![](/static/253f0d9b/assets/icons/icon-96x96.png)
![](https://infosec.pub/pictrs/image/ffa014c8-749c-4482-8599-b4be5064f8b1.png)
if you run a whois on the domain, it turns out it belongs to mailjet. they are a big service provider for bulk emails, notifications, stuff like that.
my guess is this is their cdn or something similar. you can see the “1wy1y” string in the URL path as well as a sub-domain. that’s most likely the customer ID or “tenant id” for the gov agency inside the mailjet cloud. also guessing that “tplimg” could stand for “template image” or similar, indicating that they have an email template with this image always being there. which makes sense if it’s a logo.
as for the curl call, i tried to open the url in a browser, but it just sends an empty response, that’s why you don’t see a content-length header. i guess mailjet checks where the url is being called from, either with user-agent or some custom headers or whatever, so it only loads if you actually open the email. this prevents unnecessary traffic costs for them.
i don’t think there is anything wrong here, just laziness on the gov agency’s side. they could have created some sub-domain that is an alias pointing to this mess. it wouldn’t cost anything.
Thank you for this, nice job! I’m probably not the target audience (yet), as I mostly use the bookmark toolbar or just doomscrolling for news, but you know, life changes from time to time. If I won’t have time to doomscroll anymore, it’s good to know that an open-source all-in-one-place aggregator is out there. The one-time payment is also a good concept. Personally, I would pay for it when I start using it.