It's a header that contains the IP address of the machine that ran the Tunnelmole client, which ensures it can't be used anonymously. My theory here is that phi

It's a header that contains the IP address of the machine that ran the Tunnelmole client, which ensures it can't be used anonymously. My theory here is that phishers and other nefarious actors are attracted to this type of service so they can hide their origin server. I haven't had alot of phishing issues since introducing that header and the IP address in random domains. I'll see if I can get tunnelmole.net added to that public suffix list. One reason tunnels go through tunnelmole.net instead of tunnelmole.com is to protect the reputation of the main domain.