[codethief]

Or in the subdomain, using "DNS exfiltration": https://twitter.com/rsobers/status/1293539543115862016

[city41]

That's an interesting exploit, thanks for sharing.