docs.google.com Open in urlscan Pro
64.233.180.101  Malicious Activity! Public Scan

URL: https://docs.google.com/presentation/d/e/2PACX-1vRmZBB6SquQevOw9IAMilCacQWL3twLawmtmGcJomHrgJzR0xk89wK4ZNcdKIar4Z5SaO37D...
Submission: On February 07 via api from US — Scanned from CA

Summary

This website contacted 8 IPs in 1 countries across 6 domains to perform 19 HTTP transactions. The main IP is 64.233.180.101, located in United States and belongs to GOOGLE - Google LLC, US. The main domain is docs.google.com. The Cisco Umbrella rank of the primary domain is 146.
TLS certificate: Issued by WR2 on January 19th 2026. Valid for: 3 months.
This is the only time docs.google.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: AT&T (Telecommunication)

Domain & IP information

IP Address AS Autonomous System
5 64.233.180.101 15169 (GOOGLE)
1 142.251.35.177 15169 (GOOGLE)
2 142.251.40.138 15169 (GOOGLE)
1 172.253.115.132 15169 (GOOGLE)
4 142.251.167.94 15169 (GOOGLE)
1 142.250.217.3 15169 (GOOGLE)
3 142.250.80.14 15169 (GOOGLE)
19 8
Apex Domain
Subdomains
Transfer
8 google.com
docs.google.com — Cisco Umbrella Rank: 146
play.google.com — Cisco Umbrella Rank: 33
781 KB
5 gstatic.com
ssl.gstatic.com
fonts.gstatic.com
68 KB
2 googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 45
4 KB
1 googleusercontent.com
lh7-rt.googleusercontent.com — Cisco Umbrella Rank: 798
20 KB
1 withgoogle.com
csp.withgoogle.com — Cisco Umbrella Rank: 287
0 Failed
function sub() { [native code] }. Failed
19 6
Domain Requested by
5 docs.google.com docs.google.com
4 ssl.gstatic.com docs.google.com
3 play.google.com docs.google.com
2 fonts.googleapis.com docs.google.com
1 fonts.gstatic.com docs.google.com
1 lh7-rt.googleusercontent.com docs.google.com
1 csp.withgoogle.com docs.google.com
0 invalid Failed docs.google.com
19 8

This site contains no links.

Subject Issuer Validity Valid
*.google.com
WR2
2026-01-19 -
2026-04-13
3 months crt.sh
*.appspot.com
WR2
2026-01-12 -
2026-04-06
3 months crt.sh
upload.video.google.com
WR2
2026-01-12 -
2026-04-06
3 months crt.sh
*.googleusercontent.com
WR2
2026-01-19 -
2026-04-13
3 months crt.sh
*.gstatic.com
WR2
2026-01-19 -
2026-04-13
3 months crt.sh

This page contains 1 frames:

Primary Page: https://docs.google.com/presentation/d/e/2PACX-1vRmZBB6SquQevOw9IAMilCacQWL3twLawmtmGcJomHrgJzR0xk89wK4ZNcdKIar4Z5SaO37DHxmy89j/pub?start=false&loop=false&delayms=3000
Frame ID: 72D0D5E35E50A900F1A5F49865DF6852
Requests: 18 HTTP requests in this frame

Screenshot

Page Title

AT&T Mail - Google Slides

Page Statistics

19
Requests

89 %
HTTPS

0 %
IPv6

6
Domains

8
Subdomains

8
IPs

1
Countries

873 kB
Transfer

3136 kB
Size

1
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

19 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request pub
docs.google.com/presentation/d/e/2PACX-1vRmZBB6SquQevOw9IAMilCacQWL3twLawmtmGcJomHrgJzR0xk89wK4ZNcdKIar4Z5SaO37DHxmy89j/
143 KB
40 KB
Document
General
Full URL
https://docs.google.com/presentation/d/e/2PACX-1vRmZBB6SquQevOw9IAMilCacQWL3twLawmtmGcJomHrgJzR0xk89wK4ZNcdKIar4Z5SaO37DHxmy89j/pub?start=false&loop=false&delayms=3000
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
64.233.180.101 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
on-in-f101.1e100.net
Software
ESF /
Resource Hash
4ba628219e133cc937a891e725e09749554d5cf43862e45807f4d68c35182c35
Security Headers
Name Value
Content-Security-Policy require-trusted-types-for 'script';report-uri https://csp.withgoogle.com/csp/docs-tt base-uri 'self';object-src 'self' blob:;report-uri https://docs.google.com/presentation/cspreport;script-src 'report-sample' 'nonce-1UJ_AyWr4Asp5ZvQZzHEBg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';worker-src 'self' blob:
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
no-cache, no-store, max-age=0, must-revalidate
content-encoding
gzip
content-security-policy
require-trusted-types-for 'script';report-uri https://csp.withgoogle.com/csp/docs-tt base-uri 'self';object-src 'self' blob:;report-uri https://docs.google.com/presentation/cspreport;script-src 'report-sample' 'nonce-1UJ_AyWr4Asp5ZvQZzHEBg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';worker-src 'self' blob:
content-type
text/html; charset=utf-8
date
Sat, 07 Feb 2026 07:51:33 GMT
document-policy
include-js-call-stacks-in-crash-reports
expires
Mon, 01 Jan 1990 00:00:00 GMT
link
</static/presentation/client/css/887848782-viewer_css_ltr.css>;rel=preload;as=style;nonce=1UJ_AyWr4Asp5ZvQZzHEBg,</_/presentations/_/js/k=presentations.viewer.en_CA.NYGwWWkLRjw.es5.O/am=AAgGBg/d=0/wt=0/rs=AB6fld0qvhi-MHHPZLlUCSgs6cY5L1Zfww/m=core>;rel=preload;as=script;nonce=1UJ_AyWr4Asp5ZvQZzHEBg
origin-trial
AsBCEoVg8pIwAkst2T88NNY429HzlH4fGwN+ALnF27Zl16u/ZR0Vylgws0om63IHSaH6pHPqY+k1GQ1sheqdhwgAAACGeyJvcmlnaW4iOiJodHRwczovL2dvb2dsZS5jb206NDQzIiwiZmVhdHVyZSI6IkRvY3VtZW50UG9saWN5SW5jbHVkZUpTQ2FsbFN0YWNrc0luQ3Jhc2hSZXBvcnRzIiwiZXhwaXJ5IjoxNzQ5NTEzNjAwLCJpc1N1YmRvbWFpbiI6dHJ1ZX0=
p3p
CP="This is not a P3P policy! See g.co/p3phelp for more info."
pragma
no-cache
referrer-policy
strict-origin-when-cross-origin
reporting-endpoints
default="/presentation/d/e/2PACX-1vRmZBB6SquQevOw9IAMilCacQWL3twLawmtmGcJomHrgJzR0xk89wK4ZNcdKIar4Z5SaO37DHxmy89j/web-reports?bl=editors.presentations-frontend_20260202.02_p2&app=6&clss=1&context=eJwV1nlY1NUaB_DDzO_3JRWRRRZRRphRAgXC3RuDMM6wSa5c_Q1akoQkpmiGXrUyMVMjzSXXNOEKKIgrSC4lJq6oKWpX3LUuIqsw7GDC_d4_Puec9znv-zznnPef032rRzehiLS3FHGhuyIO91BEvo0iMuwUoXFQRGtvRbztpIiLdNRFEePdFKHtq4jN7orYRZkaRcz3VES8ThGFXop4PUgRPX0VMdhPEVv8FbFmiCJWBSviB4qZpIj0KYo4Rm-bFTGK1DGKcKSS6Yp4TqWzFPGSusUrog81JChC9bEiCuYq4hIN_0QRJmr_lyJ6LVXE_ZWKqCDT14r4J43eoIgISt2uiB9p4A5FjKDOnYqw3aWI3ZmKyKXexxQxgAzXFTGZfr2liBukLuF5yLpUES5k_1QRnrSHDlER3SHNn4rwpx1lijhAo14oIpzyqIgu0z06Xa-IYjptbxbFtNLZLLJdzOIUJf3DLLbNNIss0iWYxTB6scAsmmnEQrMIpaxFZlFAixebxTfkvcQsRtMzp9viZb9qVQtpBlWrvCjygkU1mTb81aDaRsX-jarb5BnVqPIh96HNqoG0cmWzah0NXtWsGkYFn7SqztIGfZtqG5mC2lTvUVJCm2oJ_ZDaptpNsZ-3qyZca1dNo9CSdtV4SnPoUB2gglUdqrPUkt6h6qRRAzpVwRQmulQTqKRfl-o-zVvWpUqmvOdCfYZy9lmpbTKt1L0pLV2lPkB7L6rUw33Uaj21TlGruyhqqlodTddT1Oq7NGytWj2Gfn6hVhfSjO6SOoFqPSR1M3nXvSsF0CpLoJRKzhP1UtwOvTSX3A_rpYFkVaWXho8OkvR0Y0eQVEqJN4KlT6m5JFh6Q9OTQiSzu0H6kP6MMEg1JEcZpJ4Us80gzaJV1QZpC7mNHStpKeOLsVKFs1Gqp8ljjFIM_TjJKIUuNErjSf0vo9SDlhw1SivofAFzvzNJYr1JmpRtkszUWGySXlMn4ZpJWkPf02baRYYbJimSptIHtJsyyLHBJPWltZpQaSMN8w2VAum3xFDpKtV-Gio1069nQ6WLVFccKrXSzvJQKZ3KRoRJNdSrLVya5xQhOX8SIWmo1SFS6qIhfSIlPV21HieVkJ9unHR3YprcNSVNto5Ok2tOpslNZApMl79pSpc3kPHov-V5jvvkZGqbsE8WE_fJBcv3yS97Z8h1tPhxhvwl_VmXIVfSrTmZcikVzsuULxPKMmVbOr06Sz5Pk9ZlyWbyPZ4lD6e9Z_fLOfSD7wE5g16sPiDXkpdrtuxPFk223E7xMdnyPOpRnyM70unjB-XzlFd5UD5DiX1z5U_plF-ufIHco3LlgTR_Qq68mF5-mSs3UOW2XNlC6amH5FwKuHVIDiHTg0Pye-S06bA88qMj8hiKSzoiz6XwJVXyRPplQ5VcdLhKvkZ9H1TJOoqdWS1bF1fLDrTyWrW8jv56UC1X0b1H1fJT0jdUyyYKCK6RR1NGeo3ccrpG7qRhRTVyIJ0318rFdHNXrXyPZvxYK39E58Qr-RYt-apB_py6Z3XJczb1wFLyzeuBmI4emEkBSTYYTRd22-Aq5eyxwREqLLTBiRIb_EpXymxwi_w290QQ_XqiJy7S3lM9sZ8-quyJT-hudU_cp8JztrhMEy_ZQqG8ob1whiwJvdBCb_b2gpzWC6_72EHtZgdNlh28aGuOHXZR9EE7mCl6kD1mkDHEHq159ugiJcABsfRXoANeUrXJAY1knOWAKGo47IAOup7vgOASBzyjcFtHTCQfrSOG0NDBjniX0kY54gB9MdoRq6kq3BGPZjniv4TbjhhH05_0RhxNcHDCNDod4ASrCU7oRmXLnFBD_sudMJJy1zghn8YddMIUupnnhKkvnGDc54wo-uaRMzaQ42Nn9KXp81wQR4ZkF0zZ6ILftrjgKrU9cIF46IKfu1xQSJc8XPE7DUxwhR-FHHFFBM256oqF_3fNFUtp60NX7KHH6X1QRnYZfeBK337lhs00MdUNCnm8dIM32da7wZms2tzQjX5b1RcrN_XFOlpm6IcVNGdcP8ynZRf7IYXeftwPvhT3pB8-plArd0yly5HuuEmGD9wRSaXr3aH53h06wkZ3OFNUnjsm0Rf33LGazvprUETJEzVYRo1LNHhNG3M1OPJQg3y69ViDPyi9ToNsCrJoMJYaqJX2zegP74T-fJf--HlFf_xCw1L6w0idJ_oDBf2x1toDG2n8SA9MJavpHuhGRxM9kHrKA1to91UPZFBciifm0vXNniih2G2eOJnhiXO06ZUndlKUnxYzKPsdLY6RT7gW_hS0WItQurBGi-s07FstAul6mhZ36drvWtyikJvMoyoafYt1dIv-oNgSLeJpWacWKfSOnQ6XdDr8TteG6HCHzut1KKY9wTpkUtFUHa7QsUQdTtGbZTqoluswhRSatV-HBPr6Dx2-o_nrBuBLChnghQjSKl4YRF-ZvbCWVkjeWEPHZW-cJn9bb4ykR3beeE6H7LlHtr7ecKbv9nnDu9QbAdRZ7g289EY_Ox8MoK32PthDPr19MIReUh3tf_ou3jkUiFGUdzwQJ8k9LxBayqQcOpsfiCIqdtMjJVyPcxP0uEIPVujxjDTlenhRZaceFioVQXhG728PQjyF3QvC96Yx2E7Dvh3DXozB4Y4xmDsgGIso6e9grKBVtIWiRAii6apvCCwLQtBCH_wUgjg6Sifoq5wQrKaoi8yliIEGRJO70QDbnwxwJsNeA_55yYB4Gn_bgKm0rcqAn2hf11hk0_4wI5bNMyKF_r3UiByqWGlE7k4jjtF5ukyvqJHOPTLiIsWVGfEx5VYbkU-DrUywmmTCvBkmJFPKKhOm1Zkwk7wcw-BPdZFhaKXBH4UhgPqmhEFHH2aGYQ4tORCGFVRxJQz1dKc-DKW07u8wROvDoV8YDgNdSg7H79SRGw7VoXBMOxKOmXTtbjjKnoejhhT_CMT-364IVGRHoJ6qn0WgkdZ6RWI9LY2OxM-pf6GQ3p1chrH0Hf1AF5LLcJUq8spQT8cqylBAMZVlmEmF7WW4TJsGvsCV4Be4QfG5L-Asl0NDr_zK0US9I8vhmFLOu5bDpogx9S8vxwAqO_kSldQnqQKetH5tBTaTZ1YFfOjh2Qo8o2lFFZhJ2TaVOEZ6j0oYqHBKJS7Q588r8TVtrKpkfyvxpKUSLyimpgqz6I59NR7SqznVSF1ajS00a3INEsnzVA18KLWoBluoT1cNNNQxuxaqhFqMTqxFEMXuqUU8uabXwp2O61_hNFmHvsIg8pj_CgPJ6-QrrF9VB6yrwz9O1MFAtsV1cKRPg-px8IN65FGPRfVwpINf18N5bT28aMqmethfY0w7Htezj_WIecuCiO4WBAy3oDHagjayViywMlvw92wLpAQLMuZYkE9ZCyzIpYPbLLDdaUFFugXRxy1YXWDBblouNaAmsAEWKtE34D49e68BN-Y24OFWrsn6SANsKLp3I3InNyKfymMbMSGuETFSE2bSuZAm_BHbhIe0enYTUulsQhMukdecJvjStOVNePx5E27nNKGUJl9owlIKrW5CBB12bUY-7dU2I5MOUR6dod-onGooJ6cZx8mnuBl-dJluUPV7LWik9vktKDjWgjN0_1QLntL2X1qwm9QPWvAW_aexBQ-pqKsFV2i5thVVdN7QiiuUPrMVIz5uxVarNuyhHtZtuGzThr7ubQjRcn7dBh2NOdaOEHo_vx3219sx4mE73qVSVQee0ebYDmyn01kdOEf7f-lALombHZDpje9rSH6vMerOa7jav4F1_zdY-OANYmM68f2HnfzXdOF9crB565unu2_A7uqTA09Ubt0mLY6bl_jZnNnxWr_Z8YnJCxZ95r9w0ezPZiclz0pOXJD0mV_CogVJybOT4mOHBgwdGcDBP2Bo7MKh_wOaBBJO&build-label=editors.presentations-frontend_20260202.02_p2&imp-sid=CIyLw-XyxpIDFWzbOgcdoW8Ppw&is-cached-offline=false&wcrumsspbp=true"
server
ESF
strict-transport-security
max-age=31536000; includeSubDomains
x-content-type-options
nosniff
x-frame-options
SAMEORIGIN
x-l2-request-path
l2-managed-4
x-robots-tag
noindex, nofollow, nosnippet
x-xss-protection
0
887848782-viewer_css_ltr.css
docs.google.com/static/presentation/client/css/
911 KB
112 KB
Stylesheet
General
Full URL
https://docs.google.com/static/presentation/client/css/887848782-viewer_css_ltr.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
64.233.180.101 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
on-in-f101.1e100.net
Software
sffe /
Resource Hash
cee440c67d8c8fd61e06d65d10b9c54f3e465afdba03a7126715ccca43065679
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36
Referer
https://docs.google.com/presentation/d/e/2PACX-1vRmZBB6SquQevOw9IAMilCacQWL3twLawmtmGcJomHrgJzR0xk89wK4ZNcdKIar4Z5SaO37DHxmy89j/pub?start=false&amp;loop=false&amp;delayms=3000

Response headers

content-encoding
gzip
age
115715
report-to
{"group":"docs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/docs"}]}
x-content-type-options
nosniff
expires
Fri, 05 Feb 2027 23:42:58 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Thu, 05 Feb 2026 23:42:58 GMT
last-modified
Tue, 03 Feb 2026 00:53:43 GMT
content-type
text/css
vary
Accept-Encoding, Origin
cache-control
public, max-age=31536000
cross-origin-resource-policy
cross-origin
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/docs
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="docs"
content-length
113954
x-xss-protection
0
server
sffe
m=core
docs.google.com/_/presentations/_/js/k=presentations.viewer.en_CA.NYGwWWkLRjw.es5.O/am=AAgGBg/d=0/wt=0/rs=AB6fld0qvhi-MHHPZLlUCSgs6cY5L1Zfww/
1 MB
464 KB
Script
General
Full URL
https://docs.google.com/_/presentations/_/js/k=presentations.viewer.en_CA.NYGwWWkLRjw.es5.O/am=AAgGBg/d=0/wt=0/rs=AB6fld0qvhi-MHHPZLlUCSgs6cY5L1Zfww/m=core
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
64.233.180.101 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
on-in-f101.1e100.net
Software
sffe /
Resource Hash
6f04e79a74c8cc96f21ad21a2a4dff4443e3abacedc7540ae9bd000a590eba13
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36
Referer
https://docs.google.com/presentation/d/e/2PACX-1vRmZBB6SquQevOw9IAMilCacQWL3twLawmtmGcJomHrgJzR0xk89wK4ZNcdKIar4Z5SaO37DHxmy89j/pub?start=false&amp;loop=false&amp;delayms=3000

Response headers

content-encoding
gzip
age
14753
report-to
{"group":"docs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/docs"}]}
x-content-type-options
nosniff
expires
Sun, 07 Feb 2027 03:45:40 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Sat, 07 Feb 2026 03:45:40 GMT
last-modified
Sat, 07 Feb 2026 01:38:11 GMT
content-type
text/javascript; charset=UTF-8
vary
Accept-Encoding
cache-control
public, max-age=31536000
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/docs
accept-ranges
bytes
access-control-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="docs"
content-length
474689
x-xss-protection
0
server
sffe
/
invalid/
0
0

26981ed0d57bbad37e728ff58134270c
csp.withgoogle.com/csp/proto/
0
0
Ping
General
Full URL
https://csp.withgoogle.com/csp/proto/26981ed0d57bbad37e728ff58134270c
Requested by
Host: docs.google.com
URL: https://docs.google.com/presentation/d/e/2PACX-1vRmZBB6SquQevOw9IAMilCacQWL3twLawmtmGcJomHrgJzR0xk89wK4ZNcdKIar4Z5SaO37DHxmy89j/pub?start=false&amp;loop=false&amp;delayms=3000
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.251.35.177 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
lga25s78-in-f17.1e100.net
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36
Content-Type
text/plain;charset=UTF-8
Referer
https://docs.google.com/

Response headers

css
fonts.googleapis.com/
5 KB
2 KB
Stylesheet
General
Full URL
https://fonts.googleapis.com/css?family=Roboto%3A400
Requested by
Host: docs.google.com
URL: https://docs.google.com/presentation/d/e/2PACX-1vRmZBB6SquQevOw9IAMilCacQWL3twLawmtmGcJomHrgJzR0xk89wK4ZNcdKIar4Z5SaO37DHxmy89j/pub?start=false&amp;loop=false&amp;delayms=3000
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
142.251.40.138 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
lga25s80-in-f10.1e100.net
Software
ESF /
Resource Hash
1d31f469ed26c1fb1b8a2348f329b45c6eb7214c3f5fbdd53e1d4d3062983cec
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36
Referer
https://docs.google.com/

Response headers

content-encoding
gzip
x-content-type-options
nosniff
expires
Sat, 07 Feb 2026 07:51:33 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Sat, 07 Feb 2026 07:51:33 GMT
content-type
text/css; charset=utf-8
vary
Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
last-modified
Sat, 07 Feb 2026 06:40:41 GMT
x-frame-options
SAMEORIGIN
strict-transport-security
max-age=31536000
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
cross-origin-opener-policy
same-origin-allow-popups
cross-origin-resource-policy
cross-origin
access-control-allow-origin
*
x-xss-protection
0
server
ESF
AGV_vUeDvLCouabspwpC-K02sqgitRaNJLRvFmwiOW5h8V2Z3q9FGAOytrMZ8EjosF01YEVR-0SlMpY1RBN-diMyqnxcpPCtJD1cUvnbj_9iDA_G6WmBETQMmEmHomkDU4AeVNCefF5t_wot73S1a1soNa5cTaizU2lMh1_A80Ncx0DM=s2048
lh7-rt.googleusercontent.com/slidesz/
20 KB
20 KB
Image
General
Full URL
https://lh7-rt.googleusercontent.com/slidesz/AGV_vUeDvLCouabspwpC-K02sqgitRaNJLRvFmwiOW5h8V2Z3q9FGAOytrMZ8EjosF01YEVR-0SlMpY1RBN-diMyqnxcpPCtJD1cUvnbj_9iDA_G6WmBETQMmEmHomkDU4AeVNCefF5t_wot73S1a1soNa5cTaizU2lMh1_A80Ncx0DM=s2048?key=W45DTIrd-g4PNpl1J8l77w
Requested by
Host: docs.google.com
URL: https://docs.google.com/presentation/d/e/2PACX-1vRmZBB6SquQevOw9IAMilCacQWL3twLawmtmGcJomHrgJzR0xk89wK4ZNcdKIar4Z5SaO37DHxmy89j/pub?start=false&amp;loop=false&amp;delayms=3000
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.253.115.132 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
bg-in-f132.1e100.net
Software
fife /
Resource Hash
28fbba342904ed2e7449aa97c37ad1d7bff2016b1780822e65be1e95201f1bbd
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36
Referer
https://docs.google.com/

Response headers

access-control-expose-headers
Content-Length
cache-control
private, max-age=86400, no-transform
etag
"v0"
x-content-type-options
nosniff
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
20370
date
Sat, 07 Feb 2026 07:51:34 GMT
x-xss-protection
0
content-type
image/jpeg
vary
Origin
server
fife
content-disposition
inline;filename="unnamed.jpg"
css
fonts.googleapis.com/
10 KB
2 KB
Stylesheet
General
Full URL
https://fonts.googleapis.com/css?family=Google+Sans
Requested by
Host: docs.google.com
URL: https://docs.google.com/static/presentation/client/css/887848782-viewer_css_ltr.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
142.251.40.138 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
lga25s80-in-f10.1e100.net
Software
ESF /
Resource Hash
a5704a2c59946dd10ea8fecb69b31deb6e729501433422fbad8da4ac0abd58da
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36
Referer
https://docs.google.com/

Response headers

content-encoding
gzip
x-content-type-options
nosniff
expires
Sat, 07 Feb 2026 07:51:33 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Sat, 07 Feb 2026 07:51:33 GMT
content-type
text/css; charset=utf-8
vary
Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
last-modified
Sat, 07 Feb 2026 05:54:25 GMT
x-frame-options
SAMEORIGIN
strict-transport-security
max-age=31536000
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
cross-origin-opener-policy
same-origin-allow-popups
cross-origin-resource-policy
cross-origin
access-control-allow-origin
*
x-xss-protection
0
server
ESF
4a6a08e5-54a1-4d2a-991f-bb344c78868f
https://docs.google.com/
0
0

punchviewer_material_sprite46_grey_medium.svg
ssl.gstatic.com/docs/presentations/images/
55 KB
13 KB
Image
General
Full URL
https://ssl.gstatic.com/docs/presentations/images/punchviewer_material_sprite46_grey_medium.svg
Requested by
Host: docs.google.com
URL: https://docs.google.com/static/presentation/client/css/887848782-viewer_css_ltr.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.251.167.94 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
ww-in-f94.1e100.net
Software
sffe /
Resource Hash
f9b41bb504c0f7773a898244e1e28486040366380bffebf4f36120835016824c
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36
Referer
https://docs.google.com/

Response headers

content-encoding
br
age
14127
report-to
{"group":"docs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/docs"}]}
x-content-type-options
nosniff
expires
Sun, 07 Feb 2027 03:56:07 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Sat, 07 Feb 2026 03:56:07 GMT
last-modified
Thu, 08 Aug 2024 18:18:00 GMT
content-type
image/svg+xml
vary
Accept-Encoding, Origin
cache-control
public, max-age=31536000
cross-origin-resource-policy
cross-origin
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/docs
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="docs"
content-length
13253
x-xss-protection
0
server
sffe
KFO7CnqEu92Fr1ME7kSn66aGLdTylUAMa3yUBA.woff2
fonts.gstatic.com/s/roboto/v48/
39 KB
39 KB
Font
General
Full URL
https://fonts.gstatic.com/s/roboto/v48/KFO7CnqEu92Fr1ME7kSn66aGLdTylUAMa3yUBA.woff2
Requested by
Host: docs.google.com
URL: https://docs.google.com/presentation/d/e/2PACX-1vRmZBB6SquQevOw9IAMilCacQWL3twLawmtmGcJomHrgJzR0xk89wK4ZNcdKIar4Z5SaO37DHxmy89j/pub?start=false&amp;loop=false&amp;delayms=3000
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.217.3 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
pnlgaa-as-in-f3.1e100.net
Software
sffe /
Resource Hash
20b535fa80c8189e3b87d1803038389960203a886d502bc2ef1857affc2f38d2
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36
Origin
https://docs.google.com
Referer
https://docs.google.com/

Response headers

age
117255
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options
nosniff
expires
Fri, 05 Feb 2027 23:17:19 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Thu, 05 Feb 2026 23:17:19 GMT
last-modified
Thu, 29 May 2025 23:30:55 GMT
content-type
font/woff2
cache-control
public, max-age=31536000
timing-allow-origin
*
cross-origin-opener-policy
same-origin; report-to="apps-themes"
cross-origin-resource-policy
cross-origin
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges
bytes
access-control-allow-origin
*
content-length
40128
x-xss-protection
0
server
sffe
punchviewer_material_sprite46_grey_dark.svg
ssl.gstatic.com/docs/presentations/images/
55 KB
13 KB
Image
General
Full URL
https://ssl.gstatic.com/docs/presentations/images/punchviewer_material_sprite46_grey_dark.svg
Requested by
Host: docs.google.com
URL: https://docs.google.com/static/presentation/client/css/887848782-viewer_css_ltr.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.251.167.94 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
ww-in-f94.1e100.net
Software
sffe /
Resource Hash
d644f890d4021407715f113dfdd56c6f60963bf5850baa1c58b48a0af70d700c
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36
Referer
https://docs.google.com/

Response headers

content-encoding
br
age
12980
report-to
{"group":"docs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/docs"}]}
x-content-type-options
nosniff
expires
Sun, 07 Feb 2027 04:15:14 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Sat, 07 Feb 2026 04:15:14 GMT
last-modified
Thu, 08 Aug 2024 18:18:00 GMT
content-type
image/svg+xml
vary
Accept-Encoding, Origin
cache-control
public, max-age=31536000
cross-origin-resource-policy
cross-origin
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/docs
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="docs"
content-length
13260
x-xss-protection
0
server
sffe
netcheck.gif
ssl.gstatic.com/docs/common/
43 B
207 B
Image
General
Full URL
https://ssl.gstatic.com/docs/common/netcheck.gif?zx=w66wakhn3x11
Requested by
Host: docs.google.com
URL: https://docs.google.com/presentation/d/e/2PACX-1vRmZBB6SquQevOw9IAMilCacQWL3twLawmtmGcJomHrgJzR0xk89wK4ZNcdKIar4Z5SaO37DHxmy89j/pub?start=false&amp;loop=false&amp;delayms=3000&slide=id.p
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.251.167.94 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
ww-in-f94.1e100.net
Software
sffe /
Resource Hash
2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36
Referer
https://docs.google.com/

Response headers

report-to
{"group":"docs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/docs"}]}
x-content-type-options
nosniff
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Sat, 07 Feb 2026 07:51:34 GMT
content-type
image/gif
last-modified
Thu, 02 Nov 2023 22:48:00 GMT
cache-control
no-cache, no-store, must-revalidate
pragma
no-cache
cross-origin-resource-policy
cross-origin
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/docs
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="docs"
content-length
43
x-xss-protection
0
server
sffe
log
play.google.com/
131 B
151 B
Fetch
General
Full URL
https://play.google.com/log?format=json&hasfast=true&authuser=0
Requested by
Host: docs.google.com
URL: https://docs.google.com/_/presentations/_/js/k=presentations.viewer.en_CA.NYGwWWkLRjw.es5.O/am=AAgGBg/d=0/wt=0/rs=AB6fld0qvhi-MHHPZLlUCSgs6cY5L1Zfww/m=core
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.80.14 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
lga34s33-in-f14.1e100.net
Software
Playlog /
Resource Hash
502e9680cfa78fa8be779cbf4f1947c8eaa3d43bf8c7464800ec772b2ddea358
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
https://docs.google.com/
Content-Encoding
gzip
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36
Content-Type
application/binary
X-Goog-AuthUser
0

Response headers

x-frame-options
SAMEORIGIN
content-encoding
gzip
cross-origin-resource-policy
cross-origin
access-control-allow-credentials
true
access-control-allow-origin
https://docs.google.com
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
131
date
Sat, 07 Feb 2026 07:51:34 GMT
x-xss-protection
0
content-type
text/plain; charset=UTF-8
server
Playlog
access-control-allow-headers
X-Playlog-Web
log
play.google.com/
0
0
Preflight
General
Full URL
https://play.google.com/log?format=json&hasfast=true&authuser=0
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.80.14 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
lga34s33-in-f14.1e100.net
Software
Playlog /
Resource Hash
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Accept
*/*
Access-Control-Request-Headers
content-encoding,content-type,x-goog-authuser
Access-Control-Request-Method
POST
Origin
https://docs.google.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials
true
access-control-allow-headers
X-Playlog-Web,authorization,content-encoding,content-type,x-goog-authuser,origin
access-control-allow-methods
GET, POST, OPTIONS
access-control-allow-origin
https://docs.google.com
access-control-max-age
86400
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
content-type
text/plain; charset=UTF-8
date
Sat, 07 Feb 2026 07:51:34 GMT
server
Playlog
x-frame-options
SAMEORIGIN
x-xss-protection
0
m=secondary
docs.google.com/_/presentations/_/js/k=presentations.viewer.en_CA.NYGwWWkLRjw.es5.O/am=AAgGBg/d=0/wt=0/rs=AB6fld0qvhi-MHHPZLlUCSgs6cY5L1Zfww/
455 KB
152 KB
Script
General
Full URL
https://docs.google.com/_/presentations/_/js/k=presentations.viewer.en_CA.NYGwWWkLRjw.es5.O/am=AAgGBg/d=0/wt=0/rs=AB6fld0qvhi-MHHPZLlUCSgs6cY5L1Zfww/m=secondary
Requested by
Host: docs.google.com
URL: https://docs.google.com/_/presentations/_/js/k=presentations.viewer.en_CA.NYGwWWkLRjw.es5.O/am=AAgGBg/d=0/wt=0/rs=AB6fld0qvhi-MHHPZLlUCSgs6cY5L1Zfww/m=core
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
64.233.180.101 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
on-in-f101.1e100.net
Software
sffe /
Resource Hash
8fd8206e7d267b7b2340d1f5cc9670e83cb6b5f9a7b7861f709ec6456c7592ae
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36
Referer
https://docs.google.com/presentation/d/e/2PACX-1vRmZBB6SquQevOw9IAMilCacQWL3twLawmtmGcJomHrgJzR0xk89wK4ZNcdKIar4Z5SaO37DHxmy89j/pub?start=false&amp;loop=false&amp;delayms=3000&slide=id.p

Response headers

content-encoding
gzip
age
14753
report-to
{"group":"docs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/docs"}]}
x-content-type-options
nosniff
expires
Sun, 07 Feb 2027 03:45:41 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Sat, 07 Feb 2026 03:45:41 GMT
last-modified
Sat, 07 Feb 2026 01:38:11 GMT
content-type
text/javascript; charset=UTF-8
vary
Accept-Encoding
cache-control
public, max-age=31536000
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/docs
accept-ranges
bytes
access-control-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="docs"
content-length
155425
x-xss-protection
0
server
sffe
m=help
docs.google.com/_/presentations/_/js/k=presentations.viewer.en_CA.NYGwWWkLRjw.es5.O/am=AAgGBg/d=0/wt=0/rs=AB6fld0qvhi-MHHPZLlUCSgs6cY5L1Zfww/
36 KB
13 KB
Script
General
Full URL
https://docs.google.com/_/presentations/_/js/k=presentations.viewer.en_CA.NYGwWWkLRjw.es5.O/am=AAgGBg/d=0/wt=0/rs=AB6fld0qvhi-MHHPZLlUCSgs6cY5L1Zfww/m=help
Requested by
Host: docs.google.com
URL: https://docs.google.com/_/presentations/_/js/k=presentations.viewer.en_CA.NYGwWWkLRjw.es5.O/am=AAgGBg/d=0/wt=0/rs=AB6fld0qvhi-MHHPZLlUCSgs6cY5L1Zfww/m=core
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
64.233.180.101 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
on-in-f101.1e100.net
Software
sffe /
Resource Hash
626a86217a7e26fe96db928c62ec5ad54e1c41a41abf63ca75f0ec17c7d68c45
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36
Referer
https://docs.google.com/presentation/d/e/2PACX-1vRmZBB6SquQevOw9IAMilCacQWL3twLawmtmGcJomHrgJzR0xk89wK4ZNcdKIar4Z5SaO37DHxmy89j/pub?start=false&amp;loop=false&amp;delayms=3000&slide=id.p

Response headers

content-encoding
gzip
age
14753
report-to
{"group":"docs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/docs"}]}
x-content-type-options
nosniff
expires
Sun, 07 Feb 2027 03:45:41 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Sat, 07 Feb 2026 03:45:41 GMT
last-modified
Sat, 07 Feb 2026 01:38:11 GMT
content-type
text/javascript; charset=UTF-8
vary
Accept-Encoding
cache-control
public, max-age=31536000
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/docs
accept-ranges
bytes
access-control-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="docs"
content-length
13301
x-xss-protection
0
server
sffe
favicon-2023q4.ico
ssl.gstatic.com/docs/presentations/images/
24 KB
2 KB
Other
General
Full URL
https://ssl.gstatic.com/docs/presentations/images/favicon-2023q4.ico
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.251.167.94 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
ww-in-f94.1e100.net
Software
sffe /
Resource Hash
1d2b1bf6c2921393f0eeb1b21613bb9e1c9144dfda918306ef99dbf0d9d2aee4
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36
Referer
https://docs.google.com/

Response headers

content-encoding
br
age
14329
report-to
{"group":"docs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/docs"}]}
x-content-type-options
nosniff
expires
Sun, 07 Feb 2027 03:52:45 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Sat, 07 Feb 2026 03:52:45 GMT
last-modified
Mon, 30 Oct 2023 14:18:00 GMT
content-type
image/x-icon
vary
Accept-Encoding, Origin
cache-control
public, max-age=31536000
cross-origin-resource-policy
cross-origin
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/docs
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="docs"
content-length
1593
x-xss-protection
0
server
sffe
log
play.google.com/
131 B
151 B
Fetch
General
Full URL
https://play.google.com/log?format=json&hasfast=true&authuser=0
Requested by
Host: docs.google.com
URL: https://docs.google.com/_/presentations/_/js/k=presentations.viewer.en_CA.NYGwWWkLRjw.es5.O/am=AAgGBg/d=0/wt=0/rs=AB6fld0qvhi-MHHPZLlUCSgs6cY5L1Zfww/m=core
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.80.14 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
lga34s33-in-f14.1e100.net
Software
Playlog /
Resource Hash
502e9680cfa78fa8be779cbf4f1947c8eaa3d43bf8c7464800ec772b2ddea358
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
https://docs.google.com/
Content-Encoding
gzip
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36
Content-Type
application/binary
X-Goog-AuthUser
0

Response headers

x-frame-options
SAMEORIGIN
content-encoding
gzip
cross-origin-resource-policy
cross-origin
access-control-allow-credentials
true
access-control-allow-origin
https://docs.google.com
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
131
date
Sat, 07 Feb 2026 07:51:37 GMT
x-xss-protection
0
content-type
text/plain; charset=UTF-8
server
Playlog
access-control-allow-headers
X-Playlog-Web

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
invalid
URL
chrome-extension://invalid/
Domain
docs.google.com
URL
blob:https://docs.google.com/4a6a08e5-54a1-4d2a-991f-bb344c78868f

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: AT&T (Telecommunication)

38 JavaScript Window variables

These are the non-standard variables defined on the window object. These include var declarations and global functions and can be helpful in identifying possible client-side frameworks and code.

object| ppConfig object| DOCS_timing object| WIZ_global_data object| _docs_flag_initialData function| _F_toggles_initialize function| a object| b object| d string| e object| _F_toggles function| DOCS_attachInitialMaterialFontLoadListener object| DOCS_timingPromises object| _docs_yt_api_youtube_ready_promise object| _$sk object| _F_toggles__$sk object| CLOSURE_DEFINES object| CLOSURE_UNCOMPILED_DEFINES function| DOCS_initializeModules number| U3bHHf function| DOCS_initDocsMobileWeb function| DOCS_initSlidesMobileWeb function| DOCS_initSheetsMobileWeb function| DOCS_installLinkReferrerSanitizer function| onYouTubeIframeAPIReady function| init_viewer object| __punchViewerWorkerInstance object| viewerData object| SK_viewerApp object| DOCS_initialLoadTiming object| closure_lm_574724 object| wizBind object| SK_viewerToastService object| SK_editorEventListener boolean| sup_wp_key number| SK_modelChunkLoadStart number| SK_modelChunkParseStart object| userfeedback function| startFeedback

1 Cookies

Domain/Path Name / Value
.google.com/ Name: NID
Value: 528=WFUEbJru49ST18ORCSg6qWNu-t8__pxJjMbPe-HbKGxWx1wJgAMgUwFa2YnPKv3-_IvZAWP_T2YxjzBJyomKhAqdjHN0QMYwCNJwkZkDi5ZTlE6b1p31NVeYVnUpJzy7XbVgSZs-svYr0ZCpjA3bt5FQJDiXtlh_sf4lPRt7-H4mhcr7jJFcFfjGyRiy5fvwET7NkVbU_jqVgab5lvM

2 Console Messages

Source Level URL
Text
network error URL: chrome-extension://invalid/
Message:
Failed to load resource: net::ERR_BLOCKED_BY_CLIENT
rendering warning URL: https://docs.google.com/presentation/d/e/2PACX-1vRmZBB6SquQevOw9IAMilCacQWL3twLawmtmGcJomHrgJzR0xk89wK4ZNcdKIar4Z5SaO37DHxmy89j/pub?start=false&amp;loop=false&amp;delayms=3000(Line 9)
Message:
The key "target-densitydpi" is not supported.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Content-Security-Policy require-trusted-types-for 'script';report-uri https://csp.withgoogle.com/csp/docs-tt base-uri 'self';object-src 'self' blob:;report-uri https://docs.google.com/presentation/cspreport;script-src 'report-sample' 'nonce-1UJ_AyWr4Asp5ZvQZzHEBg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';worker-src 'self' blob:
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0