ezh.es Open in urlscan Pro
2606:4700:3032::6812:3a6e Public Scan

Go To Rescan
Add Verdict Report

URL:
https://ezh.es/blog/2020/08/the-confused-mailman-sending-spf-and-dmarc-passing-mail-as-any-gmail-or-g-suite-cus...
Submission: On August 22 via manual (August 22nd 2020, 12:28:58 am UTC) from AU

Summary HTTP 14 Redirects Links 9 Behaviour Indicators

Summary

This website contacted 2 IPs in 1 countries across 2 domains to perform 14 HTTP transactions. The main IP is 2606:4700:3032::6812:3a6e, located in United States and belongs to CLOUDFLARENET, US. The main domain is ezh.es.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on July 10th 2020. Valid for: a year.

This is the only time ezh.es was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
13	2606:4700:303... 2606:4700:3032::6812:3a6e	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6810:5f41	13335 (CLOUDFLAR...) (CLOUDFLARENET)
14	2

13 2606:4700:3032::6812:3a6e (United States)

ASN13335 (CLOUDFLARENET, US)

ezh.es	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:5f41 (United States)

ASN13335 (CLOUDFLARENET, US)

static.cloudflareinsights.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
13	ezh.es ezh.es	412 KB
1	cloudflareinsights.com static.cloudflareinsights.com	4 KB
14	2

	Domain	Requested by
13	ezh.es	ezh.es static.cloudflareinsights.com
1	static.cloudflareinsights.com	ezh.es
14	2

This site contains links to these domains. Also see Links.

Domain
github.com
twitter.com
en.wikipedia.org
support.google.com
serverfault.com
gohugo.io

Subject Issuer	Validity	Valid
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2020-07-10` - `2021-07-10`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://ezh.es/blog/2020/08/the-confused-mailman-sending-spf-and-dmarc-passing-mail-as-any-gmail-or-g-suite-customer/
Frame ID: 9A73DB8B9F464294DBCDB33522A870DC
Requests: 14 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

CloudFlare (CDN) Expand

Overall confidence: 100%
Detected patterns

headers server /^cloudflare$/i

Page Statistics

14
Requests

100 %
HTTPS

100 %
IPv6

2
Domains

2
Subdomains

2
IPs

1
Countries

416 kB
Transfer

628 kB
Size

1
Cookies

9 Outgoing links

These are links going to different origins than the main page.

URL: https://github.com/ezhes
Title: Github

Search URL Search Domain Scan URL

URL: https://twitter.com/ezhes_
Title: Twitter

Search URL Search Domain Scan URL

URL: https://en.wikipedia.org/wiki/Email_spoofing
Title: classic mail spoofing

Search URL Search Domain Scan URL

URL: https://en.wikipedia.org/wiki/Sender_Policy_Framework
Title: Sender Policy Framework (SPF)

Search URL Search Domain Scan URL

URL: https://en.wikipedia.org/wiki/DMARC
Title: Domain-based Message Authentication, Reporting and Conformance (DMARC)

Search URL Search Domain Scan URL

URL: https://support.google.com/a/answer/60730?hl=en
Title: Google provides a succinct explanation of this feature in their docs

Search URL Search Domain Scan URL

URL: https://serverfault.com/a/945817/417964
Title: any violations of SPF (regardless of the SPF policy) should result in the message simply being dropped with prejudice.

Search URL Search Domain Scan URL

URL: https://gohugo.io/
Title: Hugo

Search URL Search Domain Scan URL

URL: https://twitter.com/panr
Title: panr

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

14 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
ezh.es/blog/2020/08/the-confused-mailman-sending-spf-and-dmarc-passing-mail-as-any-gmail-or-g-suite-customer/ 29 KB
8 KB 595ms
578ms Document
text/html 2606:4700:3032::6812:3a6e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://ezh.es/blog/2020/08/the-confused-mailman-sending-spf-and-dmarc-passing-mail-as-any-gmail-or-g-suite-customer/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3032::6812:3a6e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

135e698523a82de4da445a687ef285196101a1cb2105b2d07b84fc6610079d3b

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff

Request headers

:method: GET
:authority: ezh.es
:scheme: https
:path: /blog/2020/08/the-confused-mailman-sending-spf-and-dmarc-passing-mail-as-any-gmail-or-g-suite-customer/
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 200
date: Sat, 22 Aug 2020 00:28:40 GMT
content-type: text/html
set-cookie: __cfduid=d0f0973cd003357b7fab338bdd36572f01598056120; expires=Mon, 21-Sep-20 00:28:40 GMT; path=/; domain=.ezh.es; HttpOnly; SameSite=Lax; Secure
last-modified: Thu, 20 Aug 2020 02:56:19 GMT
cf-cache-status: DYNAMIC
cf-request-id: 04b52a58330000dfc788a42200000001
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; preload
x-content-type-options: nosniff
server: cloudflare
cf-ray: 5c6879a05ebbdfc7-FRA
content-encoding: br

GET
H2 200 style.css
ezh.es/blog/assets/ 19 KB
4 KB 19ms
17ms Stylesheet
text/css 2606:4700:3032::6812:3a6e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://ezh.es/blog/assets/style.css

Requested by

Host: ezh.es
URL: https://ezh.es/blog/2020/08/the-confused-mailman-sending-spf-and-dmarc-passing-mail-as-any-gmail-or-g-suite-customer/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3032::6812:3a6e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

32323aa59ad4e1843b7a38d204cf6c29813d373c2f7d0be63146dc044234dd33

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://ezh.es/blog/2020/08/the-confused-mailman-sending-spf-and-dmarc-passing-mail-as-any-gmail-or-g-suite-customer/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 22 Aug 2020 00:28:40 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
age: 2761
cf-polished: origSize=19543
status: 200
vary: Accept-Encoding
cf-request-id: 04b52a5a850000dfc788a89200000001
last-modified: Sun, 02 Aug 2020 03:49:36 GMT
server: cloudflare
etag: W/"5f2637d0-4c57"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; preload
content-type: text/css
cache-control: max-age=14400
cf-ray: 5c6879a40b67dfc7-FRA
cf-bgj: minify

GET
H2 200 pink.css
ezh.es/blog/assets/ 12 KB
3 KB 13ms
11ms Stylesheet
text/css 2606:4700:3032::6812:3a6e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://ezh.es/blog/assets/pink.css

Requested by

Host: ezh.es
URL: https://ezh.es/blog/2020/08/the-confused-mailman-sending-spf-and-dmarc-passing-mail-as-any-gmail-or-g-suite-customer/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3032::6812:3a6e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d5ad36621dcbc87b4567fdc689077142427570fa9fb0409e1b466fa49104566c

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://ezh.es/blog/2020/08/the-confused-mailman-sending-spf-and-dmarc-passing-mail-as-any-gmail-or-g-suite-customer/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 22 Aug 2020 00:28:40 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
age: 2761
cf-polished: origSize=12115
status: 200
vary: Accept-Encoding
cf-request-id: 04b52a5a850000dfc788a8a200000001
last-modified: Sun, 02 Aug 2020 04:50:20 GMT
server: cloudflare
etag: W/"5f26460c-2f53"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; preload
content-type: text/css
cache-control: max-age=14400
cf-ray: 5c6879a40b68dfc7-FRA
cf-bgj: minify

GET
H2 200 Envelope_Rewriting.png
ezh.es/blog/images/003_gsuite_spf_bypass/ 59 KB
59 KB 15ms
10ms Image
image/png 2606:4700:3032::6812:3a6e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ezh.es/blog/images/003_gsuite_spf_bypass/Envelope_Rewriting.png

Requested by

Host: ezh.es
URL: https://ezh.es/blog/2020/08/the-confused-mailman-sending-spf-and-dmarc-passing-mail-as-any-gmail-or-g-suite-customer/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3032::6812:3a6e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0270ace9c66dd39f3e5fcd9dd7077482722eb431e4f8c0eb9c508f762722c5e7

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://ezh.es/blog/2020/08/the-confused-mailman-sending-spf-and-dmarc-passing-mail-as-any-gmail-or-g-suite-customer/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 22 Aug 2020 00:28:40 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
age: 4030
status: 200
vary: Accept-Encoding
content-length: 59983
cf-request-id: 04b52a5a8d0000dfc788a8e200000001
last-modified: Sat, 18 Jul 2020 21:50:37 GMT
server: cloudflare
etag: "5f136ead-ea4f"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; preload
content-type: image/png
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 5c6879a41b73dfc7-FRA

GET
H2 200 Attack_Diagram.svg
ezh.es/blog/images/003_gsuite_spf_bypass/ 24 KB
5 KB 23ms
19ms Image
image/svg+xml 2606:4700:3032::6812:3a6e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ezh.es/blog/images/003_gsuite_spf_bypass/Attack_Diagram.svg

Requested by

Host: ezh.es
URL: https://ezh.es/blog/2020/08/the-confused-mailman-sending-spf-and-dmarc-passing-mail-as-any-gmail-or-g-suite-customer/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3032::6812:3a6e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ba7fce47e46a330ad66a6937bffbc3ecbb92d2ecb443a7f704c995b270619af6

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://ezh.es/blog/2020/08/the-confused-mailman-sending-spf-and-dmarc-passing-mail-as-any-gmail-or-g-suite-customer/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 22 Aug 2020 00:28:40 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
age: 4030
status: 200
vary: Accept-Encoding
cf-request-id: 04b52a5a8d0000dfc788a8f200000001
last-modified: Sat, 01 Aug 2020 21:06:58 GMT
server: cloudflare
etag: W/"5f25d972-5f9d"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; preload
content-type: image/svg+xml
cache-control: max-age=14400
cf-ray: 5c6879a41b75dfc7-FRA

GET
H2 200 inbox_example.png
ezh.es/blog/images/003_gsuite_spf_bypass/ 18 KB
18 KB 21ms
17ms Image
image/png 2606:4700:3032::6812:3a6e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ezh.es/blog/images/003_gsuite_spf_bypass/inbox_example.png

Requested by

Host: ezh.es
URL: https://ezh.es/blog/2020/08/the-confused-mailman-sending-spf-and-dmarc-passing-mail-as-any-gmail-or-g-suite-customer/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3032::6812:3a6e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8bd4ffe14c20a40924ff4c3afce7706db8ed6f546f453634f556b3cb241e2fc0

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://ezh.es/blog/2020/08/the-confused-mailman-sending-spf-and-dmarc-passing-mail-as-any-gmail-or-g-suite-customer/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 22 Aug 2020 00:28:40 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
age: 4030
status: 200
vary: Accept-Encoding
content-length: 18773
cf-request-id: 04b52a5a8d0000dfc788a90200000001
last-modified: Sun, 19 Jul 2020 00:58:14 GMT
server: cloudflare
etag: "5f139aa6-4955"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; preload
content-type: image/png
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 5c6879a41b77dfc7-FRA

GET
H2 200 gmail_pass_results.png
ezh.es/blog/images/003_gsuite_spf_bypass/ 50 KB
50 KB 22ms
18ms Image
image/png 2606:4700:3032::6812:3a6e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ezh.es/blog/images/003_gsuite_spf_bypass/gmail_pass_results.png

Requested by

Host: ezh.es
URL: https://ezh.es/blog/2020/08/the-confused-mailman-sending-spf-and-dmarc-passing-mail-as-any-gmail-or-g-suite-customer/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3032::6812:3a6e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

9e8f35b7431de82dc2898a13e2c9a81becff75ef1c4002106b96d0fd3fd47b84

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://ezh.es/blog/2020/08/the-confused-mailman-sending-spf-and-dmarc-passing-mail-as-any-gmail-or-g-suite-customer/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 22 Aug 2020 00:28:40 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
age: 4030
status: 200
vary: Accept-Encoding
content-length: 50998
cf-request-id: 04b52a5a8d0000dfc788a91200000001
last-modified: Sun, 19 Jul 2020 00:58:28 GMT
server: cloudflare
etag: "5f139ab4-c736"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; preload
content-type: image/png
cache-control: max-age=14400
accept-ranges: bytes
cf-ray: 5c6879a41b78dfc7-FRA

GET
H2 200 email-decode.min.js Show response
ezh.es/cdn-cgi/scripts/5c5dd728/cloudflare-static/ 1 KB
860 B 13ms
6ms Script
application/javascript 2606:4700:3032::6812:3a6e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://ezh.es/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js

Requested by

Host: ezh.es
URL: https://ezh.es/blog/2020/08/the-confused-mailman-sending-spf-and-dmarc-passing-mail-as-any-gmail-or-g-suite-customer/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3032::6812:3a6e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://ezh.es/blog/2020/08/the-confused-mailman-sending-spf-and-dmarc-passing-mail-as-any-gmail-or-g-suite-customer/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 22 Aug 2020 00:28:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
status: 200
vary: Accept-Encoding
cf-request-id: 04b52a5a8c0000dfc788a8b200000001
last-modified: Mon, 17 Aug 2020 17:01:45 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: W/"5f3ab7f9-4d7"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; preload
content-type: application/javascript
cache-control: max-age=172800, public
cf-ray: 5c6879a41b70dfc7-FRA
expires: Mon, 24 Aug 2020 00:28:40 GMT

GET
H2 200 main.js Show response
ezh.es/blog/assets/ 6 KB
1 KB 22ms
16ms Script
application/javascript 2606:4700:3032::6812:3a6e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://ezh.es/blog/assets/main.js

Requested by

Host: ezh.es
URL: https://ezh.es/blog/2020/08/the-confused-mailman-sending-spf-and-dmarc-passing-mail-as-any-gmail-or-g-suite-customer/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3032::6812:3a6e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0e195aa22d17a273f2ad335cef176be318d67ee144799845d06289fbe329e4e5

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://ezh.es/blog/2020/08/the-confused-mailman-sending-spf-and-dmarc-passing-mail-as-any-gmail-or-g-suite-customer/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 22 Aug 2020 00:28:40 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
age: 2761
cf-polished: origSize=8117
status: 200
vary: Accept-Encoding
cf-request-id: 04b52a5a8d0000dfc788a8c200000001
last-modified: Sun, 02 Aug 2020 03:49:36 GMT
server: cloudflare
etag: W/"5f2637d0-1fb5"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; preload
content-type: application/javascript
cache-control: max-age=14400
cf-ray: 5c6879a41b71dfc7-FRA
cf-bgj: minify

GET
H2 200 prism.js Show response
ezh.es/blog/assets/ 192 KB
52 KB 28ms
23ms Script
application/javascript 2606:4700:3032::6812:3a6e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://ezh.es/blog/assets/prism.js

Requested by

Host: ezh.es
URL: https://ezh.es/blog/2020/08/the-confused-mailman-sending-spf-and-dmarc-passing-mail-as-any-gmail-or-g-suite-customer/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3032::6812:3a6e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

1266a67e9eec2b242e4c1cc0cc19004344ee9fcb72447385459c71a8513c5254

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://ezh.es/blog/2020/08/the-confused-mailman-sending-spf-and-dmarc-passing-mail-as-any-gmail-or-g-suite-customer/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 22 Aug 2020 00:28:40 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
age: 2761
cf-polished: origSize=198506
status: 200
vary: Accept-Encoding
cf-request-id: 04b52a5a8d0000dfc788a8d200000001
last-modified: Sun, 02 Aug 2020 03:49:36 GMT
server: cloudflare
etag: W/"5f2637d0-3076a"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; preload
content-type: application/javascript
cache-control: max-age=14400
cf-ray: 5c6879a41b72dfc7-FRA
cf-bgj: minify

GET
H2 200 beacon.min.js Show response
static.cloudflareinsights.com/ 10 KB
4 KB 30ms
11ms Script
text/javascript 2606:4700::6810:5f41
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://static.cloudflareinsights.com/beacon.min.js
Requested by: Host: ezh.es
URL: https://ezh.es/blog/2020/08/the-confused-mailman-sending-spf-and-dmarc-passing-mail-as-any-gmail-or-g-suite-customer/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6810:5f41 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 80a501b2d3e77be83e3f7464b0e39f8dcae689ca96ca1290f606caa8eb8e5c88

Request headers

Referer: https://ezh.es/blog/2020/08/the-confused-mailman-sending-spf-and-dmarc-passing-mail-as-any-gmail-or-g-suite-customer/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 22 Aug 2020 00:28:40 GMT
content-encoding: gzip
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/javascript;charset=UTF-8
status: 200
cf-ray: 5c6879a42ca6074a-FRA
cf-request-id: 04b52a5a9c0000074a50b70200000001

GET
H2 200 62da0ac51db1e4a3a4d57b9154a344fc.woff
ezh.es/blog/assets/ 100 KB
101 KB 20ms
11ms Font
application/font-woff 2606:4700:3032::6812:3a6e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://ezh.es/blog/assets/62da0ac51db1e4a3a4d57b9154a344fc.woff

Requested by

Host: ezh.es
URL: https://ezh.es/blog/assets/style.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3032::6812:3a6e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff

Request headers

Origin: https://ezh.es
Referer: https://ezh.es/blog/assets/style.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 22 Aug 2020 00:28:41 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
age: 2354
status: 200
vary: Accept-Encoding
cf-request-id: 04b52a5aaa0000dfc788a92200000001
last-modified: Sun, 02 Aug 2020 03:49:36 GMT
server: cloudflare
etag: W/"5f2637d0-19184"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; preload
content-type: application/font-woff
cache-control: max-age=14400
cf-ray: 5c6879a44bbddfc7-FRA

GET
H2 200 2bf08001f42c34e30e1de9d2eb81aead.woff
ezh.es/blog/assets/ 108 KB
109 KB 21ms
13ms Font
application/font-woff 2606:4700:3032::6812:3a6e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://ezh.es/blog/assets/2bf08001f42c34e30e1de9d2eb81aead.woff

Requested by

Host: ezh.es
URL: https://ezh.es/blog/assets/style.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3032::6812:3a6e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff

Request headers

Origin: https://ezh.es
Referer: https://ezh.es/blog/assets/style.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sat, 22 Aug 2020 00:28:41 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
age: 2354
status: 200
vary: Accept-Encoding
cf-request-id: 04b52a5aaa0000dfc788a93200000001
last-modified: Sun, 02 Aug 2020 03:49:36 GMT
server: cloudflare
etag: W/"5f2637d0-1b198"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; preload
content-type: application/font-woff
cache-control: max-age=14400
cf-ray: 5c6879a44bbfdfc7-FRA

POST
H2 204 performance Show response
ezh.es/cdn-cgi/beacon/ 0
56 B 10ms
10ms XHR
text/plain 2606:4700:3032::6812:3a6e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://ezh.es/cdn-cgi/beacon/performance?req_id=5c6879a05ebbdfc7

Requested by

Host: static.cloudflareinsights.com
URL: https://static.cloudflareinsights.com/beacon.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3032::6812:3a6e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://ezh.es/blog/2020/08/the-confused-mailman-sending-spf-and-dmarc-passing-mail-as-any-gmail-or-g-suite-customer/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
content-type: application/json

Response headers

status: 204
date: Sat, 22 Aug 2020 00:28:41 GMT
x-frame-options: SAMEORIGIN
server: cloudflare
cf-ray: 5c6879a67e46dfc7-FRA
cf-request-id: 04b52a5c0a0000dfc788aa9200000001

Verdicts & Comments Add Verdict or Comment

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| trustedTypes object| languageSelector object| moreLanguagesContainer object| Prism

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.ezh.es/	1970-01-19 12:37:28	Name: __cfduid Value: d0f0973cd003357b7fab338bdd36572f01598056120

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ezh.es
static.cloudflareinsights.com
2606:4700:3032::6812:3a6e
2606:4700::6810:5f41
0270ace9c66dd39f3e5fcd9dd7077482722eb431e4f8c0eb9c508f762722c5e7
0e195aa22d17a273f2ad335cef176be318d67ee144799845d06289fbe329e4e5
1266a67e9eec2b242e4c1cc0cc19004344ee9fcb72447385459c71a8513c5254
135e698523a82de4da445a687ef285196101a1cb2105b2d07b84fc6610079d3b
2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8
32323aa59ad4e1843b7a38d204cf6c29813d373c2f7d0be63146dc044234dd33
80a501b2d3e77be83e3f7464b0e39f8dcae689ca96ca1290f606caa8eb8e5c88
8bd4ffe14c20a40924ff4c3afce7706db8ed6f546f453634f556b3cb241e2fc0
9e8f35b7431de82dc2898a13e2c9a81becff75ef1c4002106b96d0fd3fd47b84
ba7fce47e46a330ad66a6937bffbc3ecbb92d2ecb443a7f704c995b270619af6
d5ad36621dcbc87b4567fdc689077142427570fa9fb0409e1b466fa49104566c
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

ezh.es Open in urlscan Pro 2606:4700:3032::6812:3a6e Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

14 Requests

100 %HTTPS

100 %IPv6

2 Domains

2 Subdomains

2 IPs

1 Countries

416 kBTransfer

628 kBSize

1 Cookies

9 Outgoing links

Redirected requests

14 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

4 JavaScript Global Variables

1 Cookies

Security Headers

Indicators

ezh.es Open in urlscan Pro
2606:4700:3032::6812:3a6e Public Scan

Screenshot
Live screenshot

Full Image

14
Requests

100 %
HTTPS

100 %
IPv6

2
Domains

2
Subdomains

2
IPs

1
Countries

416 kB
Transfer

628 kB
Size

1
Cookies

14 HTTP transactions
0 data transactions