logrhythm.com Open in urlscan Pro
143.204.101.20  Public Scan

15 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 24

• https://ads.avocet.io/s?add=5a33dc888945849615039dac HTTP 302
• https://ads.avocet.io/s?bounce=true&add=5a33dc888945849615039dac

Request Chain 32

• https://stats.g.doubleclick.net/r/collect?t=dc&aip=1&_r=3&v=1&_v=j79&tid=UA-3420049-1&cid=849653506.1571029451&jid=166717973&gjid=13790015&_gid=1061378863.1571029451&_u=aGDAgUADQ~&z=688492608 HTTP 302
• https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-3420049-1&cid=849653506.1571029451&jid=166717973&_v=j79&z=688492608 HTTP 302
• https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-3420049-1&cid=849653506.1571029451&jid=166717973&_v=j79&z=688492608&slf_rd=1&random=58063388

Request Chain 49

• https://d.adroll.com/pixel/QDCFINCFT5HK5FU45EXRDS/RG6IRLN6UZHIPJAJPJJ7E2?adroll_fpc=b89517a11da139a0e00064165659899d-1571029451235&xid_ch=f&pv=9780451998.867678&cookie=&adroll_s_ref=&keyw=&arrfrr=https%3A%2F%2Flogrhythm.com%2Fblog%2Fdetecting-dns-tunneling%2F HTTP 302
• https://s.adroll.com/pixel/QDCFINCFT5HK5FU45EXRDS/RG6IRLN6UZHIPJAJPJJ7E2/JKDRBTEKQ5DYLPBQZ7OUBG.js

Request Chain 61

• https://d.adroll.com/cm/aol/out?adroll_fpc=b89517a11da139a0e00064165659899d-1571029451235&xid_ch=f&advertisable=QDCFINCFT5HK5FU45EXRDS HTTP 302
• https://pixel.advertising.com/ups/55980/sync?uid=MjBkZjg3ZDQxNjYxYjk5YjE1OTE4YmZiZTYzNDY1NGQ&_origin=1&gdpr=1&gdpr_consent=BOOla_OOOla_OA2ABBENAkwAAAAXyACAAyAIIA HTTP 302
• https://pixel.advertising.com/ups/55980/sync?uid=MjBkZjg3ZDQxNjYxYjk5YjE1OTE4YmZiZTYzNDY1NGQ&_origin=1&gdpr=1&gdpr_consent=BOOla_OOOla_OA2ABBENAkwAAAAXyACAAyAIIA&verify=true HTTP 302
• https://ups.analytics.yahoo.com/ups/55980/sync?uid=MjBkZjg3ZDQxNjYxYjk5YjE1OTE4YmZiZTYzNDY1NGQ&_origin=1&gdpr=1&gdpr_consent=BOOla_OOOla_OA2ABBENAkwAAAAXyACAAyAIIA&apid=UP0f57f173-ee40-11e9-9e12-0262cd3e8f28 HTTP 302
• https://ups.analytics.yahoo.com/ups/55980/sync?uid=MjBkZjg3ZDQxNjYxYjk5YjE1OTE4YmZiZTYzNDY1NGQ&_origin=1&gdpr=1&gdpr_consent=BOOla_OOOla_OA2ABBENAkwAAAAXyACAAyAIIA&apid=UP0f57f173-ee40-11e9-9e12-0262cd3e8f28&verify=true

Request Chain 62

• https://d.adroll.com/cm/index/out?adroll_fpc=b89517a11da139a0e00064165659899d-1571029451235&xid_ch=f&advertisable=QDCFINCFT5HK5FU45EXRDS HTTP 302
• https://dsum-sec.casalemedia.com/rum?cm_dsp_id=105&external_user_id=MjBkZjg3ZDQxNjYxYjk5YjE1OTE4YmZiZTYzNDY1NGQ&expiration=1602565451 HTTP 302
• https://dsum-sec.casalemedia.com/rum?cm_dsp_id=105&external_user_id=MjBkZjg3ZDQxNjYxYjk5YjE1OTE4YmZiZTYzNDY1NGQ&expiration=1602565451&C=1

Request Chain 63

• https://d.adroll.com/cm/n/out?adroll_fpc=b89517a11da139a0e00064165659899d-1571029451235&xid_ch=f&advertisable=QDCFINCFT5HK5FU45EXRDS HTTP 302
• https://pixel.rubiconproject.com/tap.php?v=194538&nid=3644&put=MjBkZjg3ZDQxNjYxYjk5YjE1OTE4YmZiZTYzNDY1NGQ&expires=365

Request Chain 64

• https://d.adroll.com/cm/outbrain/out?adroll_fpc=b89517a11da139a0e00064165659899d-1571029451235&xid_ch=f&advertisable=QDCFINCFT5HK5FU45EXRDS HTTP 302
• https://sync.outbrain.com/cookie-sync?p=adroll&uid=MjBkZjg3ZDQxNjYxYjk5YjE1OTE4YmZiZTYzNDY1NGQ HTTP 302
• https://sync.outbrain.com/cookie-sync?p=adroll&uid=MjBkZjg3ZDQxNjYxYjk5YjE1OTE4YmZiZTYzNDY1NGQ&rdrctExp=true

Request Chain 65

• https://d.adroll.com/cm/pubmatic/out?adroll_fpc=b89517a11da139a0e00064165659899d-1571029451235&xid_ch=f&advertisable=QDCFINCFT5HK5FU45EXRDS HTTP 302
• https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzMwNiZ0bD01MjU2MDA&piggybackCookie=MjBkZjg3ZDQxNjYxYjk5YjE1OTE4YmZiZTYzNDY1NGQ&gdpr=1&gdpr_consent=BOOoKswOOoKswA2ABBENAkwAAAAXyACACYAIIA

Request Chain 66

• https://d.adroll.com/cm/r/out?adroll_fpc=b89517a11da139a0e00064165659899d-1571029451235&xid_ch=f&advertisable=QDCFINCFT5HK5FU45EXRDS HTTP 302
• https://ads.yahoo.com/cms/v1?esig=1~bf4e7dc4546a90c08591652d78a230d3f2ef5733&nwid=10001032567&sigv=1&gdpr=1&gdpr_consent=BOOla_OOOla_OA2ABBENAkwAAAAXyACAAyAIIA HTTP 302
• https://d.adroll.com/cm/r/in?xid=E0&gdpr=1&gdpr_consent=BOOla_OOOla_OA2ABBENAkwAAAAXyACAAyAIIA

Request Chain 67

• https://d.adroll.com/cm/taboola/out?adroll_fpc=b89517a11da139a0e00064165659899d-1571029451235&xid_ch=f&advertisable=QDCFINCFT5HK5FU45EXRDS HTTP 302
• https://trc.taboola.com/sg/adroll-network/1/rtb-h/?taboola_hm=MjBkZjg3ZDQxNjYxYjk5YjE1OTE4YmZiZTYzNDY1NGQ

Request Chain 68

• https://d.adroll.com/cm/triplelift/out?adroll_fpc=b89517a11da139a0e00064165659899d-1571029451235&xid_ch=f&advertisable=QDCFINCFT5HK5FU45EXRDS HTTP 302
• https://eb2.3lift.com/xuid?mid=4714&xuid=MjBkZjg3ZDQxNjYxYjk5YjE1OTE4YmZiZTYzNDY1NGQ&dongle=c85e HTTP 302
• https://eb2.3lift.com/xuid?ld=1&mid=4714&xuid=MjBkZjg3ZDQxNjYxYjk5YjE1OTE4YmZiZTYzNDY1NGQ&dongle=c85e&gdpr=1&cmp_cs=

Request Chain 70

• https://d.adroll.com/cm/b/out?adroll_fpc=b89517a11da139a0e00064165659899d-1571029451235&xid_ch=f&advertisable=QDCFINCFT5HK5FU45EXRDS HTTP 302
• https://x.bidswitch.net/sync?dsp_id=44&user_id=MjBkZjg3ZDQxNjYxYjk5YjE1OTE4YmZiZTYzNDY1NGQ HTTP 302
• https://x.bidswitch.net/ul_cb/sync?dsp_id=44&user_id=MjBkZjg3ZDQxNjYxYjk5YjE1OTE4YmZiZTYzNDY1NGQ

Request Chain 71

• https://d.adroll.com/cm/x/out?adroll_fpc=b89517a11da139a0e00064165659899d-1571029451235&xid_ch=f&advertisable=QDCFINCFT5HK5FU45EXRDS HTTP 302
• https://ib.adnxs.com/setuid?entity=172&code=MjBkZjg3ZDQxNjYxYjk5YjE1OTE4YmZiZTYzNDY1NGQ

Request Chain 72

• https://d.adroll.com/cm/l/out?adroll_fpc=b89517a11da139a0e00064165659899d-1571029451235&xid_ch=f&advertisable=QDCFINCFT5HK5FU45EXRDS HTTP 302
• https://idsync.rlcdn.com/377928.gif?partner_uid=20df87d41661b99b15918bfbe634654d

Request Chain 73

• https://d.adroll.com/cm/o/out?adroll_fpc=b89517a11da139a0e00064165659899d-1571029451235&xid_ch=f&advertisable=QDCFINCFT5HK5FU45EXRDS HTTP 302
• https://us-u.openx.net/w/1.0/sd?id=537103138&val=20df87d41661b99b15918bfbe634654d HTTP 302
• https://us-u.openx.net/w/1.0/sd?cc=1&id=537103138&val=20df87d41661b99b15918bfbe634654d

Request Chain 74

• https://d.adroll.com/cm/g/out?adroll_fpc=b89517a11da139a0e00064165659899d-1571029451235&xid_ch=f&advertisable=QDCFINCFT5HK5FU45EXRDS&google_nid=adroll5 HTTP 302
• https://cm.g.doubleclick.net/pixel?google_sc&google_nid=artb&google_hm=IN-H1BZhuZsVkYv75jRlTQ HTTP 302
• https://d.adroll.com/cm/g/in

Request Chain 99

• https://googleads.g.doubleclick.net/pagead/viewthroughconversion/952414179/?random=1571029451517&cv=9&fst=1571029451517&num=1&fmt=3&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2wga21&sendb=1&ig=1&frm=2&url=https%3A%2F%2Fecrm.logrhythm.com%2FGuided-Blog-Subscribe-Form.html%3Fform_type%3Dcompact%26ty_page_url%3Dhttps%253A%252F%252Flogrhythm.com%252Fblog-newsletter-subscription-ty%252F%26resizeGuid%3DDB9FB6E2-35C7-4E17-81C4-2CE5AFDBB9B8%26page_url%3Dhttps%253A%252F%252Flogrhythm.com%252Fblog%252Fdetecting-dns-tunneling%252F&ref=https%3A%2F%2Flogrhythm.com%2Fblog%2Fdetecting-dns-tunneling%2F&async=1 HTTP 302
• https://www.google.com/pagead/1p-user-list/952414179/?random=1571029451517&cv=9&fst=1571029200000&num=1&fmt=3&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2wga21&sendb=1&frm=2&url=https%3A%2F%2Fecrm.logrhythm.com%2FGuided-Blog-Subscribe-Form.html%3Fform_type%3Dcompact%26ty_page_url%3Dhttps%253A%252F%252Flogrhythm.com%252Fblog-newsletter-subscription-ty%252F%26resizeGuid%3DDB9FB6E2-35C7-4E17-81C4-2CE5AFDBB9B8%26page_url%3Dhttps%253A%252F%252Flogrhythm.com%252Fblog%252Fdetecting-dns-tunneling%252F&ref=https%3A%2F%2Flogrhythm.com%2Fblog%2Fdetecting-dns-tunneling%2F&async=1&is_vtc=1&random=2025624421&resp=GooglemKTybQhCsO HTTP 302
• https://www.google.de/pagead/1p-user-list/952414179/?random=1571029451517&cv=9&fst=1571029200000&num=1&fmt=3&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2wga21&sendb=1&frm=2&url=https%3A%2F%2Fecrm.logrhythm.com%2FGuided-Blog-Subscribe-Form.html%3Fform_type%3Dcompact%26ty_page_url%3Dhttps%253A%252F%252Flogrhythm.com%252Fblog-newsletter-subscription-ty%252F%26resizeGuid%3DDB9FB6E2-35C7-4E17-81C4-2CE5AFDBB9B8%26page_url%3Dhttps%253A%252F%252Flogrhythm.com%252Fblog%252Fdetecting-dns-tunneling%252F&ref=https%3A%2F%2Flogrhythm.com%2Fblog%2Fdetecting-dns-tunneling%2F&async=1&is_vtc=1&random=2025624421&resp=GooglemKTybQhCsO&ipr=y

Request Chain 104

• https://d.adroll.com/pixel/QDCFINCFT5HK5FU45EXRDS/RG6IRLN6UZHIPJAJPJJ7E2?adroll_fpc=b89517a11da139a0e00064165659899d-1571029451235&xid_ch=f&pv=51206354542.89251&cookie=JKDRBTEKQ5DYLPBQZ7OUBG%3A1%7CRG6IRLN6UZHIPJAJPJJ7E2%3A1%7CQDCFINCFT5HK5FU45EXRDS%3A1&adroll_s_ref=https%3A//logrhythm.com/blog/detecting-dns-tunneling/&keyw=&arrfrr=https%3A%2F%2Fecrm.logrhythm.com%2FGuided-Blog-Subscribe-Form.html%3Fform_type%3Dcompact%26ty_page_url%3Dhttps%253A%252F%252Flogrhythm.com%252Fblog-newsletter-subscription-ty%252F%26resizeGuid%3DDB9FB6E2-35C7-4E17-81C4-2CE5AFDBB9B8%26page_url%3Dhttps%253A%252F%252Flogrhythm.com%252Fblog%252Fdetecting-dns-tunneling%252F HTTP 302
• https://s.adroll.com/pixel/QDCFINCFT5HK5FU45EXRDS/RG6IRLN6UZHIPJAJPJJ7E2/JKDRBTEKQ5DYLPBQZ7OUBG.js

Request Chain 107

• https://d.adroll.com/cm/index/out?adroll_fpc=b89517a11da139a0e00064165659899d-1571029451235&xid_ch=f&advertisable=QDCFINCFT5HK5FU45EXRDS HTTP 302
• https://dsum-sec.casalemedia.com/rum?cm_dsp_id=105&external_user_id=MjBkZjg3ZDQxNjYxYjk5YjE1OTE4YmZiZTYzNDY1NGQ&expiration=1602565451

Request Chain 108

• https://d.adroll.com/cm/outbrain/out?adroll_fpc=b89517a11da139a0e00064165659899d-1571029451235&xid_ch=f&advertisable=QDCFINCFT5HK5FU45EXRDS HTTP 302
• https://sync.outbrain.com/cookie-sync?p=adroll&uid=MjBkZjg3ZDQxNjYxYjk5YjE1OTE4YmZiZTYzNDY1NGQ HTTP 302
• https://sync.outbrain.com/cookie-sync?p=adroll&uid=MjBkZjg3ZDQxNjYxYjk5YjE1OTE4YmZiZTYzNDY1NGQ&rdrctExp=true

Request Chain 109

• https://d.adroll.com/cm/r/out?adroll_fpc=b89517a11da139a0e00064165659899d-1571029451235&xid_ch=f&advertisable=QDCFINCFT5HK5FU45EXRDS HTTP 302
• https://ads.yahoo.com/cms/v1?esig=1~bf4e7dc4546a90c08591652d78a230d3f2ef5733&nwid=10001032567&sigv=1&gdpr=1&gdpr_consent=BOOla_OOOla_OA2ABBENAkwAAAAXyACAAyAIIA HTTP 302
• https://d.adroll.com/cm/r/in?xid=E0&gdpr=1&gdpr_consent=BOOla_OOOla_OA2ABBENAkwAAAAXyACAAyAIIA

Request Chain 110

• https://d.adroll.com/cm/taboola/out?adroll_fpc=b89517a11da139a0e00064165659899d-1571029451235&xid_ch=f&advertisable=QDCFINCFT5HK5FU45EXRDS HTTP 302
• https://trc.taboola.com/sg/adroll-network/1/rtb-h/?taboola_hm=MjBkZjg3ZDQxNjYxYjk5YjE1OTE4YmZiZTYzNDY1NGQ

Request Chain 111

• https://d.adroll.com/cm/triplelift/out?adroll_fpc=b89517a11da139a0e00064165659899d-1571029451235&xid_ch=f&advertisable=QDCFINCFT5HK5FU45EXRDS HTTP 302
• https://eb2.3lift.com/xuid?mid=4714&xuid=MjBkZjg3ZDQxNjYxYjk5YjE1OTE4YmZiZTYzNDY1NGQ&dongle=c85e

Request Chain 115

• https://d.adroll.com/cm/b/out?adroll_fpc=b89517a11da139a0e00064165659899d-1571029451235&xid_ch=f&advertisable=QDCFINCFT5HK5FU45EXRDS HTTP 302
• https://x.bidswitch.net/sync?dsp_id=44&user_id=MjBkZjg3ZDQxNjYxYjk5YjE1OTE4YmZiZTYzNDY1NGQ

Request Chain 116

• https://d.adroll.com/cm/x/out?adroll_fpc=b89517a11da139a0e00064165659899d-1571029451235&xid_ch=f&advertisable=QDCFINCFT5HK5FU45EXRDS HTTP 302
• https://ib.adnxs.com/setuid?entity=172&code=MjBkZjg3ZDQxNjYxYjk5YjE1OTE4YmZiZTYzNDY1NGQ

Request Chain 117

• https://d.adroll.com/cm/l/out?adroll_fpc=b89517a11da139a0e00064165659899d-1571029451235&xid_ch=f&advertisable=QDCFINCFT5HK5FU45EXRDS HTTP 302
• https://idsync.rlcdn.com/377928.gif?partner_uid=20df87d41661b99b15918bfbe634654d

Request Chain 118

• https://d.adroll.com/cm/o/out?adroll_fpc=b89517a11da139a0e00064165659899d-1571029451235&xid_ch=f&advertisable=QDCFINCFT5HK5FU45EXRDS HTTP 302
• https://us-u.openx.net/w/1.0/sd?id=537103138&val=20df87d41661b99b15918bfbe634654d

Request Chain 119

• https://d.adroll.com/cm/g/out?adroll_fpc=b89517a11da139a0e00064165659899d-1571029451235&xid_ch=f&advertisable=QDCFINCFT5HK5FU45EXRDS&google_nid=adroll5 HTTP 302
• https://cm.g.doubleclick.net/pixel?google_sc&google_nid=artb&google_hm=IN-H1BZhuZsVkYv75jRlTQ HTTP 302
• https://d.adroll.com/cm/g/in

Request Chain 120

• https://d.adroll.com/cm/aol/out?adroll_fpc=b89517a11da139a0e00064165659899d-1571029451235&xid_ch=f&advertisable=QDCFINCFT5HK5FU45EXRDS HTTP 302
• https://pixel.advertising.com/ups/55980/sync?uid=MjBkZjg3ZDQxNjYxYjk5YjE1OTE4YmZiZTYzNDY1NGQ&_origin=1&gdpr=1&gdpr_consent=BOOla_OOOla_OA2ABBENAkwAAAAXyACAAyAIIA HTTP 302
• https://ups.analytics.yahoo.com/ups/55980/sync?uid=MjBkZjg3ZDQxNjYxYjk5YjE1OTE4YmZiZTYzNDY1NGQ&_origin=1&gdpr=1&gdpr_consent=BOOla_OOOla_OA2ABBENAkwAAAAXyACAAyAIIA&apid=UP0f57f173-ee40-11e9-9e12-0262cd3e8f28

Request Chain 121

• https://d.adroll.com/cm/n/out?adroll_fpc=b89517a11da139a0e00064165659899d-1571029451235&xid_ch=f&advertisable=QDCFINCFT5HK5FU45EXRDS HTTP 302
• https://pixel.rubiconproject.com/tap.php?v=194538&nid=3644&put=MjBkZjg3ZDQxNjYxYjk5YjE1OTE4YmZiZTYzNDY1NGQ&expires=365

Request Chain 122

• https://d.adroll.com/cm/pubmatic/out?adroll_fpc=b89517a11da139a0e00064165659899d-1571029451235&xid_ch=f&advertisable=QDCFINCFT5HK5FU45EXRDS HTTP 302
• https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzMwNiZ0bD01MjU2MDA&piggybackCookie=MjBkZjg3ZDQxNjYxYjk5YjE1OTE4YmZiZTYzNDY1NGQ&gdpr=1&gdpr_consent=BOOoKswOOoKswA2ABBENAkwAAAAXyACACYAIIA

128 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response logrhythm.com/blog/detecting-dns-tunneling/	104 KB 19 KB	233ms 161ms	Document text/html	143.204.101.20 Amazon.com
General Check archive.org Show headers Download Go to Full URL https://logrhythm.com/blog/detecting-dns-tunneling/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 143.204.101.20 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US), Reverse DNS server-143-204-101-20.fra50.r.cloudfront.net Software AmazonS3 / Resource Hash 07bb872f47011f0de595c1d7491e6bf4b639f9312bc85fc5122ee55b3f2b9198 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers :method GET :authority logrhythm.com :scheme https :path /blog/detecting-dns-tunneling/ pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 sec-fetch-mode navigate sec-fetch-user ?1 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3 sec-fetch-site none accept-encoding gzip, deflate, br Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Mode navigate Sec-Fetch-User ?1 Response headers status 200 content-type text/html date Fri, 11 Oct 2019 08:13:53 GMT last-modified Fri, 11 Oct 2019 00:32:54 GMT server AmazonS3 x-content-type-options nosniff x-xss-protection 1; mode=block content-encoding gzip vary Accept-Encoding x-cache RefreshHit from cloudfront via 1.1 e64eb476d8f76c461d21278e018e194f.cloudfront.net (CloudFront) x-amz-cf-pop FRA50-C1 x-amz-cf-id zVKPjDFfgUAmD4OdWDOLTLUQmt6mZikq1fAXe4XlE1SWMfAdfENP4A==
GET H2	200	styles.min.css logrhythm.com/css/	92 KB 17 KB	32ms 32ms	Stylesheet text/css	143.204.101.20 Amazon.com
General Check archive.org Show headers Download Go to Full URL https://logrhythm.com/css/styles.min.css Requested by Host: logrhythm.com URL: https://logrhythm.com/blog/detecting-dns-tunneling/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 143.204.101.20 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US), Reverse DNS server-143-204-101-20.fra50.r.cloudfront.net Software AmazonS3 / Resource Hash 78defa72e27fa4441d473e669c41352c5eaf2184ca4b76abf9468f6b54434e00 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Sec-Fetch-Mode no-cors Referer https://logrhythm.com/blog/detecting-dns-tunneling/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Fri, 11 Oct 2019 00:35:35 GMT content-encoding gzip x-content-type-options nosniff last-modified Fri, 11 Oct 2019 00:33:06 GMT server AmazonS3 age 7298 status 200 vary Accept-Encoding x-cache Hit from cloudfront content-type text/css via 1.1 e64eb476d8f76c461d21278e018e194f.cloudfront.net (CloudFront) x-amz-cf-pop FRA50-C1 x-amz-cf-id mjnTMvEXcLp9blTOwvczMvDeglCTbyeADt_XKXyG1tl06Q5aed9JIA== x-xss-protection 1; mode=block
GET H2	200	gtm.js Show response www.googletagmanager.com/	164 KB 32 KB	18ms 18ms	Script application/javascript	2a00:1450:4001:814::2008 Google LLC
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtm.js?id=GTM-P82TVL&l=dataLayer Requested by Host: logrhythm.com URL: https://logrhythm.com/blog/detecting-dns-tunneling/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:814::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US), Reverse DNS Software Google Tag Manager / Resource Hash 38377355370363e2c6bb060c5b12258111f86a6de42fdb5427a50712f15067a8 Security Headers Name Value X-Xss-Protection 0 Request headers Sec-Fetch-Mode no-cors Referer https://logrhythm.com/blog/detecting-dns-tunneling/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Mon, 14 Oct 2019 05:04:10 GMT content-encoding br last-modified Mon, 14 Oct 2019 03:00:00 GMT server Google Tag Manager access-control-allow-headers Cache-Control status 200 vary Accept-Encoding content-type application/javascript; charset=UTF-8 access-control-allow-origin http://www.googletagmanager.com cache-control private, max-age=900 access-control-allow-credentials true alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 32819 x-xss-protection 0 expires Mon, 14 Oct 2019 05:04:10 GMT
GET H2	200	logo.svg logrhythm.com/images/lr-logos/	10 KB 4 KB	30ms 30ms	Image image/svg+xml	143.204.101.20 Amazon.com
General Check archive.org Show headers Download Go to Show image Full URL https://logrhythm.com/images/lr-logos/logo.svg Requested by Host: logrhythm.com URL: https://logrhythm.com/blog/detecting-dns-tunneling/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 143.204.101.20 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US), Reverse DNS server-143-204-101-20.fra50.r.cloudfront.net Software AmazonS3 / Resource Hash cfb10437019afede668d4b63ecaac8163c8f0ec131e035b53d7dd6e1121298c6 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Sec-Fetch-Mode no-cors Referer https://logrhythm.com/blog/detecting-dns-tunneling/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Fri, 11 Oct 2019 00:35:35 GMT content-encoding gzip x-content-type-options nosniff last-modified Fri, 11 Oct 2019 00:35:02 GMT server AmazonS3 age 7298 status 200 vary Accept-Encoding x-cache Hit from cloudfront content-type image/svg+xml via 1.1 e64eb476d8f76c461d21278e018e194f.cloudfront.net (CloudFront) x-amz-cf-pop FRA50-C1 x-amz-cf-id DuZTxgXr20ueyxD_AXpgTOEnPm0wCQHvMm8ZQ7lkPSTrp_-65by-Ag== x-xss-protection 1; mode=block
GET H2	200	logrhythm-dots-blog-icon.png res.cloudinary.com/logrhythm/image/upload/c_scale,w_80/v1537557515/icons/	3 KB 4 KB	22ms 7ms	Image image/png	2a04:4e42:1b::393 Fastly
General Check archive.org Show headers Download Go to Show image Full URL https://res.cloudinary.com/logrhythm/image/upload/c_scale,w_80/v1537557515/icons/logrhythm-dots-blog-icon.png Requested by Host: logrhythm.com URL: https://logrhythm.com/blog/detecting-dns-tunneling/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:1b::393 , Ascension Island, ASN54113 (FASTLY - Fastly, US), Reverse DNS Software cloudinary / Resource Hash 0b1e16d7fcd06d726f7956a2b283a008402a996b38a8ea2826a58c239270853e Request headers Sec-Fetch-Mode no-cors Referer https://logrhythm.com/blog/detecting-dns-tunneling/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Mon, 14 Oct 2019 05:04:10 GMT via 1.1 varnish age 1629998 edge-cache-tag 394350655498152366632841495623709273057,418982223367125858526750486812326365158,ccef7cfa0dcb2237012fae9eb09ccd70 status 200 x-cache HIT content-length 3404 x-served-by cache-hhn4022-HHN last-modified Thu, 04 Oct 2018 17:22:56 GMT server cloudinary x-timer S1571029451.938513,VS0,VE1 etag "4f2e5990236f80ea1431d6828dd7df89" content-type image/png access-control-allow-origin * cache-control public, max-age=2592000 accept-ranges bytes timing-allow-origin * access-control-allow-headers X-Requested-With,Range,User-Agent x-cache-hits 1
GET H2	200	F_Blanke_1-1024x767.png logrhythm.com/images/blog-images/	100 KB 100 KB	341ms 340ms	Image image/png	143.204.101.20 Amazon.com
General Check archive.org Show headers Download Go to Show image Full URL https://logrhythm.com/images/blog-images/F_Blanke_1-1024x767.png Requested by Host: logrhythm.com URL: https://logrhythm.com/blog/detecting-dns-tunneling/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 143.204.101.20 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US), Reverse DNS server-143-204-101-20.fra50.r.cloudfront.net Software AmazonS3 / Resource Hash 1ed014d869aedff333852634085c5c2eb49ae3e3622c1073e40c6d75463a19f4 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Sec-Fetch-Mode no-cors Referer https://logrhythm.com/blog/detecting-dns-tunneling/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Fri, 11 Oct 2019 08:13:54 GMT via 1.1 e64eb476d8f76c461d21278e018e194f.cloudfront.net (CloudFront) x-content-type-options nosniff last-modified Fri, 11 Oct 2019 00:33:32 GMT server AmazonS3 x-amz-cf-pop FRA50-C1 etag "97755d7ae274fe9adedba454a92ac51b" x-cache RefreshHit from cloudfront content-type image/png status 200 content-length 102122 x-xss-protection 1; mode=block x-amz-cf-id SkG8NCvKhm5krWndmfwqsmWIe7IRn5itfeXPP5zc_SaBkxKyicci6Q==
GET H2	200	F_Blanke_2-1024x771.png logrhythm.com/images/blog-images/	108 KB 109 KB	334ms 333ms	Image image/png	143.204.101.20 Amazon.com
General Check archive.org Show headers Download Go to Show image Full URL https://logrhythm.com/images/blog-images/F_Blanke_2-1024x771.png Requested by Host: logrhythm.com URL: https://logrhythm.com/blog/detecting-dns-tunneling/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 143.204.101.20 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US), Reverse DNS server-143-204-101-20.fra50.r.cloudfront.net Software AmazonS3 / Resource Hash f170798050d7ffba453c0defa10cd703d6a65cc5405f2953bb236b39f8ca1064 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Sec-Fetch-Mode no-cors Referer https://logrhythm.com/blog/detecting-dns-tunneling/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Fri, 11 Oct 2019 08:13:54 GMT via 1.1 e64eb476d8f76c461d21278e018e194f.cloudfront.net (CloudFront) x-content-type-options nosniff last-modified Fri, 11 Oct 2019 00:33:32 GMT server AmazonS3 x-amz-cf-pop FRA50-C1 etag "5a8c58f13854c2655748d0d6d9d12405" x-cache RefreshHit from cloudfront content-type image/png status 200 content-length 111055 x-xss-protection 1; mode=block x-amz-cf-id GwJ0Pdpq2hr3_grcK2pcHiQraRn-Ggo5t1r8W9X6RLRR_ZCnHwx8vQ==
GET H2	200	F_Blanke_3-1024x769.png logrhythm.com/images/blog-images/	84 KB 84 KB	155ms 154ms	Image image/png	143.204.101.20 Amazon.com
General Check archive.org Show headers Download Go to Show image Full URL https://logrhythm.com/images/blog-images/F_Blanke_3-1024x769.png Requested by Host: logrhythm.com URL: https://logrhythm.com/blog/detecting-dns-tunneling/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 143.204.101.20 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US), Reverse DNS server-143-204-101-20.fra50.r.cloudfront.net Software AmazonS3 / Resource Hash a2cac85c8d8a445ca6d2e7fdd7b9683a9f099d875d71eb6cc1a3b7971c4fcf03 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Sec-Fetch-Mode no-cors Referer https://logrhythm.com/blog/detecting-dns-tunneling/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Fri, 11 Oct 2019 08:13:54 GMT via 1.1 e64eb476d8f76c461d21278e018e194f.cloudfront.net (CloudFront) x-content-type-options nosniff last-modified Fri, 11 Oct 2019 00:33:32 GMT server AmazonS3 x-amz-cf-pop FRA50-C1 etag "0921179510c09518eea3b1107c00d40a" x-cache RefreshHit from cloudfront content-type image/png status 200 content-length 85987 x-xss-protection 1; mode=block x-amz-cf-id lV9N0lLKa3Vd1btuhuyyAGtTSRWvOz6wu0mSZevK0L4Qw3bttugcHQ==
GET H2	200	F_Blanke_4-1024x768.png logrhythm.com/images/blog-images/	89 KB 89 KB	333ms 332ms	Image image/png	143.204.101.20 Amazon.com
General Check archive.org Show headers Download Go to Show image Full URL https://logrhythm.com/images/blog-images/F_Blanke_4-1024x768.png Requested by Host: logrhythm.com URL: https://logrhythm.com/blog/detecting-dns-tunneling/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 143.204.101.20 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US), Reverse DNS server-143-204-101-20.fra50.r.cloudfront.net Software AmazonS3 / Resource Hash 5ebf49a3364510333abd7d5149f0c962700f7b9481b0138767ff448bf0f5b0cf Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Sec-Fetch-Mode no-cors Referer https://logrhythm.com/blog/detecting-dns-tunneling/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Fri, 11 Oct 2019 08:13:54 GMT via 1.1 e64eb476d8f76c461d21278e018e194f.cloudfront.net (CloudFront) x-content-type-options nosniff last-modified Fri, 11 Oct 2019 00:33:32 GMT server AmazonS3 x-amz-cf-pop FRA50-C1 etag "9d689c758ad720cd9d570a1c638d5e9b" x-cache RefreshHit from cloudfront content-type image/png status 200 content-length 90974 x-xss-protection 1; mode=block x-amz-cf-id obMqqcw18kIxfE4IzXuZ-7kwnbXQKQC8suDTFNH3xuaFcpihjMYkLA==
GET H2	200	F_Blanke_5-1024x770.png logrhythm.com/images/blog-images/	90 KB 91 KB	160ms 159ms	Image image/png	143.204.101.20 Amazon.com
General Check archive.org Show headers Download Go to Show image Full URL https://logrhythm.com/images/blog-images/F_Blanke_5-1024x770.png Requested by Host: logrhythm.com URL: https://logrhythm.com/blog/detecting-dns-tunneling/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 143.204.101.20 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US), Reverse DNS server-143-204-101-20.fra50.r.cloudfront.net Software AmazonS3 / Resource Hash f7f302962986b90538dad66ec674141d6bfef40451e8598aa513fefcc3021b01 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Sec-Fetch-Mode no-cors Referer https://logrhythm.com/blog/detecting-dns-tunneling/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Fri, 11 Oct 2019 08:13:54 GMT via 1.1 e64eb476d8f76c461d21278e018e194f.cloudfront.net (CloudFront) x-content-type-options nosniff last-modified Fri, 11 Oct 2019 00:33:32 GMT server AmazonS3 x-amz-cf-pop FRA50-C1 etag "b84bdd4031203a02432771125a519406" x-cache RefreshHit from cloudfront content-type image/png status 200 content-length 92394 x-xss-protection 1; mode=block x-amz-cf-id zMTUIV1YFjdT8HNr3GtJhbfKyBkAWSh3QNjLFc_0VX2vt41_uRiBqQ==
GET H2	200	svg-sprite.svg logrhythm.com/images/	103 KB 40 KB	35ms 34ms	Other image/svg+xml	143.204.101.20 Amazon.com
General Check archive.org Show headers Download Go to Full URL https://logrhythm.com/images/svg-sprite.svg Requested by Host: logrhythm.com URL: https://logrhythm.com/blog/detecting-dns-tunneling/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 143.204.101.20 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US), Reverse DNS server-143-204-101-20.fra50.r.cloudfront.net Software AmazonS3 / Resource Hash b00d1e1ec4257b4cc76d3dc539bd6720f50df23e0c30a0f1982bfd55cf7dc06d Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Sec-Fetch-Mode same-origin Referer https://logrhythm.com/blog/detecting-dns-tunneling/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Fri, 11 Oct 2019 00:35:35 GMT content-encoding gzip x-content-type-options nosniff last-modified Fri, 11 Oct 2019 00:35:02 GMT server AmazonS3 x-amz-cf-pop FRA50-C1 status 200 vary Accept-Encoding x-cache Hit from cloudfront content-type image/svg+xml via 1.1 e64eb476d8f76c461d21278e018e194f.cloudfront.net (CloudFront) x-amz-cf-id 5q2uEBV-D815V4hUa8BFnugvT7TXjeEG6QPPpobrINSQmlxTC1qJsQ== x-xss-protection 1; mode=block
GET H2	200	34740D_15_0.woff2 logrhythm.com/fonts/proxima-nova/webfonts/	54 KB 54 KB	52ms 52ms	Font binary/octet-stream	143.204.101.20 Amazon.com
General Check archive.org Show headers Download Go to Full URL https://logrhythm.com/fonts/proxima-nova/webfonts/34740D_15_0.woff2 Requested by Host: logrhythm.com URL: https://logrhythm.com/blog/detecting-dns-tunneling/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 143.204.101.20 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US), Reverse DNS server-143-204-101-20.fra50.r.cloudfront.net Software AmazonS3 / Resource Hash c2193b88bf23d3f8e2ebda463ec34bda3e6200f91459327b6acee22f19784ee2 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Sec-Fetch-Mode cors Referer https://logrhythm.com/blog/detecting-dns-tunneling/ Origin https://logrhythm.com User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Fri, 11 Oct 2019 00:55:07 GMT via 1.1 e64eb476d8f76c461d21278e018e194f.cloudfront.net (CloudFront) x-content-type-options nosniff last-modified Fri, 11 Oct 2019 00:33:11 GMT server AmazonS3 x-amz-cf-pop FRA50-C1 etag "078b954ecd994fdfcc561522c55783e4" x-cache Hit from cloudfront content-type binary/octet-stream status 200 content-length 55205 x-xss-protection 1; mode=block x-amz-cf-id PoCBwFP64ZMQe3cvxg2TykxzsIHvib69ShyJFANAZqQGceO3cGiNJQ==
GET H2	200	34740D_11_0.woff2 logrhythm.com/fonts/proxima-nova/webfonts/	54 KB 54 KB	44ms 44ms	Font binary/octet-stream	143.204.101.20 Amazon.com
General Check archive.org Show headers Download Go to Full URL https://logrhythm.com/fonts/proxima-nova/webfonts/34740D_11_0.woff2 Requested by Host: logrhythm.com URL: https://logrhythm.com/blog/detecting-dns-tunneling/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 143.204.101.20 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US), Reverse DNS server-143-204-101-20.fra50.r.cloudfront.net Software AmazonS3 / Resource Hash 9b57d8c219e9452d5aad64412bc5ac44f27d4aa7d74c680b1bf1ddd27d70bb63 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Sec-Fetch-Mode cors Referer https://logrhythm.com/blog/detecting-dns-tunneling/ Origin https://logrhythm.com User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Fri, 11 Oct 2019 00:55:07 GMT via 1.1 e64eb476d8f76c461d21278e018e194f.cloudfront.net (CloudFront) x-content-type-options nosniff last-modified Fri, 11 Oct 2019 00:33:11 GMT server AmazonS3 x-amz-cf-pop FRA50-C1 etag "2531a0f7f3117c2f33113338175292c6" x-cache Hit from cloudfront content-type binary/octet-stream status 200 content-length 55314 x-xss-protection 1; mode=block x-amz-cf-id ADtUR7LMxEQ3ESsZWAVAarJt1-UtmSsFwB1W6nyxoZh8p_Pxtldaug==
GET H2	200	notice Show response consent.truste.com/	4 KB 2 KB	140ms 54ms	Script text/javascript	13.225.78.24 Amazon.com
General Check archive.org Show headers Download Go to Full URL https://consent.truste.com/notice?domain=logrhythm.com&c=teconsent&js=bb&noticeType=bb Requested by Host: logrhythm.com URL: https://logrhythm.com/blog/detecting-dns-tunneling/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 13.225.78.24 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US), Reverse DNS server-13-225-78-24.fra2.r.cloudfront.net Software nginx / Resource Hash ead1c89c2dd2088f892ffea2946096022de79d859efa630ef80337e9b6d9c297 Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Sec-Fetch-Mode cors Referer https://logrhythm.com/blog/detecting-dns-tunneling/ Origin https://logrhythm.com User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Mon, 14 Oct 2019 05:04:11 GMT content-encoding gzip x-content-type-options nosniff x-amz-cf-pop FRA2-C2 x-cache Miss from cloudfront status 200 content-length 1526 x-xss-protection 1; mode=block access-control-allow-origin * server nginx x-frame-options SAMEORIGIN vary Accept-Encoding content-type text/javascript;charset=UTF-8 via 1.1 f8fe53d5464b299529d281799da8de30.cloudfront.net (CloudFront) cache-control no-cache x-amz-cf-id zm0OPEoJh6omZh9BTze9GcIRCNq4MtQCaYHbKS_NiSYaAe6BWAiFrQ== expires Mon, 14 Oct 2019 05:04:10 GMT
GET H2	200	app.min.js Show response logrhythm.com/scripts/	198 KB 61 KB	43ms 42ms	Script text/javascript	143.204.101.20 Amazon.com
General Check archive.org Show headers Download Go to Full URL https://logrhythm.com/scripts/app.min.js Requested by Host: logrhythm.com URL: https://logrhythm.com/blog/detecting-dns-tunneling/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 143.204.101.20 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US), Reverse DNS server-143-204-101-20.fra50.r.cloudfront.net Software AmazonS3 / Resource Hash f7d024842ec93c222458570ebf1875cd652ac0d11378f24c1979d8e57072d74b Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Sec-Fetch-Mode no-cors Referer https://logrhythm.com/blog/detecting-dns-tunneling/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Fri, 11 Oct 2019 00:35:35 GMT content-encoding gzip x-content-type-options nosniff last-modified Fri, 11 Oct 2019 00:34:48 GMT server AmazonS3 age 7298 status 200 vary Accept-Encoding x-cache Hit from cloudfront content-type text/javascript via 1.1 e64eb476d8f76c461d21278e018e194f.cloudfront.net (CloudFront) x-amz-cf-pop FRA50-C1 x-amz-cf-id 6hWPODTeTrIzlCzPFSnR6BNAS0IIwh10273ZDinHipArOYVwSX4nnw== x-xss-protection 1; mode=block
GET H/1.1	200 OK	embed.js Show response logrhythm.disqus.com/	64 KB 21 KB	347ms 291ms	Script application/javascript	151.101.112.134 Fastly
General Check archive.org Show headers Download Go to Full URL https://logrhythm.disqus.com/embed.js Requested by Host: logrhythm.com URL: https://logrhythm.com/blog/detecting-dns-tunneling/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.112.134 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US), Reverse DNS Software openresty / Resource Hash 7fc6082470a19ec6ff80dacf7a3a7146759e6ca9b0fa9e48825c9abc524d4f00 Security Headers Name Value Strict-Transport-Security max-age=300; includeSubdomains Request headers Sec-Fetch-Mode no-cors Referer https://logrhythm.com/blog/detecting-dns-tunneling/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Mon, 14 Oct 2019 05:04:11 GMT Content-Encoding gzip Server openresty Age 0 Vary Accept-Encoding Connection keep-alive Content-Type application/javascript; charset=utf-8 Cache-Control private, max-age=60 X-Service router Strict-Transport-Security max-age=300; includeSubdomains Link <https://disqus.com>; rel=preconnect, <https://c.disquscdn.com>; rel=preconnect Content-Length 21543
GET		Guided-Blog-Subscribe-Form.html ecrm.logrhythm.com/ Frame 1AE1	0 0
GET H2	200	analytics.js Show response www.google-analytics.com/	43 KB 17 KB	6ms 6ms	Script text/javascript	2a00:1450:4001:80b::200e Google LLC
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/analytics.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-P82TVL&l=dataLayer Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:80b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US), Reverse DNS Software Golfe2 / Resource Hash dbb67c620eaabf6679a314db18d3ae43037aef71ab27422e6feec08ee987cc0a Security Headers Name Value Strict-Transport-Security max-age=10886400; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Sec-Fetch-Mode no-cors Referer https://logrhythm.com/blog/detecting-dns-tunneling/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers strict-transport-security max-age=10886400; includeSubDomains; preload content-encoding gzip x-content-type-options nosniff last-modified Mon, 19 Aug 2019 17:22:41 GMT server Golfe2 age 4200 date Mon, 14 Oct 2019 03:54:10 GMT vary Accept-Encoding content-type text/javascript status 200 cache-control public, max-age=7200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 17803 expires Mon, 14 Oct 2019 05:54:10 GMT
GET H/1.1	200 OK	munchkin.js Show response munchkin.marketo.net/	1 KB 1 KB	96ms 25ms	Script application/x-javascript	104.111.251.133 Akamai Technologies
General Check archive.org Show headers Download Go to Full URL https://munchkin.marketo.net/munchkin.js Requested by Host: logrhythm.com URL: https://logrhythm.com/blog/detecting-dns-tunneling/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 104.111.251.133 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US), Reverse DNS a104-111-251-133.deploy.static.akamaitechnologies.com Software Apache / Resource Hash 66f7eaa7a45f696c332cd450771f4be48e110f6afbe1fe7b39c7a95518aeef76 Request headers Sec-Fetch-Mode no-cors Referer https://logrhythm.com/blog/detecting-dns-tunneling/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Mon, 14 Oct 2019 05:04:11 GMT Content-Encoding gzip Last-Modified Fri, 05 Apr 2019 02:53:44 GMT Server Apache ETag "54520320df20b526337717d6d28181fc:1554432824" Vary Accept-Encoding P3P policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR" Connection keep-alive Accept-Ranges bytes Content-Type application/x-javascript Content-Length 752
GET H2	200	conversion_async.js Show response www.googleadservices.com/pagead/	24 KB 10 KB	74ms 31ms	Script text/javascript	216.58.208.34 Google LLC
General Check archive.org Show headers Download Go to Full URL https://www.googleadservices.com/pagead/conversion_async.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-P82TVL&l=dataLayer Protocol H2 Security TLS 1.3, , AES_128_GCM Server 216.58.208.34 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US), Reverse DNS fra15s12-in-f2.1e100.net Software cafe / Resource Hash a6b5e22c905bbb22ce9e7aad76eeca32474b5ba7c932893d554b0edfddc7f9e2 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Sec-Fetch-Mode no-cors Referer https://logrhythm.com/blog/detecting-dns-tunneling/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Mon, 14 Oct 2019 05:04:11 GMT content-encoding gzip x-content-type-options nosniff p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" status 200 content-disposition attachment; filename="f.txt" alt-svc quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 9184 x-xss-protection 0 server cafe etag 4597387999763492622 vary Accept-Encoding content-type text/javascript; charset=UTF-8 cache-control private, max-age=3600 timing-allow-origin * expires Mon, 14 Oct 2019 05:04:11 GMT
GET H2	200	uwt.js Show response static.ads-twitter.com/	5 KB 2 KB	64ms 21ms	Script application/javascript	151.101.112.157 Fastly
General Check archive.org Show headers Download Go to Full URL https://static.ads-twitter.com/uwt.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-P82TVL&l=dataLayer Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.112.157 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US), Reverse DNS Software / Resource Hash 319949c8c08b86e9c35ea542c0dc0c30cedaa9b8d3d3c3327a36c91aefbd8af5 Request headers Sec-Fetch-Mode no-cors Referer https://logrhythm.com/blog/detecting-dns-tunneling/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Mon, 14 Oct 2019 05:04:11 GMT content-encoding gzip age 75081 x-cache HIT p3p CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT" status 200 content-length 1954 x-served-by cache-hhn4045-HHN last-modified Tue, 23 Jan 2018 20:09:00 GMT x-timer S1571029451.030345,VS0,VE0 etag "b7b33882a4f3ffd5cbf07434f3137166+gzip" vary Accept-Encoding,Host content-type application/javascript; charset=utf-8 via 1.1 varnish cache-control no-cache accept-ranges bytes
GET H/1.1	200 OK	roundtrip.js Show response s.adroll.com/j/	33 KB 11 KB	78ms 27ms	Script text/javascript	2.18.233.40 Akamai Technologies
General Check archive.org Show headers Download Go to Full URL https://s.adroll.com/j/roundtrip.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-P82TVL&l=dataLayer Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2.18.233.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US), Reverse DNS a2-18-233-40.deploy.static.akamaitechnologies.com Software AmazonS3 / Resource Hash 4a1d3bf6c1cec783f967068348e78974da3b79cdfae1746c01f7f9ad86ad9951 Request headers Sec-Fetch-Mode no-cors Referer https://logrhythm.com/blog/detecting-dns-tunneling/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers x-amz-version-id 9.BQ9cxFANfreH2vrVxQTFpw5o67znAv Content-Encoding gzip ETag "4cdaf4a1f2ebfda8dd871575ebef2236" x-amz-request-id 43692B5807BE08A9 x-amz-server-side-encryption AES256 Connection keep-alive Vary Accept-Encoding Content-Length 10345 x-amz-id-2 ZQUqt6+TOkdgwadOb4rRXtH/zTXxRMa2B/Q3JC2N12nwj4qVLAGSMuqUr6fSLmp42OnQir5Jk9Y= Last-Modified Wed, 25 Sep 2019 15:18:31 GMT Server AmazonS3 Date Mon, 14 Oct 2019 05:04:11 GMT Access-Control-Max-Age 600 Access-Control-Allow-Methods GET Content-Type text/javascript Access-Control-Allow-Origin * Cache-Control max-age=3600, must-revalidate Access-Control-Allow-Credentials false Accept-Ranges bytes Access-Control-Allow-Headers *
GET H2	200	fbevents.js Show response connect.facebook.net/en_US/	103 KB 22 KB	6ms 6ms	Script application/x-javascript	2a03:2880:f01c:8012:face:b00c:0:3 Facebook
General Check archive.org Show headers Download Go to Full URL https://connect.facebook.net/en_US/fbevents.js Requested by Host: logrhythm.com URL: https://logrhythm.com/blog/detecting-dns-tunneling/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f01c:8012:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US), Reverse DNS Software / Resource Hash fe6062b8859b1cbec624e610c390a71f1830a3202eb0a2c4d8cd42aaf446a8cf Security Headers Name Value Content-Security-Policy default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm; Strict-Transport-Security max-age=31536000; preload; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 0 Request headers Sec-Fetch-Mode no-cors Referer https://logrhythm.com/blog/detecting-dns-tunneling/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers strict-transport-security max-age=31536000; preload; includeSubDomains content-encoding gzip x-content-type-options nosniff status 200 content-length 22372 x-xss-protection 0 pragma public x-fb-debug +y+wgqfOP87YxfznQNxj10QGvMiL4PhPh9tOguYt57JVM3rya/qUb/8olhu/ogtCb8oXRRbmWR/8XkJ+qXjefQ== x-fb-trip-id 1850256238 x-frame-options DENY date Mon, 14 Oct 2019 05:04:10 GMT vary Accept-Encoding content-type application/x-javascript; charset=utf-8 cache-control public, max-age=1200 content-security-policy default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm; expires Sat, 01 Jan 2000 00:00:00 GMT
GET H/1.1	200 OK	163889.js Show response secure.leadforensics.com/js/	1 KB 987 B	209ms 26ms	Script text/javascript	51.140.49.131 Microsoft Corpora...
General Check archive.org Show headers Download Go to Full URL https://secure.leadforensics.com/js/163889.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-P82TVL&l=dataLayer Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 51.140.49.131 London, United Kingdom, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US), Reverse DNS Software Kestrel / Resource Hash 127598a4b1e0a2d7a8a9e6d17e96fea567e30bf466f8b8c522d4b822ce44a105 Request headers Sec-Fetch-Mode no-cors Referer https://logrhythm.com/blog/detecting-dns-tunneling/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Pragma no-cache Date Mon, 14 Oct 2019 05:04:10 GMT Content-Encoding gzip Server Kestrel Vary Accept-Encoding Content-Type text/javascript Cache-Control no-store, must-revalidate Transfer-Encoding chunked Expires 0
GET H2	200	visitor.js Show response app.leadsrx.com/	12 KB 12 KB	734ms 318ms	Script application/javascript	54.148.155.229 Amazon.com
General Check archive.org Show headers Download Go to Full URL https://app.leadsrx.com/visitor.js Requested by Host: logrhythm.com URL: https://logrhythm.com/blog/detecting-dns-tunneling/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 54.148.155.229 Boardman, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US), Reverse DNS ec2-54-148-155-229.us-west-2.compute.amazonaws.com Software Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16 / Resource Hash 426700681006c09323ce1237063674931f3f44fd70880a0a83f920bd60fdcb1a Request headers Sec-Fetch-Mode no-cors Referer https://logrhythm.com/blog/detecting-dns-tunneling/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Mon, 14 Oct 2019 05:04:11 GMT last-modified Sun, 13 Oct 2019 20:45:45 GMT server Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16 etag "2f9e-594d0d5dfc80c" content-type application/javascript status 200 accept-ranges bytes content-length 12190
GET H/1.1	200 OK	s ads.avocet.io/ Redirect Chain https://ads.avocet.io/s?add=5a33dc888945849615039dac https://ads.avocet.io/s?bounce=true&add=5a33dc888945849615039dac	35 B 440 B	31ms 31ms	Image image/gif	52.208.204.25 Amazon.com
General Check archive.org Show headers Download Go to Show image Full URL https://ads.avocet.io/s?bounce=true&add=5a33dc888945849615039dac Requested by Host: logrhythm.com URL: https://logrhythm.com/blog/detecting-dns-tunneling/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.208.204.25 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US), Reverse DNS ec2-52-208-204-25.eu-west-1.compute.amazonaws.com Software / Resource Hash 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992 Request headers Referer https://logrhythm.com/blog/detecting-dns-tunneling/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Mon, 14 Oct 2019 05:04:11 GMT Connection keep-alive P3p policyref="http://cdn.avocet.io/w3c/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" Content-Length 35 Content-Type image/gif Redirect headers Location /s?bounce=true&add=5a33dc888945849615039dac Date Mon, 14 Oct 2019 05:04:11 GMT Connection keep-alive P3p policyref="http://cdn.avocet.io/w3c/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" Content-Length 70 Content-Type text/html; charset=utf-8
GET H2	200	mintigo_pixel.png pixel.mintigo.com/	68 B 420 B	34ms 6ms	Image image/png	2600:9000:2156:d800:1e:d8cf:91c0:93a1 Amazon.com
General Check archive.org Show headers Download Go to Show image Full URL https://pixel.mintigo.com/mintigo_pixel.png?pixel_cid=d94964756a Requested by Host: logrhythm.com URL: https://logrhythm.com/blog/detecting-dns-tunneling/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2600:9000:2156:d800:1e:d8cf:91c0:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US), Reverse DNS Software AmazonS3 / Resource Hash 85394914807c18a79c9cd90140f3c494888d2cd9689d68835bdfe830545b2e36 Request headers Sec-Fetch-Mode no-cors Referer https://logrhythm.com/blog/detecting-dns-tunneling/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers x-amz-server-side-encryption AES256 date Sun, 13 Oct 2019 22:08:07 GMT via 1.1 a148356b14492df0e216c234ac2c2308.cloudfront.net (CloudFront) last-modified Mon, 19 Mar 2018 21:23:31 GMT server AmazonS3 age 24965 etag "fb204f945bb89bb73d3c1304701d7428" x-cache Hit from cloudfront content-type image/png status 200 x-amz-cf-pop FRA50-C1 accept-ranges bytes content-length 68 x-amz-cf-id -he2WeriEvz8lKerJ5-y1w7IDYDuVCkZq4QOPjLE7iSoqigm-ywSqw==
GET H2	200	dots.svg logrhythm.com/images/svgs/	2 KB 1 KB	27ms 27ms	Image image/svg+xml	143.204.101.20 Amazon.com
General Check archive.org Show headers Download Go to Show image Full URL https://logrhythm.com/images/svgs/dots.svg Requested by Host: logrhythm.com URL: https://logrhythm.com/blog/detecting-dns-tunneling/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 143.204.101.20 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US), Reverse DNS server-143-204-101-20.fra50.r.cloudfront.net Software AmazonS3 / Resource Hash 71c603a83fa2dd8bf3c932d1b4cf810c8201cc466a5eb20b8d98831db45c7110 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Sec-Fetch-Mode no-cors Referer https://logrhythm.com/css/styles.min.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Fri, 11 Oct 2019 03:27:26 GMT content-encoding gzip x-content-type-options nosniff last-modified Fri, 11 Oct 2019 00:35:02 GMT server AmazonS3 age 25306 status 200 vary Accept-Encoding x-cache Hit from cloudfront content-type image/svg+xml via 1.1 e64eb476d8f76c461d21278e018e194f.cloudfront.net (CloudFront) x-amz-cf-pop FRA50-C1 x-amz-cf-id 9OQxYBz5kKWcW9wgpXOU7e7qtSoQcBzIjU7rZN6D3jyWGKbC4l_o1A== x-xss-protection 1; mode=block
GET H2	200	js Show response www.google-analytics.com/gtm/	57 KB 21 KB	21ms 20ms	Script application/javascript	2a00:1450:4001:80b::200e Google LLC
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/gtm/js?id=GTM-MSXFN7F&t=gtm1&cid=849653506.1571029451 Requested by Host: www.google-analytics.com URL: https://www.google-analytics.com/analytics.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:80b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US), Reverse DNS Software Google Tag Manager / Resource Hash c30461f0d3697c0d1ffe38213c0b79ec4efec095a660e1d03f57eff6da524436 Security Headers Name Value X-Xss-Protection 0 Request headers Sec-Fetch-Mode no-cors Referer https://logrhythm.com/blog/detecting-dns-tunneling/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Mon, 14 Oct 2019 05:04:11 GMT content-encoding br last-modified Mon, 14 Oct 2019 03:00:00 GMT server Google Tag Manager access-control-allow-headers Cache-Control status 200 vary Accept-Encoding content-type application/javascript; charset=UTF-8 access-control-allow-origin http://www.googletagmanager.com cache-control private, max-age=900 access-control-allow-credentials true alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 21710 x-xss-protection 0 expires Mon, 14 Oct 2019 05:04:11 GMT
GET H2	200	232919347190734 Show response connect.facebook.net/signals/config/	280 KB 65 KB	56ms 56ms	Script application/x-javascript	2a03:2880:f01c:8012:face:b00c:0:3 Facebook
General Check archive.org Show headers Download Go to Full URL https://connect.facebook.net/signals/config/232919347190734?v=2.9.5&r=stable Requested by Host: connect.facebook.net URL: https://connect.facebook.net/en_US/fbevents.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f01c:8012:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US), Reverse DNS Software / Resource Hash 9f34f0fa6e27f823398636e42d0abd8f4eebdb32af50394bcfab686857a93988 Security Headers Name Value Content-Security-Policy default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm; Strict-Transport-Security max-age=31536000; preload; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 0 Request headers Sec-Fetch-Mode no-cors Referer https://logrhythm.com/blog/detecting-dns-tunneling/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers x-fb-trip-id 1850256238 pragma public x-fb-debug eBIaPrqifcZ2ALQY9Co8ccejsm/XkzZe6SKt2+bOp3VZmergdGUkM5YwqGF2XLcR07QWlphe/rwaksgt1hNSOA== content-encoding gzip x-content-type-options nosniff x-frame-options DENY date Mon, 14 Oct 2019 05:04:11 GMT strict-transport-security max-age=31536000; preload; includeSubDomains content-type application/x-javascript; charset=utf-8 status 200 cache-control public, max-age=1200 content-security-policy default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm; vary Accept-Encoding x-xss-protection 0 expires Sat, 01 Jan 2000 00:00:00 GMT
GET H2	200	Guided-Blog-Subscribe-Form.html Show response ecrm.logrhythm.com/ Frame 1AE1	22 KB 6 KB	370ms 315ms	Document text/html	104.17.70.206 Cloudflare
General Check archive.org Show headers Download Go to Full URL https://ecrm.logrhythm.com/Guided-Blog-Subscribe-Form.html?form_type=compact&ty_page_url=https%3A%2F%2Flogrhythm.com%2Fblog-newsletter-subscription-ty%2F&resizeGuid=DB9FB6E2-35C7-4E17-81C4-2CE5AFDBB9B8&page_url=https%3A%2F%2Flogrhythm.com%2Fblog%2Fdetecting-dns-tunneling%2F Requested by Host: logrhythm.com URL: https://logrhythm.com/scripts/app.min.js Protocol H2 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 104.17.70.206 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash 3a6601e748b2b6e0aef5e413e41b5f270c91a826f8ce6846222e863592ef40f8 Security Headers Name Value X-Content-Type-Options nosniff Request headers :method GET :authority ecrm.logrhythm.com :scheme https :path /Guided-Blog-Subscribe-Form.html?form_type=compact&ty_page_url=https%3A%2F%2Flogrhythm.com%2Fblog-newsletter-subscription-ty%2F&resizeGuid=DB9FB6E2-35C7-4E17-81C4-2CE5AFDBB9B8&page_url=https%3A%2F%2Flogrhythm.com%2Fblog%2Fdetecting-dns-tunneling%2F pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 sec-fetch-mode nested-navigate accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3 sec-fetch-site same-site referer https://logrhythm.com/blog/detecting-dns-tunneling/ accept-encoding gzip, deflate, br cookie _gcl_au=1.1.1921783526.1571029451; _ga=GA1.2.849653506.1571029451; _gid=GA1.2.1061378863.1571029451 Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Mode nested-navigate Referer https://logrhythm.com/blog/detecting-dns-tunneling/ Response headers status 200 date Mon, 14 Oct 2019 05:04:11 GMT content-type text/html; charset=utf-8 set-cookie __cfduid=d5641ac4e226cbd5a67ae218f4aeaccd01571029451; expires=Tue, 13-Oct-20 05:04:11 GMT; path=/; domain=.ecrm.logrhythm.com; HttpOnly BIGipServerabcweb-nginx-app_https=!mS75frHmviX/Yqdybf/nLIVwOTHiDsnp3+pxs+Jv+lfhU+r580Y2PMbwUZxLAkEcCK1zAUMEFDksNg==;Path=/;Version=1;Secure;Httponly __cf_bm=503515fb335df62b5bfdcab438e1d833d849da0a-1571029451-1800-AZ/ytj0LfVigh/dJPD08IofvyBfRGz02V4BS2C/pQM5JueaCDyY0k2DsHIx+r7X2qBVdUBci84SYW1MR+X5H2sY=; path=/; expires=Mon, 14-Oct-19 05:34:11 GMT; domain=.ecrm.logrhythm.com; HttpOnly p3p CP="CAO CURa ADMa DEVa TAIa OUR IND UNI COM NAV INT" vary *,Accept-Encoding x-content-type-options nosniff x-cache-status MISS x-mkto-nginx-cache true cf-cache-status DYNAMIC expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" server cloudflare cf-ray 525702d56aedbdb9-AMS content-encoding gzip
GET H2	200	adsct t.co/i/	43 B 447 B	180ms 136ms	Image image/gif	104.244.42.5 Twitter Inc.
General Check archive.org Show headers Download Go to Show image Full URL https://t.co/i/adsct?p_id=Twitter&p_user_id=0&txn_id=nw4xr&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0 Requested by Host: logrhythm.com URL: https://logrhythm.com/blog/detecting-dns-tunneling/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 104.244.42.5 , United States, ASN13414 (TWITTER - Twitter Inc., US), Reverse DNS Software tsa_o / Resource Hash ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957 Security Headers Name Value Strict-Transport-Security max-age=0 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers Sec-Fetch-Mode no-cors Referer https://logrhythm.com/blog/detecting-dns-tunneling/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Mon, 14 Oct 2019 05:04:11 GMT content-encoding gzip x-content-type-options nosniff status 200, 200 OK x-twitter-response-tags BouncerCompliant content-length 65 x-xss-protection 0 x-response-time 111 pragma no-cache last-modified Mon, 14 Oct 2019 05:04:11 GMT server tsa_o x-frame-options SAMEORIGIN strict-transport-security max-age=0 content-type image/gif;charset=utf-8 cache-control no-cache, no-store, must-revalidate, pre-check=0, post-check=0 x-connection-hash 6ae3adc00f90e104909f4088eb50a2a0 x-transaction 00c7ae640020b2dc expires Tue, 31 Mar 1981 05:00:00 GMT
GET H2	200	collect www.google-analytics.com/	35 B 109 B	6ms 5ms	Image image/gif	2a00:1450:4001:80b::200e Google LLC
General Check archive.org Show headers Download Go to Show image Full URL https://www.google-analytics.com/collect?v=1&_v=j79&a=915949175&t=pageview&_s=1&dl=https%3A%2F%2Flogrhythm.com%2Fblog%2Fdetecting-dns-tunneling%2F&ul=en-us&de=UTF-8&dt=Detecting%20DNS%20Tunneling%20%7C%20LogRhythm&sd=24-bit&sr=1600x1200&vp=1585x1200&je=0&_u=aGDAgUADQ~&jid=166717973&gjid=13790015&cid=849653506.1571029451&tid=UA-3420049-1&_gid=1061378863.1571029451&gtm=2wga21P82TVL&z=849096422 Requested by Host: logrhythm.com URL: https://logrhythm.com/blog/detecting-dns-tunneling/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:80b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US), Reverse DNS Software Golfe2 / Resource Hash 8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015 Security Headers Name Value X-Content-Type-Options nosniff Request headers Sec-Fetch-Mode no-cors Referer https://logrhythm.com/blog/detecting-dns-tunneling/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers pragma no-cache date Fri, 11 Oct 2019 20:02:15 GMT x-content-type-options nosniff last-modified Sun, 17 May 1998 03:00:00 GMT server Golfe2 age 205316 status 200 content-type image/gif access-control-allow-origin * cache-control no-cache, no-store, must-revalidate alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 35 expires Mon, 01 Jan 1990 00:00:00 GMT
GET H2	200	ga-audiences www.google.de/ads/ Redirect Chain https://stats.g.doubleclick.net/r/collect?t=dc&aip=1&_r=3&v=1&_v=j79&tid=UA-3420049-1&cid=849653506.1571029451&jid=166717973&gjid=13790015&_gid=1061378863.1571029451&_u=aGDAgUADQ~&z=688492608 https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-3420049-1&cid=849653506.1571029451&jid=166717973&_v=j79&z=688492608 https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-3420049-1&cid=849653506.1571029451&jid=166717973&_v=j79&z=688492608&slf_rd=1&random=58063388	42 B 109 B	18ms 18ms	Image image/gif	2a00:1450:4001:800::2003 Google LLC
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-3420049-1&cid=849653506.1571029451&jid=166717973&_v=j79&z=688492608&slf_rd=1&random=58063388 Requested by Host: logrhythm.com URL: https://logrhythm.com/blog/detecting-dns-tunneling/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:800::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://logrhythm.com/blog/detecting-dns-tunneling/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers pragma no-cache date Mon, 14 Oct 2019 05:04:11 GMT x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" status 200 cache-control no-cache, no-store, must-revalidate content-type image/gif alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT Redirect headers pragma no-cache date Mon, 14 Oct 2019 05:04:11 GMT x-content-type-options nosniff server cafe p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" status 302 content-type text/html; charset=UTF-8 location https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-3420049-1&cid=849653506.1571029451&jid=166717973&_v=j79&z=688492608&slf_rd=1&random=58063388 cache-control no-cache, no-store, must-revalidate timing-allow-origin * alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 0 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	/ Show response googleads.g.doubleclick.net/pagead/viewthroughconversion/1070386004/	2 KB 1 KB	17ms 17ms	Script text/javascript	2a00:1450:4001:824::2002 Google LLC
General Check archive.org Show headers Download Go to Full URL https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1070386004/?random=1571029451059&cv=9&fst=1571029451059&num=1&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2wga21&sendb=1&ig=1&frm=0&url=https%3A%2F%2Flogrhythm.com%2Fblog%2Fdetecting-dns-tunneling%2F&tiba=Detecting%20DNS%20Tunneling%20%7C%20LogRhythm&async=1&rfmt=3&fmt=4 Requested by Host: www.googleadservices.com URL: https://www.googleadservices.com/pagead/conversion_async.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:824::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US), Reverse DNS Software cafe / Resource Hash 81e78adefaf37f0fada52fe99ceaa2af7af6f6d0911d99d89712c78f7bc643ee Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Sec-Fetch-Mode no-cors Referer https://logrhythm.com/blog/detecting-dns-tunneling/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers pragma no-cache date Mon, 14 Oct 2019 05:04:11 GMT content-encoding gzip x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" status 200 cache-control no-cache, must-revalidate content-disposition attachment; filename="f.txt" content-type text/javascript; charset=UTF-8 alt-svc quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 952 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	/ Show response googleads.g.doubleclick.net/pagead/viewthroughconversion/903108792/	2 KB 1 KB	18ms 18ms	Script text/javascript	2a00:1450:4001:824::2002 Google LLC
General Check archive.org Show headers Download Go to Full URL https://googleads.g.doubleclick.net/pagead/viewthroughconversion/903108792/?random=1571029451061&cv=9&fst=1571029451061&num=1&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2wga21&sendb=1&ig=1&frm=0&url=https%3A%2F%2Flogrhythm.com%2Fblog%2Fdetecting-dns-tunneling%2F&tiba=Detecting%20DNS%20Tunneling%20%7C%20LogRhythm&async=1&rfmt=3&fmt=4 Requested by Host: www.googleadservices.com URL: https://www.googleadservices.com/pagead/conversion_async.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:824::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US), Reverse DNS Software cafe / Resource Hash d303702e5f84abd7b4120773f3e0f75ed4d269535c669e8033f3b8bc462294a5 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Sec-Fetch-Mode no-cors Referer https://logrhythm.com/blog/detecting-dns-tunneling/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers pragma no-cache date Mon, 14 Oct 2019 05:04:11 GMT content-encoding gzip x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" status 200 cache-control no-cache, must-revalidate content-disposition attachment; filename="f.txt" content-type text/javascript; charset=UTF-8 alt-svc quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 950 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	/ Show response googleads.g.doubleclick.net/pagead/viewthroughconversion/952414179/	2 KB 1 KB	17ms 17ms	Script text/javascript	2a00:1450:4001:824::2002 Google LLC
General Check archive.org Show headers Download Go to Full URL https://googleads.g.doubleclick.net/pagead/viewthroughconversion/952414179/?random=1571029451062&cv=9&fst=1571029451062&num=1&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2wga21&sendb=1&ig=1&frm=0&url=https%3A%2F%2Flogrhythm.com%2Fblog%2Fdetecting-dns-tunneling%2F&tiba=Detecting%20DNS%20Tunneling%20%7C%20LogRhythm&async=1&rfmt=3&fmt=4 Requested by Host: www.googleadservices.com URL: https://www.googleadservices.com/pagead/conversion_async.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:824::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US), Reverse DNS Software cafe / Resource Hash 316fc0c706f1511ffdad65a7a2b966edf18ac1f515f3843d87d4b2a39aa6b9eb Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Sec-Fetch-Mode no-cors Referer https://logrhythm.com/blog/detecting-dns-tunneling/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers pragma no-cache date Mon, 14 Oct 2019 05:04:11 GMT content-encoding gzip x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" status 200 cache-control no-cache, must-revalidate content-disposition attachment; filename="f.txt" content-type text/javascript; charset=UTF-8 alt-svc quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 951 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H/1.1	200 OK	index.js Show response s.adroll.com/j/exp/QDCFINCFT5HK5FU45EXRDS/	37 B 689 B	32ms 32ms	Script application/javascript	2.18.233.40 Akamai Technologies
General Check archive.org Show headers Download Go to Full URL https://s.adroll.com/j/exp/QDCFINCFT5HK5FU45EXRDS/index.js Requested by Host: s.adroll.com URL: https://s.adroll.com/j/roundtrip.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2.18.233.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US), Reverse DNS a2-18-233-40.deploy.static.akamaitechnologies.com Software AmazonS3 / Resource Hash 6a8466d729c03a3f87ea7d1ea02379eae9ffc52171cd62b9428a39ca71675814 Request headers Sec-Fetch-Mode no-cors Referer https://logrhythm.com/blog/detecting-dns-tunneling/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers x-amz-version-id WfIxNyfu0rdBUAUfEtPPDWUEez.Nwrkb ETag "af5292134b7f9ce1b2a338c5daae4370" x-amz-request-id 4E51AD4693114B54 x-amz-server-side-encryption AES256 Connection keep-alive Content-Length 37 x-amz-id-2 ciahh9FqYa9aFFbJ19JPt/ys40GZnN8Pb3n446ljoARaPkVTi7qh0uFPJInX+j+hLb7WrECQZok= Last-Modified Mon, 30 Sep 2019 18:32:09 GMT Server AmazonS3 Date Mon, 14 Oct 2019 05:04:11 GMT Access-Control-Max-Age 600 Access-Control-Allow-Methods GET Content-Type application/javascript Access-Control-Allow-Origin * Access-Control-Allow-Credentials false Accept-Ranges bytes Access-Control-Allow-Headers *
GET H/1.1	200 OK	QDCFINCFT5HK5FU45EXRDS Show response d.adroll.com/consent/check/	52 B 511 B	132ms 32ms	Script application/javascript	54.75.248.80 Amazon.com
General Check archive.org Show headers Download Go to Full URL https://d.adroll.com/consent/check/QDCFINCFT5HK5FU45EXRDS?_s=10f4b071d9036ae8c7da0e2c42dfa72a&_b=2 Requested by Host: s.adroll.com URL: https://s.adroll.com/j/roundtrip.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 54.75.248.80 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US), Reverse DNS ec2-54-75-248-80.eu-west-1.compute.amazonaws.com Software nginx/1.14.1 / Resource Hash 78e8014068cb4da20c259ed16b0576ab430744d992d822b5b643ef6d0049dd05 Request headers Sec-Fetch-Mode no-cors Referer https://logrhythm.com/blog/detecting-dns-tunneling/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Pragma no-cache Date Mon, 14 Oct 2019 05:04:11 GMT Server nginx/1.14.1 P3P CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA" Cache-Control no-store, no-cache, must-revalidate Connection keep-alive Content-Type application/javascript Content-Length 52
GET H/1.1	200 OK	munchkin.js Show response munchkin.marketo.net/155/	9 KB 4 KB	26ms 26ms	Script application/x-javascript	104.111.251.133 Akamai Technologies
General Check archive.org Show headers Download Go to Full URL https://munchkin.marketo.net/155/munchkin.js Requested by Host: munchkin.marketo.net URL: https://munchkin.marketo.net/munchkin.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 104.111.251.133 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US), Reverse DNS a104-111-251-133.deploy.static.akamaitechnologies.com Software Apache / Resource Hash efb6b9732bf508ee305363b10cf2a67ace474e06eb42642f2c3696b2442a5775 Request headers Sec-Fetch-Mode no-cors Referer https://logrhythm.com/blog/detecting-dns-tunneling/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Mon, 14 Oct 2019 05:04:11 GMT Content-Encoding gzip Last-Modified Fri, 30 Nov 2018 03:18:20 GMT Server Apache ETag "c67dad42946949112916578f78706df8:1543547900" Vary Accept-Encoding P3P policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR" Cache-Control max-age=8640000 Connection keep-alive Accept-Ranges bytes Content-Type application/x-javascript Content-Length 3923 Expires Wed, 22 Jan 2020 05:04:11 GMT
GET H2	200	v1.7-11 Show response consent.trustarc.com/asset/notice.js/v/	55 KB 19 KB	124ms 58ms	Script text/javascript	13.224.196.99 Amazon.com
General Check archive.org Show headers Download Go to Full URL https://consent.trustarc.com/asset/notice.js/v/v1.7-11 Requested by Host: consent.truste.com URL: https://consent.truste.com/notice?domain=logrhythm.com&c=teconsent&js=bb&noticeType=bb Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 13.224.196.99 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US), Reverse DNS server-13-224-196-99.fra2.r.cloudfront.net Software nginx / Resource Hash a451f2564c4d093f17562cec045ad8d57dc5ff438a1b7f5831a958e69c962e58 Security Headers Name Value X-Frame-Options ALLOWALL Request headers Sec-Fetch-Mode cors Referer https://logrhythm.com/blog/detecting-dns-tunneling/ Origin https://logrhythm.com User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Mon, 14 Oct 2019 05:04:11 GMT content-encoding gzip vary Accept-Encoding x-amz-cf-pop FRA2-C1 x-cache Miss from cloudfront status 200 pragma public access-control-allow-origin * last-modified Thu, 5 Sep 2019 04:10:58 GMT server nginx x-frame-options ALLOWALL content-type text/javascript via 1.1 5076c8187f430eebe5e26fc594d6125a.cloudfront.net (CloudFront) cache-control max-age=2592000 x-amz-cf-id TVpGFx38SGWSQUEq0-__2BEHl2NJpLBIKPtUj6h2INRrbBIrVRH5kQ== expires Wed, 13 Nov 2019 05:04:11 GMT
GET H2	200	/ www.google.com/pagead/1p-user-list/1070386004/	42 B 119 B	20ms 20ms	Image image/gif	2a00:1450:4001:820::2004 Google LLC
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.com/pagead/1p-user-list/1070386004/?random=1571029451059&cv=9&fst=1571029200000&num=1&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2wga21&sendb=1&frm=0&url=https%3A%2F%2Flogrhythm.com%2Fblog%2Fdetecting-dns-tunneling%2F&tiba=Detecting%20DNS%20Tunneling%20%7C%20LogRhythm&async=1&fmt=3&is_vtc=1&random=2505723671&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y Requested by Host: logrhythm.com URL: https://logrhythm.com/blog/detecting-dns-tunneling/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:820::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value Content-Security-Policy script-src 'none'; object-src 'none' X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Sec-Fetch-Mode no-cors Referer https://logrhythm.com/blog/detecting-dns-tunneling/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers pragma no-cache date Mon, 14 Oct 2019 05:04:11 GMT x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" status 200 cache-control no-cache, no-store, must-revalidate content-security-policy script-src 'none'; object-src 'none' content-type image/gif alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	/ www.google.de/pagead/1p-user-list/1070386004/	42 B 110 B	21ms 21ms	Image image/gif	2a00:1450:4001:800::2003 Google LLC
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.de/pagead/1p-user-list/1070386004/?random=1571029451059&cv=9&fst=1571029200000&num=1&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2wga21&sendb=1&frm=0&url=https%3A%2F%2Flogrhythm.com%2Fblog%2Fdetecting-dns-tunneling%2F&tiba=Detecting%20DNS%20Tunneling%20%7C%20LogRhythm&async=1&fmt=3&is_vtc=1&random=2505723671&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y Requested by Host: logrhythm.com URL: https://logrhythm.com/blog/detecting-dns-tunneling/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:800::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value Content-Security-Policy script-src 'none'; object-src 'none' X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Sec-Fetch-Mode no-cors Referer https://logrhythm.com/blog/detecting-dns-tunneling/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers pragma no-cache date Mon, 14 Oct 2019 05:04:11 GMT x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" status 200 cache-control no-cache, no-store, must-revalidate content-security-policy script-src 'none'; object-src 'none' content-type image/gif alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	/ www.google.com/pagead/1p-user-list/903108792/	42 B 119 B	19ms 19ms	Image image/gif	2a00:1450:4001:820::2004 Google LLC
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.com/pagead/1p-user-list/903108792/?random=1571029451061&cv=9&fst=1571029200000&num=1&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2wga21&sendb=1&frm=0&url=https%3A%2F%2Flogrhythm.com%2Fblog%2Fdetecting-dns-tunneling%2F&tiba=Detecting%20DNS%20Tunneling%20%7C%20LogRhythm&async=1&fmt=3&is_vtc=1&random=1991673104&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y Requested by Host: logrhythm.com URL: https://logrhythm.com/blog/detecting-dns-tunneling/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:820::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value Content-Security-Policy script-src 'none'; object-src 'none' X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Sec-Fetch-Mode no-cors Referer https://logrhythm.com/blog/detecting-dns-tunneling/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers pragma no-cache date Mon, 14 Oct 2019 05:04:11 GMT x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" status 200 cache-control no-cache, no-store, must-revalidate content-security-policy script-src 'none'; object-src 'none' content-type image/gif alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	/ www.google.de/pagead/1p-user-list/903108792/	42 B 110 B	22ms 21ms	Image image/gif	2a00:1450:4001:800::2003 Google LLC
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.de/pagead/1p-user-list/903108792/?random=1571029451061&cv=9&fst=1571029200000&num=1&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2wga21&sendb=1&frm=0&url=https%3A%2F%2Flogrhythm.com%2Fblog%2Fdetecting-dns-tunneling%2F&tiba=Detecting%20DNS%20Tunneling%20%7C%20LogRhythm&async=1&fmt=3&is_vtc=1&random=1991673104&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y Requested by Host: logrhythm.com URL: https://logrhythm.com/blog/detecting-dns-tunneling/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:800::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value Content-Security-Policy script-src 'none'; object-src 'none' X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Sec-Fetch-Mode no-cors Referer https://logrhythm.com/blog/detecting-dns-tunneling/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers pragma no-cache date Mon, 14 Oct 2019 05:04:11 GMT x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" status 200 cache-control no-cache, no-store, must-revalidate content-security-policy script-src 'none'; object-src 'none' content-type image/gif alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	/ www.google.com/pagead/1p-user-list/952414179/	42 B 119 B	20ms 20ms	Image image/gif	2a00:1450:4001:820::2004 Google LLC
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.com/pagead/1p-user-list/952414179/?random=1571029451062&cv=9&fst=1571029200000&num=1&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2wga21&sendb=1&frm=0&url=https%3A%2F%2Flogrhythm.com%2Fblog%2Fdetecting-dns-tunneling%2F&tiba=Detecting%20DNS%20Tunneling%20%7C%20LogRhythm&async=1&fmt=3&is_vtc=1&random=1299973009&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y Requested by Host: logrhythm.com URL: https://logrhythm.com/blog/detecting-dns-tunneling/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:820::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value Content-Security-Policy script-src 'none'; object-src 'none' X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Sec-Fetch-Mode no-cors Referer https://logrhythm.com/blog/detecting-dns-tunneling/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers pragma no-cache date Mon, 14 Oct 2019 05:04:11 GMT x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" status 200 cache-control no-cache, no-store, must-revalidate content-security-policy script-src 'none'; object-src 'none' content-type image/gif alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	/ www.google.de/pagead/1p-user-list/952414179/	42 B 110 B	23ms 23ms	Image image/gif	2a00:1450:4001:800::2003 Google LLC
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.de/pagead/1p-user-list/952414179/?random=1571029451062&cv=9&fst=1571029200000&num=1&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2wga21&sendb=1&frm=0&url=https%3A%2F%2Flogrhythm.com%2Fblog%2Fdetecting-dns-tunneling%2F&tiba=Detecting%20DNS%20Tunneling%20%7C%20LogRhythm&async=1&fmt=3&is_vtc=1&random=1299973009&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y Requested by Host: logrhythm.com URL: https://logrhythm.com/blog/detecting-dns-tunneling/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:800::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value Content-Security-Policy script-src 'none'; object-src 'none' X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Sec-Fetch-Mode no-cors Referer https://logrhythm.com/blog/detecting-dns-tunneling/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers pragma no-cache date Mon, 14 Oct 2019 05:04:11 GMT x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" status 200 cache-control no-cache, no-store, must-revalidate content-security-policy script-src 'none'; object-src 'none' content-type image/gif alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	/ www.facebook.com/tr/	44 B 321 B	17ms 6ms	Image image/gif	2a03:2880:f11c:8083:face:b00c:0:25de Facebook
General Check archive.org Show headers Download Go to Show image Full URL https://www.facebook.com/tr/?id=232919347190734&ev=PageView&dl=https%3A%2F%2Flogrhythm.com%2Fblog%2Fdetecting-dns-tunneling%2F&rl=&if=false&ts=1571029451115&sw=1600&sh=1200&v=2.9.5&r=stable&ec=0&o=30&fbp=fb.1.1571029451114.1634147949&it=1571029451035&coo=false&exp=w1&rqm=GET Requested by Host: logrhythm.com URL: https://logrhythm.com/blog/detecting-dns-tunneling/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f11c:8083:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US), Reverse DNS Software proxygen-bolt / Resource Hash 10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Sec-Fetch-Mode no-cors Referer https://logrhythm.com/blog/detecting-dns-tunneling/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Mon, 14 Oct 2019 05:04:11 GMT last-modified Fri, 21 Dec 2012 00:00:01 GMT server proxygen-bolt strict-transport-security max-age=31536000; includeSubDomains content-type image/gif status 200 cache-control no-cache, must-revalidate, max-age=0 content-length 44 expires Mon, 14 Oct 2019 05:04:11 GMT
GET H/1.1	200 OK	visitWebPage Show response 050-uwt-888.mktoresp.com/webevents/	2 B 303 B	539ms 99ms	XHR text/plain	192.28.144.124 Adobe Systems Inc.
General Check archive.org Show headers Download Go to Full URL https://050-uwt-888.mktoresp.com/webevents/visitWebPage?_mchNc=1571029451125&_mchCn=&_mchId=050-UWT-888&_mchTk=_mch-logrhythm.com-1571029451124-22571&_mchHo=logrhythm.com&_mchPo=&_mchRu=%2Fblog%2Fdetecting-dns-tunneling%2F&_mchPc=https%3A&_mchVr=155&_mchHa=&_mchRe=&_mchQp= Requested by Host: munchkin.marketo.net URL: https://munchkin.marketo.net/155/munchkin.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 192.28.144.124 , United States, ASN15224 (OMNITURE - Adobe Systems Inc., US), Reverse DNS Software akka-http/10.1.7 / Resource Hash 565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3 Request headers Sec-Fetch-Mode cors Referer https://logrhythm.com/blog/detecting-dns-tunneling/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Access-Control-Allow-Origin * Date Mon, 14 Oct 2019 05:04:11 GMT Content-Encoding gzip Server akka-http/10.1.7 Transfer-Encoding chunked X-Request-Id 9ce1c81b-fd40-4bf7-bede-1e3a70960329 Content-Type text/plain; charset=UTF-8
GET H/1.1	200 OK	Capture.aspx Show response secure.leadforensics.com/Track/	0 92 B	99ms 98ms	Script text/plain	51.140.49.131 Microsoft Corpora...
General Check archive.org Show headers Download Go to Full URL https://secure.leadforensics.com/Track/Capture.aspx?retType=js&trk_uid=&trk_user=163889&trk_sw=1600&trk_sh=1200&trk_ref=&trk_tit=Detecting%20DNS%20Tunneling%20%7C%20LogRhythm&trk_loc=https%3A%2F%2Flogrhythm.com%2Fblog%2Fdetecting-dns-tunneling%2F&trk_agn=Netscape&trk_agv=Mozilla%2F5.0%20(Macintosh%3B%20Intel%20Mac%20OS%20X%2010_14_5)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F74.0.3729.169%20Safari%2F537.36.lfcd24.lflngen-US&trk_dom=logrhythm.com&trk_cookie=NA Requested by Host: secure.leadforensics.com URL: https://secure.leadforensics.com/js/163889.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 51.140.49.131 London, United Kingdom, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US), Reverse DNS Software Kestrel / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Sec-Fetch-Mode no-cors Referer https://logrhythm.com/blog/detecting-dns-tunneling/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Mon, 14 Oct 2019 05:04:10 GMT Content-Length 0 Server Kestrel
GET H/1.1	200 OK	JKDRBTEKQ5DYLPBQZ7OUBG.js Show response s.adroll.com/pixel/QDCFINCFT5HK5FU45EXRDS/RG6IRLN6UZHIPJAJPJJ7E2/ Redirect Chain https://d.adroll.com/pixel/QDCFINCFT5HK5FU45EXRDS/RG6IRLN6UZHIPJAJPJJ7E2?adroll_fpc=b89517a11da139a0e00064165659899d-1571029451235&xid_ch=f&pv=9780451998.867678&cookie=&adroll_s_ref=&keyw=&arrfrr=h... https://s.adroll.com/pixel/QDCFINCFT5HK5FU45EXRDS/RG6IRLN6UZHIPJAJPJJ7E2/JKDRBTEKQ5DYLPBQZ7OUBG.js	6 KB 3 KB	32ms 32ms	Script text/javascript	2.18.233.40 Akamai Technologies
General Check archive.org Show headers Download Go to Full URL https://s.adroll.com/pixel/QDCFINCFT5HK5FU45EXRDS/RG6IRLN6UZHIPJAJPJJ7E2/JKDRBTEKQ5DYLPBQZ7OUBG.js Requested by Host: logrhythm.com URL: https://logrhythm.com/blog/detecting-dns-tunneling/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2.18.233.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US), Reverse DNS a2-18-233-40.deploy.static.akamaitechnologies.com Software AmazonS3 / Resource Hash 9382440acc4b3de2503b5b04c728d47db4b26e2a8405d72391678ec5ac223fb2 Request headers Referer https://logrhythm.com/blog/detecting-dns-tunneling/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers x-amz-version-id gfb7_P2NN7MNKvUMKcy0upFNRhrsXlKI Content-Encoding gzip ETag "b2c777af626db6069711bf3b752e87d8" x-amz-request-id C5755CAB701780B8 x-amz-server-side-encryption AES256 Connection keep-alive Vary Accept-Encoding Content-Length 1972 x-amz-id-2 J3nS9q5zjIB7siKlm36Dz4UOoXc93/8Q+T1azOumEslveW0tLocD4MR7sQawdkX5YBk8x4D8Ivs= Last-Modified Thu, 10 Oct 2019 20:51:42 GMT Server AmazonS3 Date Mon, 14 Oct 2019 05:04:11 GMT Access-Control-Max-Age 600 Access-Control-Allow-Methods GET Content-Type text/javascript; charset=utf-8 Access-Control-Allow-Origin * Cache-Control max-age=3600, must-revalidate Access-Control-Allow-Credentials false Accept-Ranges bytes Access-Control-Allow-Headers * Redirect headers Date Mon, 14 Oct 2019 05:04:11 GMT X-Segment-Display-Name P3P CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA" Connection keep-alive Content-Length 0 Pragma no-cache X-Conversion-Value 0.0 Server nginx/1.14.1 X-Rule * X-Segment-Eid JKDRBTEKQ5DYLPBQZ7OUBG Location https://s.adroll.com/pixel/QDCFINCFT5HK5FU45EXRDS/RG6IRLN6UZHIPJAJPJJ7E2/JKDRBTEKQ5DYLPBQZ7OUBG.js Cache-Control no-store, no-cache, must-revalidate X-Pixel-Eid RG6IRLN6UZHIPJAJPJJ7E2 X-Segment-Name * X-Advertisable-Eid QDCFINCFT5HK5FU45EXRDS X-Conversion-Currency
GET H2	200	/ consent-pref.trustarc.com/ Frame 10F7	0 0	118ms 52ms	Document text/html	13.224.196.113 Amazon.com
General Check archive.org Show headers Download Go to Full URL https://consent-pref.trustarc.com/?type=logrhythm&site=logrhythm.com&action=notice&country=nl&locale=en&behavior=expressed&layout=default_eu&from=https://consent.trustarc.com/ Requested by Host: consent.trustarc.com URL: https://consent.trustarc.com/asset/notice.js/v/v1.7-11 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 13.224.196.113 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US), Reverse DNS server-13-224-196-113.fra2.r.cloudfront.net Software nginx / Resource Hash Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers :method GET :authority consent-pref.trustarc.com :scheme https :path /?type=logrhythm&site=logrhythm.com&action=notice&country=nl&locale=en&behavior=expressed&layout=default_eu&from=https://consent.trustarc.com/ pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 sec-fetch-mode nested-navigate accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3 sec-fetch-site cross-site referer https://logrhythm.com/blog/detecting-dns-tunneling/ accept-encoding gzip, deflate, br Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Mode nested-navigate Referer https://logrhythm.com/blog/detecting-dns-tunneling/ Response headers status 200 content-type text/html; charset=UTF-8 date Thu, 10 Oct 2019 22:14:46 GMT server nginx etag W/"5700-1566948362000" last-modified Tue, 27 Aug 2019 23:26:02 GMT x-xss-protection 1; mode=block x-content-type-options nosniff content-encoding gzip vary Accept-Encoding x-cache Hit from cloudfront via 1.1 24c299c0a6423c6f96984a85fb014109.cloudfront.net (CloudFront) x-amz-cf-pop FRA2-C1 x-amz-cf-id 0jOEgZH458DtpagHTKi4vyoFqTBDIfOb1rD8x9DW9gP-ygT6rw-PZA==
GET H2	200	get consent.trustarc.com/	2 KB 2 KB	110ms 54ms	Image image/png	13.224.196.99 Amazon.com
General Check archive.org Show headers Download Go to Show image Full URL https://consent.trustarc.com/get?name=trustarc_cookiepreferences.png Requested by Host: logrhythm.com URL: https://logrhythm.com/blog/detecting-dns-tunneling/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 13.224.196.99 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US), Reverse DNS server-13-224-196-99.fra2.r.cloudfront.net Software nginx / Resource Hash 4b0e644f809d6096b56f9e2c923959b6851fa72a59e5eeddfd2534e8ec38a114 Security Headers Name Value X-Frame-Options ALLOWALL Request headers Sec-Fetch-Mode no-cors Referer https://logrhythm.com/blog/detecting-dns-tunneling/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers pragma public date Mon, 14 Oct 2019 05:04:11 GMT via 1.1 42b60ee17f7593fff72ca1cb725d6c9a.cloudfront.net (CloudFront) server nginx x-amz-cf-pop FRA2-C1 status 200 x-frame-options ALLOWALL x-cache Miss from cloudfront content-type image/png access-control-allow-origin * cache-control max-age=2592000 content-length 2016 x-amz-cf-id qH6wfC-qHdMg6Zo8vZjSIGhSyQJ-V_I8kvwWjGkRaerKcVjnIdxGzw== expires Wed, 13 Nov 2019 05:04:11 GMT
GET H2	200	get consent.trustarc.com/	95 B 437 B	115ms 59ms	Image image/png	13.224.196.99 Amazon.com
General Check archive.org Show headers Download Go to Show image Full URL https://consent.trustarc.com/get?name=transparent.png Requested by Host: logrhythm.com URL: https://logrhythm.com/blog/detecting-dns-tunneling/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 13.224.196.99 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US), Reverse DNS server-13-224-196-99.fra2.r.cloudfront.net Software nginx / Resource Hash d1f997e9d36cab74d9b7c82335b21734e1c74b284d17a8b3df2aa3f4661d2f6c Security Headers Name Value X-Frame-Options ALLOWALL Request headers Sec-Fetch-Mode no-cors Referer https://logrhythm.com/blog/detecting-dns-tunneling/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers pragma public date Mon, 14 Oct 2019 05:04:11 GMT via 1.1 42b60ee17f7593fff72ca1cb725d6c9a.cloudfront.net (CloudFront) server nginx x-amz-cf-pop FRA2-C1 status 200 x-frame-options ALLOWALL x-cache Miss from cloudfront content-type image/png access-control-allow-origin * cache-control max-age=2592000 content-length 95 x-amz-cf-id bLldVQe6QxEbndNlP3JsANQ2uS65tmLwNAiI1RlsZwSmbMLV62fjAg== expires Wed, 13 Nov 2019 05:04:11 GMT
GET H2	200	noticemsg consent.trustarc.com/	43 B 432 B	112ms 56ms	Image image/gif	13.224.196.99 Amazon.com
General Check archive.org Show headers Download Go to Show image Full URL https://consent.trustarc.com/noticemsg?action=consent&domain=logrhythm.com&behavior=expressed&country=nl&language=en&rand=0.5730563408362446 Requested by Host: logrhythm.com URL: https://logrhythm.com/blog/detecting-dns-tunneling/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 13.224.196.99 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US), Reverse DNS server-13-224-196-99.fra2.r.cloudfront.net Software nginx / Resource Hash 98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a Security Headers Name Value X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Sec-Fetch-Mode no-cors Referer https://logrhythm.com/blog/detecting-dns-tunneling/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Mon, 14 Oct 2019 05:04:11 GMT via 1.1 42b60ee17f7593fff72ca1cb725d6c9a.cloudfront.net (CloudFront) x-content-type-options nosniff x-amz-cf-pop FRA2-C1 x-cache Miss from cloudfront status 200 content-length 43 x-xss-protection 1; mode=block pragma no-cache server nginx x-frame-options SAMEORIGIN content-type image/gif access-control-allow-origin * cache-control no-cache x-amz-cf-id ij2__eNpcwy5Tvl8srPYLmpjCQLwdDrOuONyC2AkOdzChC_z1aCXlg== expires Mon, 14 Oct 2019 05:04:10 GMT
GET H2	200	get consent.trustarc.com/	923 B 1 KB	113ms 58ms	Image image/png	13.224.196.99 Amazon.com
General Check archive.org Show headers Download Go to Show image Full URL https://consent.trustarc.com/get?name=trans.png Requested by Host: logrhythm.com URL: https://logrhythm.com/blog/detecting-dns-tunneling/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 13.224.196.99 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US), Reverse DNS server-13-224-196-99.fra2.r.cloudfront.net Software nginx / Resource Hash 2606b91cca1f76efe9c503aaef5b7956ef6415a9403b8bbc0f5eb857d515bb05 Security Headers Name Value X-Frame-Options ALLOWALL Request headers Sec-Fetch-Mode no-cors Referer https://logrhythm.com/blog/detecting-dns-tunneling/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers pragma public date Mon, 14 Oct 2019 05:04:11 GMT via 1.1 42b60ee17f7593fff72ca1cb725d6c9a.cloudfront.net (CloudFront) server nginx x-amz-cf-pop FRA2-C1 status 200 x-frame-options ALLOWALL x-cache Miss from cloudfront content-type image/png access-control-allow-origin * cache-control max-age=2592000 content-length 923 x-amz-cf-id QFw2KrPYq6LKutScbYOTqCqtDeOoDXGzBC37pOdFDcmx94iRWvM4Fw== expires Wed, 13 Nov 2019 05:04:11 GMT
GET H2	200	lounge.953a2bd009935f47a8e815c3ee2bfc5a.css c.disquscdn.com/next/embed/styles/	0 21 KB	67ms 33ms	Other text/css	2606:4700::6810:4da6 Cloudflare
General Check archive.org Show headers Download Go to Full URL https://c.disquscdn.com/next/embed/styles/lounge.953a2bd009935f47a8e815c3ee2bfc5a.css Requested by Host: logrhythm.disqus.com URL: https://logrhythm.disqus.com/embed.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:4da6 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Strict-Transport-Security max-age=300; includeSubdomains X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Sec-Fetch-Mode no-cors Referer https://logrhythm.com/blog/detecting-dns-tunneling/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Mon, 14 Oct 2019 05:04:11 GMT content-encoding gzip x-content-type-options nosniff cf-cache-status HIT age 1050681 status 200 strict-transport-security max-age=300; includeSubdomains content-length 21493 x-xss-protection 1; mode=block timing-allow-origin * last-modified Wed, 02 Oct 2019 01:07:45 GMT server cloudflare etag "5d93f861-53f5" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type text/css; charset=utf-8 access-control-allow-origin * cache-control max-age=31536000, public, immutable, no-transform accept-ranges bytes cf-ray 525702d6e923cbb4-VIE expires Thu, 01 Oct 2020 01:12:47 GMT
GET H2	200	common.bundle.f91bb4d435d2d5726fa104d427b9c213.js c.disquscdn.com/next/embed/	0 89 KB	66ms 32ms	Other application/javascript	2606:4700::6810:4da6 Cloudflare
General Check archive.org Show headers Download Go to Full URL https://c.disquscdn.com/next/embed/common.bundle.f91bb4d435d2d5726fa104d427b9c213.js Requested by Host: logrhythm.disqus.com URL: https://logrhythm.disqus.com/embed.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:4da6 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Strict-Transport-Security max-age=300; includeSubdomains X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Sec-Fetch-Mode no-cors Referer https://logrhythm.com/blog/detecting-dns-tunneling/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Mon, 14 Oct 2019 05:04:11 GMT content-encoding gzip x-content-type-options nosniff cf-cache-status HIT age 1506687 status 200 strict-transport-security max-age=300; includeSubdomains content-length 90400 x-xss-protection 1; mode=block timing-allow-origin * last-modified Thu, 26 Sep 2019 00:29:39 GMT server cloudflare etag "5d8c0673-16120" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=31536000, public, immutable, no-transform accept-ranges bytes cf-ray 525702d6e925cbb4-VIE expires Fri, 25 Sep 2020 16:20:27 GMT
GET H2	200	lounge.bundle.c67073fc01a67474229c3c09e16d9c77.js c.disquscdn.com/next/embed/	0 107 KB	52ms 19ms	Other application/javascript	2606:4700::6810:4da6 Cloudflare
General Check archive.org Show headers Download Go to Full URL https://c.disquscdn.com/next/embed/lounge.bundle.c67073fc01a67474229c3c09e16d9c77.js Requested by Host: logrhythm.disqus.com URL: https://logrhythm.disqus.com/embed.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:4da6 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Strict-Transport-Security max-age=300; includeSubdomains X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Sec-Fetch-Mode no-cors Referer https://logrhythm.com/blog/detecting-dns-tunneling/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Mon, 14 Oct 2019 05:04:11 GMT content-encoding gzip x-content-type-options nosniff cf-cache-status HIT age 453350 status 200 strict-transport-security max-age=300; includeSubdomains content-length 109203 x-xss-protection 1; mode=block timing-allow-origin * last-modified Tue, 08 Oct 2019 21:35:39 GMT server cloudflare etag "5d9d012b-1aa93" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=31536000, public, immutable, no-transform accept-ranges bytes cf-ray 525702d6e927cbb4-VIE expires Wed, 07 Oct 2020 23:08:18 GMT
GET H/1.1	200 OK	config.js disqus.com/next/	0 3 KB	50ms 16ms	Other application/javascript	151.101.64.134 Fastly
General Check archive.org Show headers Download Go to Full URL https://disqus.com/next/config.js Requested by Host: logrhythm.disqus.com URL: https://logrhythm.disqus.com/embed.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.64.134 , United States, ASN54113 (FASTLY - Fastly, US), Reverse DNS Software nginx / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Strict-Transport-Security max-age=300; includeSubdomains X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Sec-Fetch-Mode no-cors Referer https://logrhythm.com/blog/detecting-dns-tunneling/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Mon, 14 Oct 2019 05:04:11 GMT Content-Encoding gzip X-Content-Type-Options nosniff Age 17 p3p CP="DSP IDC CUR ADM DELi STP NAV COM UNI INT PHY DEM" Connection keep-alive Vary Accept-Encoding Content-Length 2209 X-XSS-Protection 1; mode=block Server nginx X-Frame-Options SAMEORIGIN Strict-Transport-Security max-age=300; includeSubdomains Content-Type application/javascript; charset=UTF-8 Access-Control-Allow-Origin * Cache-Control public, stale-while-revalidate=300, s-stalewhilerevalidate=3600, max-age=60 Timing-Allow-Origin *
GET H/1.1	200 OK	sendrolling.js Show response s.adroll.com/j/	9 KB 3 KB	28ms 27ms	Script text/javascript	2.18.233.40 Akamai Technologies
General Check archive.org Show headers Download Go to Full URL https://s.adroll.com/j/sendrolling.js Requested by Host: s.adroll.com URL: https://s.adroll.com/pixel/QDCFINCFT5HK5FU45EXRDS/RG6IRLN6UZHIPJAJPJJ7E2/JKDRBTEKQ5DYLPBQZ7OUBG.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2.18.233.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US), Reverse DNS a2-18-233-40.deploy.static.akamaitechnologies.com Software AmazonS3 / Resource Hash 1bdbcee5cd776cb671f72362db4be8dde833057b8e8f816c86fd301896652c8d Request headers Sec-Fetch-Mode no-cors Referer https://logrhythm.com/blog/detecting-dns-tunneling/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers x-amz-version-id MoLWhO2.QuEN6uxWTtfGTs9VNo6GBT4q Content-Encoding gzip ETag "15441b08d0c4f93b1dd5f533cd361cd8" x-amz-request-id 8D66B12AEC1FE16F x-amz-server-side-encryption AES256 Connection keep-alive Vary Accept-Encoding Content-Length 2039 x-amz-id-2 U03k8W+834KnzjHY1HWwJBpUJGIUw1OrdeDx2NV4ro8fdV068lw0rs7u1JTVs0/hT895iGPnM+w= Last-Modified Thu, 10 Oct 2019 01:46:34 GMT Server AmazonS3 Date Mon, 14 Oct 2019 05:04:11 GMT Access-Control-Max-Age 600 Access-Control-Allow-Methods GET Content-Type text/javascript Access-Control-Allow-Origin * Cache-Control max-age=3600 Access-Control-Allow-Credentials false Accept-Ranges bytes Access-Control-Allow-Headers *
GET H2	200	836361346565242 Show response connect.facebook.net/signals/config/	280 KB 65 KB	72ms 72ms	Script application/x-javascript	2a03:2880:f01c:8012:face:b00c:0:3 Facebook
General Check archive.org Show headers Download Go to Full URL https://connect.facebook.net/signals/config/836361346565242?v=2.9.5&r=stable Requested by Host: connect.facebook.net URL: https://connect.facebook.net/en_US/fbevents.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f01c:8012:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US), Reverse DNS Software / Resource Hash e528bd595dc9790c04f3f7200b61b3816a7f1110d75410de4b0e14c1b27ab2d3 Security Headers Name Value Content-Security-Policy default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm; Strict-Transport-Security max-age=31536000; preload; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 0 Request headers Sec-Fetch-Mode no-cors Referer https://logrhythm.com/blog/detecting-dns-tunneling/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers x-fb-trip-id 1850256238 pragma public x-fb-debug DT0U0zCujoVRjTVWavVvGFxO8l6+j0dW/2+Gua6CmjFSrWJnIG9Bge7nyK4b8C6VTpzELSYU9UCwAnI37ErL1A== content-encoding gzip x-content-type-options nosniff x-frame-options DENY date Mon, 14 Oct 2019 05:04:11 GMT strict-transport-security max-age=31536000; preload; includeSubDomains content-type application/x-javascript; charset=utf-8 status 200 cache-control public, max-age=1200 content-security-policy default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm; vary Accept-Encoding x-xss-protection 0 expires Sat, 01 Jan 2000 00:00:00 GMT
GET H2	204	sync ups.analytics.yahoo.com/ups/55980/ Redirect Chain https://d.adroll.com/cm/aol/out?adroll_fpc=b89517a11da139a0e00064165659899d-1571029451235&xid_ch=f&advertisable=QDCFINCFT5HK5FU45EXRDS https://pixel.advertising.com/ups/55980/sync?uid=MjBkZjg3ZDQxNjYxYjk5YjE1OTE4YmZiZTYzNDY1NGQ&_origin=1&gdpr=1&gdpr_consent=BOOla_OOOla_OA2ABBENAkwAAAAXyACAAyAIIA https://pixel.advertising.com/ups/55980/sync?uid=MjBkZjg3ZDQxNjYxYjk5YjE1OTE4YmZiZTYzNDY1NGQ&_origin=1&gdpr=1&gdpr_consent=BOOla_OOOla_OA2ABBENAkwAAAAXyACAAyAIIA&verify=true https://ups.analytics.yahoo.com/ups/55980/sync?uid=MjBkZjg3ZDQxNjYxYjk5YjE1OTE4YmZiZTYzNDY1NGQ&_origin=1&gdpr=1&gdpr_consent=BOOla_OOOla_OA2ABBENAkwAAAAXyACAAyAIIA&apid=UP0f57f173-ee40-11e9-9e12-02... https://ups.analytics.yahoo.com/ups/55980/sync?uid=MjBkZjg3ZDQxNjYxYjk5YjE1OTE4YmZiZTYzNDY1NGQ&_origin=1&gdpr=1&gdpr_consent=BOOla_OOOla_OA2ABBENAkwAAAAXyACAAyAIIA&apid=UP0f57f173-ee40-11e9-9e12-02...	0 472 B	34ms 34ms	Image text/plain	35.157.201.139 Amazon.com
General Check archive.org Show headers Download Go to Show image Full URL https://ups.analytics.yahoo.com/ups/55980/sync?uid=MjBkZjg3ZDQxNjYxYjk5YjE1OTE4YmZiZTYzNDY1NGQ&_origin=1&gdpr=1&gdpr_consent=BOOla_OOOla_OA2ABBENAkwAAAAXyACAAyAIIA&apid=UP0f57f173-ee40-11e9-9e12-0262cd3e8f28&verify=true Requested by Host: logrhythm.com URL: https://logrhythm.com/blog/detecting-dns-tunneling/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 35.157.201.139 Frankfurt am Main, Germany, ASN16509 (AMAZON-02 - Amazon.com, Inc., US), Reverse DNS ec2-35-157-201-139.eu-central-1.compute.amazonaws.com Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://logrhythm.com/blog/detecting-dns-tunneling/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers status 204 date Mon, 14 Oct 2019 05:04:11 GMT p3p CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV Redirect headers status 302 date Mon, 14 Oct 2019 05:04:11 GMT content-length 0 location https://ups.analytics.yahoo.com/ups/55980/sync?uid=MjBkZjg3ZDQxNjYxYjk5YjE1OTE4YmZiZTYzNDY1NGQ&_origin=1&gdpr=1&gdpr_consent=BOOla_OOOla_OA2ABBENAkwAAAAXyACAAyAIIA&apid=UP0f57f173-ee40-11e9-9e12-0262cd3e8f28&verify=true p3p CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
GET H/1.1	200 OK	rum dsum-sec.casalemedia.com/ Redirect Chain https://d.adroll.com/cm/index/out?adroll_fpc=b89517a11da139a0e00064165659899d-1571029451235&xid_ch=f&advertisable=QDCFINCFT5HK5FU45EXRDS https://dsum-sec.casalemedia.com/rum?cm_dsp_id=105&external_user_id=MjBkZjg3ZDQxNjYxYjk5YjE1OTE4YmZiZTYzNDY1NGQ&expiration=1602565451 https://dsum-sec.casalemedia.com/rum?cm_dsp_id=105&external_user_id=MjBkZjg3ZDQxNjYxYjk5YjE1OTE4YmZiZTYzNDY1NGQ&expiration=1602565451&C=1	43 B 898 B	32ms 32ms	Image image/gif	2.18.234.21 Akamai Technologies
General Check archive.org Show headers Download Go to Show image Full URL https://dsum-sec.casalemedia.com/rum?cm_dsp_id=105&external_user_id=MjBkZjg3ZDQxNjYxYjk5YjE1OTE4YmZiZTYzNDY1NGQ&expiration=1602565451&C=1 Requested by Host: logrhythm.com URL: https://logrhythm.com/blog/detecting-dns-tunneling/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2.18.234.21 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US), Reverse DNS a2-18-234-21.deploy.static.akamaitechnologies.com Software Apache / Resource Hash b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b Request headers Referer https://logrhythm.com/blog/detecting-dns-tunneling/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Pragma no-cache Date Mon, 14 Oct 2019 05:04:11 GMT Server Apache P3P policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI" Cache-Control max-age=0, no-cache, no-store Connection keep-alive Content-Type image/gif Content-Length 43 Expires Mon, 14 Oct 2019 05:04:11 GMT Redirect headers Pragma no-cache Date Mon, 14 Oct 2019 05:04:11 GMT Server Apache P3P policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI" Location https://dsum-sec.casalemedia.com/rum?cm_dsp_id=105&external_user_id=MjBkZjg3ZDQxNjYxYjk5YjE1OTE4YmZiZTYzNDY1NGQ&expiration=1602565451&C=1 Cache-Control max-age=0, no-cache, no-store Connection keep-alive Content-Type text/html; charset=iso-8859-1 Content-Length 333 Expires Mon, 14 Oct 2019 05:04:11 GMT
GET H/1.1	204 No Content	tap.php pixel.rubiconproject.com/ Redirect Chain https://d.adroll.com/cm/n/out?adroll_fpc=b89517a11da139a0e00064165659899d-1571029451235&xid_ch=f&advertisable=QDCFINCFT5HK5FU45EXRDS https://pixel.rubiconproject.com/tap.php?v=194538&nid=3644&put=MjBkZjg3ZDQxNjYxYjk5YjE1OTE4YmZiZTYzNDY1NGQ&expires=365	0 239 B	99ms 26ms	Image image/gif	69.173.144.136 The Rubicon Project
General Check archive.org Show headers Download Go to Show image Full URL https://pixel.rubiconproject.com/tap.php?v=194538&nid=3644&put=MjBkZjg3ZDQxNjYxYjk5YjE1OTE4YmZiZTYzNDY1NGQ&expires=365 Requested by Host: logrhythm.com URL: https://logrhythm.com/blog/detecting-dns-tunneling/ Protocol HTTP/1.1 Security TLS 1.2, RSA, AES_256_GCM Server 69.173.144.136 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT - The Rubicon Project, Inc., US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://logrhythm.com/blog/detecting-dns-tunneling/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Pragma no-cache Expires 0 Cache-Control no-cache,no-store,must-revalidate P3P CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT" X-RPHost a66cbf3142c6ef39e3614b84a34262cf Content-Type image/gif Redirect headers Pragma no-cache Date Mon, 14 Oct 2019 05:04:11 GMT Server nginx/1.14.1 P3P CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA" Location https://pixel.rubiconproject.com/tap.php?v=194538&nid=3644&put=MjBkZjg3ZDQxNjYxYjk5YjE1OTE4YmZiZTYzNDY1NGQ&expires=365 Cache-Control no-store, no-cache, must-revalidate Connection keep-alive Content-Length 124
GET H2	200	cookie-sync sync.outbrain.com/ Redirect Chain https://d.adroll.com/cm/outbrain/out?adroll_fpc=b89517a11da139a0e00064165659899d-1571029451235&xid_ch=f&advertisable=QDCFINCFT5HK5FU45EXRDS https://sync.outbrain.com/cookie-sync?p=adroll&uid=MjBkZjg3ZDQxNjYxYjk5YjE1OTE4YmZiZTYzNDY1NGQ https://sync.outbrain.com/cookie-sync?p=adroll&uid=MjBkZjg3ZDQxNjYxYjk5YjE1OTE4YmZiZTYzNDY1NGQ&rdrctExp=true	0 359 B	148ms 134ms	Image text/plain	151.101.14.2 Fastly
General Check archive.org Show headers Download Go to Show image Full URL https://sync.outbrain.com/cookie-sync?p=adroll&uid=MjBkZjg3ZDQxNjYxYjk5YjE1OTE4YmZiZTYzNDY1NGQ&rdrctExp=true Requested by Host: logrhythm.com URL: https://logrhythm.com/blog/detecting-dns-tunneling/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.14.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://logrhythm.com/blog/detecting-dns-tunneling/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Mon, 14 Oct 2019 05:04:11 GMT via 1.1 varnish, 1.1 varnish traffic-path CHIDC2, MDW, FRA, Europe2 x-timer S1571029452.654953,VS0,VE113 accept-ranges bytes, bytes x-served-by cache-mdw17349-MDW, cache-fra19149-FRA x-cache MISS, MISS status 200 backend-ip 157.52.75.49 x-traceid 69808b59c1bdbff1f22c4fa0e22ff562 content-length 0 x-cache-hits 0, 0 Redirect headers date Mon, 14 Oct 2019 05:04:11 GMT via 1.1 varnish, 1.1 varnish traffic-path CHIDC2, MDW, FRA, Europe2 x-timer S1571029451.498916,VS0,VE109 accept-ranges bytes, bytes x-served-by cache-mdw17322-MDW, cache-fra19149-FRA status 302 x-cache MISS, MISS location https://sync.outbrain.com/cookie-sync?p=adroll&uid=MjBkZjg3ZDQxNjYxYjk5YjE1OTE4YmZiZTYzNDY1NGQ&rdrctExp=true backend-ip 157.52.75.22 x-traceid 82a40cd43cd54055e7520b22c53c924f content-length 0 x-cache-hits 0, 0
GET H/1.1	200 OK	Pug simage2.pubmatic.com/AdServer/ Redirect Chain https://d.adroll.com/cm/pubmatic/out?adroll_fpc=b89517a11da139a0e00064165659899d-1571029451235&xid_ch=f&advertisable=QDCFINCFT5HK5FU45EXRDS https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzMwNiZ0bD01MjU2MDA&piggybackCookie=MjBkZjg3ZDQxNjYxYjk5YjE1OTE4YmZiZTYzNDY1NGQ&gdpr=1&gdpr_consent=BOOoKswOOoKswA2ABBENA...	1 B 986 B	74ms 23ms	Image text/html	185.64.190.80 PubMatic
General Check archive.org Show headers Download Go to Show image Full URL https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzMwNiZ0bD01MjU2MDA&piggybackCookie=MjBkZjg3ZDQxNjYxYjk5YjE1OTE4YmZiZTYzNDY1NGQ&gdpr=1&gdpr_consent=BOOoKswOOoKswA2ABBENAkwAAAAXyACACYAIIA Requested by Host: logrhythm.com URL: https://logrhythm.com/blog/detecting-dns-tunneling/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 185.64.190.80 , United Kingdom, ASN62713 (AS-PUBMATIC - PubMatic, Inc., US), Reverse DNS Software Apache/2.2.24 (Unix) mod_ssl/2.2.24 OpenSSL/1.0.0-fips mod_fastcgi/2.4.6 / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://logrhythm.com/blog/detecting-dns-tunneling/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers X-Cnection close Pragma no-cache Date Mon, 14 Oct 2019 05:04:11 GMT X-lat Pug23020:0:249 Server Apache/2.2.24 (Unix) mod_ssl/2.2.24 OpenSSL/1.0.0-fips mod_fastcgi/2.4.6 P3P CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC" Cache-Control no-store, no-cache, private Content-Type text/html; charset=utf-8 Content-Length 1 Redirect headers Pragma no-cache Date Mon, 14 Oct 2019 05:04:11 GMT Server nginx/1.14.1 P3P CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA" Location https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzMwNiZ0bD01MjU2MDA&piggybackCookie=MjBkZjg3ZDQxNjYxYjk5YjE1OTE4YmZiZTYzNDY1NGQ&gdpr=1&gdpr_consent=BOOoKswOOoKswA2ABBENAkwAAAAXyACACYAIIA Cache-Control no-store, no-cache, must-revalidate Connection keep-alive Content-Length 220
GET H/1.1	200 OK	in d.adroll.com/cm/r/ Redirect Chain https://d.adroll.com/cm/r/out?adroll_fpc=b89517a11da139a0e00064165659899d-1571029451235&xid_ch=f&advertisable=QDCFINCFT5HK5FU45EXRDS https://ads.yahoo.com/cms/v1?esig=1~bf4e7dc4546a90c08591652d78a230d3f2ef5733&nwid=10001032567&sigv=1&gdpr=1&gdpr_consent=BOOla_OOOla_OA2ABBENAkwAAAAXyACAAyAIIA https://d.adroll.com/cm/r/in?xid=E0&gdpr=1&gdpr_consent=BOOla_OOOla_OA2ABBENAkwAAAAXyACAAyAIIA	42 B 488 B	34ms 33ms	Image image/gif	54.75.248.80 Amazon.com
General Check archive.org Show headers Download Go to Show image Full URL https://d.adroll.com/cm/r/in?xid=E0&gdpr=1&gdpr_consent=BOOla_OOOla_OA2ABBENAkwAAAAXyACAAyAIIA Requested by Host: logrhythm.com URL: https://logrhythm.com/blog/detecting-dns-tunneling/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 54.75.248.80 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US), Reverse DNS ec2-54-75-248-80.eu-west-1.compute.amazonaws.com Software nginx/1.14.1 / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Request headers Referer https://logrhythm.com/blog/detecting-dns-tunneling/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Pragma no-cache Date Mon, 14 Oct 2019 05:04:11 GMT Server nginx/1.14.1 P3P CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA" Cache-Control no-store, no-cache, must-revalidate Connection keep-alive Content-Type image/gif Content-Length 42 Redirect headers Date Mon, 14 Oct 2019 05:04:11 GMT X-Content-Type-Options nosniff Server ATS Age 0 Expect-CT max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only" Strict-Transport-Security max-age=31536000 P3P policyref="https://policies.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE LOC GOV" Location https://d.adroll.com/cm/r/in?xid=E0&gdpr=1&gdpr_consent=BOOla_OOOla_OA2ABBENAkwAAAAXyACAAyAIIA Connection keep-alive Content-Length 0 X-XSS-Protection 1; mode=block
GET H2	204	/ trc.taboola.com/sg/adroll-network/1/rtb-h/ Redirect Chain https://d.adroll.com/cm/taboola/out?adroll_fpc=b89517a11da139a0e00064165659899d-1571029451235&xid_ch=f&advertisable=QDCFINCFT5HK5FU45EXRDS https://trc.taboola.com/sg/adroll-network/1/rtb-h/?taboola_hm=MjBkZjg3ZDQxNjYxYjk5YjE1OTE4YmZiZTYzNDY1NGQ	0 261 B	84ms 35ms	Image text/plain	151.101.114.2 Fastly
General Check archive.org Show headers Download Go to Show image Full URL https://trc.taboola.com/sg/adroll-network/1/rtb-h/?taboola_hm=MjBkZjg3ZDQxNjYxYjk5YjE1OTE4YmZiZTYzNDY1NGQ Requested by Host: logrhythm.com URL: https://logrhythm.com/blog/detecting-dns-tunneling/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.114.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US), Reverse DNS Software nginx / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://logrhythm.com/blog/detecting-dns-tunneling/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Mon, 14 Oct 2019 05:04:11 GMT via 1.1 varnish server nginx x-timer S1571029452.609740,VS0,VE9 x-cache MISS status 204 x-cache-hits 0 accept-ranges bytes x-served-by cache-hhn4052-HHN Redirect headers Pragma no-cache Date Mon, 14 Oct 2019 05:04:11 GMT Server nginx/1.14.1 P3P CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA" Location https://trc.taboola.com/sg/adroll-network/1/rtb-h/?taboola_hm=MjBkZjg3ZDQxNjYxYjk5YjE1OTE4YmZiZTYzNDY1NGQ Cache-Control no-store, no-cache, must-revalidate Connection keep-alive Content-Length 111
GET H2	200	xuid eb2.3lift.com/ Redirect Chain https://d.adroll.com/cm/triplelift/out?adroll_fpc=b89517a11da139a0e00064165659899d-1571029451235&xid_ch=f&advertisable=QDCFINCFT5HK5FU45EXRDS https://eb2.3lift.com/xuid?mid=4714&xuid=MjBkZjg3ZDQxNjYxYjk5YjE1OTE4YmZiZTYzNDY1NGQ&dongle=c85e https://eb2.3lift.com/xuid?ld=1&mid=4714&xuid=MjBkZjg3ZDQxNjYxYjk5YjE1OTE4YmZiZTYzNDY1NGQ&dongle=c85e&gdpr=1&cmp_cs=	37 B 335 B	28ms 28ms	Image image/gif	52.58.86.83 Amazon.com
General Check archive.org Show headers Download Go to Show image Full URL https://eb2.3lift.com/xuid?ld=1&mid=4714&xuid=MjBkZjg3ZDQxNjYxYjk5YjE1OTE4YmZiZTYzNDY1NGQ&dongle=c85e&gdpr=1&cmp_cs= Requested by Host: logrhythm.com URL: https://logrhythm.com/blog/detecting-dns-tunneling/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.58.86.83 Frankfurt am Main, Germany, ASN16509 (AMAZON-02 - Amazon.com, Inc., US), Reverse DNS ec2-52-58-86-83.eu-central-1.compute.amazonaws.com Software / Resource Hash bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96 Request headers Referer https://logrhythm.com/blog/detecting-dns-tunneling/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers status 200 date Mon, 14 Oct 2019 05:04:11 GMT cache-control no-cache, no-store, must-revalidate content-type image/gif content-length 37 p3p policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC" Redirect headers status 302 date Mon, 14 Oct 2019 05:04:11 GMT cache-control no-cache, no-store, must-revalidate content-length 0 location /xuid?ld=1&mid=4714&xuid=MjBkZjg3ZDQxNjYxYjk5YjE1OTE4YmZiZTYzNDY1NGQ&dongle=c85e&gdpr=1&cmp_cs= p3p policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
GET H/1.1	200 OK	in d.adroll.com/cm/mk/QDCFINCFT5HK5FU45EXRDS/	42 B 488 B	34ms 33ms	Image image/gif	54.75.248.80 Amazon.com
General Check archive.org Show headers Download Go to Show image Full URL https://d.adroll.com/cm/mk/QDCFINCFT5HK5FU45EXRDS/in?id=id%3A050-UWT-888%26token%3A_mch-logrhythm.com-1571029451124-22571 Requested by Host: logrhythm.com URL: https://logrhythm.com/blog/detecting-dns-tunneling/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 54.75.248.80 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US), Reverse DNS ec2-54-75-248-80.eu-west-1.compute.amazonaws.com Software nginx/1.14.1 / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Request headers Sec-Fetch-Mode no-cors Referer https://logrhythm.com/blog/detecting-dns-tunneling/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Pragma no-cache Date Mon, 14 Oct 2019 05:04:11 GMT Server nginx/1.14.1 P3P CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA" Cache-Control no-store, no-cache, must-revalidate Connection keep-alive Content-Type image/gif Content-Length 42
GET H2	200	sync x.bidswitch.net/ul_cb/ Redirect Chain https://d.adroll.com/cm/b/out?adroll_fpc=b89517a11da139a0e00064165659899d-1571029451235&xid_ch=f&advertisable=QDCFINCFT5HK5FU45EXRDS https://x.bidswitch.net/sync?dsp_id=44&user_id=MjBkZjg3ZDQxNjYxYjk5YjE1OTE4YmZiZTYzNDY1NGQ https://x.bidswitch.net/ul_cb/sync?dsp_id=44&user_id=MjBkZjg3ZDQxNjYxYjk5YjE1OTE4YmZiZTYzNDY1NGQ	43 B 379 B	28ms 28ms	Image image/gif	52.29.176.117 Amazon.com
General Check archive.org Show headers Download Go to Show image Full URL https://x.bidswitch.net/ul_cb/sync?dsp_id=44&user_id=MjBkZjg3ZDQxNjYxYjk5YjE1OTE4YmZiZTYzNDY1NGQ Requested by Host: logrhythm.com URL: https://logrhythm.com/blog/detecting-dns-tunneling/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.29.176.117 Frankfurt am Main, Germany, ASN16509 (AMAZON-02 - Amazon.com, Inc., US), Reverse DNS ec2-52-29-176-117.eu-central-1.compute.amazonaws.com Software / Resource Hash 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87 Request headers Referer https://logrhythm.com/blog/detecting-dns-tunneling/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers status 200 date Mon, 14 Oct 2019 05:04:11 GMT cache-control no-cache, no-store, must-revalidate content-type image/gif content-length 43 p3p CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA" Redirect headers status 302 date Mon, 14 Oct 2019 05:04:11 GMT cache-control no-cache, no-store, must-revalidate content-length 0 location https://x.bidswitch.net/ul_cb/sync?dsp_id=44&user_id=MjBkZjg3ZDQxNjYxYjk5YjE1OTE4YmZiZTYzNDY1NGQ p3p CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
GET H/1.1	200 OK	setuid ib.adnxs.com/ Redirect Chain https://d.adroll.com/cm/x/out?adroll_fpc=b89517a11da139a0e00064165659899d-1571029451235&xid_ch=f&advertisable=QDCFINCFT5HK5FU45EXRDS https://ib.adnxs.com/setuid?entity=172&code=MjBkZjg3ZDQxNjYxYjk5YjE1OTE4YmZiZTYzNDY1NGQ	0 590 B	57ms 15ms	Image text/html	185.33.223.83 AppNexus
General Check archive.org Show headers Download Go to Show image Full URL https://ib.adnxs.com/setuid?entity=172&code=MjBkZjg3ZDQxNjYxYjk5YjE1OTE4YmZiZTYzNDY1NGQ Requested by Host: logrhythm.com URL: https://logrhythm.com/blog/detecting-dns-tunneling/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 185.33.223.83 , Netherlands, ASN29990 (ASN-APPNEXUS - AppNexus, Inc, US), Reverse DNS 250.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net Software nginx/1.13.4 / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value X-Xss-Protection 0 Request headers Referer https://logrhythm.com/blog/detecting-dns-tunneling/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Pragma no-cache Date Mon, 14 Oct 2019 05:04:13 GMT X-Proxy-Origin 109.236.94.21; 109.236.94.21; 250.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.223.174:80 AN-X-Request-Uuid 513289a7-059a-45a7-a92a-55b87e63bca7 Server nginx/1.13.4 P3P policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" Cache-Control no-store, no-cache, private Connection keep-alive Content-Type text/html; charset=utf-8 Content-Length 0 X-XSS-Protection 0 Expires Sat, 15 Nov 2008 16:00:00 GMT Redirect headers Pragma no-cache Date Mon, 14 Oct 2019 05:04:11 GMT Server nginx/1.14.1 P3P CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA" Location https://ib.adnxs.com/setuid?entity=172&code=MjBkZjg3ZDQxNjYxYjk5YjE1OTE4YmZiZTYzNDY1NGQ Cache-Control no-store, no-cache, must-revalidate Connection keep-alive Content-Length 93
GET H2	204	377928.gif idsync.rlcdn.com/ Redirect Chain https://d.adroll.com/cm/l/out?adroll_fpc=b89517a11da139a0e00064165659899d-1571029451235&xid_ch=f&advertisable=QDCFINCFT5HK5FU45EXRDS https://idsync.rlcdn.com/377928.gif?partner_uid=20df87d41661b99b15918bfbe634654d	0 62 B	148ms 116ms	Image text/plain	35.190.72.21 Google LLC
General Check archive.org Show headers Download Go to Show image Full URL https://idsync.rlcdn.com/377928.gif?partner_uid=20df87d41661b99b15918bfbe634654d Requested by Host: logrhythm.com URL: https://logrhythm.com/blog/detecting-dns-tunneling/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 35.190.72.21 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US), Reverse DNS 21.72.190.35.bc.googleusercontent.com Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://logrhythm.com/blog/detecting-dns-tunneling/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers status 204 date Mon, 14 Oct 2019 05:04:11 GMT via 1.1 google alt-svc clear Redirect headers Pragma no-cache Date Mon, 14 Oct 2019 05:04:11 GMT Server nginx/1.14.1 P3P CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA" Location https://idsync.rlcdn.com/377928.gif?partner_uid=20df87d41661b99b15918bfbe634654d Cache-Control no-store, no-cache, must-revalidate Connection keep-alive Content-Length 86
GET H2	200	sd us-u.openx.net/w/1.0/ Redirect Chain https://d.adroll.com/cm/o/out?adroll_fpc=b89517a11da139a0e00064165659899d-1571029451235&xid_ch=f&advertisable=QDCFINCFT5HK5FU45EXRDS https://us-u.openx.net/w/1.0/sd?id=537103138&val=20df87d41661b99b15918bfbe634654d https://us-u.openx.net/w/1.0/sd?cc=1&id=537103138&val=20df87d41661b99b15918bfbe634654d	43 B 183 B	21ms 21ms	Image image/gif	34.95.120.147 Google LLC
General Check archive.org Show headers Download Go to Show image Full URL https://us-u.openx.net/w/1.0/sd?cc=1&id=537103138&val=20df87d41661b99b15918bfbe634654d Requested by Host: logrhythm.com URL: https://logrhythm.com/blog/detecting-dns-tunneling/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.95.120.147 , United States, ASN15169 (GOOGLE - Google LLC, US), Reverse DNS 147.120.95.34.bc.googleusercontent.com Software OXGW/16.163.0 / Resource Hash 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49 Request headers Referer https://logrhythm.com/blog/detecting-dns-tunneling/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers pragma no-cache date Mon, 14 Oct 2019 05:04:11 GMT via 1.1 google server OXGW/16.163.0 vary Accept p3p CP="CUR ADM OUR NOR STA NID" status 200 cache-control private, max-age=0, no-cache content-type image/gif alt-svc clear content-length 43 expires Mon, 26 Jul 1997 05:00:00 GMT Redirect headers date Mon, 14 Oct 2019 05:04:11 GMT via 1.1 google server OXGW/16.163.0 status 302 p3p CP="CUR ADM OUR NOR STA NID" location https://us-u.openx.net/w/1.0/sd?cc=1&id=537103138&val=20df87d41661b99b15918bfbe634654d alt-svc clear content-length 0
GET H/1.1	200 OK	in d.adroll.com/cm/g/ Redirect Chain https://d.adroll.com/cm/g/out?adroll_fpc=b89517a11da139a0e00064165659899d-1571029451235&xid_ch=f&advertisable=QDCFINCFT5HK5FU45EXRDS&google_nid=adroll5 https://cm.g.doubleclick.net/pixel?google_sc&google_nid=artb&google_hm=IN-H1BZhuZsVkYv75jRlTQ https://d.adroll.com/cm/g/in	42 B 523 B	33ms 33ms	Image image/gif	54.75.248.80 Amazon.com
General Check archive.org Show headers Download Go to Show image Full URL https://d.adroll.com/cm/g/in Requested by Host: logrhythm.com URL: https://logrhythm.com/blog/detecting-dns-tunneling/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 54.75.248.80 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US), Reverse DNS ec2-54-75-248-80.eu-west-1.compute.amazonaws.com Software nginx/1.14.1 / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Request headers Referer https://logrhythm.com/blog/detecting-dns-tunneling/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Pragma no-cache Date Mon, 14 Oct 2019 05:04:11 GMT Server nginx/1.14.1 P3P CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA" Cache-Control no-store, no-cache, must-revalidate Connection keep-alive Content-Type image/gif Content-Length 42 X-Result g.-1.-1.-1 Redirect headers pragma no-cache date Mon, 14 Oct 2019 05:04:11 GMT server HTTP server (unknown) status 302 p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" location https://d.adroll.com/cm/g/in cache-control no-cache, must-revalidate content-type text/html; charset=UTF-8 alt-svc quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 225 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H/1.1	200 OK	/ disqus.com/embed/comments/ Frame 07C2	0 0	212ms 211ms	Document text/html	151.101.64.134 Fastly
General Check archive.org Show headers Download Go to Full URL https://disqus.com/embed/comments/?base=default&f=logrhythm&t_i=%2Fblog%2Fdetecting-dns-tunneling%2F&t_u=https%3A%2F%2Flogrhythm.com%2Fblog%2Fdetecting-dns-tunneling%2F&t_d=Detecting%20DNS%20Tunneling&t_t=Detecting%20DNS%20Tunneling&s_o=default Requested by Host: logrhythm.disqus.com URL: https://logrhythm.disqus.com/embed.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.64.134 , United States, ASN54113 (FASTLY - Fastly, US), Reverse DNS Software nginx / Resource Hash Security Headers Name Value Content-Security-Policy script-src https://*.twitter.com:* https://www.gstatic.com/recaptcha/ https://a.disquscdn.com https://c.disquscdn.com c.disquscdn.com https://*.services.disqus.com:* https://cdn.boomtrain.com/p13n/ 'unsafe-inline' https://cdn.syndication.twimg.com/tweets.json https://connect.facebook.net/en_US/sdk.js https://referrer.disqus.com/juggler/ https://apis.google.com https://www.google.com/recaptcha/ https://disqus.com Strict-Transport-Security max-age=300; includeSubdomains X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Host disqus.com Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Mode nested-navigate Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3 Sec-Fetch-Site cross-site Referer https://logrhythm.com/blog/detecting-dns-tunneling/ Accept-Encoding gzip, deflate, br Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Mode nested-navigate Referer https://logrhythm.com/blog/detecting-dns-tunneling/ Response headers Server nginx Content-Type text/html; charset=utf-8 Content-Security-Policy script-src https://*.twitter.com:* https://www.gstatic.com/recaptcha/ https://a.disquscdn.com https://c.disquscdn.com c.disquscdn.com https://*.services.disqus.com:* https://cdn.boomtrain.com/p13n/ 'unsafe-inline' https://cdn.syndication.twimg.com/tweets.json https://connect.facebook.net/en_US/sdk.js https://referrer.disqus.com/juggler/ https://apis.google.com https://www.google.com/recaptcha/ https://disqus.com Last-Modified Wed, 14 Aug 2019 08:13:47 GMT ETag W/"lounge:view:4204794772.1aad2d5b8eedec0849f7799979a2a981.2" Link <https://c.disquscdn.com>;rel=preconnect,<https://c.disquscdn.com>;rel=dns-prefetch Cache-Control stale-if-error=3600, s-stalewhilerevalidate=3600, stale-while-revalidate=30, no-cache, must-revalidate, public, s-maxage=5 p3p CP="DSP IDC CUR ADM DELi STP NAV COM UNI INT PHY DEM" Timing-Allow-Origin * X-Content-Type-Options nosniff X-XSS-Protection 1; mode=block Content-Encoding gzip Content-Length 2523 Date Mon, 14 Oct 2019 05:04:11 GMT Age 0 Connection keep-alive Vary Accept-Encoding Strict-Transport-Security max-age=300; includeSubdomains
GET H2	200	/ www.facebook.com/tr/	44 B 99 B	6ms 5ms	Image image/gif	2a03:2880:f11c:8083:face:b00c:0:25de Facebook
General Check archive.org Show headers Download Go to Show image Full URL https://www.facebook.com/tr/?id=836361346565242&ev=PageView&dl=https%3A%2F%2Flogrhythm.com%2Fblog%2Fdetecting-dns-tunneling%2F&rl=&if=false&ts=1571029451427&cd[segment_eid]=JKDRBTEKQ5DYLPBQZ7OUBG&sw=1600&sh=1200&v=2.9.5&r=stable&ec=0&o=29&fbp=fb.1.1571029451114.1634147949&it=1571029451035&coo=false&exp=w1&rqm=GET Requested by Host: logrhythm.com URL: https://logrhythm.com/blog/detecting-dns-tunneling/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f11c:8083:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US), Reverse DNS Software proxygen-bolt / Resource Hash 10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Sec-Fetch-Mode no-cors Referer https://logrhythm.com/blog/detecting-dns-tunneling/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Mon, 14 Oct 2019 05:04:11 GMT last-modified Fri, 21 Dec 2012 00:00:01 GMT server proxygen-bolt strict-transport-security max-age=31536000; includeSubDomains content-type image/gif status 200 cache-control no-cache, must-revalidate, max-age=0 content-length 44 expires Mon, 14 Oct 2019 05:04:11 GMT
GET H2	200	forms2.min.js Show response ecrm.logrhythm.com/js/forms2/js/ Frame 1AE1	169 KB 57 KB	23ms 22ms	Script application/x-javascript	104.17.70.206 Cloudflare
General Check archive.org Show headers Download Go to Full URL https://ecrm.logrhythm.com/js/forms2/js/forms2.min.js Requested by Host: ecrm.logrhythm.com URL: https://ecrm.logrhythm.com/Guided-Blog-Subscribe-Form.html?form_type=compact&ty_page_url=https%3A%2F%2Flogrhythm.com%2Fblog-newsletter-subscription-ty%2F&resizeGuid=DB9FB6E2-35C7-4E17-81C4-2CE5AFDBB9B8&page_url=https%3A%2F%2Flogrhythm.com%2Fblog%2Fdetecting-dns-tunneling%2F Protocol H2 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 104.17.70.206 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash 321bbcc4cc57483b7e329186e5159498b668ddde87cb64696ddcdc95176cce82 Security Headers Name Value X-Content-Type-Options nosniff Request headers Sec-Fetch-Mode no-cors Referer https://ecrm.logrhythm.com/Guided-Blog-Subscribe-Form.html?form_type=compact&ty_page_url=https%3A%2F%2Flogrhythm.com%2Fblog-newsletter-subscription-ty%2F&resizeGuid=DB9FB6E2-35C7-4E17-81C4-2CE5AFDBB9B8&page_url=https%3A%2F%2Flogrhythm.com%2Fblog%2Fdetecting-dns-tunneling%2F User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Mon, 14 Oct 2019 05:04:11 GMT content-encoding gzip x-content-type-options nosniff cf-cache-status HIT last-modified Wed, 25 Sep 2019 18:55:06 GMT server cloudflare age 1869 etag "100be6-2a536-5936530f69680" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type application/x-javascript status 200 cache-control public, max-age=14400 cf-ray 525702d77cafbdb9-AMS expires Mon, 14 Oct 2019 09:04:11 GMT
GET H2	200	jquery.min.js Show response ajax.googleapis.com/ajax/libs/jquery/3.1.0/ Frame 1AE1	84 KB 30 KB	6ms 5ms	Script text/javascript	2a00:1450:4001:817::200a Google LLC
General Check archive.org Show headers Download Go to Full URL https://ajax.googleapis.com/ajax/libs/jquery/3.1.0/jquery.min.js Requested by Host: ecrm.logrhythm.com URL: https://ecrm.logrhythm.com/Guided-Blog-Subscribe-Form.html?form_type=compact&ty_page_url=https%3A%2F%2Flogrhythm.com%2Fblog-newsletter-subscription-ty%2F&resizeGuid=DB9FB6E2-35C7-4E17-81C4-2CE5AFDBB9B8&page_url=https%3A%2F%2Flogrhythm.com%2Fblog%2Fdetecting-dns-tunneling%2F Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:817::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US), Reverse DNS Software sffe / Resource Hash 702b9e051e82b32038ffdb33a4f7eb5f7b38f4cf6f514e4182d8898f4eb0b7fb Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Sec-Fetch-Mode no-cors Referer https://ecrm.logrhythm.com/Guided-Blog-Subscribe-Form.html?form_type=compact&ty_page_url=https%3A%2F%2Flogrhythm.com%2Fblog-newsletter-subscription-ty%2F&resizeGuid=DB9FB6E2-35C7-4E17-81C4-2CE5AFDBB9B8&page_url=https%3A%2F%2Flogrhythm.com%2Fblog%2Fdetecting-dns-tunneling%2F User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Fri, 11 Oct 2019 14:12:38 GMT content-encoding gzip x-content-type-options nosniff age 226293 status 200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 30211 x-xss-protection 0 last-modified Tue, 20 Dec 2016 18:17:03 GMT server sffe vary Accept-Encoding content-type text/javascript; charset=UTF-8 access-control-allow-origin * cache-control public, max-age=31536000, stale-while-revalidate=2592000 accept-ranges bytes timing-allow-origin * expires Sat, 10 Oct 2020 14:12:38 GMT
GET H/1.1	200 OK	munchkin.js Show response munchkin.marketo.net// Frame 1AE1	1 KB 1 KB	26ms 25ms	Script application/x-javascript	104.111.251.133 Akamai Technologies
General Check archive.org Show headers Download Go to Full URL https://munchkin.marketo.net//munchkin.js Requested by Host: ecrm.logrhythm.com URL: https://ecrm.logrhythm.com/Guided-Blog-Subscribe-Form.html?form_type=compact&ty_page_url=https%3A%2F%2Flogrhythm.com%2Fblog-newsletter-subscription-ty%2F&resizeGuid=DB9FB6E2-35C7-4E17-81C4-2CE5AFDBB9B8&page_url=https%3A%2F%2Flogrhythm.com%2Fblog%2Fdetecting-dns-tunneling%2F Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 104.111.251.133 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US), Reverse DNS a104-111-251-133.deploy.static.akamaitechnologies.com Software Apache / Resource Hash 66f7eaa7a45f696c332cd450771f4be48e110f6afbe1fe7b39c7a95518aeef76 Request headers Sec-Fetch-Mode no-cors Referer https://ecrm.logrhythm.com/Guided-Blog-Subscribe-Form.html?form_type=compact&ty_page_url=https%3A%2F%2Flogrhythm.com%2Fblog-newsletter-subscription-ty%2F&resizeGuid=DB9FB6E2-35C7-4E17-81C4-2CE5AFDBB9B8&page_url=https%3A%2F%2Flogrhythm.com%2Fblog%2Fdetecting-dns-tunneling%2F User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Mon, 14 Oct 2019 05:04:11 GMT Content-Encoding gzip Last-Modified Fri, 05 Apr 2019 02:53:44 GMT Server Apache ETag "54520320df20b526337717d6d28181fc:1554432824" Vary Accept-Encoding P3P policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR" Connection keep-alive Accept-Ranges bytes Content-Type application/x-javascript Content-Length 752
GET H2	200	stripmkttok.js Show response ecrm.logrhythm.com/js/ Frame 1AE1	2 KB 870 B	21ms 20ms	Script application/x-javascript	104.17.70.206 Cloudflare
General Check archive.org Show headers Download Go to Full URL https://ecrm.logrhythm.com/js/stripmkttok.js Requested by Host: ecrm.logrhythm.com URL: https://ecrm.logrhythm.com/Guided-Blog-Subscribe-Form.html?form_type=compact&ty_page_url=https%3A%2F%2Flogrhythm.com%2Fblog-newsletter-subscription-ty%2F&resizeGuid=DB9FB6E2-35C7-4E17-81C4-2CE5AFDBB9B8&page_url=https%3A%2F%2Flogrhythm.com%2Fblog%2Fdetecting-dns-tunneling%2F Protocol H2 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 104.17.70.206 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash f7545b96ed2740220c349ae9deb614faf1f0f211d4cf710788e0790f74cc9715 Security Headers Name Value X-Content-Type-Options nosniff Request headers Sec-Fetch-Mode no-cors Referer https://ecrm.logrhythm.com/Guided-Blog-Subscribe-Form.html?form_type=compact&ty_page_url=https%3A%2F%2Flogrhythm.com%2Fblog-newsletter-subscription-ty%2F&resizeGuid=DB9FB6E2-35C7-4E17-81C4-2CE5AFDBB9B8&page_url=https%3A%2F%2Flogrhythm.com%2Fblog%2Fdetecting-dns-tunneling%2F User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Mon, 14 Oct 2019 05:04:11 GMT content-encoding gzip x-content-type-options nosniff cf-cache-status HIT age 1869 status 200 content-length 678 last-modified Wed, 25 Sep 2019 18:55:06 GMT server cloudflare etag "61c11-602-5936530f69680" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type application/x-javascript cache-control public, max-age=14400 accept-ranges bytes cf-ray 525702d77cb0bdb9-AMS expires Mon, 14 Oct 2019 09:04:11 GMT
GET H2	200	gtm.js Show response www.googletagmanager.com/ Frame 1AE1	164 KB 32 KB	17ms 16ms	Script application/javascript	2a00:1450:4001:814::2008 Google LLC
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtm.js?id=GTM-P82TVL&l=dataLayer Requested by Host: ecrm.logrhythm.com URL: https://ecrm.logrhythm.com/Guided-Blog-Subscribe-Form.html?form_type=compact&ty_page_url=https%3A%2F%2Flogrhythm.com%2Fblog-newsletter-subscription-ty%2F&resizeGuid=DB9FB6E2-35C7-4E17-81C4-2CE5AFDBB9B8&page_url=https%3A%2F%2Flogrhythm.com%2Fblog%2Fdetecting-dns-tunneling%2F Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:814::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US), Reverse DNS Software Google Tag Manager / Resource Hash 38377355370363e2c6bb060c5b12258111f86a6de42fdb5427a50712f15067a8 Security Headers Name Value X-Xss-Protection 0 Request headers Sec-Fetch-Mode no-cors Referer https://ecrm.logrhythm.com/Guided-Blog-Subscribe-Form.html?form_type=compact&ty_page_url=https%3A%2F%2Flogrhythm.com%2Fblog-newsletter-subscription-ty%2F&resizeGuid=DB9FB6E2-35C7-4E17-81C4-2CE5AFDBB9B8&page_url=https%3A%2F%2Flogrhythm.com%2Fblog%2Fdetecting-dns-tunneling%2F User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Mon, 14 Oct 2019 05:04:11 GMT content-encoding br last-modified Mon, 14 Oct 2019 03:00:00 GMT server Google Tag Manager access-control-allow-headers Cache-Control status 200 vary Accept-Encoding content-type application/javascript; charset=UTF-8 access-control-allow-origin http://www.googletagmanager.com cache-control private, max-age=900 access-control-allow-credentials true alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 32819 x-xss-protection 0 expires Mon, 14 Oct 2019 05:04:11 GMT
GET H2	200	analytics.js Show response www.google-analytics.com/ Frame 1AE1	43 KB 17 KB	6ms 5ms	Script text/javascript	2a00:1450:4001:80b::200e Google LLC
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/analytics.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-P82TVL&l=dataLayer Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:80b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US), Reverse DNS Software Golfe2 / Resource Hash dbb67c620eaabf6679a314db18d3ae43037aef71ab27422e6feec08ee987cc0a Security Headers Name Value Strict-Transport-Security max-age=10886400; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Sec-Fetch-Mode no-cors Referer https://ecrm.logrhythm.com/Guided-Blog-Subscribe-Form.html?form_type=compact&ty_page_url=https%3A%2F%2Flogrhythm.com%2Fblog-newsletter-subscription-ty%2F&resizeGuid=DB9FB6E2-35C7-4E17-81C4-2CE5AFDBB9B8&page_url=https%3A%2F%2Flogrhythm.com%2Fblog%2Fdetecting-dns-tunneling%2F User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers strict-transport-security max-age=10886400; includeSubDomains; preload content-encoding gzip x-content-type-options nosniff last-modified Mon, 19 Aug 2019 17:22:41 GMT server Golfe2 age 4201 date Mon, 14 Oct 2019 03:54:10 GMT vary Accept-Encoding content-type text/javascript status 200 cache-control public, max-age=7200 alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 17803 expires Mon, 14 Oct 2019 05:54:10 GMT
GET H/1.1	200 OK	munchkin.js Show response munchkin.marketo.net/ Frame 1AE1	1 KB 1 KB	38ms 38ms	Script application/x-javascript	104.111.251.133 Akamai Technologies
General Check archive.org Show headers Download Go to Full URL https://munchkin.marketo.net/munchkin.js Requested by Host: logrhythm.com URL: https://logrhythm.com/blog/detecting-dns-tunneling/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 104.111.251.133 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US), Reverse DNS a104-111-251-133.deploy.static.akamaitechnologies.com Software Apache / Resource Hash 66f7eaa7a45f696c332cd450771f4be48e110f6afbe1fe7b39c7a95518aeef76 Request headers Sec-Fetch-Mode no-cors Referer https://ecrm.logrhythm.com/Guided-Blog-Subscribe-Form.html?form_type=compact&ty_page_url=https%3A%2F%2Flogrhythm.com%2Fblog-newsletter-subscription-ty%2F&resizeGuid=DB9FB6E2-35C7-4E17-81C4-2CE5AFDBB9B8&page_url=https%3A%2F%2Flogrhythm.com%2Fblog%2Fdetecting-dns-tunneling%2F User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Mon, 14 Oct 2019 05:04:11 GMT Content-Encoding gzip Last-Modified Fri, 05 Apr 2019 02:53:44 GMT Server Apache ETag "54520320df20b526337717d6d28181fc:1554432824" Vary Accept-Encoding P3P policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR" Connection keep-alive Accept-Ranges bytes Content-Type application/x-javascript Content-Length 752
GET H2	200	conversion_async.js Show response www.googleadservices.com/pagead/ Frame 1AE1	24 KB 9 KB	30ms 30ms	Script text/javascript	216.58.208.34 Google LLC
General Check archive.org Show headers Download Go to Full URL https://www.googleadservices.com/pagead/conversion_async.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-P82TVL&l=dataLayer Protocol H2 Security TLS 1.3, , AES_128_GCM Server 216.58.208.34 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US), Reverse DNS fra15s12-in-f2.1e100.net Software cafe / Resource Hash a6b5e22c905bbb22ce9e7aad76eeca32474b5ba7c932893d554b0edfddc7f9e2 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Sec-Fetch-Mode no-cors Referer https://ecrm.logrhythm.com/Guided-Blog-Subscribe-Form.html?form_type=compact&ty_page_url=https%3A%2F%2Flogrhythm.com%2Fblog-newsletter-subscription-ty%2F&resizeGuid=DB9FB6E2-35C7-4E17-81C4-2CE5AFDBB9B8&page_url=https%3A%2F%2Flogrhythm.com%2Fblog%2Fdetecting-dns-tunneling%2F User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Mon, 14 Oct 2019 05:04:11 GMT content-encoding gzip x-content-type-options nosniff p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" status 200 content-disposition attachment; filename="f.txt" alt-svc quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 9184 x-xss-protection 0 server cafe etag 4597387999763492622 vary Accept-Encoding content-type text/javascript; charset=UTF-8 cache-control private, max-age=3600 timing-allow-origin * expires Mon, 14 Oct 2019 05:04:11 GMT
GET H/1.1	200 OK	roundtrip.js Show response s.adroll.com/j/ Frame 1AE1	33 KB 11 KB	29ms 29ms	Script text/javascript	2.18.233.40 Akamai Technologies
General Check archive.org Show headers Download Go to Full URL https://s.adroll.com/j/roundtrip.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-P82TVL&l=dataLayer Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2.18.233.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US), Reverse DNS a2-18-233-40.deploy.static.akamaitechnologies.com Software AmazonS3 / Resource Hash 4a1d3bf6c1cec783f967068348e78974da3b79cdfae1746c01f7f9ad86ad9951 Request headers Sec-Fetch-Mode no-cors Referer https://ecrm.logrhythm.com/Guided-Blog-Subscribe-Form.html?form_type=compact&ty_page_url=https%3A%2F%2Flogrhythm.com%2Fblog-newsletter-subscription-ty%2F&resizeGuid=DB9FB6E2-35C7-4E17-81C4-2CE5AFDBB9B8&page_url=https%3A%2F%2Flogrhythm.com%2Fblog%2Fdetecting-dns-tunneling%2F User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers x-amz-version-id 9.BQ9cxFANfreH2vrVxQTFpw5o67znAv Content-Encoding gzip ETag "4cdaf4a1f2ebfda8dd871575ebef2236" x-amz-request-id 43692B5807BE08A9 x-amz-server-side-encryption AES256 Connection keep-alive Vary Accept-Encoding Content-Length 10345 x-amz-id-2 ZQUqt6+TOkdgwadOb4rRXtH/zTXxRMa2B/Q3JC2N12nwj4qVLAGSMuqUr6fSLmp42OnQir5Jk9Y= Last-Modified Wed, 25 Sep 2019 15:18:31 GMT Server AmazonS3 Date Mon, 14 Oct 2019 05:04:11 GMT Access-Control-Max-Age 600 Access-Control-Allow-Methods GET Content-Type text/javascript Access-Control-Allow-Origin * Cache-Control max-age=3600, must-revalidate Access-Control-Allow-Credentials false Accept-Ranges bytes Access-Control-Allow-Headers *
GET H2	200	fbevents.js Show response connect.facebook.net/en_US/ Frame 1AE1	103 KB 22 KB	6ms 5ms	Script application/x-javascript	2a03:2880:f01c:8012:face:b00c:0:3 Facebook
General Check archive.org Show headers Download Go to Full URL https://connect.facebook.net/en_US/fbevents.js Requested by Host: logrhythm.com URL: https://logrhythm.com/blog/detecting-dns-tunneling/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f01c:8012:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US), Reverse DNS Software / Resource Hash fe6062b8859b1cbec624e610c390a71f1830a3202eb0a2c4d8cd42aaf446a8cf Security Headers Name Value Content-Security-Policy default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm; Strict-Transport-Security max-age=31536000; preload; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 0 Request headers Sec-Fetch-Mode no-cors Referer https://ecrm.logrhythm.com/Guided-Blog-Subscribe-Form.html?form_type=compact&ty_page_url=https%3A%2F%2Flogrhythm.com%2Fblog-newsletter-subscription-ty%2F&resizeGuid=DB9FB6E2-35C7-4E17-81C4-2CE5AFDBB9B8&page_url=https%3A%2F%2Flogrhythm.com%2Fblog%2Fdetecting-dns-tunneling%2F User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers strict-transport-security max-age=31536000; preload; includeSubDomains content-encoding gzip x-content-type-options nosniff status 200 content-length 22372 x-xss-protection 0 pragma public x-fb-debug +y+wgqfOP87YxfznQNxj10QGvMiL4PhPh9tOguYt57JVM3rya/qUb/8olhu/ogtCb8oXRRbmWR/8XkJ+qXjefQ== x-fb-trip-id 1850256238 x-frame-options DENY date Mon, 14 Oct 2019 05:04:11 GMT vary Accept-Encoding content-type application/x-javascript; charset=utf-8 cache-control public, max-age=1200 content-security-policy default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm; expires Sat, 01 Jan 2000 00:00:00 GMT
GET H/1.1	200 OK	s ads.avocet.io/ Frame 1AE1	35 B 440 B	31ms 31ms	Image image/gif	52.208.204.25 Amazon.com
General Check archive.org Show headers Download Go to Show image Full URL https://ads.avocet.io/s?add=5a33dc888945849615039dac Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-P82TVL&l=dataLayer Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.208.204.25 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US), Reverse DNS ec2-52-208-204-25.eu-west-1.compute.amazonaws.com Software / Resource Hash 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992 Request headers Sec-Fetch-Mode no-cors Referer https://ecrm.logrhythm.com/Guided-Blog-Subscribe-Form.html?form_type=compact&ty_page_url=https%3A%2F%2Flogrhythm.com%2Fblog-newsletter-subscription-ty%2F&resizeGuid=DB9FB6E2-35C7-4E17-81C4-2CE5AFDBB9B8&page_url=https%3A%2F%2Flogrhythm.com%2Fblog%2Fdetecting-dns-tunneling%2F User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Mon, 14 Oct 2019 05:04:11 GMT Connection keep-alive P3p policyref="http://cdn.avocet.io/w3c/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" Content-Length 35 Content-Type image/gif
GET H/1.1	200 OK	s ads.avocet.io/ Frame 1AE1	35 B 440 B	62ms 30ms	Image image/gif	52.208.204.25 Amazon.com
General Check archive.org Show headers Download Go to Show image Full URL https://ads.avocet.io/s?add=5a33dcfa8945849615039db0 Requested by Host: ecrm.logrhythm.com URL: https://ecrm.logrhythm.com/Guided-Blog-Subscribe-Form.html?form_type=compact&ty_page_url=https%3A%2F%2Flogrhythm.com%2Fblog-newsletter-subscription-ty%2F&resizeGuid=DB9FB6E2-35C7-4E17-81C4-2CE5AFDBB9B8&page_url=https%3A%2F%2Flogrhythm.com%2Fblog%2Fdetecting-dns-tunneling%2F Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.208.204.25 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US), Reverse DNS ec2-52-208-204-25.eu-west-1.compute.amazonaws.com Software / Resource Hash 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992 Request headers Sec-Fetch-Mode no-cors Referer https://ecrm.logrhythm.com/Guided-Blog-Subscribe-Form.html?form_type=compact&ty_page_url=https%3A%2F%2Flogrhythm.com%2Fblog-newsletter-subscription-ty%2F&resizeGuid=DB9FB6E2-35C7-4E17-81C4-2CE5AFDBB9B8&page_url=https%3A%2F%2Flogrhythm.com%2Fblog%2Fdetecting-dns-tunneling%2F User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Mon, 14 Oct 2019 05:04:11 GMT Connection keep-alive P3p policyref="http://cdn.avocet.io/w3c/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" Content-Length 35 Content-Type image/gif
GET H2	200	js Show response www.google-analytics.com/gtm/ Frame 1AE1	57 KB 21 KB	16ms 15ms	Script application/javascript	2a00:1450:4001:80b::200e Google LLC
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/gtm/js?id=GTM-MSXFN7F&t=gtm1&cid=849653506.1571029451 Requested by Host: www.google-analytics.com URL: https://www.google-analytics.com/analytics.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:80b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US), Reverse DNS Software Google Tag Manager / Resource Hash c30461f0d3697c0d1ffe38213c0b79ec4efec095a660e1d03f57eff6da524436 Security Headers Name Value X-Xss-Protection 0 Request headers Sec-Fetch-Mode no-cors Referer https://ecrm.logrhythm.com/Guided-Blog-Subscribe-Form.html?form_type=compact&ty_page_url=https%3A%2F%2Flogrhythm.com%2Fblog-newsletter-subscription-ty%2F&resizeGuid=DB9FB6E2-35C7-4E17-81C4-2CE5AFDBB9B8&page_url=https%3A%2F%2Flogrhythm.com%2Fblog%2Fdetecting-dns-tunneling%2F User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Mon, 14 Oct 2019 05:04:11 GMT content-encoding br last-modified Mon, 14 Oct 2019 03:00:00 GMT server Google Tag Manager access-control-allow-headers Cache-Control status 200 vary Accept-Encoding content-type application/javascript; charset=UTF-8 access-control-allow-origin http://www.googletagmanager.com cache-control private, max-age=900 access-control-allow-credentials true alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 21710 x-xss-protection 0 expires Mon, 14 Oct 2019 05:04:11 GMT
GET H2	200	232919347190734 Show response connect.facebook.net/signals/config/ Frame 1AE1	280 KB 65 KB	9ms 8ms	Script application/x-javascript	2a03:2880:f01c:8012:face:b00c:0:3 Facebook
General Check archive.org Show headers Download Go to Full URL https://connect.facebook.net/signals/config/232919347190734?v=2.9.5&r=stable Requested by Host: connect.facebook.net URL: https://connect.facebook.net/en_US/fbevents.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f01c:8012:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US), Reverse DNS Software / Resource Hash 9f34f0fa6e27f823398636e42d0abd8f4eebdb32af50394bcfab686857a93988 Security Headers Name Value Content-Security-Policy default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm; Strict-Transport-Security max-age=31536000; preload; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 0 Request headers Sec-Fetch-Mode no-cors Referer https://ecrm.logrhythm.com/Guided-Blog-Subscribe-Form.html?form_type=compact&ty_page_url=https%3A%2F%2Flogrhythm.com%2Fblog-newsletter-subscription-ty%2F&resizeGuid=DB9FB6E2-35C7-4E17-81C4-2CE5AFDBB9B8&page_url=https%3A%2F%2Flogrhythm.com%2Fblog%2Fdetecting-dns-tunneling%2F User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers strict-transport-security max-age=31536000; preload; includeSubDomains content-encoding gzip x-content-type-options nosniff status 200 content-length 66233 x-xss-protection 0 pragma public x-fb-debug eBIaPrqifcZ2ALQY9Co8ccejsm/XkzZe6SKt2+bOp3VZmergdGUkM5YwqGF2XLcR07QWlphe/rwaksgt1hNSOA== x-fb-trip-id 1850256238 x-frame-options DENY date Mon, 14 Oct 2019 05:04:11 GMT vary Accept-Encoding content-type application/x-javascript; charset=utf-8 cache-control public, max-age=1200 content-security-policy default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm; expires Sat, 01 Jan 2000 00:00:00 GMT
GET H2	200	forms2.css ecrm.logrhythm.com/js/forms2/css/ Frame 1AE1	13 KB 3 KB	23ms 21ms	Stylesheet text/css	104.17.70.206 Cloudflare
General Check archive.org Show headers Download Go to Full URL https://ecrm.logrhythm.com/js/forms2/css/forms2.css Requested by Host: ecrm.logrhythm.com URL: https://ecrm.logrhythm.com/js/forms2/js/forms2.min.js Protocol H2 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 104.17.70.206 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash 397d07fbfb19b6ac538d7b8bcdf5ebf7be881c9f9ad3982278d9d4f3a02c160b Security Headers Name Value X-Content-Type-Options nosniff Request headers Sec-Fetch-Mode no-cors Referer https://ecrm.logrhythm.com/Guided-Blog-Subscribe-Form.html?form_type=compact&ty_page_url=https%3A%2F%2Flogrhythm.com%2Fblog-newsletter-subscription-ty%2F&resizeGuid=DB9FB6E2-35C7-4E17-81C4-2CE5AFDBB9B8&page_url=https%3A%2F%2Flogrhythm.com%2Fblog%2Fdetecting-dns-tunneling%2F User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Mon, 14 Oct 2019 05:04:11 GMT content-encoding gzip x-content-type-options nosniff cf-cache-status HIT age 1861 status 200 content-length 2610 last-modified Wed, 25 Sep 2019 18:55:06 GMT server cloudflare etag "300d39-33f8-5936530f69680" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type text/css cache-control public, max-age=14400 accept-ranges bytes cf-ray 525702d7dd0bbdb9-AMS expires Mon, 14 Oct 2019 09:04:11 GMT
GET H2	200	forms2-theme-plain.css ecrm.logrhythm.com/js/forms2/css/ Frame 1AE1	828 B 343 B	21ms 20ms	Stylesheet text/css	104.17.70.206 Cloudflare
General Check archive.org Show headers Download Go to Full URL https://ecrm.logrhythm.com/js/forms2/css/forms2-theme-plain.css Requested by Host: ecrm.logrhythm.com URL: https://ecrm.logrhythm.com/js/forms2/js/forms2.min.js Protocol H2 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 104.17.70.206 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US), Reverse DNS Software cloudflare / Resource Hash 57cd46adbabd6c40823602b4513aecbe89320a769572255272abe9f008de69fa Security Headers Name Value X-Content-Type-Options nosniff Request headers Sec-Fetch-Mode no-cors Referer https://ecrm.logrhythm.com/Guided-Blog-Subscribe-Form.html?form_type=compact&ty_page_url=https%3A%2F%2Flogrhythm.com%2Fblog-newsletter-subscription-ty%2F&resizeGuid=DB9FB6E2-35C7-4E17-81C4-2CE5AFDBB9B8&page_url=https%3A%2F%2Flogrhythm.com%2Fblog%2Fdetecting-dns-tunneling%2F User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Mon, 14 Oct 2019 05:04:11 GMT content-encoding gzip x-content-type-options nosniff cf-cache-status HIT age 1861 status 200 content-length 246 last-modified Wed, 25 Sep 2019 18:55:06 GMT server cloudflare etag "100be0-33c-5936530f69680" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type text/css cache-control public, max-age=14400 accept-ranges bytes cf-ray 525702d7dd0cbdb9-AMS expires Mon, 14 Oct 2019 09:04:11 GMT
GET H/1.1	200 OK	index.js Show response s.adroll.com/j/exp/QDCFINCFT5HK5FU45EXRDS/ Frame 1AE1	37 B 689 B	26ms 25ms	Script application/javascript	2.18.233.40 Akamai Technologies
General Check archive.org Show headers Download Go to Full URL https://s.adroll.com/j/exp/QDCFINCFT5HK5FU45EXRDS/index.js Requested by Host: s.adroll.com URL: https://s.adroll.com/j/roundtrip.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2.18.233.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US), Reverse DNS a2-18-233-40.deploy.static.akamaitechnologies.com Software AmazonS3 / Resource Hash 6a8466d729c03a3f87ea7d1ea02379eae9ffc52171cd62b9428a39ca71675814 Request headers Sec-Fetch-Mode no-cors Referer https://ecrm.logrhythm.com/Guided-Blog-Subscribe-Form.html?form_type=compact&ty_page_url=https%3A%2F%2Flogrhythm.com%2Fblog-newsletter-subscription-ty%2F&resizeGuid=DB9FB6E2-35C7-4E17-81C4-2CE5AFDBB9B8&page_url=https%3A%2F%2Flogrhythm.com%2Fblog%2Fdetecting-dns-tunneling%2F User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers x-amz-version-id WfIxNyfu0rdBUAUfEtPPDWUEez.Nwrkb ETag "af5292134b7f9ce1b2a338c5daae4370" x-amz-request-id 4E51AD4693114B54 x-amz-server-side-encryption AES256 Connection keep-alive Content-Length 37 x-amz-id-2 ciahh9FqYa9aFFbJ19JPt/ys40GZnN8Pb3n446ljoARaPkVTi7qh0uFPJInX+j+hLb7WrECQZok= Last-Modified Mon, 30 Sep 2019 18:32:09 GMT Server AmazonS3 Date Mon, 14 Oct 2019 05:04:11 GMT Access-Control-Max-Age 600 Access-Control-Allow-Methods GET Content-Type application/javascript Access-Control-Allow-Origin * Access-Control-Allow-Credentials false Accept-Ranges bytes Access-Control-Allow-Headers *
GET H/1.1	200 OK	QDCFINCFT5HK5FU45EXRDS Show response d.adroll.com/consent/check/ Frame 1AE1	52 B 511 B	33ms 32ms	Script application/javascript	54.75.248.80 Amazon.com
General Check archive.org Show headers Download Go to Full URL https://d.adroll.com/consent/check/QDCFINCFT5HK5FU45EXRDS?adroll_fpc=b89517a11da139a0e00064165659899d-1571029451235&_s=15cacacfb7a10db13e0b3819e9fa8654&_b=2 Requested by Host: s.adroll.com URL: https://s.adroll.com/j/roundtrip.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 54.75.248.80 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US), Reverse DNS ec2-54-75-248-80.eu-west-1.compute.amazonaws.com Software nginx/1.14.1 / Resource Hash 78e8014068cb4da20c259ed16b0576ab430744d992d822b5b643ef6d0049dd05 Request headers Sec-Fetch-Mode no-cors Referer https://ecrm.logrhythm.com/Guided-Blog-Subscribe-Form.html?form_type=compact&ty_page_url=https%3A%2F%2Flogrhythm.com%2Fblog-newsletter-subscription-ty%2F&resizeGuid=DB9FB6E2-35C7-4E17-81C4-2CE5AFDBB9B8&page_url=https%3A%2F%2Flogrhythm.com%2Fblog%2Fdetecting-dns-tunneling%2F User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Pragma no-cache Date Mon, 14 Oct 2019 05:04:11 GMT Server nginx/1.14.1 P3P CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA" Cache-Control no-store, no-cache, must-revalidate Connection keep-alive Content-Type application/javascript Content-Length 52
GET H/1.1	200 OK	munchkin.js Show response munchkin.marketo.net/155/ Frame 1AE1	9 KB 4 KB	56ms 55ms	Script application/x-javascript	104.111.251.133 Akamai Technologies
General Check archive.org Show headers Download Go to Full URL https://munchkin.marketo.net/155/munchkin.js Requested by Host: munchkin.marketo.net URL: https://munchkin.marketo.net//munchkin.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 104.111.251.133 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US), Reverse DNS a104-111-251-133.deploy.static.akamaitechnologies.com Software Apache / Resource Hash efb6b9732bf508ee305363b10cf2a67ace474e06eb42642f2c3696b2442a5775 Request headers Sec-Fetch-Mode no-cors Referer https://ecrm.logrhythm.com/Guided-Blog-Subscribe-Form.html?form_type=compact&ty_page_url=https%3A%2F%2Flogrhythm.com%2Fblog-newsletter-subscription-ty%2F&resizeGuid=DB9FB6E2-35C7-4E17-81C4-2CE5AFDBB9B8&page_url=https%3A%2F%2Flogrhythm.com%2Fblog%2Fdetecting-dns-tunneling%2F User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Mon, 14 Oct 2019 05:04:11 GMT Content-Encoding gzip Last-Modified Fri, 30 Nov 2018 03:18:20 GMT Server Apache ETag "c67dad42946949112916578f78706df8:1543547900" Vary Accept-Encoding P3P policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR" Cache-Control max-age=8640000 Connection keep-alive Accept-Ranges bytes Content-Type application/x-javascript Content-Length 3923 Expires Wed, 22 Jan 2020 05:04:11 GMT
GET H2	200	/ www.facebook.com/tr/ Frame 1AE1	44 B 99 B	6ms 6ms	Image image/gif	2a03:2880:f11c:8083:face:b00c:0:25de Facebook
General Check archive.org Show headers Download Go to Show image Full URL https://www.facebook.com/tr/?id=232919347190734&ev=PageView&dl=https%3A%2F%2Fecrm.logrhythm.com%2FGuided-Blog-Subscribe-Form.html%3Fform_type%3Dcompact%26ty_page_url%3Dhttps%253A%252F%252Flogrhythm.com%252Fblog-newsletter-subscription-ty%252F%26resizeGuid%3DDB9FB6E2-35C7-4E17-81C4-2CE5AFDBB9B8%26page_url%3Dhttps%253A%252F%252Flogrhythm.com%252Fblog%252Fdetecting-dns-tunneling%252F&rl=https%3A%2F%2Flogrhythm.com%2Fblog%2Fdetecting-dns-tunneling%2F&if=true&ts=1571029451515&sw=1600&sh=1200&v=2.9.5&r=stable&ec=0&o=30&fbp=fb.1.1571029451114.1634147949&it=1571029451472&coo=false&exp=w1&rqm=GET Requested by Host: ecrm.logrhythm.com URL: https://ecrm.logrhythm.com/Guided-Blog-Subscribe-Form.html?form_type=compact&ty_page_url=https%3A%2F%2Flogrhythm.com%2Fblog-newsletter-subscription-ty%2F&resizeGuid=DB9FB6E2-35C7-4E17-81C4-2CE5AFDBB9B8&page_url=https%3A%2F%2Flogrhythm.com%2Fblog%2Fdetecting-dns-tunneling%2F Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f11c:8083:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US), Reverse DNS Software proxygen-bolt / Resource Hash 10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Sec-Fetch-Mode no-cors Referer https://ecrm.logrhythm.com/Guided-Blog-Subscribe-Form.html?form_type=compact&ty_page_url=https%3A%2F%2Flogrhythm.com%2Fblog-newsletter-subscription-ty%2F&resizeGuid=DB9FB6E2-35C7-4E17-81C4-2CE5AFDBB9B8&page_url=https%3A%2F%2Flogrhythm.com%2Fblog%2Fdetecting-dns-tunneling%2F User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Mon, 14 Oct 2019 05:04:11 GMT last-modified Fri, 21 Dec 2012 00:00:01 GMT server proxygen-bolt strict-transport-security max-age=31536000; includeSubDomains content-type image/gif status 200 cache-control no-cache, must-revalidate, max-age=0 content-length 44 expires Mon, 14 Oct 2019 05:04:11 GMT
GET H2	200	/ Show response googleads.g.doubleclick.net/pagead/viewthroughconversion/1070386004/ Frame 1AE1	3 KB 1 KB	18ms 18ms	Script text/javascript	2a00:1450:4001:824::2002 Google LLC
General Check archive.org Show headers Download Go to Full URL https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1070386004/?random=1571029451516&cv=9&fst=1571029451516&num=1&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2wga21&sendb=1&ig=1&frm=2&url=https%3A%2F%2Fecrm.logrhythm.com%2FGuided-Blog-Subscribe-Form.html%3Fform_type%3Dcompact%26ty_page_url%3Dhttps%253A%252F%252Flogrhythm.com%252Fblog-newsletter-subscription-ty%252F%26resizeGuid%3DDB9FB6E2-35C7-4E17-81C4-2CE5AFDBB9B8%26page_url%3Dhttps%253A%252F%252Flogrhythm.com%252Fblog%252Fdetecting-dns-tunneling%252F&ref=https%3A%2F%2Flogrhythm.com%2Fblog%2Fdetecting-dns-tunneling%2F&async=1&rfmt=3&fmt=4 Requested by Host: www.googleadservices.com URL: https://www.googleadservices.com/pagead/conversion_async.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:824::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US), Reverse DNS Software cafe / Resource Hash 60dc13948ba3e8b9e6a0391a87efa2df5895049fd4c8691c1d39b9bba77b89fa Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Sec-Fetch-Mode no-cors Referer https://ecrm.logrhythm.com/Guided-Blog-Subscribe-Form.html?form_type=compact&ty_page_url=https%3A%2F%2Flogrhythm.com%2Fblog-newsletter-subscription-ty%2F&resizeGuid=DB9FB6E2-35C7-4E17-81C4-2CE5AFDBB9B8&page_url=https%3A%2F%2Flogrhythm.com%2Fblog%2Fdetecting-dns-tunneling%2F User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers pragma no-cache date Mon, 14 Oct 2019 05:04:11 GMT content-encoding gzip x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" status 200 cache-control no-cache, must-revalidate content-disposition attachment; filename="f.txt" content-type text/javascript; charset=UTF-8 alt-svc quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 1072 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	/ Show response googleads.g.doubleclick.net/pagead/viewthroughconversion/903108792/ Frame 1AE1	3 KB 1 KB	20ms 20ms	Script text/javascript	2a00:1450:4001:824::2002 Google LLC
General Check archive.org Show headers Download Go to Full URL https://googleads.g.doubleclick.net/pagead/viewthroughconversion/903108792/?random=1571029451517&cv=9&fst=1571029451517&num=1&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2wga21&sendb=1&ig=1&frm=2&url=https%3A%2F%2Fecrm.logrhythm.com%2FGuided-Blog-Subscribe-Form.html%3Fform_type%3Dcompact%26ty_page_url%3Dhttps%253A%252F%252Flogrhythm.com%252Fblog-newsletter-subscription-ty%252F%26resizeGuid%3DDB9FB6E2-35C7-4E17-81C4-2CE5AFDBB9B8%26page_url%3Dhttps%253A%252F%252Flogrhythm.com%252Fblog%252Fdetecting-dns-tunneling%252F&ref=https%3A%2F%2Flogrhythm.com%2Fblog%2Fdetecting-dns-tunneling%2F&async=1&rfmt=3&fmt=4 Requested by Host: www.googleadservices.com URL: https://www.googleadservices.com/pagead/conversion_async.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:824::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US), Reverse DNS Software cafe / Resource Hash d44d11b60c7a412b096521f47d0551113873cfe29de796e81a5e9f7fe1e370fa Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Sec-Fetch-Mode no-cors Referer https://ecrm.logrhythm.com/Guided-Blog-Subscribe-Form.html?form_type=compact&ty_page_url=https%3A%2F%2Flogrhythm.com%2Fblog-newsletter-subscription-ty%2F&resizeGuid=DB9FB6E2-35C7-4E17-81C4-2CE5AFDBB9B8&page_url=https%3A%2F%2Flogrhythm.com%2Fblog%2Fdetecting-dns-tunneling%2F User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers pragma no-cache date Mon, 14 Oct 2019 05:04:11 GMT content-encoding gzip x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" status 200 cache-control no-cache, must-revalidate content-disposition attachment; filename="f.txt" content-type text/javascript; charset=UTF-8 alt-svc quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 1069 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	/ www.google.de/pagead/1p-user-list/952414179/ Frame 1AE1 Redirect Chain https://googleads.g.doubleclick.net/pagead/viewthroughconversion/952414179/?random=1571029451517&cv=9&fst=1571029451517&num=1&fmt=3&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=16... https://www.google.com/pagead/1p-user-list/952414179/?random=1571029451517&cv=9&fst=1571029200000&num=1&fmt=3&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_n... https://www.google.de/pagead/1p-user-list/952414179/?random=1571029451517&cv=9&fst=1571029200000&num=1&fmt=3&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_np...	42 B 110 B	21ms 21ms	Image image/gif	2a00:1450:4001:800::2003 Google LLC
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.de/pagead/1p-user-list/952414179/?random=1571029451517&cv=9&fst=1571029200000&num=1&fmt=3&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2wga21&sendb=1&frm=2&url=https%3A%2F%2Fecrm.logrhythm.com%2FGuided-Blog-Subscribe-Form.html%3Fform_type%3Dcompact%26ty_page_url%3Dhttps%253A%252F%252Flogrhythm.com%252Fblog-newsletter-subscription-ty%252F%26resizeGuid%3DDB9FB6E2-35C7-4E17-81C4-2CE5AFDBB9B8%26page_url%3Dhttps%253A%252F%252Flogrhythm.com%252Fblog%252Fdetecting-dns-tunneling%252F&ref=https%3A%2F%2Flogrhythm.com%2Fblog%2Fdetecting-dns-tunneling%2F&async=1&is_vtc=1&random=2025624421&resp=GooglemKTybQhCsO&ipr=y Requested by Host: ecrm.logrhythm.com URL: https://ecrm.logrhythm.com/Guided-Blog-Subscribe-Form.html?form_type=compact&ty_page_url=https%3A%2F%2Flogrhythm.com%2Fblog-newsletter-subscription-ty%2F&resizeGuid=DB9FB6E2-35C7-4E17-81C4-2CE5AFDBB9B8&page_url=https%3A%2F%2Flogrhythm.com%2Fblog%2Fdetecting-dns-tunneling%2F Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:800::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value Content-Security-Policy script-src 'none'; object-src 'none' X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://ecrm.logrhythm.com/Guided-Blog-Subscribe-Form.html?form_type=compact&ty_page_url=https%3A%2F%2Flogrhythm.com%2Fblog-newsletter-subscription-ty%2F&resizeGuid=DB9FB6E2-35C7-4E17-81C4-2CE5AFDBB9B8&page_url=https%3A%2F%2Flogrhythm.com%2Fblog%2Fdetecting-dns-tunneling%2F User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers pragma no-cache date Mon, 14 Oct 2019 05:04:11 GMT x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" status 200 cache-control no-cache, no-store, must-revalidate content-security-policy script-src 'none'; object-src 'none' content-type image/gif alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT Redirect headers pragma no-cache date Mon, 14 Oct 2019 05:04:11 GMT x-content-type-options nosniff server cafe p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" status 302 content-type image/gif location https://www.google.de/pagead/1p-user-list/952414179/?random=1571029451517&cv=9&fst=1571029200000&num=1&fmt=3&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2wga21&sendb=1&frm=2&url=https%3A%2F%2Fecrm.logrhythm.com%2FGuided-Blog-Subscribe-Form.html%3Fform_type%3Dcompact%26ty_page_url%3Dhttps%253A%252F%252Flogrhythm.com%252Fblog-newsletter-subscription-ty%252F%26resizeGuid%3DDB9FB6E2-35C7-4E17-81C4-2CE5AFDBB9B8%26page_url%3Dhttps%253A%252F%252Flogrhythm.com%252Fblog%252Fdetecting-dns-tunneling%252F&ref=https%3A%2F%2Flogrhythm.com%2Fblog%2Fdetecting-dns-tunneling%2F&async=1&is_vtc=1&random=2025624421&resp=GooglemKTybQhCsO&ipr=y cache-control no-cache, no-store, must-revalidate content-security-policy script-src 'none'; object-src 'none' timing-allow-origin * alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	/ www.google.com/pagead/1p-user-list/1070386004/ Frame 1AE1	42 B 118 B	23ms 23ms	Image image/gif	2a00:1450:4001:820::2004 Google LLC
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.com/pagead/1p-user-list/1070386004/?random=1571029451516&cv=9&fst=1571029200000&num=1&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2wga21&sendb=1&frm=2&url=https%3A%2F%2Fecrm.logrhythm.com%2FGuided-Blog-Subscribe-Form.html%3Fform_type%3Dcompact%26ty_page_url%3Dhttps%253A%252F%252Flogrhythm.com%252Fblog-newsletter-subscription-ty%252F%26resizeGuid%3DDB9FB6E2-35C7-4E17-81C4-2CE5AFDBB9B8%26page_url%3Dhttps%253A%252F%252Flogrhythm.com%252Fblog%252Fdetecting-dns-tunneling%252F&ref=https%3A%2F%2Flogrhythm.com%2Fblog%2Fdetecting-dns-tunneling%2F&async=1&fmt=3&is_vtc=1&random=1405948306&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y Requested by Host: ecrm.logrhythm.com URL: https://ecrm.logrhythm.com/Guided-Blog-Subscribe-Form.html?form_type=compact&ty_page_url=https%3A%2F%2Flogrhythm.com%2Fblog-newsletter-subscription-ty%2F&resizeGuid=DB9FB6E2-35C7-4E17-81C4-2CE5AFDBB9B8&page_url=https%3A%2F%2Flogrhythm.com%2Fblog%2Fdetecting-dns-tunneling%2F Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:820::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value Content-Security-Policy script-src 'none'; object-src 'none' X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Sec-Fetch-Mode no-cors Referer https://ecrm.logrhythm.com/Guided-Blog-Subscribe-Form.html?form_type=compact&ty_page_url=https%3A%2F%2Flogrhythm.com%2Fblog-newsletter-subscription-ty%2F&resizeGuid=DB9FB6E2-35C7-4E17-81C4-2CE5AFDBB9B8&page_url=https%3A%2F%2Flogrhythm.com%2Fblog%2Fdetecting-dns-tunneling%2F User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers pragma no-cache date Mon, 14 Oct 2019 05:04:11 GMT x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" status 200 cache-control no-cache, no-store, must-revalidate content-security-policy script-src 'none'; object-src 'none' content-type image/gif alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	/ www.google.de/pagead/1p-user-list/1070386004/ Frame 1AE1	42 B 110 B	23ms 22ms	Image image/gif	2a00:1450:4001:800::2003 Google LLC
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.de/pagead/1p-user-list/1070386004/?random=1571029451516&cv=9&fst=1571029200000&num=1&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2wga21&sendb=1&frm=2&url=https%3A%2F%2Fecrm.logrhythm.com%2FGuided-Blog-Subscribe-Form.html%3Fform_type%3Dcompact%26ty_page_url%3Dhttps%253A%252F%252Flogrhythm.com%252Fblog-newsletter-subscription-ty%252F%26resizeGuid%3DDB9FB6E2-35C7-4E17-81C4-2CE5AFDBB9B8%26page_url%3Dhttps%253A%252F%252Flogrhythm.com%252Fblog%252Fdetecting-dns-tunneling%252F&ref=https%3A%2F%2Flogrhythm.com%2Fblog%2Fdetecting-dns-tunneling%2F&async=1&fmt=3&is_vtc=1&random=1405948306&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y Requested by Host: ecrm.logrhythm.com URL: https://ecrm.logrhythm.com/Guided-Blog-Subscribe-Form.html?form_type=compact&ty_page_url=https%3A%2F%2Flogrhythm.com%2Fblog-newsletter-subscription-ty%2F&resizeGuid=DB9FB6E2-35C7-4E17-81C4-2CE5AFDBB9B8&page_url=https%3A%2F%2Flogrhythm.com%2Fblog%2Fdetecting-dns-tunneling%2F Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:800::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value Content-Security-Policy script-src 'none'; object-src 'none' X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Sec-Fetch-Mode no-cors Referer https://ecrm.logrhythm.com/Guided-Blog-Subscribe-Form.html?form_type=compact&ty_page_url=https%3A%2F%2Flogrhythm.com%2Fblog-newsletter-subscription-ty%2F&resizeGuid=DB9FB6E2-35C7-4E17-81C4-2CE5AFDBB9B8&page_url=https%3A%2F%2Flogrhythm.com%2Fblog%2Fdetecting-dns-tunneling%2F User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers pragma no-cache date Mon, 14 Oct 2019 05:04:11 GMT x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" status 200 cache-control no-cache, no-store, must-revalidate content-security-policy script-src 'none'; object-src 'none' content-type image/gif alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	/ www.google.com/pagead/1p-user-list/903108792/ Frame 1AE1	42 B 118 B	21ms 21ms	Image image/gif	2a00:1450:4001:820::2004 Google LLC
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.com/pagead/1p-user-list/903108792/?random=1571029451517&cv=9&fst=1571029200000&num=1&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2wga21&sendb=1&frm=2&url=https%3A%2F%2Fecrm.logrhythm.com%2FGuided-Blog-Subscribe-Form.html%3Fform_type%3Dcompact%26ty_page_url%3Dhttps%253A%252F%252Flogrhythm.com%252Fblog-newsletter-subscription-ty%252F%26resizeGuid%3DDB9FB6E2-35C7-4E17-81C4-2CE5AFDBB9B8%26page_url%3Dhttps%253A%252F%252Flogrhythm.com%252Fblog%252Fdetecting-dns-tunneling%252F&ref=https%3A%2F%2Flogrhythm.com%2Fblog%2Fdetecting-dns-tunneling%2F&async=1&fmt=3&is_vtc=1&random=1601823698&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y Requested by Host: ecrm.logrhythm.com URL: https://ecrm.logrhythm.com/Guided-Blog-Subscribe-Form.html?form_type=compact&ty_page_url=https%3A%2F%2Flogrhythm.com%2Fblog-newsletter-subscription-ty%2F&resizeGuid=DB9FB6E2-35C7-4E17-81C4-2CE5AFDBB9B8&page_url=https%3A%2F%2Flogrhythm.com%2Fblog%2Fdetecting-dns-tunneling%2F Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:820::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value Content-Security-Policy script-src 'none'; object-src 'none' X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Sec-Fetch-Mode no-cors Referer https://ecrm.logrhythm.com/Guided-Blog-Subscribe-Form.html?form_type=compact&ty_page_url=https%3A%2F%2Flogrhythm.com%2Fblog-newsletter-subscription-ty%2F&resizeGuid=DB9FB6E2-35C7-4E17-81C4-2CE5AFDBB9B8&page_url=https%3A%2F%2Flogrhythm.com%2Fblog%2Fdetecting-dns-tunneling%2F User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers pragma no-cache date Mon, 14 Oct 2019 05:04:11 GMT x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" status 200 cache-control no-cache, no-store, must-revalidate content-security-policy script-src 'none'; object-src 'none' content-type image/gif alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	/ www.google.de/pagead/1p-user-list/903108792/ Frame 1AE1	42 B 110 B	21ms 20ms	Image image/gif	2a00:1450:4001:800::2003 Google LLC
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.de/pagead/1p-user-list/903108792/?random=1571029451517&cv=9&fst=1571029200000&num=1&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2wga21&sendb=1&frm=2&url=https%3A%2F%2Fecrm.logrhythm.com%2FGuided-Blog-Subscribe-Form.html%3Fform_type%3Dcompact%26ty_page_url%3Dhttps%253A%252F%252Flogrhythm.com%252Fblog-newsletter-subscription-ty%252F%26resizeGuid%3DDB9FB6E2-35C7-4E17-81C4-2CE5AFDBB9B8%26page_url%3Dhttps%253A%252F%252Flogrhythm.com%252Fblog%252Fdetecting-dns-tunneling%252F&ref=https%3A%2F%2Flogrhythm.com%2Fblog%2Fdetecting-dns-tunneling%2F&async=1&fmt=3&is_vtc=1&random=1601823698&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y Requested by Host: ecrm.logrhythm.com URL: https://ecrm.logrhythm.com/Guided-Blog-Subscribe-Form.html?form_type=compact&ty_page_url=https%3A%2F%2Flogrhythm.com%2Fblog-newsletter-subscription-ty%2F&resizeGuid=DB9FB6E2-35C7-4E17-81C4-2CE5AFDBB9B8&page_url=https%3A%2F%2Flogrhythm.com%2Fblog%2Fdetecting-dns-tunneling%2F Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:800::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value Content-Security-Policy script-src 'none'; object-src 'none' X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Sec-Fetch-Mode no-cors Referer https://ecrm.logrhythm.com/Guided-Blog-Subscribe-Form.html?form_type=compact&ty_page_url=https%3A%2F%2Flogrhythm.com%2Fblog-newsletter-subscription-ty%2F&resizeGuid=DB9FB6E2-35C7-4E17-81C4-2CE5AFDBB9B8&page_url=https%3A%2F%2Flogrhythm.com%2Fblog%2Fdetecting-dns-tunneling%2F User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers pragma no-cache date Mon, 14 Oct 2019 05:04:11 GMT x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" status 200 cache-control no-cache, no-store, must-revalidate content-security-policy script-src 'none'; object-src 'none' content-type image/gif alt-svc quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H/1.1	200 OK	JKDRBTEKQ5DYLPBQZ7OUBG.js Show response s.adroll.com/pixel/QDCFINCFT5HK5FU45EXRDS/RG6IRLN6UZHIPJAJPJJ7E2/ Frame 1AE1 Redirect Chain https://d.adroll.com/pixel/QDCFINCFT5HK5FU45EXRDS/RG6IRLN6UZHIPJAJPJJ7E2?adroll_fpc=b89517a11da139a0e00064165659899d-1571029451235&xid_ch=f&pv=51206354542.89251&cookie=JKDRBTEKQ5DYLPBQZ7OUBG%3A1%7C... https://s.adroll.com/pixel/QDCFINCFT5HK5FU45EXRDS/RG6IRLN6UZHIPJAJPJJ7E2/JKDRBTEKQ5DYLPBQZ7OUBG.js	6 KB 3 KB	26ms 26ms	Script text/javascript	2.18.233.40 Akamai Technologies
General Check archive.org Show headers Download Go to Full URL https://s.adroll.com/pixel/QDCFINCFT5HK5FU45EXRDS/RG6IRLN6UZHIPJAJPJJ7E2/JKDRBTEKQ5DYLPBQZ7OUBG.js Requested by Host: ecrm.logrhythm.com URL: https://ecrm.logrhythm.com/Guided-Blog-Subscribe-Form.html?form_type=compact&ty_page_url=https%3A%2F%2Flogrhythm.com%2Fblog-newsletter-subscription-ty%2F&resizeGuid=DB9FB6E2-35C7-4E17-81C4-2CE5AFDBB9B8&page_url=https%3A%2F%2Flogrhythm.com%2Fblog%2Fdetecting-dns-tunneling%2F Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2.18.233.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US), Reverse DNS a2-18-233-40.deploy.static.akamaitechnologies.com Software AmazonS3 / Resource Hash 9382440acc4b3de2503b5b04c728d47db4b26e2a8405d72391678ec5ac223fb2 Request headers Referer https://ecrm.logrhythm.com/Guided-Blog-Subscribe-Form.html?form_type=compact&ty_page_url=https%3A%2F%2Flogrhythm.com%2Fblog-newsletter-subscription-ty%2F&resizeGuid=DB9FB6E2-35C7-4E17-81C4-2CE5AFDBB9B8&page_url=https%3A%2F%2Flogrhythm.com%2Fblog%2Fdetecting-dns-tunneling%2F User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers x-amz-version-id gfb7_P2NN7MNKvUMKcy0upFNRhrsXlKI Content-Encoding gzip ETag "b2c777af626db6069711bf3b752e87d8" x-amz-request-id C5755CAB701780B8 x-amz-server-side-encryption AES256 Connection keep-alive Vary Accept-Encoding Content-Length 1972 x-amz-id-2 J3nS9q5zjIB7siKlm36Dz4UOoXc93/8Q+T1azOumEslveW0tLocD4MR7sQawdkX5YBk8x4D8Ivs= Last-Modified Thu, 10 Oct 2019 20:51:42 GMT Server AmazonS3 Date Mon, 14 Oct 2019 05:04:11 GMT Access-Control-Max-Age 600 Access-Control-Allow-Methods GET Content-Type text/javascript; charset=utf-8 Access-Control-Allow-Origin * Cache-Control max-age=3600, must-revalidate Access-Control-Allow-Credentials false Accept-Ranges bytes Access-Control-Allow-Headers * Redirect headers Date Mon, 14 Oct 2019 05:04:11 GMT X-Segment-Display-Name P3P CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA" Connection keep-alive Content-Length 0 Pragma no-cache X-Conversion-Value 0.0 Server nginx/1.14.1 X-Rule * X-Segment-Eid JKDRBTEKQ5DYLPBQZ7OUBG Location https://s.adroll.com/pixel/QDCFINCFT5HK5FU45EXRDS/RG6IRLN6UZHIPJAJPJJ7E2/JKDRBTEKQ5DYLPBQZ7OUBG.js Cache-Control no-store, no-cache, must-revalidate X-Pixel-Eid RG6IRLN6UZHIPJAJPJJ7E2 X-Segment-Name * X-Advertisable-Eid QDCFINCFT5HK5FU45EXRDS X-Conversion-Currency
GET H/1.1	200 OK	visitWebPage Show response 050-uwt-888.mktoresp.com/webevents/ Frame 1AE1	2 B 303 B	191ms 98ms	XHR text/plain	192.28.144.124 Adobe Systems Inc.
General Check archive.org Show headers Download Go to Full URL https://050-uwt-888.mktoresp.com/webevents/visitWebPage?_mchNc=1571029451571&_mchCn=Guided-Blog-Subscribe-Form&_mchId=050-UWT-888&_mchTk=_mch-logrhythm.com-1571029451124-22571&_mchWs=j1RR&_mchHo=ecrm.logrhythm.com&_mchPo=&_mchRu=%2FGuided-Blog-Subscribe-Form.html&_mchPc=https%3A&_mchVr=155&_mchHa=&_mchRe=https%3A%2F%2Flogrhythm.com%2Fblog%2Fdetecting-dns-tunneling%2F&_mchQp=form_type%3Dcompact__-__ty_page_url%3Dhttps%3A%2F%2Flogrhythm.com%2Fblog-newsletter-subscription-ty%2F__-__resizeGuid%3DDB9FB6E2-35C7-4E17-81C4-2CE5AFDBB9B8__-__page_url%3Dhttps%3A%2F%2Flogrhythm.com%2Fblog%2Fdetecting-dns-tunneling%2F Requested by Host: munchkin.marketo.net URL: https://munchkin.marketo.net/155/munchkin.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 192.28.144.124 , United States, ASN15224 (OMNITURE - Adobe Systems Inc., US), Reverse DNS Software akka-http/10.1.7 / Resource Hash 565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3 Request headers Sec-Fetch-Mode cors Referer https://ecrm.logrhythm.com/Guided-Blog-Subscribe-Form.html?form_type=compact&ty_page_url=https%3A%2F%2Flogrhythm.com%2Fblog-newsletter-subscription-ty%2F&resizeGuid=DB9FB6E2-35C7-4E17-81C4-2CE5AFDBB9B8&page_url=https%3A%2F%2Flogrhythm.com%2Fblog%2Fdetecting-dns-tunneling%2F User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Access-Control-Allow-Origin * Date Mon, 14 Oct 2019 05:04:11 GMT Content-Encoding gzip Server akka-http/10.1.7 Transfer-Encoding chunked X-Request-Id 26c85320-0831-4937-be96-ff212e3aa938 Content-Type text/plain; charset=UTF-8
POST H2	200	/ www.facebook.com/tr/	0 81 B	16ms 3ms	Other text/plain	2a03:2880:f11c:8083:face:b00c:0:25de Facebook
General Check archive.org Show headers Download Go to Full URL https://www.facebook.com/tr/ Requested by Host: connect.facebook.net URL: https://connect.facebook.net/en_US/fbevents.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f11c:8083:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US), Reverse DNS Software proxygen-bolt / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Sec-Fetch-Mode no-cors Referer https://logrhythm.com/blog/detecting-dns-tunneling/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type multipart/form-data; boundary=----WebKitFormBoundaryLga9aOQzHW4t8JWD Response headers strict-transport-security max-age=31536000; includeSubDomains server proxygen-bolt date Mon, 14 Oct 2019 05:04:11 GMT status 200 content-type text/plain access-control-allow-origin https://logrhythm.com access-control-allow-credentials true content-length 0
GET H/1.1	200 OK	rum dsum-sec.casalemedia.com/ Frame 1AE1 Redirect Chain https://d.adroll.com/cm/index/out?adroll_fpc=b89517a11da139a0e00064165659899d-1571029451235&xid_ch=f&advertisable=QDCFINCFT5HK5FU45EXRDS https://dsum-sec.casalemedia.com/rum?cm_dsp_id=105&external_user_id=MjBkZjg3ZDQxNjYxYjk5YjE1OTE4YmZiZTYzNDY1NGQ&expiration=1602565451	43 B 799 B	30ms 30ms	Image image/gif	2.18.234.21 Akamai Technologies
General Check archive.org Show headers Download Go to Show image Full URL https://dsum-sec.casalemedia.com/rum?cm_dsp_id=105&external_user_id=MjBkZjg3ZDQxNjYxYjk5YjE1OTE4YmZiZTYzNDY1NGQ&expiration=1602565451 Requested by Host: ecrm.logrhythm.com URL: https://ecrm.logrhythm.com/Guided-Blog-Subscribe-Form.html?form_type=compact&ty_page_url=https%3A%2F%2Flogrhythm.com%2Fblog-newsletter-subscription-ty%2F&resizeGuid=DB9FB6E2-35C7-4E17-81C4-2CE5AFDBB9B8&page_url=https%3A%2F%2Flogrhythm.com%2Fblog%2Fdetecting-dns-tunneling%2F Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2.18.234.21 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US), Reverse DNS a2-18-234-21.deploy.static.akamaitechnologies.com Software Apache / Resource Hash b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b Request headers Referer https://ecrm.logrhythm.com/Guided-Blog-Subscribe-Form.html?form_type=compact&ty_page_url=https%3A%2F%2Flogrhythm.com%2Fblog-newsletter-subscription-ty%2F&resizeGuid=DB9FB6E2-35C7-4E17-81C4-2CE5AFDBB9B8&page_url=https%3A%2F%2Flogrhythm.com%2Fblog%2Fdetecting-dns-tunneling%2F User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Pragma no-cache Date Mon, 14 Oct 2019 05:04:11 GMT Server Apache P3P policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI" Cache-Control max-age=0, no-cache, no-store Connection keep-alive Content-Type image/gif Content-Length 43 Expires Mon, 14 Oct 2019 05:04:11 GMT Redirect headers Pragma no-cache Date Mon, 14 Oct 2019 05:04:11 GMT Server nginx/1.14.1 P3P CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA" Location https://dsum-sec.casalemedia.com/rum?cm_dsp_id=105&external_user_id=MjBkZjg3ZDQxNjYxYjk5YjE1OTE4YmZiZTYzNDY1NGQ&expiration=1602565451 Cache-Control no-store, no-cache, must-revalidate Connection keep-alive Content-Length 139
GET H2	200	cookie-sync sync.outbrain.com/ Frame 1AE1 Redirect Chain https://d.adroll.com/cm/outbrain/out?adroll_fpc=b89517a11da139a0e00064165659899d-1571029451235&xid_ch=f&advertisable=QDCFINCFT5HK5FU45EXRDS https://sync.outbrain.com/cookie-sync?p=adroll&uid=MjBkZjg3ZDQxNjYxYjk5YjE1OTE4YmZiZTYzNDY1NGQ https://sync.outbrain.com/cookie-sync?p=adroll&uid=MjBkZjg3ZDQxNjYxYjk5YjE1OTE4YmZiZTYzNDY1NGQ&rdrctExp=true	0 125 B	134ms 134ms	Image text/plain	151.101.14.2 Fastly
General Check archive.org Show headers Download Go to Show image Full URL https://sync.outbrain.com/cookie-sync?p=adroll&uid=MjBkZjg3ZDQxNjYxYjk5YjE1OTE4YmZiZTYzNDY1NGQ&rdrctExp=true Requested by Host: ecrm.logrhythm.com URL: https://ecrm.logrhythm.com/Guided-Blog-Subscribe-Form.html?form_type=compact&ty_page_url=https%3A%2F%2Flogrhythm.com%2Fblog-newsletter-subscription-ty%2F&resizeGuid=DB9FB6E2-35C7-4E17-81C4-2CE5AFDBB9B8&page_url=https%3A%2F%2Flogrhythm.com%2Fblog%2Fdetecting-dns-tunneling%2F Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.14.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://ecrm.logrhythm.com/Guided-Blog-Subscribe-Form.html?form_type=compact&ty_page_url=https%3A%2F%2Flogrhythm.com%2Fblog-newsletter-subscription-ty%2F&resizeGuid=DB9FB6E2-35C7-4E17-81C4-2CE5AFDBB9B8&page_url=https%3A%2F%2Flogrhythm.com%2Fblog%2Fdetecting-dns-tunneling%2F User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Mon, 14 Oct 2019 05:04:11 GMT via 1.1 varnish, 1.1 varnish traffic-path CHIDC2, MDW, FRA, Europe2 x-timer S1571029452.822800,VS0,VE112 accept-ranges bytes, bytes x-served-by cache-mdw17377-MDW, cache-fra19149-FRA x-cache MISS, MISS status 200 backend-ip 157.52.75.77 x-traceid 7a426cfa5602a36a376fb1c5b3f255c0 content-length 0 x-cache-hits 0, 0 Redirect headers date Mon, 14 Oct 2019 05:04:11 GMT via 1.1 varnish, 1.1 varnish traffic-path CHIDC2, MDW, FRA, Europe2 x-timer S1571029452.692761,VS0,VE108 accept-ranges bytes, bytes x-served-by cache-mdw17366-MDW, cache-fra19149-FRA status 302 x-cache MISS, MISS location https://sync.outbrain.com/cookie-sync?p=adroll&uid=MjBkZjg3ZDQxNjYxYjk5YjE1OTE4YmZiZTYzNDY1NGQ&rdrctExp=true backend-ip 157.52.75.66 x-traceid abbfa6c54b27b93a995dae317e70b8f6 content-length 0 x-cache-hits 0, 0
GET H/1.1	200 OK	in d.adroll.com/cm/r/ Frame 1AE1 Redirect Chain https://d.adroll.com/cm/r/out?adroll_fpc=b89517a11da139a0e00064165659899d-1571029451235&xid_ch=f&advertisable=QDCFINCFT5HK5FU45EXRDS https://ads.yahoo.com/cms/v1?esig=1~bf4e7dc4546a90c08591652d78a230d3f2ef5733&nwid=10001032567&sigv=1&gdpr=1&gdpr_consent=BOOla_OOOla_OA2ABBENAkwAAAAXyACAAyAIIA https://d.adroll.com/cm/r/in?xid=E0&gdpr=1&gdpr_consent=BOOla_OOOla_OA2ABBENAkwAAAAXyACAAyAIIA	42 B 488 B	34ms 33ms	Image image/gif	54.75.248.80 Amazon.com
General Check archive.org Show headers Download Go to Show image Full URL https://d.adroll.com/cm/r/in?xid=E0&gdpr=1&gdpr_consent=BOOla_OOOla_OA2ABBENAkwAAAAXyACAAyAIIA Requested by Host: ecrm.logrhythm.com URL: https://ecrm.logrhythm.com/Guided-Blog-Subscribe-Form.html?form_type=compact&ty_page_url=https%3A%2F%2Flogrhythm.com%2Fblog-newsletter-subscription-ty%2F&resizeGuid=DB9FB6E2-35C7-4E17-81C4-2CE5AFDBB9B8&page_url=https%3A%2F%2Flogrhythm.com%2Fblog%2Fdetecting-dns-tunneling%2F Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 54.75.248.80 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US), Reverse DNS ec2-54-75-248-80.eu-west-1.compute.amazonaws.com Software nginx/1.14.1 / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Request headers Referer https://ecrm.logrhythm.com/Guided-Blog-Subscribe-Form.html?form_type=compact&ty_page_url=https%3A%2F%2Flogrhythm.com%2Fblog-newsletter-subscription-ty%2F&resizeGuid=DB9FB6E2-35C7-4E17-81C4-2CE5AFDBB9B8&page_url=https%3A%2F%2Flogrhythm.com%2Fblog%2Fdetecting-dns-tunneling%2F User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Pragma no-cache Date Mon, 14 Oct 2019 05:04:11 GMT Server nginx/1.14.1 P3P CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA" Cache-Control no-store, no-cache, must-revalidate Connection keep-alive Content-Type image/gif Content-Length 42 Redirect headers Date Mon, 14 Oct 2019 05:04:11 GMT X-Content-Type-Options nosniff Server ATS Age 0 Expect-CT max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only" Strict-Transport-Security max-age=31536000 P3P policyref="https://policies.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE LOC GOV" Location https://d.adroll.com/cm/r/in?xid=E0&gdpr=1&gdpr_consent=BOOla_OOOla_OA2ABBENAkwAAAAXyACAAyAIIA Connection keep-alive Content-Length 0 X-XSS-Protection 1; mode=block
GET H2	204	/ trc.taboola.com/sg/adroll-network/1/rtb-h/ Frame 1AE1 Redirect Chain https://d.adroll.com/cm/taboola/out?adroll_fpc=b89517a11da139a0e00064165659899d-1571029451235&xid_ch=f&advertisable=QDCFINCFT5HK5FU45EXRDS https://trc.taboola.com/sg/adroll-network/1/rtb-h/?taboola_hm=MjBkZjg3ZDQxNjYxYjk5YjE1OTE4YmZiZTYzNDY1NGQ	0 49 B	32ms 32ms	Image text/plain	151.101.114.2 Fastly
General Check archive.org Show headers Download Go to Show image Full URL https://trc.taboola.com/sg/adroll-network/1/rtb-h/?taboola_hm=MjBkZjg3ZDQxNjYxYjk5YjE1OTE4YmZiZTYzNDY1NGQ Requested by Host: ecrm.logrhythm.com URL: https://ecrm.logrhythm.com/Guided-Blog-Subscribe-Form.html?form_type=compact&ty_page_url=https%3A%2F%2Flogrhythm.com%2Fblog-newsletter-subscription-ty%2F&resizeGuid=DB9FB6E2-35C7-4E17-81C4-2CE5AFDBB9B8&page_url=https%3A%2F%2Flogrhythm.com%2Fblog%2Fdetecting-dns-tunneling%2F Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 151.101.114.2 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US), Reverse DNS Software nginx / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://ecrm.logrhythm.com/Guided-Blog-Subscribe-Form.html?form_type=compact&ty_page_url=https%3A%2F%2Flogrhythm.com%2Fblog-newsletter-subscription-ty%2F&resizeGuid=DB9FB6E2-35C7-4E17-81C4-2CE5AFDBB9B8&page_url=https%3A%2F%2Flogrhythm.com%2Fblog%2Fdetecting-dns-tunneling%2F User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Mon, 14 Oct 2019 05:04:11 GMT via 1.1 varnish server nginx x-timer S1571029452.693223,VS0,VE8 x-cache MISS status 204 x-cache-hits 0 accept-ranges bytes x-served-by cache-hhn4052-HHN Redirect headers Pragma no-cache Date Mon, 14 Oct 2019 05:04:11 GMT Server nginx/1.14.1 P3P CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA" Location https://trc.taboola.com/sg/adroll-network/1/rtb-h/?taboola_hm=MjBkZjg3ZDQxNjYxYjk5YjE1OTE4YmZiZTYzNDY1NGQ Cache-Control no-store, no-cache, must-revalidate Connection keep-alive Content-Length 111
GET H2	200	xuid eb2.3lift.com/ Frame 1AE1 Redirect Chain https://d.adroll.com/cm/triplelift/out?adroll_fpc=b89517a11da139a0e00064165659899d-1571029451235&xid_ch=f&advertisable=QDCFINCFT5HK5FU45EXRDS https://eb2.3lift.com/xuid?mid=4714&xuid=MjBkZjg3ZDQxNjYxYjk5YjE1OTE4YmZiZTYzNDY1NGQ&dongle=c85e	37 B 335 B	29ms 29ms	Image image/gif	52.58.86.83 Amazon.com
General Check archive.org Show headers Download Go to Show image Full URL https://eb2.3lift.com/xuid?mid=4714&xuid=MjBkZjg3ZDQxNjYxYjk5YjE1OTE4YmZiZTYzNDY1NGQ&dongle=c85e Requested by Host: ecrm.logrhythm.com URL: https://ecrm.logrhythm.com/Guided-Blog-Subscribe-Form.html?form_type=compact&ty_page_url=https%3A%2F%2Flogrhythm.com%2Fblog-newsletter-subscription-ty%2F&resizeGuid=DB9FB6E2-35C7-4E17-81C4-2CE5AFDBB9B8&page_url=https%3A%2F%2Flogrhythm.com%2Fblog%2Fdetecting-dns-tunneling%2F Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.58.86.83 Frankfurt am Main, Germany, ASN16509 (AMAZON-02 - Amazon.com, Inc., US), Reverse DNS ec2-52-58-86-83.eu-central-1.compute.amazonaws.com Software / Resource Hash bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96 Request headers Referer https://ecrm.logrhythm.com/Guided-Blog-Subscribe-Form.html?form_type=compact&ty_page_url=https%3A%2F%2Flogrhythm.com%2Fblog-newsletter-subscription-ty%2F&resizeGuid=DB9FB6E2-35C7-4E17-81C4-2CE5AFDBB9B8&page_url=https%3A%2F%2Flogrhythm.com%2Fblog%2Fdetecting-dns-tunneling%2F User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers status 200 date Mon, 14 Oct 2019 05:04:11 GMT cache-control no-cache, no-store, must-revalidate content-type image/gif content-length 37 p3p policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC" Redirect headers Pragma no-cache Date Mon, 14 Oct 2019 05:04:11 GMT Server nginx/1.14.1 P3P CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA" Location https://eb2.3lift.com/xuid?mid=4714&xuid=MjBkZjg3ZDQxNjYxYjk5YjE1OTE4YmZiZTYzNDY1NGQ&dongle=c85e Cache-Control no-store, no-cache, must-revalidate Connection keep-alive Content-Length 102
GET H/1.1	200 OK	sendrolling.js Show response s.adroll.com/j/ Frame 1AE1	9 KB 3 KB	29ms 27ms	Script text/javascript	2.18.233.40 Akamai Technologies
General Check archive.org Show headers Download Go to Full URL https://s.adroll.com/j/sendrolling.js Requested by Host: s.adroll.com URL: https://s.adroll.com/pixel/QDCFINCFT5HK5FU45EXRDS/RG6IRLN6UZHIPJAJPJJ7E2/JKDRBTEKQ5DYLPBQZ7OUBG.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2.18.233.40 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US), Reverse DNS a2-18-233-40.deploy.static.akamaitechnologies.com Software AmazonS3 / Resource Hash 1bdbcee5cd776cb671f72362db4be8dde833057b8e8f816c86fd301896652c8d Request headers Sec-Fetch-Mode no-cors Referer https://ecrm.logrhythm.com/Guided-Blog-Subscribe-Form.html?form_type=compact&ty_page_url=https%3A%2F%2Flogrhythm.com%2Fblog-newsletter-subscription-ty%2F&resizeGuid=DB9FB6E2-35C7-4E17-81C4-2CE5AFDBB9B8&page_url=https%3A%2F%2Flogrhythm.com%2Fblog%2Fdetecting-dns-tunneling%2F User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers x-amz-version-id MoLWhO2.QuEN6uxWTtfGTs9VNo6GBT4q Content-Encoding gzip ETag "15441b08d0c4f93b1dd5f533cd361cd8" x-amz-request-id 8D66B12AEC1FE16F x-amz-server-side-encryption AES256 Connection keep-alive Vary Accept-Encoding Content-Length 2039 x-amz-id-2 U03k8W+834KnzjHY1HWwJBpUJGIUw1OrdeDx2NV4ro8fdV068lw0rs7u1JTVs0/hT895iGPnM+w= Last-Modified Thu, 10 Oct 2019 01:46:34 GMT Server AmazonS3 Date Mon, 14 Oct 2019 05:04:11 GMT Access-Control-Max-Age 600 Access-Control-Allow-Methods GET Content-Type text/javascript Access-Control-Allow-Origin * Cache-Control max-age=3600 Access-Control-Allow-Credentials false Accept-Ranges bytes Access-Control-Allow-Headers *
GET H/1.1	200 OK	in d.adroll.com/cm/mk/QDCFINCFT5HK5FU45EXRDS/ Frame 1AE1	42 B 488 B	67ms 36ms	Image image/gif	54.75.248.80 Amazon.com
General Check archive.org Show headers Download Go to Show image Full URL https://d.adroll.com/cm/mk/QDCFINCFT5HK5FU45EXRDS/in?id=id%3A050-UWT-888%26token%3A_mch-logrhythm.com-1571029451124-22571 Requested by Host: s.adroll.com URL: https://s.adroll.com/pixel/QDCFINCFT5HK5FU45EXRDS/RG6IRLN6UZHIPJAJPJJ7E2/JKDRBTEKQ5DYLPBQZ7OUBG.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 54.75.248.80 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US), Reverse DNS ec2-54-75-248-80.eu-west-1.compute.amazonaws.com Software nginx/1.14.1 / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Request headers Sec-Fetch-Mode no-cors Referer https://ecrm.logrhythm.com/Guided-Blog-Subscribe-Form.html?form_type=compact&ty_page_url=https%3A%2F%2Flogrhythm.com%2Fblog-newsletter-subscription-ty%2F&resizeGuid=DB9FB6E2-35C7-4E17-81C4-2CE5AFDBB9B8&page_url=https%3A%2F%2Flogrhythm.com%2Fblog%2Fdetecting-dns-tunneling%2F User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Pragma no-cache Date Mon, 14 Oct 2019 05:04:11 GMT Server nginx/1.14.1 P3P CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA" Cache-Control no-store, no-cache, must-revalidate Connection keep-alive Content-Type image/gif Content-Length 42
GET H2	200	836361346565242 Show response connect.facebook.net/signals/config/ Frame 1AE1	280 KB 65 KB	9ms 6ms	Script application/x-javascript	2a03:2880:f01c:8012:face:b00c:0:3 Facebook
General Check archive.org Show headers Download Go to Full URL https://connect.facebook.net/signals/config/836361346565242?v=2.9.5&r=stable Requested by Host: connect.facebook.net URL: https://connect.facebook.net/en_US/fbevents.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f01c:8012:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US), Reverse DNS Software / Resource Hash e528bd595dc9790c04f3f7200b61b3816a7f1110d75410de4b0e14c1b27ab2d3 Security Headers Name Value Content-Security-Policy default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm; Strict-Transport-Security max-age=31536000; preload; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 0 Request headers Sec-Fetch-Mode no-cors Referer https://ecrm.logrhythm.com/Guided-Blog-Subscribe-Form.html?form_type=compact&ty_page_url=https%3A%2F%2Flogrhythm.com%2Fblog-newsletter-subscription-ty%2F&resizeGuid=DB9FB6E2-35C7-4E17-81C4-2CE5AFDBB9B8&page_url=https%3A%2F%2Flogrhythm.com%2Fblog%2Fdetecting-dns-tunneling%2F User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers strict-transport-security max-age=31536000; preload; includeSubDomains content-encoding gzip x-content-type-options nosniff status 200 content-length 66233 x-xss-protection 0 pragma public x-fb-debug DT0U0zCujoVRjTVWavVvGFxO8l6+j0dW/2+Gua6CmjFSrWJnIG9Bge7nyK4b8C6VTpzELSYU9UCwAnI37ErL1A== x-fb-trip-id 1850256238 x-frame-options DENY date Mon, 14 Oct 2019 05:04:11 GMT vary Accept-Encoding content-type application/x-javascript; charset=utf-8 cache-control public, max-age=1200 content-security-policy default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm; expires Sat, 01 Jan 2000 00:00:00 GMT
GET H2	200	sync x.bidswitch.net/ Frame 1AE1 Redirect Chain https://d.adroll.com/cm/b/out?adroll_fpc=b89517a11da139a0e00064165659899d-1571029451235&xid_ch=f&advertisable=QDCFINCFT5HK5FU45EXRDS https://x.bidswitch.net/sync?dsp_id=44&user_id=MjBkZjg3ZDQxNjYxYjk5YjE1OTE4YmZiZTYzNDY1NGQ	43 B 212 B	27ms 27ms	Image image/gif	52.29.176.117 Amazon.com
General Check archive.org Show headers Download Go to Show image Full URL https://x.bidswitch.net/sync?dsp_id=44&user_id=MjBkZjg3ZDQxNjYxYjk5YjE1OTE4YmZiZTYzNDY1NGQ Requested by Host: ecrm.logrhythm.com URL: https://ecrm.logrhythm.com/Guided-Blog-Subscribe-Form.html?form_type=compact&ty_page_url=https%3A%2F%2Flogrhythm.com%2Fblog-newsletter-subscription-ty%2F&resizeGuid=DB9FB6E2-35C7-4E17-81C4-2CE5AFDBB9B8&page_url=https%3A%2F%2Flogrhythm.com%2Fblog%2Fdetecting-dns-tunneling%2F Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.29.176.117 Frankfurt am Main, Germany, ASN16509 (AMAZON-02 - Amazon.com, Inc., US), Reverse DNS ec2-52-29-176-117.eu-central-1.compute.amazonaws.com Software / Resource Hash 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87 Request headers Referer https://ecrm.logrhythm.com/Guided-Blog-Subscribe-Form.html?form_type=compact&ty_page_url=https%3A%2F%2Flogrhythm.com%2Fblog-newsletter-subscription-ty%2F&resizeGuid=DB9FB6E2-35C7-4E17-81C4-2CE5AFDBB9B8&page_url=https%3A%2F%2Flogrhythm.com%2Fblog%2Fdetecting-dns-tunneling%2F User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers status 200 date Mon, 14 Oct 2019 05:04:11 GMT cache-control no-cache, no-store, must-revalidate content-type image/gif content-length 43 p3p CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA" Redirect headers Pragma no-cache Date Mon, 14 Oct 2019 05:04:11 GMT Server nginx/1.14.1 P3P CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA" Location https://x.bidswitch.net/sync?dsp_id=44&user_id=MjBkZjg3ZDQxNjYxYjk5YjE1OTE4YmZiZTYzNDY1NGQ Cache-Control no-store, no-cache, must-revalidate Connection keep-alive Content-Length 96
GET H/1.1	200 OK	setuid ib.adnxs.com/ Frame 1AE1 Redirect Chain https://d.adroll.com/cm/x/out?adroll_fpc=b89517a11da139a0e00064165659899d-1571029451235&xid_ch=f&advertisable=QDCFINCFT5HK5FU45EXRDS https://ib.adnxs.com/setuid?entity=172&code=MjBkZjg3ZDQxNjYxYjk5YjE1OTE4YmZiZTYzNDY1NGQ	0 590 B	16ms 15ms	Image text/html	185.33.223.83 AppNexus
General Check archive.org Show headers Download Go to Show image Full URL https://ib.adnxs.com/setuid?entity=172&code=MjBkZjg3ZDQxNjYxYjk5YjE1OTE4YmZiZTYzNDY1NGQ Requested by Host: ecrm.logrhythm.com URL: https://ecrm.logrhythm.com/Guided-Blog-Subscribe-Form.html?form_type=compact&ty_page_url=https%3A%2F%2Flogrhythm.com%2Fblog-newsletter-subscription-ty%2F&resizeGuid=DB9FB6E2-35C7-4E17-81C4-2CE5AFDBB9B8&page_url=https%3A%2F%2Flogrhythm.com%2Fblog%2Fdetecting-dns-tunneling%2F Protocol HTTP/1.1 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 185.33.223.83 , Netherlands, ASN29990 (ASN-APPNEXUS - AppNexus, Inc, US), Reverse DNS 250.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net Software nginx/1.13.4 / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value X-Xss-Protection 0 Request headers Referer https://ecrm.logrhythm.com/Guided-Blog-Subscribe-Form.html?form_type=compact&ty_page_url=https%3A%2F%2Flogrhythm.com%2Fblog-newsletter-subscription-ty%2F&resizeGuid=DB9FB6E2-35C7-4E17-81C4-2CE5AFDBB9B8&page_url=https%3A%2F%2Flogrhythm.com%2Fblog%2Fdetecting-dns-tunneling%2F User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Pragma no-cache Date Mon, 14 Oct 2019 05:04:13 GMT X-Proxy-Origin 109.236.94.21; 109.236.94.21; 250.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.220.109:80 AN-X-Request-Uuid f561000e-4625-48af-bf35-9fa7c186d955 Server nginx/1.13.4 P3P policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" Cache-Control no-store, no-cache, private Connection keep-alive Content-Type text/html; charset=utf-8 Content-Length 0 X-XSS-Protection 0 Expires Sat, 15 Nov 2008 16:00:00 GMT Redirect headers Pragma no-cache Date Mon, 14 Oct 2019 05:04:11 GMT Server nginx/1.14.1 P3P CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA" Location https://ib.adnxs.com/setuid?entity=172&code=MjBkZjg3ZDQxNjYxYjk5YjE1OTE4YmZiZTYzNDY1NGQ Cache-Control no-store, no-cache, must-revalidate Connection keep-alive Content-Length 93
GET H2	204	377928.gif idsync.rlcdn.com/ Frame 1AE1 Redirect Chain https://d.adroll.com/cm/l/out?adroll_fpc=b89517a11da139a0e00064165659899d-1571029451235&xid_ch=f&advertisable=QDCFINCFT5HK5FU45EXRDS https://idsync.rlcdn.com/377928.gif?partner_uid=20df87d41661b99b15918bfbe634654d	0 40 B	116ms 115ms	Image text/plain	35.190.72.21 Google LLC
General Check archive.org Show headers Download Go to Show image Full URL https://idsync.rlcdn.com/377928.gif?partner_uid=20df87d41661b99b15918bfbe634654d Requested by Host: ecrm.logrhythm.com URL: https://ecrm.logrhythm.com/Guided-Blog-Subscribe-Form.html?form_type=compact&ty_page_url=https%3A%2F%2Flogrhythm.com%2Fblog-newsletter-subscription-ty%2F&resizeGuid=DB9FB6E2-35C7-4E17-81C4-2CE5AFDBB9B8&page_url=https%3A%2F%2Flogrhythm.com%2Fblog%2Fdetecting-dns-tunneling%2F Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 35.190.72.21 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US), Reverse DNS 21.72.190.35.bc.googleusercontent.com Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://ecrm.logrhythm.com/Guided-Blog-Subscribe-Form.html?form_type=compact&ty_page_url=https%3A%2F%2Flogrhythm.com%2Fblog-newsletter-subscription-ty%2F&resizeGuid=DB9FB6E2-35C7-4E17-81C4-2CE5AFDBB9B8&page_url=https%3A%2F%2Flogrhythm.com%2Fblog%2Fdetecting-dns-tunneling%2F User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers status 204 date Mon, 14 Oct 2019 05:04:11 GMT via 1.1 google alt-svc clear Redirect headers Pragma no-cache Date Mon, 14 Oct 2019 05:04:11 GMT Server nginx/1.14.1 P3P CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA" Location https://idsync.rlcdn.com/377928.gif?partner_uid=20df87d41661b99b15918bfbe634654d Cache-Control no-store, no-cache, must-revalidate Connection keep-alive Content-Length 86
GET H2	200	sd us-u.openx.net/w/1.0/ Frame 1AE1 Redirect Chain https://d.adroll.com/cm/o/out?adroll_fpc=b89517a11da139a0e00064165659899d-1571029451235&xid_ch=f&advertisable=QDCFINCFT5HK5FU45EXRDS https://us-u.openx.net/w/1.0/sd?id=537103138&val=20df87d41661b99b15918bfbe634654d	43 B 109 B	22ms 22ms	Image image/gif	34.95.120.147 Google LLC
General Check archive.org Show headers Download Go to Show image Full URL https://us-u.openx.net/w/1.0/sd?id=537103138&val=20df87d41661b99b15918bfbe634654d Requested by Host: ecrm.logrhythm.com URL: https://ecrm.logrhythm.com/Guided-Blog-Subscribe-Form.html?form_type=compact&ty_page_url=https%3A%2F%2Flogrhythm.com%2Fblog-newsletter-subscription-ty%2F&resizeGuid=DB9FB6E2-35C7-4E17-81C4-2CE5AFDBB9B8&page_url=https%3A%2F%2Flogrhythm.com%2Fblog%2Fdetecting-dns-tunneling%2F Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.95.120.147 , United States, ASN15169 (GOOGLE - Google LLC, US), Reverse DNS 147.120.95.34.bc.googleusercontent.com Software OXGW/16.163.0 / Resource Hash 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49 Request headers Referer https://ecrm.logrhythm.com/Guided-Blog-Subscribe-Form.html?form_type=compact&ty_page_url=https%3A%2F%2Flogrhythm.com%2Fblog-newsletter-subscription-ty%2F&resizeGuid=DB9FB6E2-35C7-4E17-81C4-2CE5AFDBB9B8&page_url=https%3A%2F%2Flogrhythm.com%2Fblog%2Fdetecting-dns-tunneling%2F User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers pragma no-cache date Mon, 14 Oct 2019 05:04:11 GMT via 1.1 google server OXGW/16.163.0 vary Accept p3p CP="CUR ADM OUR NOR STA NID" status 200 cache-control private, max-age=0, no-cache content-type image/gif alt-svc clear content-length 43 expires Mon, 26 Jul 1997 05:00:00 GMT Redirect headers Pragma no-cache Date Mon, 14 Oct 2019 05:04:11 GMT Server nginx/1.14.1 P3P CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA" Location https://us-u.openx.net/w/1.0/sd?id=537103138&val=20df87d41661b99b15918bfbe634654d Cache-Control no-store, no-cache, must-revalidate Connection keep-alive Content-Length 87
GET H/1.1	200 OK	in d.adroll.com/cm/g/ Frame 1AE1 Redirect Chain https://d.adroll.com/cm/g/out?adroll_fpc=b89517a11da139a0e00064165659899d-1571029451235&xid_ch=f&advertisable=QDCFINCFT5HK5FU45EXRDS&google_nid=adroll5 https://cm.g.doubleclick.net/pixel?google_sc&google_nid=artb&google_hm=IN-H1BZhuZsVkYv75jRlTQ https://d.adroll.com/cm/g/in	42 B 523 B	33ms 32ms	Image image/gif	54.75.248.80 Amazon.com
General Check archive.org Show headers Download Go to Show image Full URL https://d.adroll.com/cm/g/in Requested by Host: ecrm.logrhythm.com URL: https://ecrm.logrhythm.com/Guided-Blog-Subscribe-Form.html?form_type=compact&ty_page_url=https%3A%2F%2Flogrhythm.com%2Fblog-newsletter-subscription-ty%2F&resizeGuid=DB9FB6E2-35C7-4E17-81C4-2CE5AFDBB9B8&page_url=https%3A%2F%2Flogrhythm.com%2Fblog%2Fdetecting-dns-tunneling%2F Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 54.75.248.80 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US), Reverse DNS ec2-54-75-248-80.eu-west-1.compute.amazonaws.com Software nginx/1.14.1 / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Request headers Referer https://ecrm.logrhythm.com/Guided-Blog-Subscribe-Form.html?form_type=compact&ty_page_url=https%3A%2F%2Flogrhythm.com%2Fblog-newsletter-subscription-ty%2F&resizeGuid=DB9FB6E2-35C7-4E17-81C4-2CE5AFDBB9B8&page_url=https%3A%2F%2Flogrhythm.com%2Fblog%2Fdetecting-dns-tunneling%2F User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Pragma no-cache Date Mon, 14 Oct 2019 05:04:11 GMT Server nginx/1.14.1 P3P CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA" Cache-Control no-store, no-cache, must-revalidate Connection keep-alive Content-Type image/gif Content-Length 42 X-Result g.-1.-1.-1 Redirect headers pragma no-cache date Mon, 14 Oct 2019 05:04:11 GMT server HTTP server (unknown) status 302 p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" location https://d.adroll.com/cm/g/in cache-control no-cache, must-revalidate content-type text/html; charset=UTF-8 alt-svc quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000 content-length 225 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	204	sync ups.analytics.yahoo.com/ups/55980/ Frame 1AE1 Redirect Chain https://d.adroll.com/cm/aol/out?adroll_fpc=b89517a11da139a0e00064165659899d-1571029451235&xid_ch=f&advertisable=QDCFINCFT5HK5FU45EXRDS https://pixel.advertising.com/ups/55980/sync?uid=MjBkZjg3ZDQxNjYxYjk5YjE1OTE4YmZiZTYzNDY1NGQ&_origin=1&gdpr=1&gdpr_consent=BOOla_OOOla_OA2ABBENAkwAAAAXyACAAyAIIA https://ups.analytics.yahoo.com/ups/55980/sync?uid=MjBkZjg3ZDQxNjYxYjk5YjE1OTE4YmZiZTYzNDY1NGQ&_origin=1&gdpr=1&gdpr_consent=BOOla_OOOla_OA2ABBENAkwAAAAXyACAAyAIIA&apid=UP0f57f173-ee40-11e9-9e12-02...	0 472 B	27ms 27ms	Image text/plain	35.157.201.139 Amazon.com
General Check archive.org Show headers Download Go to Show image Full URL https://ups.analytics.yahoo.com/ups/55980/sync?uid=MjBkZjg3ZDQxNjYxYjk5YjE1OTE4YmZiZTYzNDY1NGQ&_origin=1&gdpr=1&gdpr_consent=BOOla_OOOla_OA2ABBENAkwAAAAXyACAAyAIIA&apid=UP0f57f173-ee40-11e9-9e12-0262cd3e8f28 Requested by Host: ecrm.logrhythm.com URL: https://ecrm.logrhythm.com/Guided-Blog-Subscribe-Form.html?form_type=compact&ty_page_url=https%3A%2F%2Flogrhythm.com%2Fblog-newsletter-subscription-ty%2F&resizeGuid=DB9FB6E2-35C7-4E17-81C4-2CE5AFDBB9B8&page_url=https%3A%2F%2Flogrhythm.com%2Fblog%2Fdetecting-dns-tunneling%2F Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 35.157.201.139 Frankfurt am Main, Germany, ASN16509 (AMAZON-02 - Amazon.com, Inc., US), Reverse DNS ec2-35-157-201-139.eu-central-1.compute.amazonaws.com Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://ecrm.logrhythm.com/Guided-Blog-Subscribe-Form.html?form_type=compact&ty_page_url=https%3A%2F%2Flogrhythm.com%2Fblog-newsletter-subscription-ty%2F&resizeGuid=DB9FB6E2-35C7-4E17-81C4-2CE5AFDBB9B8&page_url=https%3A%2F%2Flogrhythm.com%2Fblog%2Fdetecting-dns-tunneling%2F User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers status 204 date Mon, 14 Oct 2019 05:04:11 GMT p3p CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV Redirect headers status 302 date Mon, 14 Oct 2019 05:04:11 GMT content-length 0 location https://ups.analytics.yahoo.com/ups/55980/sync?uid=MjBkZjg3ZDQxNjYxYjk5YjE1OTE4YmZiZTYzNDY1NGQ&_origin=1&gdpr=1&gdpr_consent=BOOla_OOOla_OA2ABBENAkwAAAAXyACAAyAIIA&apid=UP0f57f173-ee40-11e9-9e12-0262cd3e8f28 p3p CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
GET H/1.1	204 No Content	tap.php pixel.rubiconproject.com/ Frame 1AE1 Redirect Chain https://d.adroll.com/cm/n/out?adroll_fpc=b89517a11da139a0e00064165659899d-1571029451235&xid_ch=f&advertisable=QDCFINCFT5HK5FU45EXRDS https://pixel.rubiconproject.com/tap.php?v=194538&nid=3644&put=MjBkZjg3ZDQxNjYxYjk5YjE1OTE4YmZiZTYzNDY1NGQ&expires=365	0 239 B	25ms 25ms	Image image/gif	69.173.144.136 The Rubicon Project
General Check archive.org Show headers Download Go to Show image Full URL https://pixel.rubiconproject.com/tap.php?v=194538&nid=3644&put=MjBkZjg3ZDQxNjYxYjk5YjE1OTE4YmZiZTYzNDY1NGQ&expires=365 Requested by Host: ecrm.logrhythm.com URL: https://ecrm.logrhythm.com/Guided-Blog-Subscribe-Form.html?form_type=compact&ty_page_url=https%3A%2F%2Flogrhythm.com%2Fblog-newsletter-subscription-ty%2F&resizeGuid=DB9FB6E2-35C7-4E17-81C4-2CE5AFDBB9B8&page_url=https%3A%2F%2Flogrhythm.com%2Fblog%2Fdetecting-dns-tunneling%2F Protocol HTTP/1.1 Security TLS 1.2, RSA, AES_256_GCM Server 69.173.144.136 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT - The Rubicon Project, Inc., US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://ecrm.logrhythm.com/Guided-Blog-Subscribe-Form.html?form_type=compact&ty_page_url=https%3A%2F%2Flogrhythm.com%2Fblog-newsletter-subscription-ty%2F&resizeGuid=DB9FB6E2-35C7-4E17-81C4-2CE5AFDBB9B8&page_url=https%3A%2F%2Flogrhythm.com%2Fblog%2Fdetecting-dns-tunneling%2F User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Pragma no-cache Expires 0 Cache-Control no-cache,no-store,must-revalidate P3P CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT" X-RPHost a66cbf3142c6ef39e3614b84a34262cf Content-Type image/gif Redirect headers Pragma no-cache Date Mon, 14 Oct 2019 05:04:11 GMT Server nginx/1.14.1 P3P CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA" Location https://pixel.rubiconproject.com/tap.php?v=194538&nid=3644&put=MjBkZjg3ZDQxNjYxYjk5YjE1OTE4YmZiZTYzNDY1NGQ&expires=365 Cache-Control no-store, no-cache, must-revalidate Connection keep-alive Content-Length 124
GET H/1.1	200 OK	Pug simage2.pubmatic.com/AdServer/ Frame 1AE1 Redirect Chain https://d.adroll.com/cm/pubmatic/out?adroll_fpc=b89517a11da139a0e00064165659899d-1571029451235&xid_ch=f&advertisable=QDCFINCFT5HK5FU45EXRDS https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzMwNiZ0bD01MjU2MDA&piggybackCookie=MjBkZjg3ZDQxNjYxYjk5YjE1OTE4YmZiZTYzNDY1NGQ&gdpr=1&gdpr_consent=BOOoKswOOoKswA2ABBENA...	1 B 986 B	23ms 23ms	Image text/html	185.64.190.80 PubMatic
General Check archive.org Show headers Download Go to Show image Full URL https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzMwNiZ0bD01MjU2MDA&piggybackCookie=MjBkZjg3ZDQxNjYxYjk5YjE1OTE4YmZiZTYzNDY1NGQ&gdpr=1&gdpr_consent=BOOoKswOOoKswA2ABBENAkwAAAAXyACACYAIIA Requested by Host: ecrm.logrhythm.com URL: https://ecrm.logrhythm.com/Guided-Blog-Subscribe-Form.html?form_type=compact&ty_page_url=https%3A%2F%2Flogrhythm.com%2Fblog-newsletter-subscription-ty%2F&resizeGuid=DB9FB6E2-35C7-4E17-81C4-2CE5AFDBB9B8&page_url=https%3A%2F%2Flogrhythm.com%2Fblog%2Fdetecting-dns-tunneling%2F Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 185.64.190.80 , United Kingdom, ASN62713 (AS-PUBMATIC - PubMatic, Inc., US), Reverse DNS Software Apache/2.2.24 (Unix) mod_ssl/2.2.24 OpenSSL/1.0.0-fips mod_fastcgi/2.4.6 / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://ecrm.logrhythm.com/Guided-Blog-Subscribe-Form.html?form_type=compact&ty_page_url=https%3A%2F%2Flogrhythm.com%2Fblog-newsletter-subscription-ty%2F&resizeGuid=DB9FB6E2-35C7-4E17-81C4-2CE5AFDBB9B8&page_url=https%3A%2F%2Flogrhythm.com%2Fblog%2Fdetecting-dns-tunneling%2F User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers X-Cnection close Pragma no-cache Date Mon, 14 Oct 2019 05:04:11 GMT X-lat Pug23008:0:215 Server Apache/2.2.24 (Unix) mod_ssl/2.2.24 OpenSSL/1.0.0-fips mod_fastcgi/2.4.6 P3P CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC" Cache-Control no-store, no-cache, private Content-Type text/html; charset=utf-8 Content-Length 1 Redirect headers Pragma no-cache Date Mon, 14 Oct 2019 05:04:11 GMT Server nginx/1.14.1 P3P CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA" Location https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MzMwNiZ0bD01MjU2MDA&piggybackCookie=MjBkZjg3ZDQxNjYxYjk5YjE1OTE4YmZiZTYzNDY1NGQ&gdpr=1&gdpr_consent=BOOoKswOOoKswA2ABBENAkwAAAAXyACACYAIIA Cache-Control no-store, no-cache, must-revalidate Connection keep-alive Content-Length 220
GET H2	200	/ www.facebook.com/tr/ Frame 1AE1	44 B 99 B	6ms 6ms	Image image/gif	2a03:2880:f11c:8083:face:b00c:0:25de Facebook
General Check archive.org Show headers Download Go to Show image Full URL https://www.facebook.com/tr/?id=836361346565242&ev=PageView&dl=https%3A%2F%2Fecrm.logrhythm.com%2FGuided-Blog-Subscribe-Form.html%3Fform_type%3Dcompact%26ty_page_url%3Dhttps%253A%252F%252Flogrhythm.com%252Fblog-newsletter-subscription-ty%252F%26resizeGuid%3DDB9FB6E2-35C7-4E17-81C4-2CE5AFDBB9B8%26page_url%3Dhttps%253A%252F%252Flogrhythm.com%252Fblog%252Fdetecting-dns-tunneling%252F&rl=https%3A%2F%2Flogrhythm.com%2Fblog%2Fdetecting-dns-tunneling%2F&if=true&ts=1571029451671&cd[segment_eid]=JKDRBTEKQ5DYLPBQZ7OUBG&sw=1600&sh=1200&v=2.9.5&r=stable&ec=0&o=29&fbp=fb.1.1571029451114.1634147949&it=1571029451472&coo=false&exp=w1&rqm=GET Requested by Host: ecrm.logrhythm.com URL: https://ecrm.logrhythm.com/Guided-Blog-Subscribe-Form.html?form_type=compact&ty_page_url=https%3A%2F%2Flogrhythm.com%2Fblog-newsletter-subscription-ty%2F&resizeGuid=DB9FB6E2-35C7-4E17-81C4-2CE5AFDBB9B8&page_url=https%3A%2F%2Flogrhythm.com%2Fblog%2Fdetecting-dns-tunneling%2F Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f11c:8083:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US), Reverse DNS Software proxygen-bolt / Resource Hash 10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Sec-Fetch-Mode no-cors Referer https://ecrm.logrhythm.com/Guided-Blog-Subscribe-Form.html?form_type=compact&ty_page_url=https%3A%2F%2Flogrhythm.com%2Fblog-newsletter-subscription-ty%2F&resizeGuid=DB9FB6E2-35C7-4E17-81C4-2CE5AFDBB9B8&page_url=https%3A%2F%2Flogrhythm.com%2Fblog%2Fdetecting-dns-tunneling%2F User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Mon, 14 Oct 2019 05:04:11 GMT last-modified Fri, 21 Dec 2012 00:00:01 GMT server proxygen-bolt strict-transport-security max-age=31536000; includeSubDomains content-type image/gif status 200 cache-control no-cache, must-revalidate, max-age=0 content-length 44 expires Mon, 14 Oct 2019 05:04:11 GMT
GET H2	200	visitor.php Show response app.leadsrx.com/	74 B 353 B	181ms 181ms	XHR text/html	54.148.155.229 Amazon.com
General Check archive.org Show headers Download Go to Full URL https://app.leadsrx.com/visitor.php?acctTag=ibpztl25890&tz=-120&ref=&u=https%3A//logrhythm.com/blog/detecting-dns-tunneling/&t=Detecting%20DNS%20Tunneling%20%7C%20LogRhythm&lc=null&anon=0&vin=null Requested by Host: app.leadsrx.com URL: https://app.leadsrx.com/visitor.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 54.148.155.229 Boardman, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US), Reverse DNS ec2-54-148-155-229.us-west-2.compute.amazonaws.com Software Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16 / PHP/5.4.16 Resource Hash 4f869167ae06ec5329a2f0511b71fbd20699cca11cd1b2298808118a9d0b67b4 Request headers Sec-Fetch-Mode cors Referer https://logrhythm.com/blog/detecting-dns-tunneling/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Content-Type application/x-www-form-urlencoded; charset=UTF-8 Response headers date Mon, 14 Oct 2019 05:04:11 GMT server Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16 x-powered-by PHP/5.4.16 status 200 content-type text/html; charset=utf-8 access-control-allow-origin https://logrhythm.com access-control-allow-credentials true content-length 74
GET H2	200	adsct Show response analytics.twitter.com/i/	31 B 635 B	186ms 139ms	Script application/javascript	104.244.42.195 Twitter Inc.
General Check archive.org Show headers Download Go to Full URL https://analytics.twitter.com/i/adsct?p_id=Twitter&p_user_id=0&txn_id=nw4xr&events=%5B%5B%22pageview%22%2Cnull%5D%5D&tw_sale_amount=0&tw_order_quantity=0&tw_iframe_status=0&tpx_cb=twttr.conversion.loadPixels&tw_document_href=https%3A%2F%2Flogrhythm.com%2Fblog%2Fdetecting-dns-tunneling%2F Requested by Host: static.ads-twitter.com URL: https://static.ads-twitter.com/uwt.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 104.244.42.195 , United States, ASN13414 (TWITTER - Twitter Inc., US), Reverse DNS Software tsa_o / Resource Hash df3e003cc30e9bdd0313100e8ee5d468070b4b34d11ad355f276a356d4b9c7bf Security Headers Name Value Strict-Transport-Security max-age=631138519 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers Sec-Fetch-Mode no-cors Referer https://logrhythm.com/blog/detecting-dns-tunneling/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Mon, 14 Oct 2019 05:04:12 GMT content-encoding gzip x-content-type-options nosniff p3p CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT" status 200, 200 OK x-twitter-response-tags BouncerCompliant strict-transport-security max-age=631138519 content-length 57 x-xss-protection 0 x-response-time 116 pragma no-cache last-modified Mon, 14 Oct 2019 05:04:12 GMT server tsa_o x-frame-options SAMEORIGIN content-type application/javascript;charset=utf-8 cache-control no-cache, no-store, must-revalidate, pre-check=0, post-check=0 x-connection-hash fd31bc7ed5d254286ef60deaf37a1a72 x-transaction 003d31eb00d3baf3 expires Tue, 31 Mar 1981 05:00:00 GMT
GET H2	200	/ www.facebook.com/tr/ Frame 1AE1	44 B 145 B	7ms 6ms	Image image/gif	2a03:2880:f11c:8083:face:b00c:0:25de Facebook
General Check archive.org Show headers Download Go to Show image Full URL https://www.facebook.com/tr/?id=232919347190734&ev=Microdata&dl=https%3A%2F%2Fecrm.logrhythm.com%2FGuided-Blog-Subscribe-Form.html%3Fform_type%3Dcompact%26ty_page_url%3Dhttps%253A%252F%252Flogrhythm.com%252Fblog-newsletter-subscription-ty%252F%26resizeGuid%3DDB9FB6E2-35C7-4E17-81C4-2CE5AFDBB9B8%26page_url%3Dhttps%253A%252F%252Flogrhythm.com%252Fblog%252Fdetecting-dns-tunneling%252F&rl=https%3A%2F%2Flogrhythm.com%2Fblog%2Fdetecting-dns-tunneling%2F&if=true&ts=1571029453020&cd[DataLayer]=%5B%5D&cd[Meta]=%7B%22title%22%3A%22%22%7D&cd[OpenGraph]=%7B%7D&cd[Schema.org]=%5B%5D&cd[JSON-LD]=%5B%5D&sw=1600&sh=1200&v=2.9.5&r=stable&ec=1&o=30&fbp=fb.1.1571029451114.1634147949&it=1571029451472&coo=false&es=automatic&exp=w1&rqm=GET Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f11c:8083:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US), Reverse DNS Software proxygen-bolt / Resource Hash 10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Sec-Fetch-Mode no-cors Referer https://ecrm.logrhythm.com/Guided-Blog-Subscribe-Form.html?form_type=compact&ty_page_url=https%3A%2F%2Flogrhythm.com%2Fblog-newsletter-subscription-ty%2F&resizeGuid=DB9FB6E2-35C7-4E17-81C4-2CE5AFDBB9B8&page_url=https%3A%2F%2Flogrhythm.com%2Fblog%2Fdetecting-dns-tunneling%2F User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers date Mon, 14 Oct 2019 05:04:13 GMT last-modified Fri, 21 Dec 2012 00:00:01 GMT server proxygen-bolt strict-transport-security max-age=31536000; includeSubDomains content-type image/gif status 200 cache-control no-cache, must-revalidate, max-age=0 content-length 44 expires Mon, 14 Oct 2019 05:04:13 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain

ecrm.logrhythm.com

URL

https://ecrm.logrhythm.com/Guided-Blog-Subscribe-Form.html