Tue, 30 May 2017 05:03:13 GMT
Last-Modified: Tue, 23 May 2017 00:59:29 GMT
Server: Apache/2.2.31 (Amazon)
ETag: "164a-2a32-550267ff6e4a8"
Strict-Transport-Security: max-age=63072000; preload
Content-Type: image/gif
Connection: close
Accept-Ranges: bytes
Content-Length: 10802

Redirect headers

Location: https://blog.securolytics.io/wp-content/uploads/2017/05/securolytics-NIST-risk-management-framework.gif
Non-Authoritative-Reason: HSTS

GET
H/1.1 200
OK Cookie set zcga.js Show response
crm.zoho.com/crm/javascript/ 3 KB
1 KB 480ms
160ms Script
application/javascript 8.40.222.106
ZOHO

General

Check archive.org

Show headers Download Go to

Full URL

https://crm.zoho.com/crm/javascript/zcga.js

Requested by

Host: blog.securolytics.io
URL: https://blog.securolytics.io/2017/05/split-tunnel-smtp-exploit-explained/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

8.40.222.106 , United States, ASN2639 (ZOHO-AS - ZOHO, US),

Reverse DNS

Software

ZGS /

Resource Hash

e5db49fc15e40a9fe8a2674bb76519e46f31aefc24ca1c1449b06fe3d04ff9a3

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate, sdch, br
Host: crm.zoho.com
Accept-Language: en-US,en;q=0.8
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36
Accept: */*
Referer: https://blog.securolytics.io/2017/05/split-tunnel-smtp-exploit-explained/
Connection: keep-alive
Cache-Control: no-cache
Referer: https://blog.securolytics.io/2017/05/split-tunnel-smtp-exploit-explained/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36

Response headers

Date: Tue, 30 May 2017 05:03:12 GMT
Content-Encoding: gzip
Last-Modified: Mon, 29 May 2017 15:16:21 GMT
Server: ZGS
ETag: W/"2812-1496070981000"
Vary: Accept-Encoding
Content-Type: application/javascript
Set-Cookie: 9f54e53c1b=217d2ff5e241c38444475465b9fc988d; Path=/
Connection: keep-alive
Transfer-Encoding: chunked
Strict-Transport-Security: max-age=15768000
Accept-Ranges: bytes

GET
H/1.1 200
OK wp-emoji-release.min.js Show response
blog.securolytics.io/wp-includes/js/ 10 KB
10 KB 300ms
100ms Script
text/javascript 54.173.173.29
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.securolytics.io/wp-includes/js/wp-emoji-release.min.js?ver=4.6.1

Requested by

Host: blog.securolytics.io
URL: https://blog.securolytics.io/2017/05/split-tunnel-smtp-exploit-explained/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

54.173.173.29 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),

Reverse DNS

ec2-54-173-173-29.compute-1.amazonaws.com

Software

Apache/2.2.31 (Amazon) /

Resource Hash

29499e2b5d5cbd39647f55746440396d62f8c10c610e6e8bb4a2587030d986e1

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; preload

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate, sdch, br
Host: blog.securolytics.io
Accept-Language: en-US,en;q=0.8
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36
Accept: */*
Referer: https://blog.securolytics.io/2017/05/split-tunnel-smtp-exploit-explained/
Cookie: _ga=GA1.2.1641080908.1496120592; _gid=GA1.2.1065285530.1496120592; _gat=1; gclid=undefined; _pk_id.49.8ee7=6decf5c307a2b16b.1496120593.1.1496120593.1496120593.; _pk_ses.49.8ee7=*
Connection: keep-alive
Cache-Control: no-cache
Referer: https://blog.securolytics.io/2017/05/split-tunnel-smtp-exploit-explained/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36

Response headers

Date: Tue, 30 May 2017 05:03:15 GMT
Last-Modified: Fri, 28 Oct 2016 09:29:51 GMT
Server: Apache/2.2.31 (Amazon)
ETag: "821ce-28ae-53fe9800a3ac9"
Strict-Transport-Security: max-age=63072000; preload
Content-Type: text/javascript
Connection: close
Accept-Ranges: bytes
Content-Length: 10414

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 29 KB
12 KB 22ms
6ms Script
text/javascript 2a00:1450:4001:816::200e
Google Inc.

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: blog.securolytics.io
URL: https://blog.securolytics.io/2017/05/split-tunnel-smtp-exploit-explained/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a00:1450:4001:816::200e , Ireland, ASN15169 (GOOGLE - Google Inc., US),

Reverse DNS

Software

Golfe2 /

Resource Hash

e9830d0997e87c328360301ffb0ab81fabd9101f90453976ee61555d6f353af9

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

:path: /analytics.js
pragma: no-cache
accept-encoding: gzip, deflate, sdch, br
accept-language: en-US,en;q=0.8
user-agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36
accept: */*
cache-control: no-cache
:authority: www.google-analytics.com
referer: https://blog.securolytics.io/2017/05/split-tunnel-smtp-exploit-explained/
:scheme: https
:method: GET
Referer: https://blog.securolytics.io/2017/05/split-tunnel-smtp-exploit-explained/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Thu, 04 May 2017 01:31:56 GMT
server: Golfe2
age: 2647
date: Tue, 30 May 2017 04:19:05 GMT
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=7200
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="38,37,36,35"
content-length: 12267
expires: Tue, 30 May 2017 06:19:05 GMT

GET
H/1.1 200
OK Cookie set float.ls Show response
salesiq.zoho.com/teknas/ 18 KB
6 KB 526ms
198ms Script
text/javascript 8.40.222.111
ZOHO

General

Check archive.org

Show headers Download Go to

Full URL

https://salesiq.zoho.com/teknas/float.ls?embedname=securolytics

Requested by

Host: blog.securolytics.io
URL: https://blog.securolytics.io/2017/05/split-tunnel-smtp-exploit-explained/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

8.40.222.111 , United States, ASN2639 (ZOHO-AS - ZOHO, US),

Reverse DNS

Software

ZGS /

Resource Hash

14d3853499cc02bc0299105e50df1539a2e4ecf9daea338dfddff522ae8fd9a2

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate, sdch, br
Host: salesiq.zoho.com
Accept-Language: en-US,en;q=0.8
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36
Accept: */*
Referer: https://blog.securolytics.io/2017/05/split-tunnel-smtp-exploit-explained/
Connection: keep-alive
Cache-Control: no-cache
Referer: https://blog.securolytics.io/2017/05/split-tunnel-smtp-exploit-explained/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36

Response headers

Pragma
Date: Tue, 30 May 2017 05:03:12 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Server: ZGS
X-Frame-Options: SAMEORIGIN
Connection: keep-alive
Content-Type: text/javascript;charset=UTF-8
Set-Cookie: e3de1f7d42=88fb8b4d8b60317ef2950697809ab7eb; Path=/ LS_CSRF_TOKEN=8bdafe95-c64c-4291-8db6-f49d7929867f; Path=/; Secure JSESSIONID=C7F4159BB94381FE0E0F24A5019FBF0F; Path=/; HttpOnly
Cache-Control: must-revalidate
Transfer-Encoding: chunked
Strict-Transport-Security: max-age=15768000
Vary: Accept-Encoding
X-XSS-Protection: 1
Expires: Tue, 30 May 2017 05:04:12 GMT

GET
H2 200 CWB0XYA8bzo0kSThX0UTuA.woff2
fonts.gstatic.com/s/roboto/v16/ 14 KB
14 KB 9ms
8ms Font
font/woff2 2a00:1450:4001:816::2003
Google Inc.

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v16/CWB0XYA8bzo0kSThX0UTuA.woff2

Requested by

Host: blog.securolytics.io
URL: https://blog.securolytics.io/2017/05/split-tunnel-smtp-exploit-explained/

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2a00:1450:4001:816::2003 , Ireland, ASN15169 (GOOGLE - Google Inc., US),

Reverse DNS

Software

sffe /

Resource Hash

db44c6b7985f942465865cfe688770803ab464ec35fb9aefaeccc052e9b74b2a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:path: /s/roboto/v16/CWB0XYA8bzo0kSThX0UTuA.woff2
pragma: no-cache
origin: https://blog.securolytics.io
accept-encoding: gzip, deflate, sdch, br
accept-language: en-US,en;q=0.8
user-agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36
accept: */*
cache-control: no-cache
:authority: fonts.gstatic.com
referer: https://fonts.googleapis.com/css?family=Lato%3A300%2C400%2C700%2C900%2C300italic%2C400italic%7CRoboto%3A400%2C300%2C500%2C700&subset=latin%2Clatin-ext
:scheme: https
x-client-data: CIi2yQEIpLbJAQ==
:method: GET
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36
Referer: https://fonts.googleapis.com/css?family=Lato%3A300%2C400%2C700%2C900%2C300italic%2C400italic%7CRoboto%3A400%2C300%2C500%2C700&subset=latin%2Clatin-ext
Origin: https://blog.securolytics.io

Response headers

date: Mon, 29 May 2017 08:42:59 GMT
x-content-type-options: nosniff
last-modified: Mon, 17 Apr 2017 21:22:19 GMT
server: sffe
age: 73213
status: 200
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="38,37,36,35"
content-length: 14600
x-xss-protection: 1; mode=block
expires: Tue, 29 May 2018 08:42:59 GMT

GET
H2 200 rxxXUYj4oZ6Q5oDJFtEd6vk_vArhqVIZ0nv9q090hN8.woff2
fonts.gstatic.com/s/fjallaone/v4/ 16 KB
16 KB 10ms
9ms Font
font/woff2 2a00:1450:4001:816::2003
Google Inc.

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/fjallaone/v4/rxxXUYj4oZ6Q5oDJFtEd6vk_vArhqVIZ0nv9q090hN8.woff2

Requested by

Host: blog.securolytics.io
URL: https://blog.securolytics.io/2017/05/split-tunnel-smtp-exploit-explained/

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2a00:1450:4001:816::2003 , Ireland, ASN15169 (GOOGLE - Google Inc., US),

Reverse DNS

Software

sffe /

Resource Hash

d93b3e0523a3044e8a26474cdce53e2de4a4c8ba1e72e090305037c37040e94f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:path: /s/fjallaone/v4/rxxXUYj4oZ6Q5oDJFtEd6vk_vArhqVIZ0nv9q090hN8.woff2
pragma: no-cache
origin: https://blog.securolytics.io
accept-encoding: gzip, deflate, sdch, br
accept-language: en-US,en;q=0.8
user-agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36
accept: */*
cache-control: no-cache
:authority: fonts.gstatic.com
referer: https://fonts.googleapis.com/css?family=Fjalla+One
:scheme: https
x-client-data: CIi2yQEIpLbJAQ==
:method: GET
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36
Referer: https://fonts.googleapis.com/css?family=Fjalla+One
Origin: https://blog.securolytics.io

Response headers

date: Wed, 10 May 2017 19:26:04 GMT
x-content-type-options: nosniff
last-modified: Thu, 28 Aug 2014 18:23:59 GMT
server: sffe
age: 1676228
status: 200
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="38,37,36,35"
content-length: 16356
x-xss-protection: 1; mode=block
expires: Thu, 10 May 2018 19:26:04 GMT

GET
H2 200 fontawesome-webfont.woff2
maxcdn.bootstrapcdn.com/font-awesome/4.4.0/fonts/ 63 KB
63 KB 29ms
10ms Font
application/font-woff2 198.232.125.123
GTT-BACKBONE GTT

General

Check archive.org

Show headers Download Go to

Full URL: https://maxcdn.bootstrapcdn.com/font-awesome/4.4.0/fonts/fontawesome-webfont.woff2?v=4.4.0
Requested by: Host: blog.securolytics.io
URL: https://blog.securolytics.io/2017/05/split-tunnel-smtp-exploit-explained/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 198.232.125.123 Los Angeles, United States, ASN3257 (GTT-BACKBONE GTT, DE),
Reverse DNS: 123-125-232-198.static.unitasglobal.net
Software: NetDNA-cache/2.2 /
Resource Hash: 3c4a1bb7ce3234407184f0d80cc4dec075e4ad616b44dcc5778e1cfb1bc24019

Request headers

:path: /font-awesome/4.4.0/fonts/fontawesome-webfont.woff2?v=4.4.0
pragma: no-cache
origin: https://blog.securolytics.io
accept-encoding: gzip, deflate, sdch, br
accept-language: en-US,en;q=0.8
user-agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36
accept: */*
cache-control: no-cache
:authority: maxcdn.bootstrapcdn.com
referer: https://maxcdn.bootstrapcdn.com/font-awesome/4.4.0/css/font-awesome.min.css
:scheme: https
:method: GET
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36
Referer: https://maxcdn.bootstrapcdn.com/font-awesome/4.4.0/css/font-awesome.min.css
Origin: https://blog.securolytics.io

Response headers

date: Tue, 30 May 2017 05:03:12 GMT
last-modified: Sat, 28 Nov 2015 18:39:29 GMT
server: NetDNA-cache/2.2
status: 200
etag: "4b5a84aaf1c9485e060c503a0ff8cadb"
vary: Accept-Encoding
x-cache: HIT
content-type: application/font-woff2
access-control-allow-origin: *
cache-control: max-age=31104000
x-hello-human: Say hello back! @getBootstrapCDN on Twitter
accept-ranges: bytes
content-length: 64464
expires: Fri, 25 May 2018 05:03:12 GMT

GET
H2 200 H2DMvhDLycM56KNuAtbJYA.woff2
fonts.gstatic.com/s/lato/v13/ 22 KB
22 KB 12ms
11ms Font
font/woff2 2a00:1450:4001:816::2003
Google Inc.

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/lato/v13/H2DMvhDLycM56KNuAtbJYA.woff2

Requested by

Host: blog.securolytics.io
URL: https://blog.securolytics.io/2017/05/split-tunnel-smtp-exploit-explained/

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2a00:1450:4001:816::2003 , Ireland, ASN15169 (GOOGLE - Google Inc., US),

Reverse DNS

Software

sffe /

Resource Hash

47a03cdb40941ed9bb87178d34076aa70d7c8a21c2645d9a71e7edb02f94a4c2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:path: /s/lato/v13/H2DMvhDLycM56KNuAtbJYA.woff2
pragma: no-cache
origin: https://blog.securolytics.io
accept-encoding: gzip, deflate, sdch, br
accept-language: en-US,en;q=0.8
user-agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36
accept: */*
cache-control: no-cache
:authority: fonts.gstatic.com
referer: https://fonts.googleapis.com/css?family=Lato%3A300%2C400%2C700%2C900%2C300italic%2C400italic%7CRoboto%3A400%2C300%2C500%2C700&subset=latin%2Clatin-ext
:scheme: https
x-client-data: CIi2yQEIpLbJAQ==
:method: GET
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36
Referer: https://fonts.googleapis.com/css?family=Lato%3A300%2C400%2C700%2C900%2C300italic%2C400italic%7CRoboto%3A400%2C300%2C500%2C700&subset=latin%2Clatin-ext
Origin: https://blog.securolytics.io

Response headers

date: Thu, 11 May 2017 20:39:42 GMT
x-content-type-options: nosniff
last-modified: Thu, 09 Feb 2017 19:14:25 GMT
server: sffe
age: 1585410
status: 200
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="38,37,36,35"
content-length: 22656
x-xss-protection: 1; mode=block
expires: Fri, 11 May 2018 20:39:42 GMT

GET
H2 200 1YwB1sO8YE1Lyjf12WNiUA.woff2
fonts.gstatic.com/s/lato/v13/ 23 KB
23 KB 16ms
16ms Font
font/woff2 2a00:1450:4001:816::2003
Google Inc.

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/lato/v13/1YwB1sO8YE1Lyjf12WNiUA.woff2

Requested by

Host: blog.securolytics.io
URL: https://blog.securolytics.io/2017/05/split-tunnel-smtp-exploit-explained/

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2a00:1450:4001:816::2003 , Ireland, ASN15169 (GOOGLE - Google Inc., US),

Reverse DNS

Software

sffe /

Resource Hash

9687ee5934e8a8b125cd0e3f7e21b9eea12c5eba602dfb12941aeafaad44fbe3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:path: /s/lato/v13/1YwB1sO8YE1Lyjf12WNiUA.woff2
pragma: no-cache
origin: https://blog.securolytics.io
accept-encoding: gzip, deflate, sdch, br
accept-language: en-US,en;q=0.8
user-agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36
accept: */*
cache-control: no-cache
:authority: fonts.gstatic.com
referer: https://fonts.googleapis.com/css?family=Lato%3A300%2C400%2C700%2C900%2C300italic%2C400italic%7CRoboto%3A400%2C300%2C500%2C700&subset=latin%2Clatin-ext
:scheme: https
x-client-data: CIi2yQEIpLbJAQ==
:method: GET
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36
Referer: https://fonts.googleapis.com/css?family=Lato%3A300%2C400%2C700%2C900%2C300italic%2C400italic%7CRoboto%3A400%2C300%2C500%2C700&subset=latin%2Clatin-ext
Origin: https://blog.securolytics.io

Response headers

date: Thu, 11 May 2017 21:12:35 GMT
x-content-type-options: nosniff
last-modified: Thu, 09 Feb 2017 19:14:22 GMT
server: sffe
age: 1583437
status: 200
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="38,37,36,35"
content-length: 23216
x-xss-protection: 1; mode=block
expires: Fri, 11 May 2018 21:12:35 GMT

GET
H2 200 PLygLKRVCQnA5fhu3qk5fQ.woff2
fonts.gstatic.com/s/lato/v13/ 24 KB
24 KB 16ms
10ms Font
font/woff2 2a00:1450:4001:816::2003
Google Inc.

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/lato/v13/PLygLKRVCQnA5fhu3qk5fQ.woff2

Requested by

Host: blog.securolytics.io
URL: https://blog.securolytics.io/2017/05/split-tunnel-smtp-exploit-explained/

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2a00:1450:4001:816::2003 , Ireland, ASN15169 (GOOGLE - Google Inc., US),

Reverse DNS

Software

sffe /

Resource Hash

438eafc0cdc4cc94a17c3781a0e254d08af611c9e71a7c285fd3872ccd18cb93

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:path: /s/lato/v13/PLygLKRVCQnA5fhu3qk5fQ.woff2
pragma: no-cache
origin: https://blog.securolytics.io
accept-encoding: gzip, deflate, sdch, br
accept-language: en-US,en;q=0.8
user-agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36
accept: */*
cache-control: no-cache
:authority: fonts.gstatic.com
referer: https://fonts.googleapis.com/css?family=Lato%3A300%2C400%2C700%2C900%2C300italic%2C400italic%7CRoboto%3A400%2C300%2C500%2C700&subset=latin%2Clatin-ext
:scheme: https
x-client-data: CIi2yQEIpLbJAQ==
:method: GET
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36
Referer: https://fonts.googleapis.com/css?family=Lato%3A300%2C400%2C700%2C900%2C300italic%2C400italic%7CRoboto%3A400%2C300%2C500%2C700&subset=latin%2Clatin-ext
Origin: https://blog.securolytics.io

Response headers

date: Wed, 10 May 2017 19:25:56 GMT
x-content-type-options: nosniff
last-modified: Thu, 09 Feb 2017 19:14:17 GMT
server: sffe
age: 1676236
status: 200
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="38,37,36,35"
content-length: 24092
x-xss-protection: 1; mode=block
expires: Thu, 10 May 2018 19:25:56 GMT

GET
H/1.1 200
OK darkreading_securolytics_05-25-2017.jpg
blog.securolytics.io/wp-content/uploads/2017/05/ 10 KB
10 KB 246ms
98ms Image
image/jpeg 54.173.173.29
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blog.securolytics.io/wp-content/uploads/2017/05/darkreading_securolytics_05-25-2017.jpg

Requested by

Host: blog.securolytics.io
URL: https://blog.securolytics.io/2017/05/split-tunnel-smtp-exploit-explained/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

54.173.173.29 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),

Reverse DNS

ec2-54-173-173-29.compute-1.amazonaws.com

Software

Apache/2.2.31 (Amazon) /

Resource Hash

fd952e356e9a03c684084cd927b88f2034778356573cfeed28ece84ebf8abdda

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; preload

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate, sdch, br
Host: blog.securolytics.io
Accept-Language: en-US,en;q=0.8
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36
Accept: image/webp,image/*,*/*;q=0.8
Referer: https://blog.securolytics.io/2017/05/split-tunnel-smtp-exploit-explained/
Connection: keep-alive
Cache-Control: no-cache
Referer: https://blog.securolytics.io/2017/05/split-tunnel-smtp-exploit-explained/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36

Response headers

Date: Tue, 30 May 2017 05:03:12 GMT
Last-Modified: Tue, 30 May 2017 02:42:41 GMT
Server: Apache/2.2.31 (Amazon)
ETag: "29cb-26cd-550b4c1f0a144"
Strict-Transport-Security: max-age=63072000; preload
Content-Type: image/jpeg
Connection: close
Accept-Ranges: bytes
Content-Length: 9933

GET
H/1.1 200
OK 20ransom-1-master768.jpg
blog.securolytics.io/wp-content/uploads/2017/05/ 89 KB
89 KB 248ms
99ms Image
image/jpeg 54.173.173.29
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blog.securolytics.io/wp-content/uploads/2017/05/20ransom-1-master768.jpg

Requested by

Host: blog.securolytics.io
URL: https://blog.securolytics.io/2017/05/split-tunnel-smtp-exploit-explained/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

54.173.173.29 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),

Reverse DNS

ec2-54-173-173-29.compute-1.amazonaws.com

Software

Apache/2.2.31 (Amazon) /

Resource Hash

d7aeba6b284be2fbfeaae8f02bc140a4491d87d5f46caca6cd76aa90c412848f

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; preload

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate, sdch, br
Host: blog.securolytics.io
Accept-Language: en-US,en;q=0.8
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36
Accept: image/webp,image/*,*/*;q=0.8
Referer: https://blog.securolytics.io/2017/05/split-tunnel-smtp-exploit-explained/
Connection: keep-alive
Cache-Control: no-cache
Referer: https://blog.securolytics.io/2017/05/split-tunnel-smtp-exploit-explained/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36

Response headers

Date: Tue, 30 May 2017 05:03:12 GMT
Last-Modified: Fri, 19 May 2017 18:18:06 GMT
Server: Apache/2.2.31 (Amazon)
ETag: "29cf-165d1-54fe48b023351"
Strict-Transport-Security: max-age=63072000; preload
Content-Type: image/jpeg
Connection: close
Accept-Ranges: bytes
Content-Length: 91601

GET
H/1.1 200
OK bronxcare-1.png
blog.securolytics.io/wp-content/uploads/2017/05/ 466 KB
466 KB 247ms
99ms Image
image/png 54.173.173.29
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blog.securolytics.io/wp-content/uploads/2017/05/bronxcare-1.png

Requested by

Host: blog.securolytics.io
URL: https://blog.securolytics.io/2017/05/split-tunnel-smtp-exploit-explained/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

54.173.173.29 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),

Reverse DNS

ec2-54-173-173-29.compute-1.amazonaws.com

Software

Apache/2.2.31 (Amazon) /

Resource Hash

3c912f3753e81db1bf6883bceec8ce20e1cc5abb0b01d587d45def290878c336

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; preload

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate, sdch, br
Host: blog.securolytics.io
Accept-Language: en-US,en;q=0.8
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36
Accept: image/webp,image/*,*/*;q=0.8
Referer: https://blog.securolytics.io/2017/05/split-tunnel-smtp-exploit-explained/
Connection: keep-alive
Cache-Control: no-cache
Referer: https://blog.securolytics.io/2017/05/split-tunnel-smtp-exploit-explained/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36

Response headers

Date: Tue, 30 May 2017 05:03:12 GMT
Last-Modified: Fri, 12 May 2017 19:25:15 GMT
Server: Apache/2.2.31 (Amazon)
ETag: "2f3a-748dc-54f58aa451a8d"
Strict-Transport-Security: max-age=63072000; preload
Content-Type: image/png
Connection: close
Accept-Ranges: bytes
Content-Length: 477404

GET
H/1.1 200
OK 44339432-Internet-of-Things-IOT-concept-background-Vector-illustration-representing-new-innovative-ideas-with-Stock-Vector.jpg
blog.securolytics.io/wp-content/uploads/2017/05/ 94 KB
94 KB 244ms
97ms Image
image/jpeg 54.173.173.29
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://blog.securolytics.io/wp-content/uploads/2017/05/44339432-Internet-of-Things-IOT-concept-background-Vector-illustration-representing-new-innovative-ideas-with-Stock-Vector.jpg

Requested by

Host: blog.securolytics.io
URL: https://blog.securolytics.io/2017/05/split-tunnel-smtp-exploit-explained/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

54.173.173.29 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),

Reverse DNS

ec2-54-173-173-29.compute-1.amazonaws.com

Software

Apache/2.2.31 (Amazon) /

Resource Hash

f0cdcdf13dfc511aa872dea1d899623e02a6b176293fb34afbbafb2e13f626eb

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; preload

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate, sdch, br
Host: blog.securolytics.io
Accept-Language: en-US,en;q=0.8
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36
Accept: image/webp,image/*,*/*;q=0.8
Referer: https://blog.securolytics.io/2017/05/split-tunnel-smtp-exploit-explained/
Connection: keep-alive
Cache-Control: no-cache
Referer: https://blog.securolytics.io/2017/05/split-tunnel-smtp-exploit-explained/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36

Response headers

Date: Tue, 30 May 2017 05:03:12 GMT
Last-Modified: Fri, 05 May 2017 20:40:57 GMT
Server: Apache/2.2.31 (Amazon)
ETag: "2e5b-1789c-54ecce81a94cb"
Strict-Transport-Security: max-age=63072000; preload
Content-Type: image/jpeg
Connection: close
Accept-Ranges: bytes
Content-Length: 96412

GET
H2 200 collect
www.google-analytics.com/ 35 B
44 B 7ms
5ms Image
image/gif 2a00:1450:4001:816::200e
Google Inc.

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j54&a=676593961&t=pageview&_s=1&dl=https%3A%2F%2Fblog.securolytics.io%2F2017%2F05%2Fsplit-tunnel-smtp-exploit-explained%2F&ul=en-us&de=UTF-8&dt=Securolytics%20%7C%20Blog&sd=24-bit&sr=1600x1200&vp=1583x1132&je=0&fl=25.0%20r0&_u=IGBAgEAB~&jid=157318190&cid=1641080908.1496120592&tid=UA-83030790-1&_gid=1065285530.1496120592&z=1735982450

Requested by

Host: blog.securolytics.io
URL: https://blog.securolytics.io/2017/05/split-tunnel-smtp-exploit-explained/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a00:1450:4001:816::200e , Ireland, ASN15169 (GOOGLE - Google Inc., US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

:path: /collect?v=1&_v=j54&a=676593961&t=pageview&_s=1&dl=https%3A%2F%2Fblog.securolytics.io%2F2017%2F05%2Fsplit-tunnel-smtp-exploit-explained%2F&ul=en-us&de=UTF-8&dt=Securolytics%20%7C%20Blog&sd=24-bit&sr=1600x1200&vp=1583x1132&je=0&fl=25.0%20r0&_u=IGBAgEAB~&jid=157318190&cid=1641080908.1496120592&tid=UA-83030790-1&_gid=1065285530.1496120592&z=1735982450
pragma: no-cache
accept-encoding: gzip, deflate, sdch, br
accept-language: en-US,en;q=0.8
user-agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36
accept: image/webp,image/*,*/*;q=0.8
cache-control: no-cache
:authority: www.google-analytics.com
referer: https://blog.securolytics.io/2017/05/split-tunnel-smtp-exploit-explained/
:scheme: https
:method: GET
Referer: https://blog.securolytics.io/2017/05/split-tunnel-smtp-exploit-explained/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 29 May 2017 08:42:50 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 73222
status: 200
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
alt-svc: quic=":443"; ma=2592000; v="38,37,36,35"
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2 200 collect
stats.g.doubleclick.net/r/ 35 B
53 B 45ms
15ms Image
image/gif 2a00:1450:400c:c04::9d
Google Inc.

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://stats.g.doubleclick.net/r/collect?t=dc&aip=1&_r=3&v=1&_v=j54&tid=UA-83030790-1&cid=1641080908.1496120592&jid=157318190&_u=IGBAgEAB~&z=513449085

Requested by

Host: blog.securolytics.io
URL: https://blog.securolytics.io/2017/05/split-tunnel-smtp-exploit-explained/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a00:1450:400c:c04::9d , Ireland, ASN15169 (GOOGLE - Google Inc., US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

:path: /r/collect?t=dc&aip=1&_r=3&v=1&_v=j54&tid=UA-83030790-1&cid=1641080908.1496120592&jid=157318190&_u=IGBAgEAB~&z=513449085
pragma: no-cache
accept-encoding: gzip, deflate, sdch, br
accept-language: en-US,en;q=0.8
user-agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36
accept: image/webp,image/*,*/*;q=0.8
cache-control: no-cache
:authority: stats.g.doubleclick.net
referer: https://blog.securolytics.io/2017/05/split-tunnel-smtp-exploit-explained/
:scheme: https
x-client-data: CIi2yQEIpLbJAQ==
:method: GET
Referer: https://blog.securolytics.io/2017/05/split-tunnel-smtp-exploit-explained/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
date: Tue, 30 May 2017 05:03:12 GMT
status: 200
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
alt-svc: quic=":443"; ma=2592000; v="39,38,37,36,35"
content-length: 35
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET sm.16.html
static.addtoany.com/menu/ Frame 6410 0
0

GET
DATA 200
OK truncated
/ 34 B
0 Image
image/gif

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 1e85ec81b9800b4c443d39caca0d0926089a3ac201120db1ceb45b93789480b8

Request headers

Response headers

GET
H2 200 icons.21.svg.js Show response
static.addtoany.com/menu/svg/ 83 KB
0 1ms
0ms Script
application/javascript 2400:cb00:2048:1::6814:6e27
CloudFlare

General

Check archive.org

Show headers Download Go to

Full URL

https://static.addtoany.com/menu/svg/icons.21.svg.js

Requested by

Host: static.addtoany.com
URL: https://static.addtoany.com/menu/page.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2400:cb00:2048:1::6814:6e27 , United States, ASN13335 (CLOUDFLARENET - CloudFlare, Inc., US),

Reverse DNS

Software

cloudflare-nginx /

Resource Hash

0b6daa69314b58b23c4e39885c5465adc86e4b76c6704e824de17a2d6a8ffe11

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://blog.securolytics.io/2017/05/split-tunnel-smtp-exploit-explained/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36

Response headers

date: Tue, 30 May 2017 05:03:12 GMT
via: 1.1 vhost.phx6.nearlyfreespeech.net (squid)
x-content-type-options: nosniff
cf-cache-status: HIT
p3p: CP="ALL DSP COR CURa ADMa DEVa TAIa PSAa PSDa OUR IND UNI COM NAV INT"
status: 200
content-encoding: gzip
vary: Accept-Encoding
last-modified: Thu, 22 Dec 2016 19:47:52 GMT
server: cloudflare-nginx
etag: W/"14c84-544448b7bf264"
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-type: application/javascript
cache-control: public, max-age=315360000
set-cookie: __cfduid=d736499efdc8a28a6cff65a86f20fa92a1496120592; expires=Wed, 30-May-18 05:03:12 GMT; path=/; domain=.addtoany.com; HttpOnly
cf-ray: 366f2545fe116457-FRA
expires: Fri, 28 May 2027 05:03:12 GMT

GET
H/1.1 200
OK piwik.js Show response
teknas.piwikpro.com/ 54 KB
21 KB 416ms
27ms Script
application/x-javascript 178.162.208.180
LEASEWEB-

General

Check archive.org

Show headers Download Go to

Full URL

https://teknas.piwikpro.com/piwik.js

Requested by

Host: blog.securolytics.io
URL: https://blog.securolytics.io/2017/05/split-tunnel-smtp-exploit-explained/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

178.162.208.180 , Germany, ASN28753 (LEASEWEB-, DE),

Reverse DNS

sni.de-aurora-dc.cldsrv.biz

Software

Resource Hash

bd816aa696baaaecb101ad5e78360d69beb0dcd782a0f595b4717f4b56ae9354

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate, sdch, br
Host: teknas.piwikpro.com
Accept-Language: en-US,en;q=0.8
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36
Accept: */*
Referer: https://blog.securolytics.io/2017/05/split-tunnel-smtp-exploit-explained/
Connection: keep-alive
Cache-Control: no-cache
Referer: https://blog.securolytics.io/2017/05/split-tunnel-smtp-exploit-explained/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36

Response headers

Date: Tue, 30 May 2017 05:03:13 GMT
Content-Encoding: gzip
Last-Modified: Thu, 23 Mar 2017 11:28:03 GMT
Strict-Transport-Security: max-age=15768000
Content-Type: application/x-javascript
Cache-Control: max-age=86400
Transfer-Encoding: chunked
Connection: close
Expires: Wed, 31 May 2017 05:03:13 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 29 KB
12 KB 6ms
5ms Script
text/javascript 2a00:1450:4001:816::200e
Google Inc.

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: blog.securolytics.io
URL: https://blog.securolytics.io/2017/05/split-tunnel-smtp-exploit-explained/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a00:1450:4001:816::200e , Ireland, ASN15169 (GOOGLE - Google Inc., US),

Reverse DNS

Software

Golfe2 /

Resource Hash

e9830d0997e87c328360301ffb0ab81fabd9101f90453976ee61555d6f353af9

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

:path: /analytics.js
pragma: no-cache
accept-encoding: gzip, deflate, sdch, br
accept-language: en-US,en;q=0.8
user-agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36
accept: */*
cache-control: no-cache
:authority: www.google-analytics.com
referer: https://blog.securolytics.io/2017/05/split-tunnel-smtp-exploit-explained/
:scheme: https
:method: GET
Referer: https://blog.securolytics.io/2017/05/split-tunnel-smtp-exploit-explained/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Thu, 04 May 2017 01:31:56 GMT
server: Golfe2
age: 2647
date: Tue, 30 May 2017 04:19:05 GMT
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=7200
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="38,37,36,35"
content-length: 12267
expires: Tue, 30 May 2017 06:19:05 GMT

GET
H2 200 collect
www.google-analytics.com/ 35 B
44 B 6ms
5ms Image
image/gif 2a00:1450:4001:816::200e
Google Inc.

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j54&a=676593961&t=pageview&_s=2&dl=https%3A%2F%2Fblog.securolytics.io%2F2017%2F05%2Fsplit-tunnel-smtp-exploit-explained%2F&ul=en-us&de=UTF-8&dt=Securolytics%20%7C%20Blog&sd=24-bit&sr=1600x1200&vp=1583x1132&je=0&fl=25.0%20r0&_u=KGBAgEAB~&jid=&cid=1641080908.1496120592&tid=UA-83030790-1&_gid=1065285530.1496120592&z=550780867

Requested by

Host: blog.securolytics.io
URL: https://blog.securolytics.io/2017/05/split-tunnel-smtp-exploit-explained/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a00:1450:4001:816::200e , Ireland, ASN15169 (GOOGLE - Google Inc., US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

:path: /collect?v=1&_v=j54&a=676593961&t=pageview&_s=2&dl=https%3A%2F%2Fblog.securolytics.io%2F2017%2F05%2Fsplit-tunnel-smtp-exploit-explained%2F&ul=en-us&de=UTF-8&dt=Securolytics%20%7C%20Blog&sd=24-bit&sr=1600x1200&vp=1583x1132&je=0&fl=25.0%20r0&_u=KGBAgEAB~&jid=&cid=1641080908.1496120592&tid=UA-83030790-1&_gid=1065285530.1496120592&z=550780867
pragma: no-cache
accept-encoding: gzip, deflate, sdch, br
accept-language: en-US,en;q=0.8
user-agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36
accept: image/webp,image/*,*/*;q=0.8
cache-control: no-cache
:authority: www.google-analytics.com
referer: https://blog.securolytics.io/2017/05/split-tunnel-smtp-exploit-explained/
:scheme: https
:method: GET
Referer: https://blog.securolytics.io/2017/05/split-tunnel-smtp-exploit-explained/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 29 May 2017 08:42:50 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 73222
status: 200
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
alt-svc: quic=":443"; ma=2592000; v="38,37,36,35"
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK Cookie set button.ls Show response
salesiq.zoho.com/teknas/ 20 KB
6 KB 289ms
176ms Script
text/javascript 8.40.222.111
ZOHO

General

Check archive.org

Show headers Download Go to

Full URL

https://salesiq.zoho.com/teknas/button.ls?embedname=securolytics

Requested by

Host: blog.securolytics.io
URL: https://blog.securolytics.io/2017/05/split-tunnel-smtp-exploit-explained/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

8.40.222.111 , United States, ASN2639 (ZOHO-AS - ZOHO, US),

Reverse DNS

Software

ZGS /

Resource Hash

2537a62717843496daa8fedb32d44403c1ab23c4617d9a3aa1f56eb9045a8faa

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate, sdch, br
Host: salesiq.zoho.com
Accept-Language: en-US,en;q=0.8
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36
Accept: */*
Referer: https://blog.securolytics.io/2017/05/split-tunnel-smtp-exploit-explained/
Connection: keep-alive
Cache-Control: no-cache
Referer: https://blog.securolytics.io/2017/05/split-tunnel-smtp-exploit-explained/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36

Response headers

Date: Tue, 30 May 2017 05:03:12 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
X-XSS-Protection: 1
Pragma
Last-Modified: Wed, 24 May 2017 14:32:44 GMT
Server: ZGS
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=15768000
Content-Type: text/javascript;charset=UTF-8
Cache-Control: must-revalidate
Set-Cookie: e3de1f7d42=bf28259eecc600de73ac7e90be022a31; Path=/ LS_CSRF_TOKEN=12e2d3c1-c8d8-4902-afff-86b3d335a637; Path=/; Secure JSESSIONID=1883EA78E38ADD967D381472BE969D88; Path=/; HttpOnly
Expires: Tue, 30 May 2017 05:04:12 GMT

GET
H/1.1 204
No Response piwik.php
teknas.piwikpro.com/ 0
0 96ms
71ms Image
text/html 178.162.208.180
LEASEWEB-

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://teknas.piwikpro.com/piwik.php?action_name=blog.securolytics.io%2FSecurolytics%20%7C%20Blog&idsite=49&rec=1&r=257748&h=5&m=3&s=13&url=https%3A%2F%2Fblog.securolytics.io%2F2017%2F05%2Fsplit-tunnel-smtp-exploit-explained%2F&_id=6decf5c307a2b16b&_idts=1496120593&_idvc=1&_idn=0&_refts=0&_viewts=1496120593&send_image=0&pdf=1&qt=0&realp=0&wma=0&dir=0&fla=1&java=0&gears=0&ag=0&cookie=1&res=1600x1200&gt_ms=617

Requested by

Host: blog.securolytics.io
URL: https://blog.securolytics.io/2017/05/split-tunnel-smtp-exploit-explained/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

178.162.208.180 , Germany, ASN28753 (LEASEWEB-, DE),

Reverse DNS

sni.de-aurora-dc.cldsrv.biz

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate, sdch, br
Host: teknas.piwikpro.com
Accept-Language: en-US,en;q=0.8
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36
Accept: image/webp,image/*,*/*;q=0.8
Referer: https://blog.securolytics.io/2017/05/split-tunnel-smtp-exploit-explained/
Connection: keep-alive
Cache-Control: no-cache
Referer: https://blog.securolytics.io/2017/05/split-tunnel-smtp-exploit-explained/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36

Response headers

Date: Tue, 30 May 2017 05:03:13 GMT
Connection: close
Strict-Transport-Security: max-age=15768000
Content-Type: text/html; charset=UTF-8

GET
H/1.1 200
OK floatsupportbtn.css
css.zohostatic.com/salesiq/May_24_2017_https/styles/ 24 KB
5 KB 640ms
156ms Stylesheet
text/css 8.40.222.123
ZOHO

General

Check archive.org

Show headers Download Go to

Full URL: https://css.zohostatic.com/salesiq/May_24_2017_https/styles/floatsupportbtn.css
Requested by: Host: salesiq.zoho.com
URL: https://salesiq.zoho.com/teknas/float.ls?embedname=securolytics
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 8.40.222.123 , United States, ASN2639 (ZOHO-AS - ZOHO, US),
Reverse DNS
Software: ZGS /
Resource Hash: 05072554e3623f9841264ba7262ffb765365ac28f3162b24291609477d42e78d

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate, sdch, br
Host: css.zohostatic.com
Accept-Language: en-US,en;q=0.8
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36
Accept: text/css,*/*;q=0.1
Referer: https://blog.securolytics.io/2017/05/split-tunnel-smtp-exploit-explained/
Connection: keep-alive
Cache-Control: no-cache
Referer: https://blog.securolytics.io/2017/05/split-tunnel-smtp-exploit-explained/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36

Response headers

Date: Tue, 30 May 2017 05:03:16 GMT
Content-Encoding: gzip
Last-Modified: Thu, 25 May 2017 16:09:50 GMT
Server: ZGS
ETag: "592701ce-12ba"
Content-Type: text/css
Cache-Control: max-age=31536000
Connection: keep-alive
X-Robots-Tag: noindex, nofollow, nosnippet, noarchive
Content-Length: 4794
Expires: Wed, 30 May 2018 05:03:16 GMT

GET
H/1.1 200
OK track.js Show response
js.zohostatic.com/salesiq/May_24_2017_https/js/ 70 KB
21 KB 530ms
156ms Script
application/javascript 8.40.222.123
ZOHO

General

Check archive.org

Show headers Download Go to

Full URL: https://js.zohostatic.com/salesiq/May_24_2017_https/js/track.js
Requested by: Host: salesiq.zoho.com
URL: https://salesiq.zoho.com/teknas/float.ls?embedname=securolytics
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 8.40.222.123 , United States, ASN2639 (ZOHO-AS - ZOHO, US),
Reverse DNS
Software: ZGS /
Resource Hash: 05bbda819098c940081392a51697b2fd5b42f39d78999b50e4b335aa727a69d3

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate, sdch, br
Host: js.zohostatic.com
Accept-Language: en-US,en;q=0.8
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36
Accept: */*
Referer: https://blog.securolytics.io/2017/05/split-tunnel-smtp-exploit-explained/
Connection: keep-alive
Cache-Control: no-cache
Referer: https://blog.securolytics.io/2017/05/split-tunnel-smtp-exploit-explained/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36

Response headers

Date: Tue, 30 May 2017 05:03:16 GMT
Content-Encoding: gzip
Last-Modified: Thu, 25 May 2017 16:09:50 GMT
Server: ZGS
ETag: "592701ce-520d"
Content-Type: application/javascript
Cache-Control: max-age=31536000
Connection: keep-alive
X-Robots-Tag: noindex, nofollow, nosnippet, noarchive
Content-Length: 21005
Expires: Wed, 30 May 2018 05:03:16 GMT

GET
H/1.1 200
OK button.js Show response
js.zohostatic.com/salesiq/May_24_2017_https/js/ 13 KB
4 KB 531ms
157ms Script
application/javascript 8.40.222.123
ZOHO

General

Check archive.org

Show headers Download Go to

Full URL: https://js.zohostatic.com/salesiq/May_24_2017_https/js/button.js
Requested by: Host: salesiq.zoho.com
URL: https://salesiq.zoho.com/teknas/button.ls?embedname=securolytics
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 8.40.222.123 , United States, ASN2639 (ZOHO-AS - ZOHO, US),
Reverse DNS
Software: ZGS /
Resource Hash: c5d2cc1d2ddaef95c17a2905fff475005875a091ab0f65838dc03cea187b4739

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate, sdch, br
Host: js.zohostatic.com
Accept-Language: en-US,en;q=0.8
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36
Accept: */*
Referer: https://blog.securolytics.io/2017/05/split-tunnel-smtp-exploit-explained/
Connection: keep-alive
Cache-Control: no-cache
Referer: https://blog.securolytics.io/2017/05/split-tunnel-smtp-exploit-explained/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36

Response headers

Date: Tue, 30 May 2017 05:03:16 GMT
Content-Encoding: gzip
Last-Modified: Thu, 25 May 2017 16:09:50 GMT
Server: ZGS
ETag: "592701ce-1001"
Content-Type: application/javascript
Cache-Control: max-age=31536000
Connection: keep-alive
X-Robots-Tag: noindex, nofollow, nosnippet, noarchive
Content-Length: 4097
Expires: Wed, 30 May 2018 05:03:16 GMT

GET
H/1.1 200
OK favi.ico
blog.securolytics.io/wp-content/themes/cloudstat/images/ 1 KB
1 KB 297ms
99ms Other
image/vnd.microsoft.icon 54.173.173.29
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL

https://blog.securolytics.io/wp-content/themes/cloudstat/images/favi.ico

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

54.173.173.29 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),

Reverse DNS

ec2-54-173-173-29.compute-1.amazonaws.com

Software

Apache/2.2.31 (Amazon) /

Resource Hash

a481485d6fdef7406780f848ebcb995d7ac99a2387589f80e5fc2d1ba0709f7c

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; preload

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate, sdch, br
Host: blog.securolytics.io
Accept-Language: en-US,en;q=0.8
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36
Accept: image/webp,image/*,*/*;q=0.8
Referer: https://blog.securolytics.io/2017/05/split-tunnel-smtp-exploit-explained/
Cookie: _ga=GA1.2.1641080908.1496120592; _gid=GA1.2.1065285530.1496120592; _gat=1; gclid=undefined; _pk_id.49.8ee7=6decf5c307a2b16b.1496120593.1.1496120593.1496120593.; _pk_ses.49.8ee7=*
Connection: keep-alive
Cache-Control: no-cache
Referer: https://blog.securolytics.io/2017/05/split-tunnel-smtp-exploit-explained/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36

Response headers

Date: Tue, 30 May 2017 05:03:16 GMT
Last-Modified: Tue, 20 Sep 2016 09:27:49 GMT
Server: Apache/2.2.31 (Amazon)
ETag: "81e85-47e-53ced0ac46ae3"
Strict-Transport-Security: max-age=63072000; preload
Content-Type: image/vnd.microsoft.icon
Connection: close
Accept-Ranges: bytes
Content-Length: 1150

GET
H/1.1 200
OK float-sprite.png
img.zohostatic.com/salesiq/May_24_2017_https/images/ 28 KB
28 KB 477ms
158ms Image
image/png 74.201.154.73
ZOHO

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.zohostatic.com/salesiq/May_24_2017_https/images/float-sprite.png
Requested by: Host: js.zohostatic.com
URL: https://js.zohostatic.com/salesiq/May_24_2017_https/js/track.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 74.201.154.73 , United States, ASN2639 (ZOHO-AS - ZOHO, US),
Reverse DNS
Software: ZGS /
Resource Hash: 720b9dffd8324fb8222548dd395a84aa60c1953801990e8b021d12f4ea95273a

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate, sdch, br
Host: img.zohostatic.com
Accept-Language: en-US,en;q=0.8
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36
Accept: image/webp,image/*,*/*;q=0.8
Referer: https://css.zohostatic.com/salesiq/May_24_2017_https/styles/floatsupportbtn.css
Connection: keep-alive
Cache-Control: no-cache
Referer: https://css.zohostatic.com/salesiq/May_24_2017_https/styles/floatsupportbtn.css
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36

Response headers

Date: Tue, 30 May 2017 05:03:16 GMT
Last-Modified: Thu, 25 May 2017 16:09:50 GMT
Server: ZGS
ETag: "592701ce-7008"
Content-Type: image/png
Cache-Control: max-age=31536000
Connection: keep-alive
Accept-Ranges: bytes
X-Robots-Tag: noindex, nofollow, nosnippet, noarchive
Content-Length: 28680
Expires: Wed, 30 May 2018 05:03:16 GMT

GET drawchat.ls
salesiq.zohopublic.com/teknas/ Frame 6410 0
0

GET
H/1.1 200
OK spacer.gif
img.zohostatic.com/salesiq/May_24_2017_https/images/ 43 B
43 B 666ms
351ms Image
image/gif 8.40.222.123
ZOHO

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.zohostatic.com/salesiq/May_24_2017_https/images/spacer.gif
Requested by: Host: blog.securolytics.io
URL: https://blog.securolytics.io/2017/05/split-tunnel-smtp-exploit-explained/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 8.40.222.123 , United States, ASN2639 (ZOHO-AS - ZOHO, US),
Reverse DNS
Software: ZGS /
Resource Hash: 4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate, sdch, br
Host: img.zohostatic.com
Accept-Language: en-US,en;q=0.8
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36
Accept: image/webp,image/*,*/*;q=0.8
Referer: https://blog.securolytics.io/2017/05/split-tunnel-smtp-exploit-explained/
Connection: keep-alive
Cache-Control: no-cache
Referer: https://blog.securolytics.io/2017/05/split-tunnel-smtp-exploit-explained/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36

Response headers

Date: Tue, 30 May 2017 05:03:16 GMT
Last-Modified: Thu, 25 May 2017 16:09:50 GMT
Server: ZGS
ETag: "592701ce-2b"
Content-Type: image/gif
Cache-Control: max-age=31536000
Connection: keep-alive
Accept-Ranges: bytes
X-Robots-Tag: noindex, nofollow, nosnippet, noarchive
Content-Length: 43
Expires: Wed, 30 May 2018 05:03:16 GMT

GET
H/1.1 200
OK sprite.png
img.zohostatic.com/salesiq/May_24_2017_https/images/embed/ 23 KB
23 KB 472ms
156ms Image
image/png 8.40.222.123
ZOHO

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.zohostatic.com/salesiq/May_24_2017_https/images/embed/sprite.png
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 8.40.222.123 , United States, ASN2639 (ZOHO-AS - ZOHO, US),
Reverse DNS
Software: ZGS /
Resource Hash: 344741764fe3aea14e9b58687b571496a6ffaf8a6173e61d078537bc0cfdc88d

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate, sdch, br
Host: img.zohostatic.com
Accept-Language: en-US,en;q=0.8
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36
Accept: image/webp,image/*,*/*;q=0.8
Referer: https://css.zohostatic.com/salesiq/May_24_2017_https/styles/floatsupportbtn.css
Connection: keep-alive
Cache-Control: no-cache
Referer: https://css.zohostatic.com/salesiq/May_24_2017_https/styles/floatsupportbtn.css
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36

Response headers

Date: Tue, 30 May 2017 05:03:16 GMT
Last-Modified: Thu, 25 May 2017 16:09:50 GMT
Server: ZGS
ETag: "592701ce-5a70"
Content-Type: image/png
Cache-Control: max-age=31536000
Connection: keep-alive
Accept-Ranges: bytes
X-Robots-Tag: noindex, nofollow, nosnippet, noarchive
Content-Length: 23152
Expires: Wed, 30 May 2018 05:03:16 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: static.addtoany.com
URL: https://static.addtoany.com/menu/sm.16.html

Domain: salesiq.zohopublic.com
URL: https://salesiq.zohopublic.com/teknas/drawchat.ls?src=script&type=float&referrer=&pagetitle=Securolytics%20%7C%20Blog&embedname=securolytics&cpage=aHR0cHM6Ly9ibG9nLnNlY3Vyb2x5dGljcy5pby8yMDE3LzA1L3NwbGl0LXR1bm5lbC1zbXRwLWV4cGxvaXQtZXhwbGFpbmVkLw%3D%3D&autochat=false&lang=en&loadedtime=1496120596490

Verdicts & Comments Add Verdict or Comment

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

12 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.static.addtoany.com/	2017-11-28 17:03:12	Name: __utmz Value: 66866668.1496120592.1.1.utmcsr=blog.securolytics.io\|utmccn=(referral)\|utmcmd=referral\|utmcct=/2017/05/split-tunnel-smtp-exploit-explained/
.securolytics.io/	2018-06-27 05:03:13	Name: _pk_id.49.8ee7 Value: 6decf5c307a2b16b.1496120593.1.1496120593.1496120593.
.addtoany.com/	2018-05-30 05:03:12	Name: __cfduid Value: d736499efdc8a28a6cff65a86f20fa92a1496120592
.static.addtoany.com/	1970-01-01 00:00:00	Name: __utmc Value: 66866668
.static.addtoany.com/	2019-05-30 05:03:12	Name: __utma Value: 66866668.505925487.1496120592.1496120592.1496120592.1
blog.securolytics.io/	2017-06-29 05:03:12	Name: gclid Value: undefined
.static.addtoany.com/	2017-05-30 05:33:12	Name: __utmb Value: 66866668.0.10.1496120592
.securolytics.io/	2017-05-30 05:33:13	Name: _pk_ses.49.8ee7 Value: *
.securolytics.io/	2017-05-31 05:03:12	Name: _gid Value: GA1.2.1065285530.1496120592
.addtoany.com/	2017-05-31 05:03:12	Name: uvc Value: 1
.securolytics.io/	2019-05-30 05:03:12	Name: _ga Value: GA1.2.1641080908.1496120592
.securolytics.io/	2017-05-30 05:04:12	Name: _gat Value: 1

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	log	URL: https://blog.securolytics.io/wp-includes/js/jquery/jquery-migrate.min.js?ver=1.4.1(Line 2) Message: JQMIGRATE: Migrate is installed, version 1.4.1

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=63072000; preload

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

blog.securolytics.io
crm.zoho.com
css.zohostatic.com
fonts.googleapis.com
fonts.gstatic.com
img.zohostatic.com
js.zohostatic.com
maxcdn.bootstrapcdn.com
salesiq.zoho.com
salesiq.zohopublic.com
static.addtoany.com
stats.g.doubleclick.net
teknas.piwikpro.com
www.google-analytics.com
salesiq.zohopublic.com
static.addtoany.com
178.162.208.180
198.232.125.123
2400:cb00:2048:1::6814:6e27
2a00:1450:4001:816::2003
2a00:1450:4001:816::200a
2a00:1450:4001:816::200e
2a00:1450:400c:c04::9d
54.173.173.29
74.201.154.73
8.40.222.106
8.40.222.111
8.40.222.123
0496ffd71472af755edab2dc201d07a382b92856335769bad8c83a8e245435b4
04b2aa89e5dd20337ca3083ba08b5cb7621930665b012ef852ab1bb3f816f4c7
05072554e3623f9841264ba7262ffb765365ac28f3162b24291609477d42e78d
05bbda819098c940081392a51697b2fd5b42f39d78999b50e4b335aa727a69d3
05cc856acea257ee6e07c3817b1893e7fae9f98e5ccfd1687cc3e1e6ae706f58
0b6daa69314b58b23c4e39885c5465adc86e4b76c6704e824de17a2d6a8ffe11
0d0ca75d8b81e9a9435143496bccb504c16e52b06d208474df944675338e25b0
0f0139d7507f98a4d1182810db05ef9ec1fc197f4def7c441b862ad52f348a6c
13b1331b7bbe9beae07d7b7d8664e668efb8c747d7c5cf30869521d1a76bee52
14d3853499cc02bc0299105e50df1539a2e4ecf9daea338dfddff522ae8fd9a2
1cc76c442c3305274ee60298de111323c122f1b276f03c2d5336e85b7230a58a
1e85ec81b9800b4c443d39caca0d0926089a3ac201120db1ceb45b93789480b8
1e9655daa20e02fa31bc82b2dd17804611050568d525882f9165a3cff37207ae
2537a62717843496daa8fedb32d44403c1ab23c4617d9a3aa1f56eb9045a8faa
29499e2b5d5cbd39647f55746440396d62f8c10c610e6e8bb4a2587030d986e1
2fff935dcf212377cb836950f4826b3258b8ac891c638864a353fbec2634469f
344741764fe3aea14e9b58687b571496a6ffaf8a6173e61d078537bc0cfdc88d
364c1ea76a5b1037cd712f96c07be3c9d08ce50eb226d0758a13b9471fa50f35
3c4a1bb7ce3234407184f0d80cc4dec075e4ad616b44dcc5778e1cfb1bc24019
3c912f3753e81db1bf6883bceec8ce20e1cc5abb0b01d587d45def290878c336
42b010e422f1596bf93abca206531d06ee11016128d4dcb60ad1575ff08522ea
438eafc0cdc4cc94a17c3781a0e254d08af611c9e71a7c285fd3872ccd18cb93
47a03cdb40941ed9bb87178d34076aa70d7c8a21c2645d9a71e7edb02f94a4c2
48eb8b500ae6a38617b5738d2b3faec481922a7782246e31d2755c034a45cd5d
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
59d8be33249f70db42ba649db05211213d176d3c45b0528796787a25668e51a3
5a5fbbb175422ea3de8f4ad888047dbead43b912bc5eb7b4f28354caa1799e45
60ddbdc59a12fddd73e6764e5b95f301e81f1104004ffc1519c1064c45ed41b7
656a3dd3b522339d3f43e72c53286457ebd5133e213d2da1299a351d729a8c7e
6ab9af5c668665d6c6affd09941367d714c7efdedc286887e9e60fdea865d1b5
706e5b2dfc346c82f9a2feb0b29aad87c922cd0b07b8b25f04abc6d9d510cfa0
720b9dffd8324fb8222548dd395a84aa60c1953801990e8b021d12f4ea95273a
72fbe85629bc27977fd8684d84b51f659de98bb453d420938f6d8fc30f1238fa
7e8268de2407cdd825119f98d7448b1fbe06aedcfbdbff44ad5c9ac19fb3c2b0
7fe7e1954511737e3bd3b01759c1d7d2a8a83bb781424c9753bc62ce38e27d35
832f4c005adacc0be0855de8bd9cc3937ca1363a3121e84edab98706b2334140
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
8636944aec2fea7c4306f8cfbb484bd1cb5465e4713a266172f6eab0681e3efa
8f3e743527460788368f79b4c2929ca8c356b798362d9c1b77ea34fce5f894cb
92ee709b26e30297904101ba16fa41918211a258f7131c2ae6f107064999e71d
936ffccdc35bc55221e669d0e76034af76ba8c080c1b1149144dbbd3b5311829
9687ee5934e8a8b125cd0e3f7e21b9eea12c5eba602dfb12941aeafaad44fbe3
9b9266812d50859b2c1c3029a780ebfdd18e3057aa82ed8561328729e9d233d2
9ce819250a5b5d71a296e407dbfe80d3fed19921872264d2273756fd5fbb8361
a481485d6fdef7406780f848ebcb995d7ac99a2387589f80e5fc2d1ba0709f7c
b25baec24139ed33efcf25bdb82ceb8597cf00250aaa4bbc675b96f08db235f5
b2b481c5fc3f15b3678f5be2051d357d17650ddc54b226ec3ce33e598b0ab855
b3b4d55dfe55b3f2000383a5c30d0e78709947144b79b54ebb0f22ef8f02f0e6
b3fd007756b962c69239df8596e330919c2136d15de08a1a3b6535716986bb38
bb183733e8446a35b2411ebfbcd39332550c755a01b9776f00665b3489b4253c
bd816aa696baaaecb101ad5e78360d69beb0dcd782a0f595b4717f4b56ae9354
c1bfe2ce2c579ef311772d733be01ef4755ecd7b6e77eafbe8accc97ab69e03e
c5d2cc1d2ddaef95c17a2905fff475005875a091ab0f65838dc03cea187b4739
d3cd2c511950c7a0b74607dc9f955a24e1885f16ba06bc7dae477f7f63cc71dc
d4398dec1afbadd50ad056364ec2b16411ab97670c6e09824001a18cc5cb5b14
d55d8902a42cbeab90e4fbf63e349fd4ec2ed031630a153d177f9c5872af8ebc
d7aeba6b284be2fbfeaae8f02bc140a4491d87d5f46caca6cd76aa90c412848f
d82e93a1c95cd066f7e4dab5dc294079b60ec979a85114624b888407b2b7d863
d93b3e0523a3044e8a26474cdce53e2de4a4c8ba1e72e090305037c37040e94f
db44c6b7985f942465865cfe688770803ab464ec35fb9aefaeccc052e9b74b2a
e216c3dbcf029f288611866cec3f460fc2fc2e50529b80d111ce0dc600297e9f
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e5db49fc15e40a9fe8a2674bb76519e46f31aefc24ca1c1449b06fe3d04ff9a3
e9830d0997e87c328360301ffb0ab81fabd9101f90453976ee61555d6f353af9
f0cdcdf13dfc511aa872dea1d899623e02a6b176293fb34afbbafb2e13f626eb
f5bac3290c345d66a947d2c5e2491eafe21f5314be8599f79b5edf61b766275c
fc48d1d80ece71a79a7b39877f4104d49d3da6c3665cf6dc203000fb7df4447e
fd952e356e9a03c684084cd927b88f2034778356573cfeed28ece84ebf8abdda

blog.securolytics.io Open in urlscan Pro 54.173.173.29 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Statistics

72 Requests

97 %HTTPS

42 %IPv6

11 Domains

14 Subdomains

13 IPs

3 Countries

5273 kBTransfer

5608 kBSize

12 Cookies

27 Outgoing links

Redirected requests

72 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

blog.securolytics.io Open in urlscan Pro
54.173.173.29 Public Scan

Screenshot
Live screenshot

Full Image

72
Requests

97 %
HTTPS

42 %
IPv6

11
Domains

14
Subdomains

13
IPs

3
Countries

5273 kB
Transfer

5608 kB
Size

12
Cookies

72 HTTP transactions
1 data transactions