It uses these domains: http://xtrapath1.izatcloud.net http://xtrapath1.izatcloud.net http://xtrapath2.izatcloud.net http://xtrapath2.izatcloud.net http://xtr

It uses these domains: http://xtrapath1.izatcloud.net http://xtrapath1.izatcloud.net http://xtrapath2.izatcloud.net http://xtrapath2.izatcloud.net http://xtrapath3.izatcloud.net http://xtrapath3.izatcloud.net I'm not sure what part of the OS is sending it, but it's definitely happening (and is block-able!)