Summary

This website contacted 70 IPs in 3 countries across 39 domains to perform 515 HTTP transactions. The main IP is 104.16.224.171, located in Ascension Island and belongs to CLOUDFLARENET - Cloudflare, Inc., US. The main domain is www.darkreading.com. The Cisco Umbrella rank of the primary domain is 450083. 10yr old
TLS certificate: Issued by WE1 on July 27th 2026. Valid for: 3mo.
This is the only time www.darkreading.com was scanned on urlscan.io!

Domain & IP information

IP Address AS Autonomous System
2 75 104.16.224.171 104.16.224.171 13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
20 104.17.160.85 104.17.160.85 13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
14 142.251.167.95 142.251.167.95 15169 (GOOGLE) (GOOGLE - Google LLC)
4 104.18.40.238 104.18.40.238 13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
21 142.251.211.130 142.251.211.130 15169 (GOOGLE) (GOOGLE - Google LLC)
5 142.250.191.8 142.250.191.8 15169 (GOOGLE) (GOOGLE - Google LLC)
2 157.240.241.1 157.240.241.1 32934 (FACEBOOK) (FACEBOOK - Facebook)
1 157.240.241.174 157.240.241.174 32934 (FACEBOOK) (FACEBOOK - Facebook)
1 104.16.80.73 104.16.80.73 13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
1 1 142.251.40.238 142.251.40.238 15169 (GOOGLE) (GOOGLE - Google LLC)
1 172.253.63.139 172.253.63.139 15169 (GOOGLE) (GOOGLE - Google LLC)
28 142.251.211.131 142.251.211.131 15169 (GOOGLE) (GOOGLE - Google LLC)
10 142.250.217.14 142.250.217.14 15169 (GOOGLE) (GOOGLE - Google LLC)
2 142.251.167.141 142.251.167.141 15169 (GOOGLE) (GOOGLE - Google LLC)
14 142.250.217.238 142.250.217.238 15169 (GOOGLE) (GOOGLE - Google LLC)
3 172.64.150.107 172.64.150.107 13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
1 13.249.91.42 13.249.91.42 16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
2 3.168.102.70 3.168.102.70 16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
1 108.138.120.216 108.138.120.216 16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
1 104.18.39.181 104.18.39.181 13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
1 13.33.252.127 13.33.252.127 16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
1 4.153.187.221 4.153.187.221 8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation)
2 99.84.160.34 99.84.160.34 16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
5 172.64.155.110 172.64.155.110 13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
4 142.251.154.119 142.251.154.119 15169 (GOOGLE) (GOOGLE - Google LLC)
1 142.251.167.148 142.251.167.148 15169 (GOOGLE) (GOOGLE - Google LLC)
6 52.215.118.206 52.215.118.206 16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
2 99.83.154.140 99.83.154.140 16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
2 216.239.36.181 216.239.36.181 15169 (GOOGLE) (GOOGLE - Google LLC)
2 192.178.155.155 192.178.155.155 15169 (GOOGLE) (GOOGLE - Google LLC)
3 64.233.180.94 64.233.180.94 15169 (GOOGLE) (GOOGLE - Google LLC)
1 3.168.122.50 3.168.122.50 16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
1 54.156.230.248 54.156.230.248 14618 (AMAZON-AES) (AMAZON-AES - Amazon.com)
3 104.16.221.171 104.16.221.171 13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
1 99.84.160.95 99.84.160.95 16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
1 100.60.18.88 100.60.18.88 14618 (AMAZON-AES) (AMAZON-AES - Amazon.com)
1 150.171.109.73 150.171.109.73 8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation)
3 142.251.211.195 142.251.211.195 15169 (GOOGLE) (GOOGLE - Google LLC)
1 192.179.18.157 192.179.18.157 15169 (GOOGLE) (GOOGLE - Google LLC)
1 142.250.217.225 142.250.217.225 15169 (GOOGLE) (GOOGLE - Google LLC)
1 142.250.191.2 142.250.191.2 15169 (GOOGLE) (GOOGLE - Google LLC)
1 13.33.67.87 13.33.67.87 16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
26 64.233.180.155 64.233.180.155 15169 (GOOGLE) (GOOGLE - Google LLC)
1 1 44.235.8.238 44.235.8.238 16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
12 23.210.73.49 23.210.73.49 20940 (AKAMAI-AS...) (AKAMAI-ASN1 Akamai International B.V.)
2 142.251.163.155 142.251.163.155 15169 (GOOGLE) (GOOGLE - Google LLC)
5 142.250.31.132 142.250.31.132 15169 (GOOGLE) (GOOGLE - Google LLC)
2 104.18.3.135 104.18.3.135 13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
5 20.57.85.160 20.57.85.160 8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation)
1 142.251.167.149 142.251.167.149 15169 (GOOGLE) (GOOGLE - Google LLC)
40 142.251.167.157 142.251.167.157 15169 (GOOGLE) (GOOGLE - Google LLC)
4 172.67.163.34 172.67.163.34 13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
16 34.117.228.201 34.117.228.201 396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM - Google LLC)
1 142.250.68.198 142.250.68.198 15169 (GOOGLE) (GOOGLE - Google LLC)
60 64.233.180.154 64.233.180.154 15169 (GOOGLE) (GOOGLE - Google LLC)
13 13.32.241.19 13.32.241.19 16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
1 172.253.62.157 172.253.62.157 15169 (GOOGLE) (GOOGLE - Google LLC)
5 142.251.211.65 142.251.211.65 15169 (GOOGLE) (GOOGLE - Google LLC)
5 142.251.163.154 142.251.163.154 15169 (GOOGLE) (GOOGLE - Google LLC)
1 35.211.246.180 35.211.246.180 43515 (YOUTUBE G...) (YOUTUBE Google Ireland Limited)
16 99.84.160.3 99.84.160.3 16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
1 142.250.191.1 142.250.191.1 15169 (GOOGLE) (GOOGLE - Google LLC)
8 50.17.170.53 50.17.170.53 14618 (AMAZON-AES) (AMAZON-AES - Amazon.com)
4 142.250.65.66 142.250.65.66 15169 (GOOGLE) (GOOGLE - Google LLC)
1 162.247.243.39 162.247.243.39 54113 (FASTLY) (FASTLY - Fastly)
1 2 150.171.109.74 150.171.109.74 8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation)
1 1 150.171.28.10 150.171.28.10 8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation)
2 172.253.63.84 172.253.63.84 15169 (GOOGLE) (GOOGLE - Google LLC)
2 52.213.196.214 52.213.196.214 16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
5 185.221.87.23 185.221.87.23 54113 (FASTLY) (FASTLY - Fastly)
1 3.5.73.98 3.5.73.98 16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
1 142.251.153.119 142.251.153.119 15169 (GOOGLE) (GOOGLE - Google LLC)
515 70
Apex Domain
Subdomains
Transfer
93 googlesyndication.com
e8645ccad93e0ce44fd2d5a66aa4491b.safeframe.googlesyndication.com 1mo old
pagead2.googlesyndication.com — Cisco Umbrella Rank: 177 10yr old
tpc.googlesyndication.com — Cisco Umbrella Rank: 252 14yr old
678 KB
78 darkreading.com 2 redirects
www.darkreading.com — Cisco Umbrella Rank: 450083 10yr old
c.darkreading.com 5yr old
2 MB
40 googleadservices.com
www.googleadservices.com — Cisco Umbrella Rank: 162 14yr old
62 KB
34 doubleverify.com
pub.doubleverify.com — Cisco Umbrella Rank: 4772 8yr old
cdn.doubleverify.com — Cisco Umbrella Rank: 939 10yr old
tps.doubleverify.com — Cisco Umbrella Rank: 886 9yr old
tps-dn-ue1.doubleverify.com — Cisco Umbrella Rank: 3908 3yr old
tpsc-ue1.doubleverify.com — Cisco Umbrella Rank: 2947 5yr old
142 KB
34 google.com
marketingplatform.google.com — Cisco Umbrella Rank: 2407 8yr old
docs.google.com — Cisco Umbrella Rank: 648 10yr old
fundingchoicesmessages.google.com — Cisco Umbrella Rank: 611 8yr old
www.google.com — Cisco Umbrella Rank: 6 14yr old
analytics.google.com — Cisco Umbrella Rank: 227 9yr old
accounts.google.com — Cisco Umbrella Rank: 21 14yr old
780 KB
31 gstatic.com
fonts.gstatic.com — Cisco Umbrella Rank: 68 10yr old
ssl.gstatic.com Failed — Cisco Umbrella Rank: 192 10yr old
587 KB
29 doubleclick.net 1 redirects
securepubads.g.doubleclick.net — Cisco Umbrella Rank: 403 10yr old
www3.doubleclick.net — Cisco Umbrella Rank: 14036 5yr old
ad.doubleclick.net — Cisco Umbrella Rank: 199 10yr old
stats.g.doubleclick.net — Cisco Umbrella Rank: 247 10yr old
cm.g.doubleclick.net — Cisco Umbrella Rank: 407 10yr old
googleads.g.doubleclick.net — Cisco Umbrella Rank: 75 10yr old
googleads4.g.doubleclick.net — Cisco Umbrella Rank: 901 10yr old
391 KB
26 bridged.media
loader.bridged.media — Cisco Umbrella Rank: 214515 4yr old
gateway.bridged.media — Cisco Umbrella Rank: 169322 4yr old
agent-card.bridged.media — Cisco Umbrella Rank: 258053 1yr old
961 KB
21 celtra.com
cdn.celtra.com — Cisco Umbrella Rank: 7403 8yr old
cache-ssl.celtra.com — Cisco Umbrella Rank: 6512 10yr old
track.celtra.com — Cisco Umbrella Rank: 6094 10yr old
205 KB
20 contentstack.com
eu-images.contentstack.com — Cisco Umbrella Rank: 55473 6yr old
458 KB
14 googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 91 10yr old
6 KB
9 adtrafficquality.google
ep2.adtrafficquality.google — Cisco Umbrella Rank: 295 2yr old
ep1.adtrafficquality.google — Cisco Umbrella Rank: 280 2yr old
75 KB
9 clarity.ms 1 redirects
www.clarity.ms — Cisco Umbrella Rank: 532 8yr old
scripts.clarity.ms — Cisco Umbrella Rank: 687 1yr old
e.clarity.ms — Cisco Umbrella Rank: 4150 5yr old
c.clarity.ms — Cisco Umbrella Rank: 958 6yr old
29 KB
7 googletagservices.com
www.googletagservices.com — Cisco Umbrella Rank: 482 10yr old
126 KB
5 nr-data.net
bam.eu01.nr-data.net — Cisco Umbrella Rank: 12652 8yr old
2 KB
5 googletagmanager.com
www.googletagmanager.com — Cisco Umbrella Rank: 86 14yr old
856 KB
4 channel99.io
ping.channel99.io — Cisco Umbrella Rank: 132707 3yr old
777 B
4 transcend-cdn.com
transcend-cdn.com — Cisco Umbrella Rank: 6400 4yr old
187 KB
3 google.ca
www.google.ca — Cisco Umbrella Rank: 8606 10yr old
190 B
3 dpmsrv.com
s.dpmsrv.com — Cisco Umbrella Rank: 64039 10yr old
a.dpmsrv.com — Cisco Umbrella Rank: 93347 10yr old
62 KB
3 iiris.com
api.iiris.com — Cisco Umbrella Rank: 480586 4yr old
widgets.iiris.com — Cisco Umbrella Rank: 312370 3yr old
72 KB
2 dv.tech
vtrk.dv.tech — Cisco Umbrella Rank: 1919 3yr old
360 B
2 sail-personalize.com
api.sail-personalize.com — Cisco Umbrella Rank: 9228 11yr old
5 KB
2 hotjar.com
static.hotjar.com — Cisco Umbrella Rank: 1613 10yr old
script.hotjar.com — Cisco Umbrella Rank: 2123 10yr old
65 KB
2 ubembed.com
6600d6d98e534115970f9529a45f3195.js.ubembed.com 7yr old
assets.ubembed.com — Cisco Umbrella Rank: 39476 10yr old
52 KB
2 withgoogle.com
csp.withgoogle.com — Cisco Umbrella Rank: 606 8yr old
2 facebook.net
connect.facebook.net — Cisco Umbrella Rank: 259 14yr old
84 KB
1 amazonaws.com
stage-assets-724772082883.s3.eu-west-1.amazonaws.com 1yr old
37 KB
1 bing.com 1 redirects
c.bing.com — Cisco Umbrella Rank: 347 14yr old
772 B
1 newrelic.com
js-agent.newrelic.com — Cisco Umbrella Rank: 1884 12yr old
33 KB
1 2mdn.net
s0.2mdn.net — Cisco Umbrella Rank: 602 10yr old
140 KB
1 usbrowserspeed.com 1 redirects
a.usbrowserspeed.com — Cisco Umbrella Rank: 7314 4yr old
263 B
1 hotjar.io
vc.hotjar.io — Cisco Umbrella Rank: 5068 7yr old
231 B
1 chartbeat.net
ping.chartbeat.net — Cisco Umbrella Rank: 2532 10yr old
201 B
1 chartbeat.com
static.chartbeat.com — Cisco Umbrella Rank: 2937 10yr old
17 KB
1 sail-horizon.com
ak.sail-horizon.com — Cisco Umbrella Rank: 9079 14yr old
49 KB
1 cloudflareinsights.com
static.cloudflareinsights.com — Cisco Umbrella Rank: 321 7yr old
10 KB
1 instagram.com
www.instagram.com — Cisco Umbrella Rank: 643 10yr old
34 KB
0 Failed
function sub() { [native code] }. Failed
515 39
Domain Requested by
86 pagead2.googlesyndication.com transcend-cdn.com
ad.doubleclick.net
pagead2.googlesyndication.com
www.googleadservices.com
tpc.googlesyndication.com
ep2.adtrafficquality.google
75 www.darkreading.com 2 redirects www.darkreading.com
transcend-cdn.com
40 www.googleadservices.com transcend-cdn.com
www.googleadservices.com
pagead2.googlesyndication.com
28 fonts.gstatic.com fonts.googleapis.com
docs.google.com
21 securepubads.g.doubleclick.net www.darkreading.com
transcend-cdn.com
20 eu-images.contentstack.com www.darkreading.com
16 agent-card.bridged.media transcend-cdn.com
agent-card.bridged.media
www.darkreading.com
14 fundingchoicesmessages.google.com transcend-cdn.com
14 fonts.googleapis.com www.darkreading.com
docs.google.com
12 cache-ssl.celtra.com transcend-cdn.com
www.darkreading.com
12 cdn.doubleverify.com transcend-cdn.com
10 tpsc-ue1.doubleverify.com transcend-cdn.com
10 gateway.bridged.media transcend-cdn.com
agent-card.bridged.media
10 docs.google.com www.darkreading.com
docs.google.com
8 track.celtra.com www.darkreading.com
7 www.googletagservices.com transcend-cdn.com
www.googleadservices.com
6 tps.doubleverify.com transcend-cdn.com
6 tpc.googlesyndication.com www.darkreading.com
transcend-cdn.com
pagead2.googlesyndication.com
5 bam.eu01.nr-data.net transcend-cdn.com
5 ep2.adtrafficquality.google ad.doubleclick.net
ep2.adtrafficquality.google
transcend-cdn.com
5 e.clarity.ms transcend-cdn.com
5 www.google.com transcend-cdn.com
www.darkreading.com
5 pub.doubleverify.com transcend-cdn.com
5 www.googletagmanager.com www.darkreading.com
transcend-cdn.com
4 ep1.adtrafficquality.google ep2.adtrafficquality.google
transcend-cdn.com
4 ping.channel99.io transcend-cdn.com
4 transcend-cdn.com www.darkreading.com
transcend-cdn.com
3 c.darkreading.com transcend-cdn.com
3 www.google.ca www.darkreading.com
3 ssl.gstatic.com docs.google.com
2 accounts.google.com agent-card.bridged.media
2 c.clarity.ms 1 redirects
2 vtrk.dv.tech transcend-cdn.com
2 stats.g.doubleclick.net transcend-cdn.com
2 analytics.google.com transcend-cdn.com
2 api.sail-personalize.com transcend-cdn.com
2 ad.doubleclick.net transcend-cdn.com
2 s.dpmsrv.com transcend-cdn.com
www.darkreading.com
2 loader.bridged.media transcend-cdn.com
2 api.iiris.com transcend-cdn.com
2 csp.withgoogle.com docs.google.com
2 connect.facebook.net www.darkreading.com
transcend-cdn.com
1 stage-assets-724772082883.s3.eu-west-1.amazonaws.com
1 c.bing.com 1 redirects
1 js-agent.newrelic.com transcend-cdn.com
1 tps-dn-ue1.doubleverify.com transcend-cdn.com
1 googleads4.g.doubleclick.net ad.doubleclick.net
1 cdn.celtra.com transcend-cdn.com
1 s0.2mdn.net ad.doubleclick.net
1 a.usbrowserspeed.com 1 redirects
1 vc.hotjar.io transcend-cdn.com
1 googleads.g.doubleclick.net transcend-cdn.com
1 e8645ccad93e0ce44fd2d5a66aa4491b.safeframe.googlesyndication.com transcend-cdn.com
1 cm.g.doubleclick.net transcend-cdn.com
1 scripts.clarity.ms transcend-cdn.com
1 a.dpmsrv.com transcend-cdn.com
1 script.hotjar.com transcend-cdn.com
1 ping.chartbeat.net www.darkreading.com
1 assets.ubembed.com transcend-cdn.com
1 www.clarity.ms transcend-cdn.com
1 static.hotjar.com transcend-cdn.com
1 6600d6d98e534115970f9529a45f3195.js.ubembed.com transcend-cdn.com
1 static.chartbeat.com transcend-cdn.com
1 widgets.iiris.com transcend-cdn.com
1 ak.sail-horizon.com transcend-cdn.com
1 marketingplatform.google.com www.darkreading.com
1 www3.doubleclick.net 1 redirects
1 static.cloudflareinsights.com www.darkreading.com
1 www.instagram.com www.darkreading.com
0 Failed docs.google.com
515 70
Subject Issuer Validity Valid
www.darkreading.com
WE1
2026-07-27 -
2026-10-25
3mo crt.sh
*.contentstack.com
GandiCert
2026-07-24 -
2027-02-07
7mo crt.sh
upload.video.google.com
WR2
2026-08-10 -
2026-11-02
3mo crt.sh
transcend-cdn.com
WE1
2026-08-23 -
2026-11-21
3mo crt.sh
*.g.doubleclick.net
WR2
2026-08-10 -
2026-11-02
3mo crt.sh
*.google-analytics.com
WR2
2026-08-10 -
2026-11-02
3mo crt.sh
*.facebook.com
DigiCert Global G2 TLS RSA SHA256 2020 CA1
2026-06-18 -
2026-09-16
3mo crt.sh
*.www.instagram.com
DigiCert Global G2 TLS RSA SHA256 2020 CA1
2026-06-18 -
2026-09-16
3mo crt.sh
cloudflareinsights.com
WE1
2026-08-14 -
2026-11-12
3mo crt.sh
*.gstatic.com
WR2
2026-08-10 -
2026-11-02
3mo crt.sh
*.google.com
WR2
2026-08-10 -
2026-11-02
3mo crt.sh
*.appspot.com
WR2
2026-08-10 -
2026-11-02
3mo crt.sh
api.iiris.com
WE1
2026-07-26 -
2026-10-24
3mo crt.sh
ak.sail-horizon.com
Amazon RSA 2048 M01
2025-11-12 -
2026-12-11
1yr crt.sh
loader.bridged.media
Amazon RSA 2048 M04
2025-10-26 -
2026-11-24
1yr crt.sh
widgets.iiris.com
WE1
2026-08-17 -
2026-11-15
3mo crt.sh
*.chartbeat.com
Thawte TLS RSA CA G1
2026-05-18 -
2026-12-02
7mo crt.sh
*.js.ubembed.com
YE2
2026-07-18 -
2026-10-16
3mo crt.sh
*.hotjar.com
Amazon RSA 2048 M01
2026-08-24 -
2027-03-09
7mo crt.sh
a.tag.clarity.ms
Microsoft TLS G2 RSA CA OCSP 02
2026-08-29 -
2027-02-25
6mo crt.sh
*.dpmsrv.com
Amazon RSA 2048 M04
2025-12-16 -
2027-01-13
1yr crt.sh
pub.doubleverify.com
WE1
2026-08-20 -
2026-11-19
3mo crt.sh
*.doubleclick.net
WR2
2026-08-10 -
2026-11-02
3mo crt.sh
*.bridged.media
Amazon RSA 2048 M04
2026-08-10 -
2027-02-23
7mo crt.sh
api.sail-personalize.com
Amazon RSA 2048 M04
2026-01-23 -
2027-02-20
1yr crt.sh
*.google.ca
WR2
2026-08-10 -
2026-11-02
3mo crt.sh
assets.ubembed.com
Amazon RSA 2048 M04
2026-09-05 -
2027-03-21
7mo crt.sh
*.chartbeat.net
Thawte TLS RSA CA G1
2025-12-11 -
2026-12-29
1yr crt.sh
c.darkreading.com
WE1
2026-07-25 -
2026-10-24
3mo crt.sh
scripts.clarity.ms
GeoTrust TLS RSA CA G1
2026-05-05 -
2026-11-05
6mo crt.sh
*.hotjar.io
Amazon ECDSA 256 M04
2025-12-10 -
2027-01-08
1yr crt.sh
*.doubleverify.com
DigiCert Global G3 TLS ECC SHA384 2020 CA1
2025-11-16 -
2026-11-17
1yr crt.sh
tpc.googlesyndication.com
WR2
2026-08-10 -
2026-11-02
3mo crt.sh
vtrk.dv.tech
WE1
2026-07-22 -
2026-10-20
3mo crt.sh
a.clarity.ms
Microsoft TLS G2 RSA CA OCSP 04
2026-08-29 -
2027-02-25
6mo crt.sh
*.googleadservices.com
WR2
2026-08-10 -
2026-11-02
3mo crt.sh
ping.channel99.io
WE1
2026-08-27 -
2026-11-25
3mo crt.sh
*.tps.doubleverify.com
GoDaddy TLS Intermediate CA DV - R1v1
2026-07-30 -
2027-02-13
7mo crt.sh
celtra.com
Amazon RSA 2048 M01
2026-04-30 -
2026-11-13
7mo crt.sh
adtrafficquality.google
WR2
2026-08-10 -
2026-11-02
3mo crt.sh
agent-card.bridged.media
Amazon RSA 2048 M04
2025-12-05 -
2027-01-03
1yr crt.sh
js-agent.newrelic.com
GlobalSign Atlas R3 DV TLS CA 2025 Q4
2025-11-25 -
2026-12-27
1yr crt.sh
accounts.google.com
WR2
2026-08-10 -
2026-11-02
3mo crt.sh
*.eu01.nr-data.net
DigiCert Global G2 TLS RSA SHA256 2020 CA1
2026-02-09 -
2027-02-08
1yr crt.sh
*.s3-eu-west-1.amazonaws.com
Amazon RSA 2048 M04
2025-11-14 -
2026-11-06
1yr crt.sh

This page contains 40 frames:

Primary Page: https://www.darkreading.com/cyberattacks-data-breaches/attackers-multi-hop-google-redirects-phishing-campaign
Frame ID: 91200516DF6D66C3685E182DEEB63D23
Requests: 222 HTTP requests in this frame

Frame: https://docs.google.com/spreadsheets/d/e/2PACX-1vQsygsynrhlYSFLOwZ9IaqURE4cQ3rGo07MkUiECTl3zXlINi_MWVmfxgjSgmvPhGmk0kPdS8DBzkoj/pubhtml?gid=326945225&widget=false&headers=false&chrome=false
Frame ID: B76A27EEABC6305F4AC9F7329F75E6B9
Requests: 14 HTTP requests in this frame

Frame: https://docs.google.com/spreadsheets/d/e/2PACX-1vQsygsynrhlYSFLOwZ9IaqURE4cQ3rGo07MkUiECTl3zXlINi_MWVmfxgjSgmvPhGmk0kPdS8DBzkoj/pubhtml?gid=0&single=false&widget=false&headers=false&chrome=false
Frame ID: E8495D095AD899C054D086114A81E799
Requests: 1 HTTP requests in this frame

Frame: https://docs.google.com/spreadsheets/d/e/2PACX-1vQsygsynrhlYSFLOwZ9IaqURE4cQ3rGo07MkUiECTl3zXlINi_MWVmfxgjSgmvPhGmk0kPdS8DBzkoj/pubhtml?gid=1145058527&single=false&widget=false&headers=false&chrome=false
Frame ID: DA69A2EA7F304C668C4F0EAE6F2891DC
Requests: 15 HTTP requests in this frame

Frame: https://www.darkreading.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/330e41bb475c/main.js
Frame ID: B054CBF7293FA0C254CB2E5AB34EF254
Requests: 2 HTTP requests in this frame

Frame: https://docs.google.com/spreadsheets/d/e/2PACX-1vQsygsynrhlYSFLOwZ9IaqURE4cQ3rGo07MkUiECTl3zXlINi_MWVmfxgjSgmvPhGmk0kPdS8DBzkoj/pubhtml?gid=1145058527&single=false&widget=false&headers=false&chrome=false
Frame ID: 5FAE834B231DBF9B2C42C4BB842BB0A2
Requests: 14 HTTP requests in this frame

Frame: https://docs.google.com/spreadsheets/d/e/2PACX-1vQsygsynrhlYSFLOwZ9IaqURE4cQ3rGo07MkUiECTl3zXlINi_MWVmfxgjSgmvPhGmk0kPdS8DBzkoj/pubhtml?gid=0&single=false&widget=false&headers=false&chrome=false
Frame ID: 322297D9DA564C792A4C06EDA1FE2E67
Requests: 14 HTTP requests in this frame

Frame: https://docs.google.com/spreadsheets/d/e/2PACX-1vQsygsynrhlYSFLOwZ9IaqURE4cQ3rGo07MkUiECTl3zXlINi_MWVmfxgjSgmvPhGmk0kPdS8DBzkoj/pubhtml?gid=326945225&widget=false&headers=false&chrome=false
Frame ID: 36F5E9A2FE1DFAB9DC6E5952AC9C7FE4
Requests: 15 HTTP requests in this frame

Frame: https://cm.g.doubleclick.net/partnerpixels?gdpr=0&url=https%3A%2F%2Fwww.darkreading.com%2Fcyberattacks-data-breaches%2Fattackers-multi-hop-google-redirects-phishing-campaign
Frame ID: 317A6287AF407560B3B0F141942BC44D
Requests: 1 HTTP requests in this frame

Frame: https://e8645ccad93e0ce44fd2d5a66aa4491b.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html
Frame ID: A774CAD6292C6758AAF641D48985E8C0
Requests: 1 HTTP requests in this frame

Frame: https://cdn.doubleverify.com/dvtp_src.js
Frame ID: C77B11F59BB22069CF9F629659886EEB
Requests: 1 HTTP requests in this frame

Frame: data://truncated
Frame ID: 04A9DEAFF3600F4ABB5DE80C26973E20
Requests: 2 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstOszFjPBRccLRUE3h2boB9Wp7duD1vi070rK-ke_qz4ceLG-xqOXMcamUyjOIeEd32xMjymqhJwMWQcUZIGKRnX5DKJ44uOpbqmjq_QHPZHspsChe9Di1t4ckxFNzZ6qpcQldBJl9C9Auzw4ITCb-teclzEJpnTXc2BpVVfb0nog1ux4mO3omXz7vuNHEvadX7GQwRu2S4efaudf9mOWLGN7PlZyQE8ahAPTxZSoxa3XITbcsXV0hIMD74YgAZbLczNs8duumc_5RVCOnL-6GZNEJebmx6ebBs6BG9eM3K9-0ojltbu3YIWB88EtjhDMuITCHOPhtiTZ83OnhJWFsbaczP6AkpkLMMPTsX4c_txMybWJUZPUG9oNBqCOIPe7eDRnOqkNYhBJkhrabBCMv_SfayrmZ2YzVviaNYjsMOmBhEqZjp-fa9IoRwhdn0YIERtt4SOnDHbQbpPf3x-6TNpu29YEvzh6wZ887JWObBGE0s6A&sai=AMfl-YSwOTlpB-EvTlY-enHLdfB8oIVBLmFgtBCOlmb1dyy4CcLjqZpmMxN_pWo3kXcktDTrZGky0oPHUbaZ7l1GhDsRxLTQ51AkH4PJy71EkxHxfYps2fOS8R8iNCj6yJhHOBfFfkSgx7Zq7kthXfIsa-Z5HaUQb3LCSsmxrxM1obivxnkXsjxQrnaF_sPojqD_r-YaOzzBejENlDhXYY1BRxGFcpJ8HZrEElMUzY94nvo99B7o2IeGSoskbSKohg8kSVfWE7lta2h4df6gu9Z_a_zZ8OJVLAQvyj0k1nMIodVZIzzdaC0LLoHkaThbBidHvXahU-nCIqSoalef4ABPXVSKJWPMxap-LZoXdWXay9xpsJT6CyGALGI_03egveIhZ9AcRXfhzTrwnCV6&sig=Cg0ArKJSzOe9SJTYSaKcEAE&uach_m=%5BUACH%5D&urlfix=1&adurl=
Frame ID: 336B7F3CFA7D35871F2516865E1F055A
Requests: 14 HTTP requests in this frame

Frame: https://cdn.doubleverify.com/dvtp_src.js
Frame ID: AEE8A9276F0D1D00B20A72A698835A9A
Requests: 1 HTTP requests in this frame

Frame: https://cdn.doubleverify.com/dv-measurements10456.js
Frame ID: F9C556897DD9128E4BB72F147780B958
Requests: 4 HTTP requests in this frame

Frame: https://cdn.doubleverify.com/dv-measurements10456.js
Frame ID: C119522A4D5491D373F556A1B7B1312E
Requests: 4 HTTP requests in this frame

Frame: https://ad.doubleclick.net/ddm/adi/N520403.127711DARKREADING/B35832278.447559437;dc_ver=106.314;dc_eid=40004000;sz=640x480;u_sd=1;gdpr=0;dc_adk=2473714756;ord=nz29w6;click=https%3A%2F%2Fadclick.g.doubleclick.net%2Fpcs%2Fclick%3Fxai%3DAKAOjsu-r5iDaHcuPdbO75blbSNj10vv8HZuM0G-x-GopfMJoPQDiR4QZrtyhRzf8KycizHcd3aYMSQ6x8l5AkSj-mMjSpvqsMjHeyc2u3XoeapYIHvR06j-bNAWQH-BgGUpgioH4agm-rzvfJfROoUfFzpEjCcumBHsFGfOYBwdUUgR_4JvirmONr0A4ul4H5eYue80xgNVAgfmR4GGsBdN1lVy2_dVK0RMvK8t9QyFHOXZVf2d_3HcAs_IMsvtrGwhUD2cSYlvyfU27vLVcUPaBJJebidor5Q2pDfe_Fp6EPh2CPZQ6FKfiHClOHJqZU337mVDGg9R_6o0Yz8pYp9QIaT4-R5zpit01mkeBhMGLYV4WVjxxxFqPTZxf6Vd47kZCPftSPErpOLG1f9vSiLyazcPBzSMVTsz9XMPM-0gtBmfeiPY7kIl7SXlLPHJf-NdcSmMyj0%26sai%3DAMfl-YQqNeQ13sZJ-MA8hCfcA1W_3rEbLfDDHwWvRBcc8fDkaweii5sDV650asp4plTiRm4UeOBBC_4BXTQFx-6EL6roOz0ssNKnwScKeCdu9SrXwbHsLPGPruf9cBcQFzvMFGH7ygh3Lyar8ZBYCc6ObFrsemd9GIFnSDsQwNBFJopA-dr-qdaZMIrIVMWY4jjfH1eqPPIEXrn_wmwl8KC2wdEBFXJkzBdXgXwkLO7IAYAEaXR6CiL5305o9pXjpuQFSMccflOwmbACFuaBOeuNxTNyD5fJcl-5nOoWH6DHJbFDXgFiRC2jGFnbkc-lFXQ_uIRum02olGphNLEt3GwBFqfjTgQ9kYmkXRghbQj7eexd663KHQDnEFUc0AIqw02BKw_hcBKhXo5kZAVB%26sig%3DCg0ArKJSzGM8Rb0FbSVIEAE%26fbs_aeid%3D%255Bgw_fbsaeid%255D%26urlfix%3D1%26adurl%3D;uach=WyJMaW51eCIsIiIsIng4NiIsIiIsIjE1Mi4wLjc5NzcuODIiLG51bGwsMCxudWxsLCI2NCIsW1siQ2hyb21pdW0iLCIxNTIuMC43OTc3LjgyIl0sWyJHb29nbGUgQ2hyb21lIiwiMTUyLjAuNzk3Ny44MiJdLFsiTm90P0FfQnJhbmQiLCIyNC4wLjAuMCJdXSwwXQ..;dc_rfl=1,https%3A%2F%2Fwww.darkreading.com%2Fcyberattacks-data-breaches%2Fattackers-multi-hop-google-redirects-phishing-campaign$0;xdt=0;crlt=gwRwuG70(h;cmpl=8;gcsr=m;stc=1;chaa=1;sttr=87;prcl=s
Frame ID: CA4897987B92661F50FA749125F9E50F
Requests: 14 HTTP requests in this frame

Frame: https://www.googleadservices.com/pagead/managed/js/activeview/current/reach_worklet.html
Frame ID: 140AC9E9BB2E0A2EF5E88FDFD22B5068
Requests: 18 HTTP requests in this frame

Frame: https://cdn.doubleverify.com/dv-measurements10456.js
Frame ID: F50A932D76A0F6EFF33AC61B5CA2AA55
Requests: 4 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjssZZMtRE-bllL5ghHHEbdPne5eIuIa8vBqb_sv44HE6ISJFanRqNfMOJfGx_zQquvloYm7OFP7IUbmtHb7Qvns662BXw15At3GBPX0yzijlxvjx1j2Ox8iBPm8yBvdozJKVfJZnzJQrlehdSvj8_v9D6sc85ZuaviA2HO73Hq69_pQ49CyA86x0q9hUxExaCSf80XPMEIJQUw4VpWtJLmt7nF04xkymzPXXKvIFH2b8jkMHkvw3oVJfcgZ9D7VvupxJsDZbpGmpfd1qUSMwGblFhSWffjh2yUlbOL1pEata_uXX8Vtb-tHJ93jHkfNSbSHMGwJQqUNi9R5gtoPZuVUvOZGhgzfX-gGf0sgn_gPCPtcJtPi5G1CHvgVO83EuCTkfN5U28Pgspgl10wwxUxlMcKYT7l2T01lzcXyBHvuJ21lZEr59h1DvQHI-xD_okZshSeC7lJmXO3PpD03K&sai=AMfl-YSQrJ276mBUSFM385Kp51BrmWtmjDZ5HSn8Y8L546UeWWkphDDEGuPhTHOx5kiUzQJPS1nz3iQJVYwNAO73NvGnzF7TirqBMVsIBTra2KvFkN_QcvdSczn5v1e3TbHpkrM11vRyah0mzugnOSj2GgK0dGPV2EzBXQF6k9fq9prvgwHsBK03OPzFKKlbw8e9VLeP-zVlMI4CbHHm7BGy8fnR4F6LiAy5eeuLGBwzT27nCk60W6xDdhzVQx7CvxdbvUvuhaD2YQjr4fl70nV2ZJs5UQDPx8EsNNvrd1pmQBW4FEF7GvnLu9Q3v8WHRAAHtyDSFB0C0AukIHfFxGv81LBCD1UoFcB_Mu2zowbH6xgysxDGKPoqiCc&sig=Cg0ArKJSzIJcbbL8VTUGEAE&uach_m=%5BUACH%5D&adurl=
Frame ID: ED3713EA603BB76AE5081B713F97A72E
Requests: 13 HTTP requests in this frame

Frame: https://cdn.doubleverify.com/dvtp_src.js
Frame ID: BF2A33CD5B2FFFF3AB70D215C344AD3A
Requests: 1 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvrFGIvL5CCIEhBapq9ejpDF29SFCuPPodlwMW5vCaen06GtJ512Ob16gTcV2bXUmmkPdruI5FRuYW5cDLswNC1PY9vvM-mI_er6LI6C42xGDqBIffI40CwrIMIbenugESJ6vweO_Fcn-wJGCcJ-9E2hRe6R-4sC3zLogznZ12eL9VW0eK9Lp8WeegC0kPpggKtBpscBLZno13J3LuiMlbwxW-M_gogLMNBfjDmL8VSvOn4Mbmq_7Mgb5mS4775Abyv8Wi51uMP7LW92rJGe5Rv-qdqYMX-jOqZsXZ1kmaHcASW1fXxzDV5z34z0uKQCc_iFBNx35MzgYzgqrDhEj1cnFBaFibXigsIKYSh_qnzGejRhCH4YstJ1Jdpb8saffw2S3NVsLISLDnpXOAMyH_XiCpAIVDw2fgBv67IFqOxGnAR9hmFKGSzRvIq0GkmkP63Jztp7udeN3mWB92RAT1CYiE&sai=AMfl-YSxCc8S7VMsbqSmtvcCtv1j2b46afsRr3KG0AjDatW6fJqHTJ2hwkBhIJEl4iCYXRZGOhjTk5c90b2J-hStgBYrJU-PphjaPNkuEBh7erz_UHlZJS1izoqENUwywAR7iQw54c3lXDGStKXYeA9NOYaxXkWLAuqOT2Wy8qOjrnkVvhMaO7r5p8jNYdu0ZULSnlHDVhfg56DTKulhSWxNcEzaYoGonOLMNbKIvq15zMFB5VJixjeEQezHsaLr_MaxqO_D8Z32N4vP54Es3nEjtfg8Le584xF_UGHOGBuCrZHvN5KwBfGrseFzp7WeTFKcurd_UcXETOjhx8DYw7RaucWifv90_LUUlVWnoa2QLYpCJIvR8KwAIDI&sig=Cg0ArKJSzHKlV4c6OMe8EAE&uach_m=%5BUACH%5D&urlfix=1&adurl=
Frame ID: 2A368B2B00C9D57224E88699AEF3E3C3
Requests: 14 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsuHOJItjX8etENsWQtm2C1UBTtNDqSNTt1A5QhUK6_tjrtArPkYJLxV4Yo9IF3IYYEWqXWHnOoIDSudm7m8H868HagFvRLFwgyoJM77olDk5eHkPE5hBRrBxnWPON2FssVG-oZYJZJdfD75ekjtW5VF2kwrFb5YYK7f-WvWCSBDsglkSzVriSFMUcNz7Ub25NId9hHE1SPlPV5bUlM4i4JXJgeIdtovmqXLn-HiYMCThinGi8R7qgNVbGbRYZSFR2Le1QtCtKZrNdsGH18ok-gimQf_IOSaQ0lur3cgZuDcqwjn9Yb2EDCbtIqhQLFIdNUWqK83hP5sHZnJW80U4Mwh0qXqyNPSctvRikI_JRYpM9HnUsqQIjj8XPvEss5UAs5WxSp0FFWPyTr7K7oaNmWUAQViPPyeeYd027VEYWuvi2fOU0OsBYUydgiVUtwJ3goJt_LJS4ZpZwgGf7Kc&sai=AMfl-YSPaJl7oHdyI-GUwNZaHOZWr9cTLOLwFXHIFH6Ym85LtB62UcwUGv9HJ0-ecaE2Jqt_4N-aywAdzuaOnbzAxcI1-GAPrXCGlwE634SqpkLME6rscFymShAmGJVEgVWgUsUAiIr63-w2p9bsr5qfr4fiv3ndJizh30Phu-pdUNtLh5zGGM1y0bGkB_KyE4F1A0mbjPW2UpnWUskoz2NLc2yKyOYXDoisII8rdIJVvS8Ek5cw7Lw_2YVkLE06YaIt7TctPx2cDYaBXOUHk9z8M8Q7QDSe0wVcf-71kGa0EwvSDoyIDnM6B2ZBXAY6JJhO86Gr7RuXc860HtEonPUhKGyVTxR1bAdbx3R4BTr25xPzrEwUL920vks&sig=Cg0ArKJSzM3FFq9wui6DEAE&uach_m=%5BUACH%5D&adurl=
Frame ID: 370BD4425FEB99B4668A7929D9C91FDC
Requests: 13 HTTP requests in this frame

Frame: https://cdn.doubleverify.com/dvtp_src.js
Frame ID: 3B2435FABFE5BBB16F332948D34FBEF0
Requests: 1 HTTP requests in this frame

Frame: https://www.googleadservices.com/pagead/managed/js/activeview/current/reach_worklet.html
Frame ID: 2C8025161DF3346C661379466A8FBEF8
Requests: 18 HTTP requests in this frame

Frame: https://cdn.doubleverify.com/dv-measurements10456.js
Frame ID: 7EC06AADEE83A882E05761744B5EF291
Requests: 4 HTTP requests in this frame

Frame: https://www.googleadservices.com/pagead/managed/js/activeview/current/reach_worklet.html
Frame ID: 9EBDFF68A43E943FF955F6805C3CF100
Requests: 18 HTTP requests in this frame

Frame: https://www.googleadservices.com/pagead/managed/js/activeview/current/reach_worklet.html
Frame ID: 62F2EEAE7F6503403D53BA30D32AC412
Requests: 18 HTTP requests in this frame

Frame: https://cdn.doubleverify.com/dv-measurements10456.js
Frame ID: AD38F340FA3A3DDDD4F57B4FBB73163E
Requests: 4 HTTP requests in this frame

Frame: https://www.googleadservices.com/pagead/managed/js/activeview/current/reach_worklet.html
Frame ID: 3C3312ADEC2268987480AD8913F45B8F
Requests: 21 HTTP requests in this frame

Frame: https://ep2.adtrafficquality.google/sodar/Klz6NWr5.html
Frame ID: 6B8AB325B216916EB031F38D38E5F020
Requests: 3 HTTP requests in this frame

Frame: https://agent-card.bridged.media/?trackerId=632f45dc-cdfb-45f9-b0c5-d01316c801ef&pageURL=https://www.darkreading.com/cyberattacks-data-breaches/attackers-multi-hop-google-redirects-phishing-campaign
Frame ID: FB4DCC35791ED87E3BF81C85886567CF
Requests: 8 HTTP requests in this frame

Frame: data://truncated
Frame ID: E87D4F7CACBDC6ED90B52B1850BDAD97
Requests: 1 HTTP requests in this frame

Frame: https://agent-card.bridged.media/?trackerId=344cb24c-5431-49c6-8f70-6f93e97d47d3&pageURL=https://www.darkreading.com/cyberattacks-data-breaches/attackers-multi-hop-google-redirects-phishing-campaign
Frame ID: A1DB5051C991AD09446B25BAE91ADF13
Requests: 17 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/6Amfnw0mXXh5lbJPYIFoD5tco_Pp7NGdLfDPJHnkQi4.js
Frame ID: 1509BFF398D41CB67F60E6472B1648D6
Requests: 1 HTTP requests in this frame

Frame: https://cache-ssl.celtra.com/api/fonts/google/Lato:400/3_webfont.woff2?subset=CDEIORSUV
Frame ID: 8775926CB664BB5F9FC8C172FC4ADFB8
Requests: 11 HTTP requests in this frame

Frame: https://cdn.doubleverify.com/dvtp_src.js
Frame ID: 06CC8AEB5E317D356DE6B3405E647AFC
Requests: 1 HTTP requests in this frame

Frame: https://ep2.adtrafficquality.google/sodar/sodar2/255/runner.html
Frame ID: 1A50197EFCC4F7F6F653B649958D9D85
Requests: 3 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: D4B0665C4BE1BA85B4C1014642F77EA1
Requests: 2 HTTP requests in this frame

Frame: https://cdn.doubleverify.com/dv-measurements10456.js
Frame ID: B096D6B46750326AF0A530D46EE22F29
Requests: 3 HTTP requests in this frame

Screenshot Go Pro

Only in urlscan Pro

Use the Visual Search feature to find pages with visually similar screenshots.
Click for more information
Free trials of urlscan Pro are available.

Page Title

Attackers Use Multi-Hop Google Redirects for Phishing

Detected technologies

(Editors)
Overall confidence: 100%
Detected patterns
  • ubembed\.com

(Authentication)
Overall confidence: 100%
Detected patterns
  • accounts\.google\.com/gsi/client

(CDN)
Overall confidence: 100%
Detected patterns
  • s3[^ ]*\.amazonaws\.com/

(Analytics)
Overall confidence: 100%
Detected patterns
  • chartbeat\.js

(Security)
Overall confidence: 100%
Detected patterns

(Analytics)
Overall confidence: 100%
Detected patterns
  • static\.cloudflareinsights\.com/beacon(?:\.min)?\.js

(Advertising)
Overall confidence: 100%
Detected patterns
  • 2mdn\.net

(Advertising)
Overall confidence: 100%
Detected patterns
  • \.doubleclick\.net

(Cookie compliance)
Overall confidence: 100%
Detected patterns
  • fundingchoicesmessages\.google\.com

(Advertising)
Overall confidence: 100%
Detected patterns
  • googlesyndication\.com/
  • 2mdn\.net

(Analytics)
Overall confidence: 100%
Detected patterns
  • googletagmanager\.com/gtag/js

(Advertising)
Overall confidence: 100%
Detected patterns
  • securepubads\.g\.doubleclick.net/tag/js/gpt\.js

(Tag managers)
Overall confidence: 100%
Detected patterns
  • googletagmanager\.com/gtm\.js
  • \.googletagmanager\.com/

(Analytics)
Overall confidence: 100%
Detected patterns
  • //static\.hotjar\.com/

(Marketing automation)
Overall confidence: 100%
Detected patterns
  • ak\.sail-horizon\.com

Page Statistics

515
Requests

94 %
HTTPS

0 %
IPv6

39
Domains

70
Subdomains

70
IPs

3
Countries

7764 kB
Transfer

52160 kB
Size

42
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 70
  • https://www3.doubleclick.net/ HTTP 301
  • https://marketingplatform.google.com/about/enterprise/
Request Chain 106
  • https://www.darkreading.com/cdn-cgi/challenge-platform/scripts/jsd/main.js HTTP 302
  • https://www.darkreading.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/330e41bb475c/main.js
Request Chain 251
  • https://a.usbrowserspeed.com/cs?pid=d177d942cb8207b52f57818feb9bb79a7b77ce6e0ed688e3af36875661b9be1d&r=https%3A%2F%2Fs.dpmsrv.com%2Fblank.png&puid=dpmpixc%5B68%5Da%5BNA%5Ds%5B01a0839d-6074-7f28-872e-f05ed6e970dc%5D HTTP 302
  • https://s.dpmsrv.com/blank.png
Request Chain 280
  • https://www.darkreading.com/sites/all/themes/penton_core_theme/images/ContentPillar_Welcome_1200.png HTTP 301
  • https://www.darkreading.com/
Request Chain 483
  • https://c.clarity.ms/c.gif HTTP 302
  • https://c.bing.com/c.gif?ctsa=mr&CtsSyncId=9C580F36E0E64D239CDCE1A79527268B&RedC=c.clarity.ms&MXFR=01F4021918086FF020D315D61C08613F HTTP 302
  • https://c.clarity.ms/c.gif?ctsa=mr&CtsSyncId=9C580F36E0E64D239CDCE1A79527268B&MUID=2EAD2B9E32636A7F15003C5133386B32

515 HTTP transactions Go Pro

Only in urlscan Pro

Inspect WebSocket connections, examine POST data effortlessly, and track overlap counts in real time. Features live search and filtering across all HTTP output, complete with full response metadata for deep analysis.
Click for more information
Free trials of urlscan Pro are available.

27 data transactions

Method
Protocol
Status Resource
Path
Size
x-fer
Time
Latency
Type
MIME-Type
IP
Location
GET
H3
200
Primary Request attackers-multi-hop-google-redirects-phishing-campaign Show response
www.darkreading.com/cyberattacks-data-breaches/
424 KB
81 KB
84ms
49ms
Document
text/html
104.16.224.171
Cloudflare
General
Full URL
https://www.darkreading.com/cyberattacks-data-breaches/attackers-multi-hop-google-redirects-phishing-campaign
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.16.224.171 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
7d0c5001dc3455213b9b6a60553887b23e2391ea65fd55dbe910ccf6185151ac
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0
sec-ch-ua-platform
"Linux"

Response headers

age
9796
alt-svc
h3=":443"; ma=86400
cache-control
public, max-age=300, s-maxage=86400, must-revalidate, stale-if-error=864000
cf-cache-status
HIT
cf-ray
a3822686f8b7ebbc-YYZ
content-encoding
br
content-type
text/html; charset=utf-8
date
Wed, 09 Sep 2026 00:42:00 GMT
last-modified
Tue, 08 Sep 2026 21:58:44 GMT
priority
u=0,i
server
cloudflare
server-timing
cfCacheStatus;desc="HIT" cfEdge;dur=9,cfOrigin;dur=0 cfExtPri
strict-transport-security
max-age=15552000; includeSubDomains; preload
vary
Accept-Encoding
x-content-type-options
nosniff
GET
H2
200
hopscotch-LeoPatrizi-GettyImages-1303877346.jpg
eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt03ee880bdb37bd5a/6aa06071aa16bb4982ce6be0/
4 KB
4 KB
641ms
60ms
Image
image/webp
104.17.160.85
Cloudflare
General
Full URL
https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt03ee880bdb37bd5a/6aa06071aa16bb4982ce6be0/hopscotch-LeoPatrizi-GettyImages-1303877346.jpg?width=1280&auto=webp&quality=10&disable=upscale&blur=40
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/cyberattacks-data-breaches/attackers-multi-hop-google-redirects-phishing-campaign
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.17.160.85 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
7b30ffc8803e97926edd0e43c67fd8ef7276f98267af06470f3e30308dd7ea71
Security Headers
Name Value
Content-Security-Policy default-src 'none'; navigate-to 'none'; form-action 'none'; img-src data:; style-src 'unsafe-inline';
Strict-Transport-Security max-age=31557600

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

x-request-id
64724db0-e07f-4264-9d60-372719ff9b95
access-control-expose-headers
*
surrogate-key
blt6d90778a997de1cd.sys_assets blt6d90778a997de1cd.sys_assets.blt03ee880bdb37bd5a.download
cf-cache-status
HIT
etag
"cfCUoUBmd8MpqaROegE7vihMxhOPsGBTcQqAviZhwXDQ"
age
12725
cache-tag
blt6d90778a997de1cd.sys_assets blt6d90778a997de1cd.sys_assets.blt03ee880bdb37bd5a.download
cf-resized
internal=ok/h q=0 n=69+5 c=305+143 v=2026.9.0 l=4236 f=false c2=11 wv=2026.9.0
x-api-key
blt6d90778a997de1cd
access-control-allow-methods
GET,HEAD,PUT,PATCH,POST,DELETE,OPTIONS
x-cache
HIT, HIT
date
Wed, 09 Sep 2026 00:42:00 GMT
content-type
image/webp
content-disposition
inline; filename=hopscotch-LeoPatrizi-GettyImages-1303877346.webp
x-runtime
38ms
last-modified
Tue, 08 Sep 2026 19:22:26 GMT
x-contentstack-organization
blt5948195ac13977b0
access-control-allow-headers
*
strict-transport-security
max-age=31557600
content-security-policy
default-src 'none'; navigate-to 'none'; form-action 'none'; img-src data:; style-src 'unsafe-inline';
cache-control
public, max-age=31536000
x-timer
805
via
a380efdb5cc1a4f2-MIA
cf-ray
a382268b097a46b5-YYZ
accept-ranges
bytes
access-control-allow-origin
*
content-length
4236
server
cloudflare
GET
H3
200
brand.generated-XV_bQ2xe.css
www.darkreading.com/assets/
840 KB
91 KB
37ms
35ms
Stylesheet
text/css
104.16.224.171
Cloudflare
General
Full URL
https://www.darkreading.com/assets/brand.generated-XV_bQ2xe.css
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/cyberattacks-data-breaches/attackers-multi-hop-google-redirects-phishing-campaign
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.16.224.171 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
be49ff733b9847dfadf53bef1e1aee74d5b475c32c2caec5cc078c6a75a428ae
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.darkreading.com/cyberattacks-data-breaches/attackers-multi-hop-google-redirects-phishing-campaign
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
br
cf-cache-status
HIT
etag
W/"d1fb1-1a049e42e70"
age
386806
x-content-type-options
nosniff
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Wed, 09 Sep 2026 00:42:00 GMT
content-type
text/css; charset=utf-8
vary
Accept-Encoding
last-modified
Fri, 28 Aug 2026 19:41:26 GMT
priority
u=0,i=?0
strict-transport-security
max-age=15552000; includeSubDomains; preload
cache-control
public, max-age=31536000, immutable
cf-ray
a38226877a64ebbc-YYZ
accept-ranges
bytes
server
cloudflare
GET
H2
200
css2
fonts.googleapis.com/
22 KB
1 KB
621ms
54ms
Stylesheet
text/css
142.251.167.95
Google LLC
General
Full URL
https://fonts.googleapis.com/css2?family=Inter:wght@100;200;300;400;500;600;700;800;900&display=swap
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/cyberattacks-data-breaches/attackers-multi-hop-google-redirects-phishing-campaign
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
142.251.167.95 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
ww-in-f95.1e100.net
Software
ESF /
Resource Hash
72e6bd34f2e6555bd7878e4d3c82dbf3704b2b6d2097bed6869a2331965cb1e9
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
gzip
x-content-type-options
nosniff
expires
Wed, 09 Sep 2026 00:42:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Wed, 09 Sep 2026 00:42:00 GMT
content-type
text/css; charset=utf-8
vary
Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
last-modified
Wed, 09 Sep 2026 00:08:54 GMT
x-frame-options
SAMEORIGIN
strict-transport-security
max-age=31536000
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
cross-origin-opener-policy
same-origin-allow-popups
cross-origin-resource-policy
cross-origin
access-control-allow-origin
*
x-xss-protection
0
server
ESF
GET
H3
200
airgap.js Show response
transcend-cdn.com/cm/ef49a3f1-d8c1-47d6-88fc-50e41130631f/
279 KB
81 KB
582ms
40ms
Script
text/javascript
104.18.40.238
Cloudflare
General
Full URL
https://transcend-cdn.com/cm/ef49a3f1-d8c1-47d6-88fc-50e41130631f/airgap.js
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/cyberattacks-data-breaches/attackers-multi-hop-google-redirects-phishing-campaign
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.18.40.238 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
ead184ee7bd5c62403de0ea850cf344d6182765912b5f1981c5d12ebe9946411
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

access-control-max-age
86400
content-encoding
br
cf-cache-status
HIT
etag
W/"a6318f04c458e273f1d37b0b18cb18d6"
age
1528
expect-ct
max-age=86400, enforce
access-control-allow-methods
GET,HEAD,OPTIONS
x-content-type-options
nosniff
expires
Wed, 09 Sep 2026 00:43:00 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Wed, 09 Sep 2026 00:42:00 GMT
content-type
text/javascript
content-disposition
inline
priority
u=1,i=?0
cache-control
public, max-age=60
timing-allow-origin
*
referrer-policy
same-origin
cf-ray
a382268adaf74b56-YYZ
access-control-allow-origin
*
x-xss-protection
1; mode=block
server
cloudflare
GET
H3
200
gpt.js Show response
securepubads.g.doubleclick.net/tag/js/
124 KB
37 KB
120ms
63ms
Script
text/javascript
142.251.211.130
Google LLC
General
Full URL
https://securepubads.g.doubleclick.net/tag/js/gpt.js
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/cyberattacks-data-breaches/attackers-multi-hop-google-redirects-phishing-campaign
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.211.130 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
lclgaa-au-in-f2.1e100.net
Software
cafe /
Resource Hash
72ea95a614b21b358cbdd6c6b22a6c2a968dcfa100b68cb489eec81fe5e389f5
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
br
etag
455 / 20705 / 122880906 / config-hash: 5600301455586864716
x-content-type-options
nosniff
expires
Wed, 09 Sep 2026 00:42:01 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date
Wed, 09 Sep 2026 00:42:01 GMT
content-type
text/javascript; charset=UTF-8
vary
Accept-Encoding
content-disposition
attachment; filename="f.txt"
cache-control
private, max-age=900, stale-while-revalidate=3600
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
access-control-allow-origin
*
content-length
37994
x-xss-protection
0
server
cafe
GET
H3
200
tt-nextgen-ld.esm.js Show response
www.darkreading.com/next-gen/at/tt-ld/
377 B
603 B
107ms
97ms
Script
application/javascript
104.16.224.171
Cloudflare
General
Full URL
https://www.darkreading.com/next-gen/at/tt-ld/tt-nextgen-ld.esm.js
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/cyberattacks-data-breaches/attackers-multi-hop-google-redirects-phishing-campaign
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.16.224.171 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare / Express
Resource Hash
54e2c604afd8557ca5e2b7af1ebf8ef6b93ffb92fe16736b50e019ac8ff4320c

Request headers

Origin
https://www.darkreading.com
sec-ch-ua-platform
"Linux"
Referer
https://www.darkreading.com/cyberattacks-data-breaches/attackers-multi-hop-google-redirects-phishing-campaign
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
br
cf-cache-status
BYPASS
etag
W/"179-19bbd75f170"
expires
Wed, 09 Sep 2026 02:42:00 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Wed, 09 Sep 2026 00:42:00 GMT
content-type
application/javascript; charset=UTF-8
last-modified
Wed, 14 Jan 2026 17:03:02 GMT
vary
Origin, accept-encoding
priority
u=1,i=?0
cache-control
public, max-age=7200
access-control-allow-credentials
true
via
1.1 google
cf-ray
a38226878ab8ebbc-YYZ
access-control-allow-origin
https://www.darkreading.com
x-powered-by
Express
server
cloudflare
GET
H2
200
gtm.js Show response
www.googletagmanager.com/
633 KB
185 KB
154ms
65ms
Script
application/javascript
142.250.191.8
Google LLC
General
Full URL
https://www.googletagmanager.com/gtm.js?id=GTM-5523ZCM
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/cyberattacks-data-breaches/attackers-multi-hop-google-redirects-phishing-campaign
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.191.8 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
pnlgaa-az-in-f8.1e100.net
Software
Google Tag Manager /
Resource Hash
d0fd307e0267d299d633981aedc731ce2fc9a2d1d09d5da5442acee3068e129f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
zstd
expires
Wed, 09 Sep 2026 00:42:01 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Wed, 09 Sep 2026 00:42:01 GMT
content-type
application/javascript; charset=UTF-8
vary
Accept-Encoding
last-modified
Wed, 09 Sep 2026 00:00:00 GMT
access-control-allow-headers
Cache-Control
strict-transport-security
max-age=31536000; includeSubDomains
cache-control
private, max-age=900
cross-origin-resource-policy
cross-origin
access-control-allow-credentials
true
access-control-allow-origin
*
content-length
189391
x-xss-protection
0
server
Google Tag Manager
GET
H2
200
gtm.js Show response
www.googletagmanager.com/
487 KB
164 KB
153ms
111ms
Script
application/javascript
142.250.191.8
Google LLC
General
Full URL
https://www.googletagmanager.com/gtm.js?id=GTM-WB8Q7XR
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/cyberattacks-data-breaches/attackers-multi-hop-google-redirects-phishing-campaign
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.191.8 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
pnlgaa-az-in-f8.1e100.net
Software
Google Tag Manager /
Resource Hash
059d717b01d82fe1737b305b2f8701c39070ecaee9f18ee8bfd350927c05bfe8
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
zstd
expires
Wed, 09 Sep 2026 00:42:01 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Wed, 09 Sep 2026 00:42:01 GMT
content-type
application/javascript; charset=UTF-8
vary
Accept-Encoding
last-modified
Wed, 09 Sep 2026 00:00:00 GMT
access-control-allow-headers
Cache-Control
strict-transport-security
max-age=31536000; includeSubDomains
cache-control
private, max-age=900
cross-origin-resource-policy
cross-origin
access-control-allow-credentials
true
access-control-allow-origin
*
content-length
167931
x-xss-protection
0
server
Google Tag Manager
GET
H3
200
informaLogoCross-SPlaD0EU.png
www.darkreading.com/assets/
45 KB
45 KB
140ms
128ms
Image
image/png
104.16.224.171
Cloudflare
General
Full URL
https://www.darkreading.com/assets/informaLogoCross-SPlaD0EU.png
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/cyberattacks-data-breaches/attackers-multi-hop-google-redirects-phishing-campaign
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.16.224.171 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
b8fea27508e12f35d3d691181bcb7df458290820b1af4611c6f7ed17188ecac7
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.darkreading.com/cyberattacks-data-breaches/attackers-multi-hop-google-redirects-phishing-campaign
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

cf-cache-status
HIT
etag
W/"13688-1a049e42e70"
age
386806
cf-bgj
imgq:100,h2pri
x-content-type-options
nosniff
cf-polished
ok, orig_size=79496
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Wed, 09 Sep 2026 00:42:00 GMT
content-type
image/png
last-modified
Fri, 28 Aug 2026 19:41:26 GMT
vary
accept-encoding
priority
u=4,i
strict-transport-security
max-age=15552000; includeSubDomains; preload
cache-control
public, max-age=31536000, immutable
cf-ray
a38226878b7cebbc-YYZ
accept-ranges
bytes
content-length
45916
server
cloudflare
GET
H2
200
hopscotch-LeoPatrizi-GettyImages-1303877346.jpg
eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt03ee880bdb37bd5a/6aa06071aa16bb4982ce6be0/
66 KB
67 KB
611ms
39ms
Image
image/webp
104.17.160.85
Cloudflare
General
Full URL
https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt03ee880bdb37bd5a/6aa06071aa16bb4982ce6be0/hopscotch-LeoPatrizi-GettyImages-1303877346.jpg?width=1280&auto=webp&quality=80&disable=upscale
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/cyberattacks-data-breaches/attackers-multi-hop-google-redirects-phishing-campaign
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.17.160.85 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
9e3ac9037c7fcdbb4f020f4e28f693402bc5b40ed5c44868616a55bc97bb3a8e
Security Headers
Name Value
Content-Security-Policy default-src 'none'; navigate-to 'none'; form-action 'none'; img-src data:; style-src 'unsafe-inline';
Strict-Transport-Security max-age=31557600

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

x-request-id
64724db0-e07f-4264-9d60-372719ff9b95
access-control-expose-headers
*
surrogate-key
blt6d90778a997de1cd.sys_assets blt6d90778a997de1cd.sys_assets.blt03ee880bdb37bd5a.download
cf-cache-status
HIT
etag
"cfCUoUBmd8MpqaROegE7vihMxhYTQhf9zcdjWfOyvKDQ"
age
18302
cache-tag
blt6d90778a997de1cd.sys_assets blt6d90778a997de1cd.sys_assets.blt03ee880bdb37bd5a.download
cf-resized
internal=ok/h q=0 n=93+4 c=260+130 v=2026.9.0 l=67698 f=false c2=7 wv=2026.9.0
x-api-key
blt6d90778a997de1cd
access-control-allow-methods
GET,HEAD,PUT,PATCH,POST,DELETE,OPTIONS
x-cache
HIT, HIT
date
Wed, 09 Sep 2026 00:42:00 GMT
content-type
image/webp
content-disposition
inline; filename=hopscotch-LeoPatrizi-GettyImages-1303877346.webp
x-runtime
38ms
last-modified
Tue, 08 Sep 2026 19:22:26 GMT
x-contentstack-organization
blt5948195ac13977b0
access-control-allow-headers
*
strict-transport-security
max-age=31557600
content-security-policy
default-src 'none'; navigate-to 'none'; form-action 'none'; img-src data:; style-src 'unsafe-inline';
cache-control
public, max-age=31536000
x-timer
804
via
a38067aeecf87456-MIA
cf-ray
a382268b097646b5-YYZ
accept-ranges
bytes
access-control-allow-origin
*
content-length
67698
server
cloudflare
GET
H3
200
sdk.js Show response
connect.facebook.net/en_US/
12 KB
5 KB
98ms
34ms
Script
application/x-javascript
157.240.241.1
Facebook
General
Full URL
https://connect.facebook.net/en_US/sdk.js
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/cyberattacks-data-breaches/attackers-multi-hop-google-redirects-phishing-campaign
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
157.240.241.1 New York, United States, ASN32934 (FACEBOOK - Facebook, Inc., US),
Reverse DNS
xx-fbcdn-shv-02-lga3.fbcdn.net
Software
/
Resource Hash
a7acad89482a8efed98d620e30bcf0742f1448cad685fe84d405f13d1d546a58
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-md5
FvAEwoasaf8gcqTZyA85Rg==
access-control-expose-headers
X-FB-Content-MD5
content-encoding
gzip
etag
"7b22f6b2d5f57677aa50a992bec542f8"
report-to
{"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options
nosniff
expires
Wed, 09 Sep 2026 01:00:45 GMT
alt-svc
h3=":443"; ma=86400
date
Wed, 09 Sep 2026 00:42:01 GMT
content-type
application/x-javascript; charset=utf-8
vary
Accept-Encoding
cross-origin-embedder-policy-report-only
require-corp;report-to="coep_report"
priority
u=3,i
x-frame-options
DENY
strict-transport-security
max-age=31536000; preload; includeSubDomains
reporting-endpoints
coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
x-fb-content-md5
93493f339501331b44784d3970a2cb85
cache-control
public,max-age=1200,stale-while-revalidate=3600
x-fb-debug
bk1dkDYqZ+/wa3LjCCzJIoBMsHekK70cILgNyOtrHlhcmQ/SsFaEXyhkdgp1H612EPJ1Ism7KB9P/nqICAg9rg==
cross-origin-opener-policy
same-origin-allow-popups
x-fb-connection-quality
EXCELLENT; q=0.9, rtt=32, rtx=0, c=23, mss=1232, tbw=4993, tp=9, tpl=0, uplat=0, ullat=-1
cross-origin-resource-policy
cross-origin
permissions-policy
accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
document-policy
force-load-at-top, include-js-call-stacks-in-crash-reports
access-control-allow-origin
*
content-length
5036
origin-agent-cluster
?1
GET
H3
200
entry.client-D8SNnbFQ.js Show response
www.darkreading.com/assets/
392 B
558 B
68ms
55ms
Script
text/javascript
104.16.224.171
Cloudflare
General
Full URL
https://www.darkreading.com/assets/entry.client-D8SNnbFQ.js
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/cyberattacks-data-breaches/attackers-multi-hop-google-redirects-phishing-campaign
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.16.224.171 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
b6f1034f0924d63ca457f2f70b35da83ab85e9466fd3892edbd5ea0eb6402475
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Origin
https://www.darkreading.com
sec-ch-ua-platform
"Linux"
Referer
https://www.darkreading.com/cyberattacks-data-breaches/attackers-multi-hop-google-redirects-phishing-campaign
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
br
cf-cache-status
HIT
etag
W/"188-1a049e42e70"
age
386806
x-content-type-options
nosniff
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Wed, 09 Sep 2026 00:42:00 GMT
content-type
text/javascript; charset=utf-8
vary
Accept-Encoding
last-modified
Fri, 28 Aug 2026 19:41:26 GMT
priority
u=1,i=?0
strict-transport-security
max-age=15552000; includeSubDomains; preload
cache-control
public, max-age=31536000, immutable
cf-ray
a38226878adfebbc-YYZ
server
cloudflare
GET
H3
200
rolldown-runtime-C0FnF6B9.js Show response
www.darkreading.com/assets/
1 KB
986 B
67ms
53ms
Script
text/javascript
104.16.224.171
Cloudflare
General
Full URL
https://www.darkreading.com/assets/rolldown-runtime-C0FnF6B9.js
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/cyberattacks-data-breaches/attackers-multi-hop-google-redirects-phishing-campaign
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.16.224.171 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
e0a79ad36c6ca1ffbc796c80aa5661803a9d1bc684e29d1587f48b4ba9a82714
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Origin
https://www.darkreading.com
sec-ch-ua-platform
"Linux"
Referer
https://www.darkreading.com/cyberattacks-data-breaches/attackers-multi-hop-google-redirects-phishing-campaign
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
br
cf-cache-status
HIT
etag
W/"50b-1a049e42e70"
age
386806
x-content-type-options
nosniff
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Wed, 09 Sep 2026 00:42:00 GMT
content-type
text/javascript; charset=utf-8
vary
Accept-Encoding
last-modified
Fri, 28 Aug 2026 19:41:26 GMT
priority
u=1,i=?0
strict-transport-security
max-age=15552000; includeSubDomains; preload
cache-control
public, max-age=31536000, immutable
cf-ray
a38226878aebebbc-YYZ
accept-ranges
bytes
server
cloudflare
GET
H3
200
vendor-html-parser-DOJ8foyv.js Show response
www.darkreading.com/assets/
37 KB
13 KB
64ms
49ms
Script
text/javascript
104.16.224.171
Cloudflare
General
Full URL
https://www.darkreading.com/assets/vendor-html-parser-DOJ8foyv.js
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/cyberattacks-data-breaches/attackers-multi-hop-google-redirects-phishing-campaign
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.16.224.171 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
94ce5eb16b20e40acc3287a8b5da97e56838b1301af9ca4465bc900936eebc58
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Origin
https://www.darkreading.com
sec-ch-ua-platform
"Linux"
Referer
https://www.darkreading.com/cyberattacks-data-breaches/attackers-multi-hop-google-redirects-phishing-campaign
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
br
cf-cache-status
HIT
etag
W/"94b0-1a049e42e70"
age
386806
x-content-type-options
nosniff
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Wed, 09 Sep 2026 00:42:00 GMT
content-type
text/javascript; charset=utf-8
vary
Accept-Encoding
last-modified
Fri, 28 Aug 2026 19:41:26 GMT
priority
u=1,i=?0
strict-transport-security
max-age=15552000; includeSubDomains; preload
cache-control
public, max-age=31536000, immutable
cf-ray
a38226878af6ebbc-YYZ
accept-ranges
bytes
server
cloudflare
GET
H3
200
vendor-react-BREUBCH4.js Show response
www.darkreading.com/assets/
178 KB
56 KB
68ms
54ms
Script
text/javascript
104.16.224.171
Cloudflare
General
Full URL
https://www.darkreading.com/assets/vendor-react-BREUBCH4.js
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/cyberattacks-data-breaches/attackers-multi-hop-google-redirects-phishing-campaign
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.16.224.171 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
c16f08c1986c03dbbd250fed4dd025290072ddc0acacf5103206010b9eb728fb
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Origin
https://www.darkreading.com
sec-ch-ua-platform
"Linux"
Referer
https://www.darkreading.com/cyberattacks-data-breaches/attackers-multi-hop-google-redirects-phishing-campaign
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
br
cf-cache-status
HIT
etag
W/"2c8d1-1a049e42e70"
age
386806
x-content-type-options
nosniff
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Wed, 09 Sep 2026 00:42:00 GMT
content-type
text/javascript; charset=utf-8
vary
Accept-Encoding
last-modified
Fri, 28 Aug 2026 19:41:26 GMT
priority
u=1,i=?0
strict-transport-security
max-age=15552000; includeSubDomains; preload
cache-control
public, max-age=31536000, immutable
cf-ray
a38226878b00ebbc-YYZ
accept-ranges
bytes
server
cloudflare
GET
H3
200
vendor-react-router-C-6Wf3r1.js Show response
www.darkreading.com/assets/
119 KB
39 KB
69ms
55ms
Script
text/javascript
104.16.224.171
Cloudflare
General
Full URL
https://www.darkreading.com/assets/vendor-react-router-C-6Wf3r1.js
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/cyberattacks-data-breaches/attackers-multi-hop-google-redirects-phishing-campaign
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.16.224.171 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
a9ccceed638cc73b0597e033e527d1c69f31341ad274f081103ef033ae52ee97
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Origin
https://www.darkreading.com
sec-ch-ua-platform
"Linux"
Referer
https://www.darkreading.com/cyberattacks-data-breaches/attackers-multi-hop-google-redirects-phishing-campaign
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
br
cf-cache-status
HIT
etag
W/"1da7a-1a049e42e70"
age
386806
x-content-type-options
nosniff
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Wed, 09 Sep 2026 00:42:00 GMT
content-type
text/javascript; charset=utf-8
vary
Accept-Encoding
last-modified
Fri, 28 Aug 2026 19:41:26 GMT
priority
u=1,i=?0
strict-transport-security
max-age=15552000; includeSubDomains; preload
cache-control
public, max-age=31536000, immutable
cf-ray
a38226878b06ebbc-YYZ
accept-ranges
bytes
server
cloudflare
GET
H3
200
root-B11sgZe3.js Show response
www.darkreading.com/assets/
93 KB
33 KB
69ms
55ms
Script
text/javascript
104.16.224.171
Cloudflare
General
Full URL
https://www.darkreading.com/assets/root-B11sgZe3.js
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/cyberattacks-data-breaches/attackers-multi-hop-google-redirects-phishing-campaign
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.16.224.171 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
d56a0487360d27b493e6a2b8bf23d520a9a9a0abf2372763cfbb2b6c3ccff9dd
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Origin
https://www.darkreading.com
sec-ch-ua-platform
"Linux"
Referer
https://www.darkreading.com/cyberattacks-data-breaches/attackers-multi-hop-google-redirects-phishing-campaign
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
br
cf-cache-status
HIT
etag
W/"17326-1a049e42e70"
age
386806
x-content-type-options
nosniff
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Wed, 09 Sep 2026 00:42:00 GMT
content-type
text/javascript; charset=utf-8
vary
Accept-Encoding
last-modified
Fri, 28 Aug 2026 19:41:26 GMT
priority
u=1,i=?0
strict-transport-security
max-age=15552000; includeSubDomains; preload
cache-control
public, max-age=31536000, immutable
cf-ray
a38226878b0aebbc-YYZ
accept-ranges
bytes
server
cloudflare
GET
H3
200
errorBoundary-Dd5IQF9g.js Show response
www.darkreading.com/assets/
680 KB
212 KB
84ms
70ms
Script
text/javascript
104.16.224.171
Cloudflare
General
Full URL
https://www.darkreading.com/assets/errorBoundary-Dd5IQF9g.js
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/cyberattacks-data-breaches/attackers-multi-hop-google-redirects-phishing-campaign
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.16.224.171 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
6b51bec174b57ee9aa0c93519ffc671f89d024188f95c427dade9416bffa3c97
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Origin
https://www.darkreading.com
sec-ch-ua-platform
"Linux"
Referer
https://www.darkreading.com/cyberattacks-data-breaches/attackers-multi-hop-google-redirects-phishing-campaign
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
br
cf-cache-status
HIT
etag
W/"a9f60-1a049e42e70"
age
386806
x-content-type-options
nosniff
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Wed, 09 Sep 2026 00:42:00 GMT
content-type
text/javascript; charset=utf-8
vary
Accept-Encoding
last-modified
Fri, 28 Aug 2026 19:41:26 GMT
priority
u=1,i=?0
strict-transport-security
max-age=15552000; includeSubDomains; preload
cache-control
public, max-age=31536000, immutable
cf-ray
a38226878b0cebbc-YYZ
accept-ranges
bytes
server
cloudflare
GET
H3
200
src-Cp6jrjML.js Show response
www.darkreading.com/assets/
140 KB
41 KB
89ms
75ms
Script
text/javascript
104.16.224.171
Cloudflare
General
Full URL
https://www.darkreading.com/assets/src-Cp6jrjML.js
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/cyberattacks-data-breaches/attackers-multi-hop-google-redirects-phishing-campaign
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.16.224.171 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
b9fbbb54f512323dfbae33ed5122df2d624e352d38a903ad0069c4fbc943a515
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Origin
https://www.darkreading.com
sec-ch-ua-platform
"Linux"
Referer
https://www.darkreading.com/cyberattacks-data-breaches/attackers-multi-hop-google-redirects-phishing-campaign
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
br
cf-cache-status
HIT
etag
W/"22f5b-1a049e42e70"
age
386806
x-content-type-options
nosniff
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Wed, 09 Sep 2026 00:42:00 GMT
content-type
text/javascript; charset=utf-8
vary
Accept-Encoding
last-modified
Fri, 28 Aug 2026 19:41:26 GMT
priority
u=1,i=?0
strict-transport-security
max-age=15552000; includeSubDomains; preload
cache-control
public, max-age=31536000, immutable
cf-ray
a38226878b10ebbc-YYZ
accept-ranges
bytes
server
cloudflare
GET
H3
200
meta-BzKAaSdl.js Show response
www.darkreading.com/assets/
7 KB
3 KB
89ms
75ms
Script
text/javascript
104.16.224.171
Cloudflare
General
Full URL
https://www.darkreading.com/assets/meta-BzKAaSdl.js
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/cyberattacks-data-breaches/attackers-multi-hop-google-redirects-phishing-campaign
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.16.224.171 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
269ff5f049215f8bb3133926319a8a16c772b2999064834ca4171faabb47ecca
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Origin
https://www.darkreading.com
sec-ch-ua-platform
"Linux"
Referer
https://www.darkreading.com/cyberattacks-data-breaches/attackers-multi-hop-google-redirects-phishing-campaign
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
br
cf-cache-status
HIT
etag
W/"1b54-1a049e42e70"
age
386806
x-content-type-options
nosniff
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Wed, 09 Sep 2026 00:42:00 GMT
content-type
text/javascript; charset=utf-8
vary
Accept-Encoding
last-modified
Fri, 28 Aug 2026 19:41:26 GMT
priority
u=1,i=?0
strict-transport-security
max-age=15552000; includeSubDomains; preload
cache-control
public, max-age=31536000, immutable
cf-ray
a38226878b12ebbc-YYZ
accept-ranges
bytes
server
cloudflare
GET
H3
200
src-DylmbmTU.js Show response
www.darkreading.com/assets/
86 KB
26 KB
90ms
76ms
Script
text/javascript
104.16.224.171
Cloudflare
General
Full URL
https://www.darkreading.com/assets/src-DylmbmTU.js
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/cyberattacks-data-breaches/attackers-multi-hop-google-redirects-phishing-campaign
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.16.224.171 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
7b0464bac04c1abd6381b8ce24862a3b92d639dc42f318673e3f841553e8f751
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Origin
https://www.darkreading.com
sec-ch-ua-platform
"Linux"
Referer
https://www.darkreading.com/cyberattacks-data-breaches/attackers-multi-hop-google-redirects-phishing-campaign
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
br
cf-cache-status
HIT
etag
W/"15736-1a049e42e70"
age
386801
x-content-type-options
nosniff
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Wed, 09 Sep 2026 00:42:00 GMT
content-type
text/javascript; charset=utf-8
vary
Accept-Encoding
last-modified
Fri, 28 Aug 2026 19:41:26 GMT
priority
u=1,i=?0
strict-transport-security
max-age=15552000; includeSubDomains; preload
cache-control
public, max-age=31536000, immutable
cf-ray
a38226878b17ebbc-YYZ
accept-ranges
bytes
server
cloudflare
GET
H3
200
src-Bzlf83jA.js Show response
www.darkreading.com/assets/
19 KB
8 KB
90ms
76ms
Script
text/javascript
104.16.224.171
Cloudflare
General
Full URL
https://www.darkreading.com/assets/src-Bzlf83jA.js
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/cyberattacks-data-breaches/attackers-multi-hop-google-redirects-phishing-campaign
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.16.224.171 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
e50dffa44de83e1d409f4343fcd9eb0a2c086c6d913d4ab497136f286dd85685
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Origin
https://www.darkreading.com
sec-ch-ua-platform
"Linux"
Referer
https://www.darkreading.com/cyberattacks-data-breaches/attackers-multi-hop-google-redirects-phishing-campaign
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
br
cf-cache-status
HIT
etag
W/"4b8f-1a049e42e70"
age
386806
x-content-type-options
nosniff
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Wed, 09 Sep 2026 00:42:00 GMT
content-type
text/javascript; charset=utf-8
vary
Accept-Encoding
last-modified
Fri, 28 Aug 2026 19:41:26 GMT
priority
u=1,i=?0
strict-transport-security
max-age=15552000; includeSubDomains; preload
cache-control
public, max-age=31536000, immutable
cf-ray
a38226878b1debbc-YYZ
accept-ranges
bytes
server
cloudflare
GET
H3
200
src-DehiOB3a.js Show response
www.darkreading.com/assets/
21 KB
7 KB
92ms
78ms
Script
text/javascript
104.16.224.171
Cloudflare
General
Full URL
https://www.darkreading.com/assets/src-DehiOB3a.js
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/cyberattacks-data-breaches/attackers-multi-hop-google-redirects-phishing-campaign
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.16.224.171 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
fcdcbdd0530ea9afc0483d309bd7cc2f2ec914da076c1c5b856069ca9ef10371
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Origin
https://www.darkreading.com
sec-ch-ua-platform
"Linux"
Referer
https://www.darkreading.com/cyberattacks-data-breaches/attackers-multi-hop-google-redirects-phishing-campaign
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
br
cf-cache-status
HIT
etag
W/"52b1-1a049e42e70"
age
386806
x-content-type-options
nosniff
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Wed, 09 Sep 2026 00:42:00 GMT
content-type
text/javascript; charset=utf-8
vary
Accept-Encoding
last-modified
Fri, 28 Aug 2026 19:41:26 GMT
priority
u=1,i=?0
strict-transport-security
max-age=15552000; includeSubDomains; preload
cache-control
public, max-age=31536000, immutable
cf-ray
a38226878b25ebbc-YYZ
accept-ranges
bytes
server
cloudflare
GET
H3
200
src-CNseDMio.js Show response
www.darkreading.com/assets/
5 KB
3 KB
95ms
81ms
Script
text/javascript
104.16.224.171
Cloudflare
General
Full URL
https://www.darkreading.com/assets/src-CNseDMio.js
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/cyberattacks-data-breaches/attackers-multi-hop-google-redirects-phishing-campaign
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.16.224.171 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
7ab65985e0338ce733e5cbd43fdcd2162b1764899be5cf64200d0b66c0337918
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Origin
https://www.darkreading.com
sec-ch-ua-platform
"Linux"
Referer
https://www.darkreading.com/cyberattacks-data-breaches/attackers-multi-hop-google-redirects-phishing-campaign
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
br
cf-cache-status
HIT
etag
W/"1579-1a049e42e70"
age
386806
x-content-type-options
nosniff
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Wed, 09 Sep 2026 00:42:00 GMT
content-type
text/javascript; charset=utf-8
vary
Accept-Encoding
last-modified
Fri, 28 Aug 2026 19:41:26 GMT
priority
u=1,i=?0
strict-transport-security
max-age=15552000; includeSubDomains; preload
cache-control
public, max-age=31536000, immutable
cf-ray
a38226878b28ebbc-YYZ
accept-ranges
bytes
server
cloudflare
GET
H3
200
src-DmQpXszw.js Show response
www.darkreading.com/assets/
21 KB
7 KB
94ms
80ms
Script
text/javascript
104.16.224.171
Cloudflare
General
Full URL
https://www.darkreading.com/assets/src-DmQpXszw.js
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/cyberattacks-data-breaches/attackers-multi-hop-google-redirects-phishing-campaign
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.16.224.171 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
f57f59c924514f1cbfbb3d0c2c586dc3221542342d766c7e7c0555ba47c3b239
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Origin
https://www.darkreading.com
sec-ch-ua-platform
"Linux"
Referer
https://www.darkreading.com/cyberattacks-data-breaches/attackers-multi-hop-google-redirects-phishing-campaign
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
br
cf-cache-status
HIT
etag
W/"5246-1a049e42e70"
age
386806
x-content-type-options
nosniff
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Wed, 09 Sep 2026 00:42:00 GMT
content-type
text/javascript; charset=utf-8
vary
Accept-Encoding
last-modified
Fri, 28 Aug 2026 19:41:26 GMT
priority
u=1,i=?0
strict-transport-security
max-age=15552000; includeSubDomains; preload
cache-control
public, max-age=31536000, immutable
cf-ray
a38226878b2debbc-YYZ
accept-ranges
bytes
server
cloudflare
GET
H3
200
src-B5Tvw7pk.js Show response
www.darkreading.com/assets/
3 KB
2 KB
94ms
80ms
Script
text/javascript
104.16.224.171
Cloudflare
General
Full URL
https://www.darkreading.com/assets/src-B5Tvw7pk.js
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/cyberattacks-data-breaches/attackers-multi-hop-google-redirects-phishing-campaign
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.16.224.171 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
607c0740f94d69c0e5f514570a312659148df48de0cb53d702fc444f6af8ee28
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Origin
https://www.darkreading.com
sec-ch-ua-platform
"Linux"
Referer
https://www.darkreading.com/cyberattacks-data-breaches/attackers-multi-hop-google-redirects-phishing-campaign
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
br
cf-cache-status
HIT
etag
W/"da3-1a049e42e70"
age
386806
x-content-type-options
nosniff
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Wed, 09 Sep 2026 00:42:00 GMT
content-type
text/javascript; charset=utf-8
vary
Accept-Encoding
last-modified
Fri, 28 Aug 2026 19:41:26 GMT
priority
u=1,i=?0
strict-transport-security
max-age=15552000; includeSubDomains; preload
cache-control
public, max-age=31536000, immutable
cf-ray
a38226878b2febbc-YYZ
accept-ranges
bytes
server
cloudflare
GET
H3
200
src-CvtWMEi8.js Show response
www.darkreading.com/assets/
116 KB
41 KB
94ms
81ms
Script
text/javascript
104.16.224.171
Cloudflare
General
Full URL
https://www.darkreading.com/assets/src-CvtWMEi8.js
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/cyberattacks-data-breaches/attackers-multi-hop-google-redirects-phishing-campaign
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.16.224.171 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
c3bccbd678473eebdec08a3a228feebb0b1b0053cfb3ee42b874fccc53079846
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Origin
https://www.darkreading.com
sec-ch-ua-platform
"Linux"
Referer
https://www.darkreading.com/cyberattacks-data-breaches/attackers-multi-hop-google-redirects-phishing-campaign
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
br
cf-cache-status
HIT
etag
W/"1cfc1-1a049e42e70"
age
386806
x-content-type-options
nosniff
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Wed, 09 Sep 2026 00:42:00 GMT
content-type
text/javascript; charset=utf-8
vary
Accept-Encoding
last-modified
Fri, 28 Aug 2026 19:41:26 GMT
priority
u=1,i=?0
strict-transport-security
max-age=15552000; includeSubDomains; preload
cache-control
public, max-age=31536000, immutable
cf-ray
a38226878b31ebbc-YYZ
accept-ranges
bytes
server
cloudflare
GET
H3
200
_baseForOwn-fUwX3IFe.js Show response
www.darkreading.com/assets/
1 KB
1 KB
95ms
81ms
Script
text/javascript
104.16.224.171
Cloudflare
General
Full URL
https://www.darkreading.com/assets/_baseForOwn-fUwX3IFe.js
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/cyberattacks-data-breaches/attackers-multi-hop-google-redirects-phishing-campaign
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.16.224.171 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
ceced2a91b6c7af952d1a200a1c678e03e4404bb1779ca62adab26c9fd17489a
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Origin
https://www.darkreading.com
sec-ch-ua-platform
"Linux"
Referer
https://www.darkreading.com/cyberattacks-data-breaches/attackers-multi-hop-google-redirects-phishing-campaign
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
br
cf-cache-status
HIT
etag
W/"5fc-1a049e42e70"
age
386806
x-content-type-options
nosniff
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Wed, 09 Sep 2026 00:42:00 GMT
content-type
text/javascript; charset=utf-8
vary
Accept-Encoding
last-modified
Fri, 28 Aug 2026 19:41:26 GMT
priority
u=1,i=?0
strict-transport-security
max-age=15552000; includeSubDomains; preload
cache-control
public, max-age=31536000, immutable
cf-ray
a38226878b34ebbc-YYZ
accept-ranges
bytes
server
cloudflare
GET
H3
200
src-DS2_t6aL.js Show response
www.darkreading.com/assets/
412 KB
79 KB
95ms
82ms
Script
text/javascript
104.16.224.171
Cloudflare
General
Full URL
https://www.darkreading.com/assets/src-DS2_t6aL.js
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/cyberattacks-data-breaches/attackers-multi-hop-google-redirects-phishing-campaign
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.16.224.171 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
638c4daeb8e35160b09d02d5286ed9a90f7ef252d91233fdb87a1bcec3ce00d1
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Origin
https://www.darkreading.com
sec-ch-ua-platform
"Linux"
Referer
https://www.darkreading.com/cyberattacks-data-breaches/attackers-multi-hop-google-redirects-phishing-campaign
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
br
cf-cache-status
HIT
etag
W/"67115-1a049e42e70"
age
386806
x-content-type-options
nosniff
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Wed, 09 Sep 2026 00:42:00 GMT
content-type
text/javascript; charset=utf-8
vary
Accept-Encoding
last-modified
Fri, 28 Aug 2026 19:41:26 GMT
priority
u=1,i=?0
strict-transport-security
max-age=15552000; includeSubDomains; preload
cache-control
public, max-age=31536000, immutable
cf-ray
a38226878b36ebbc-YYZ
accept-ranges
bytes
server
cloudflare
GET
H3
200
swiper-react-D2nzdOtp.js Show response
www.darkreading.com/assets/
88 KB
28 KB
172ms
159ms
Script
text/javascript
104.16.224.171
Cloudflare
General
Full URL
https://www.darkreading.com/assets/swiper-react-D2nzdOtp.js
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/cyberattacks-data-breaches/attackers-multi-hop-google-redirects-phishing-campaign
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.16.224.171 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
e573446a664e13ff231aee16c75846239578805c99da5dfd33247ec56f0b89f2
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Origin
https://www.darkreading.com
sec-ch-ua-platform
"Linux"
Referer
https://www.darkreading.com/cyberattacks-data-breaches/attackers-multi-hop-google-redirects-phishing-campaign
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
br
cf-cache-status
HIT
etag
W/"15ec0-1a049e42e70"
age
386806
x-content-type-options
nosniff
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Wed, 09 Sep 2026 00:42:00 GMT
content-type
text/javascript; charset=utf-8
vary
Accept-Encoding
last-modified
Fri, 28 Aug 2026 19:41:26 GMT
priority
u=1,i=?0
strict-transport-security
max-age=15552000; includeSubDomains; preload
cache-control
public, max-age=31536000, immutable
cf-ray
a38226878b39ebbc-YYZ
accept-ranges
bytes
server
cloudflare
GET
H3
200
src-DNX0cuPn.js Show response
www.darkreading.com/assets/
124 KB
41 KB
173ms
160ms
Script
text/javascript
104.16.224.171
Cloudflare
General
Full URL
https://www.darkreading.com/assets/src-DNX0cuPn.js
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/cyberattacks-data-breaches/attackers-multi-hop-google-redirects-phishing-campaign
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.16.224.171 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
4a8e73f81805be514653b8c8dfc68dbdda1f9e430f56e5bea4c47d1e1d85e252
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Origin
https://www.darkreading.com
sec-ch-ua-platform
"Linux"
Referer
https://www.darkreading.com/cyberattacks-data-breaches/attackers-multi-hop-google-redirects-phishing-campaign
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
br
cf-cache-status
HIT
etag
W/"1f117-1a049e42e70"
age
386806
x-content-type-options
nosniff
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Wed, 09 Sep 2026 00:42:00 GMT
content-type
text/javascript; charset=utf-8
vary
Accept-Encoding
last-modified
Fri, 28 Aug 2026 19:41:26 GMT
priority
u=1,i=?0
strict-transport-security
max-age=15552000; includeSubDomains; preload
cache-control
public, max-age=31536000, immutable
cf-ray
a38226878b3aebbc-YYZ
accept-ranges
bytes
server
cloudflare
GET
H3
200
index.es-BYcUETnu.js Show response
www.darkreading.com/assets/
126 KB
43 KB
113ms
100ms
Script
text/javascript
104.16.224.171
Cloudflare
General
Full URL
https://www.darkreading.com/assets/index.es-BYcUETnu.js
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/cyberattacks-data-breaches/attackers-multi-hop-google-redirects-phishing-campaign
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.16.224.171 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
122d003b837b31475fe446ffdcbdf4f4899970a2bef51a905e38d18ac8ab3afb
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Origin
https://www.darkreading.com
sec-ch-ua-platform
"Linux"
Referer
https://www.darkreading.com/cyberattacks-data-breaches/attackers-multi-hop-google-redirects-phishing-campaign
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
br
cf-cache-status
HIT
etag
W/"1f83e-1a049e42e70"
age
386806
x-content-type-options
nosniff
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Wed, 09 Sep 2026 00:42:00 GMT
content-type
text/javascript; charset=utf-8
vary
Accept-Encoding
last-modified
Fri, 28 Aug 2026 19:41:26 GMT
priority
u=1,i=?0
strict-transport-security
max-age=15552000; includeSubDomains; preload
cache-control
public, max-age=31536000, immutable
cf-ray
a38226878b3cebbc-YYZ
accept-ranges
bytes
server
cloudflare
GET
H3
200
src-DGiq3EQA.js Show response
www.darkreading.com/assets/
17 KB
6 KB
119ms
106ms
Script
text/javascript
104.16.224.171
Cloudflare
General
Full URL
https://www.darkreading.com/assets/src-DGiq3EQA.js
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/cyberattacks-data-breaches/attackers-multi-hop-google-redirects-phishing-campaign
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.16.224.171 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
6ab0cc4e1d72c0547bc6ed84e71396e9fbcd22dada3b11d40c358af38ec649ac
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Origin
https://www.darkreading.com
sec-ch-ua-platform
"Linux"
Referer
https://www.darkreading.com/cyberattacks-data-breaches/attackers-multi-hop-google-redirects-phishing-campaign
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
br
cf-cache-status
HIT
etag
W/"4254-1a049e42e70"
age
386806
x-content-type-options
nosniff
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Wed, 09 Sep 2026 00:42:00 GMT
content-type
text/javascript; charset=utf-8
vary
Accept-Encoding
last-modified
Fri, 28 Aug 2026 19:41:26 GMT
priority
u=1,i=?0
strict-transport-security
max-age=15552000; includeSubDomains; preload
cache-control
public, max-age=31536000, immutable
cf-ray
a38226878b3eebbc-YYZ
accept-ranges
bytes
server
cloudflare
GET
H3
200
useLockBodyScroll-BGJrZGjL.js Show response
www.darkreading.com/assets/
2 KB
1006 B
119ms
106ms
Script
text/javascript
104.16.224.171
Cloudflare
General
Full URL
https://www.darkreading.com/assets/useLockBodyScroll-BGJrZGjL.js
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/cyberattacks-data-breaches/attackers-multi-hop-google-redirects-phishing-campaign
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.16.224.171 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
d06efddb3327b5b6ad4a7f4ff63509e7dcb2d6ed8ef3bb272d1537347bb02b5d
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Origin
https://www.darkreading.com
sec-ch-ua-platform
"Linux"
Referer
https://www.darkreading.com/cyberattacks-data-breaches/attackers-multi-hop-google-redirects-phishing-campaign
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
br
cf-cache-status
HIT
etag
W/"64c-1a049e42e70"
age
386806
x-content-type-options
nosniff
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Wed, 09 Sep 2026 00:42:00 GMT
content-type
text/javascript; charset=utf-8
vary
Accept-Encoding
last-modified
Fri, 28 Aug 2026 19:41:26 GMT
priority
u=1,i=?0
strict-transport-security
max-age=15552000; includeSubDomains; preload
cache-control
public, max-age=31536000, immutable
cf-ray
a38226878b3febbc-YYZ
accept-ranges
bytes
server
cloudflare
GET
H3
200
useIsomorphicLayoutEffect-BI0Xeo7e.js Show response
www.darkreading.com/assets/
276 B
497 B
119ms
106ms
Script
text/javascript
104.16.224.171
Cloudflare
General
Full URL
https://www.darkreading.com/assets/useIsomorphicLayoutEffect-BI0Xeo7e.js
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/cyberattacks-data-breaches/attackers-multi-hop-google-redirects-phishing-campaign
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.16.224.171 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
e8c159972e006cd75eba4caa4019252481618b344626b5d52561982a15f15a04
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Origin
https://www.darkreading.com
sec-ch-ua-platform
"Linux"
Referer
https://www.darkreading.com/cyberattacks-data-breaches/attackers-multi-hop-google-redirects-phishing-campaign
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
br
cf-cache-status
HIT
etag
W/"114-1a049e42e70"
age
386806
x-content-type-options
nosniff
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Wed, 09 Sep 2026 00:42:00 GMT
content-type
text/javascript; charset=utf-8
vary
Accept-Encoding
last-modified
Fri, 28 Aug 2026 19:41:26 GMT
priority
u=1,i=?0
strict-transport-security
max-age=15552000; includeSubDomains; preload
cache-control
public, max-age=31536000, immutable
cf-ray
a38226878b42ebbc-YYZ
server
cloudflare
GET
H3
200
src-t9XroQkU.js Show response
www.darkreading.com/assets/
2 KB
1 KB
118ms
105ms
Script
text/javascript
104.16.224.171
Cloudflare
General
Full URL
https://www.darkreading.com/assets/src-t9XroQkU.js
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/cyberattacks-data-breaches/attackers-multi-hop-google-redirects-phishing-campaign
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.16.224.171 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
70feb4472d4298de17e9d2814987b3bb526c801d5c2a5fd447a1a95d251b0cf4
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Origin
https://www.darkreading.com
sec-ch-ua-platform
"Linux"
Referer
https://www.darkreading.com/cyberattacks-data-breaches/attackers-multi-hop-google-redirects-phishing-campaign
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
br
cf-cache-status
HIT
etag
W/"619-1a049e42e70"
age
386806
x-content-type-options
nosniff
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Wed, 09 Sep 2026 00:42:00 GMT
content-type
text/javascript; charset=utf-8
vary
Accept-Encoding
last-modified
Fri, 28 Aug 2026 19:41:26 GMT
priority
u=1,i=?0
strict-transport-security
max-age=15552000; includeSubDomains; preload
cache-control
public, max-age=31536000, immutable
cf-ray
a38226878b43ebbc-YYZ
accept-ranges
bytes
server
cloudflare
GET
H3
200
src-OLAl1VEo.js Show response
www.darkreading.com/assets/
7 KB
3 KB
127ms
112ms
Script
text/javascript
104.16.224.171
Cloudflare
General
Full URL
https://www.darkreading.com/assets/src-OLAl1VEo.js
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/cyberattacks-data-breaches/attackers-multi-hop-google-redirects-phishing-campaign
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.16.224.171 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
4ed7bc3ad858fc3c8bdcca5bb8ed560a0832b73938d1bdc701b7fa601148e09f
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Origin
https://www.darkreading.com
sec-ch-ua-platform
"Linux"
Referer
https://www.darkreading.com/cyberattacks-data-breaches/attackers-multi-hop-google-redirects-phishing-campaign
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
br
cf-cache-status
HIT
etag
W/"1b1b-1a049e42e70"
age
386806
x-content-type-options
nosniff
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Wed, 09 Sep 2026 00:42:00 GMT
content-type
text/javascript; charset=utf-8
vary
Accept-Encoding
last-modified
Fri, 28 Aug 2026 19:41:26 GMT
priority
u=1,i=?0
strict-transport-security
max-age=15552000; includeSubDomains; preload
cache-control
public, max-age=31536000, immutable
cf-ray
a38226878b45ebbc-YYZ
accept-ranges
bytes
server
cloudflare
GET
H3
200
src-DlnpR4Oc2.js Show response
www.darkreading.com/assets/
4 KB
2 KB
124ms
110ms
Script
text/javascript
104.16.224.171
Cloudflare
General
Full URL
https://www.darkreading.com/assets/src-DlnpR4Oc2.js
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/cyberattacks-data-breaches/attackers-multi-hop-google-redirects-phishing-campaign
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.16.224.171 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
b348e05aea31addac26e9593c3645ef2d3745ff1078b87f22c2275a221adaed9
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Origin
https://www.darkreading.com
sec-ch-ua-platform
"Linux"
Referer
https://www.darkreading.com/cyberattacks-data-breaches/attackers-multi-hop-google-redirects-phishing-campaign
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
br
cf-cache-status
HIT
etag
W/"f4d-1a049e42e70"
age
386806
x-content-type-options
nosniff
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Wed, 09 Sep 2026 00:42:00 GMT
content-type
text/javascript; charset=utf-8
vary
Accept-Encoding
last-modified
Fri, 28 Aug 2026 19:41:26 GMT
priority
u=1,i=?0
strict-transport-security
max-age=15552000; includeSubDomains; preload
cache-control
public, max-age=31536000, immutable
cf-ray
a38226878b49ebbc-YYZ
accept-ranges
bytes
server
cloudflare
GET
H3
200
src-CLopXELS2.js Show response
www.darkreading.com/assets/
19 KB
7 KB
125ms
110ms
Script
text/javascript
104.16.224.171
Cloudflare
General
Full URL
https://www.darkreading.com/assets/src-CLopXELS2.js
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/cyberattacks-data-breaches/attackers-multi-hop-google-redirects-phishing-campaign
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.16.224.171 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
0a26e823e05761e4d2aaf23c9bc88f9a4ae4742b2a462eb6164e58ba3b8ffc26
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Origin
https://www.darkreading.com
sec-ch-ua-platform
"Linux"
Referer
https://www.darkreading.com/cyberattacks-data-breaches/attackers-multi-hop-google-redirects-phishing-campaign
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
br
cf-cache-status
HIT
etag
W/"4d89-1a049e42e70"
age
386806
x-content-type-options
nosniff
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Wed, 09 Sep 2026 00:42:00 GMT
content-type
text/javascript; charset=utf-8
vary
Accept-Encoding
last-modified
Fri, 28 Aug 2026 19:41:26 GMT
priority
u=1,i=?0
strict-transport-security
max-age=15552000; includeSubDomains; preload
cache-control
public, max-age=31536000, immutable
cf-ray
a38226878b4bebbc-YYZ
accept-ranges
bytes
server
cloudflare
GET
H3
200
src-2JSjF9Cx2.js Show response
www.darkreading.com/assets/
2 KB
1 KB
125ms
110ms
Script
text/javascript
104.16.224.171
Cloudflare
General
Full URL
https://www.darkreading.com/assets/src-2JSjF9Cx2.js
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/cyberattacks-data-breaches/attackers-multi-hop-google-redirects-phishing-campaign
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.16.224.171 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
288e5b61f769813be25d7fb3b04ee4018d01f71853a30c2fee01c372c81d1047
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Origin
https://www.darkreading.com
sec-ch-ua-platform
"Linux"
Referer
https://www.darkreading.com/cyberattacks-data-breaches/attackers-multi-hop-google-redirects-phishing-campaign
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
br
cf-cache-status
HIT
etag
W/"890-1a049e42e70"
age
386806
x-content-type-options
nosniff
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Wed, 09 Sep 2026 00:42:00 GMT
content-type
text/javascript; charset=utf-8
vary
Accept-Encoding
last-modified
Fri, 28 Aug 2026 19:41:26 GMT
priority
u=1,i=?0
strict-transport-security
max-age=15552000; includeSubDomains; preload
cache-control
public, max-age=31536000, immutable
cf-ray
a38226878b4cebbc-YYZ
accept-ranges
bytes
server
cloudflare
GET
H3
200
src-Dd-dkmZg.js Show response
www.darkreading.com/assets/
31 KB
13 KB
125ms
111ms
Script
text/javascript
104.16.224.171
Cloudflare
General
Full URL
https://www.darkreading.com/assets/src-Dd-dkmZg.js
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/cyberattacks-data-breaches/attackers-multi-hop-google-redirects-phishing-campaign
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.16.224.171 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
de4ca6e1c11150c450c5db5393229fee9211a6c3e08a45562309abd81334dcec
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Origin
https://www.darkreading.com
sec-ch-ua-platform
"Linux"
Referer
https://www.darkreading.com/cyberattacks-data-breaches/attackers-multi-hop-google-redirects-phishing-campaign
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
br
cf-cache-status
HIT
etag
W/"7b98-1a049e42e70"
age
386806
x-content-type-options
nosniff
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Wed, 09 Sep 2026 00:42:00 GMT
content-type
text/javascript; charset=utf-8
vary
Accept-Encoding
last-modified
Fri, 28 Aug 2026 19:41:26 GMT
priority
u=1,i=?0
strict-transport-security
max-age=15552000; includeSubDomains; preload
cache-control
public, max-age=31536000, immutable
cf-ray
a38226878b4eebbc-YYZ
accept-ranges
bytes
server
cloudflare
GET
H3
200
src-CFCxIJ-z.js Show response
www.darkreading.com/assets/
2 KB
1 KB
129ms
115ms
Script
text/javascript
104.16.224.171
Cloudflare
General
Full URL
https://www.darkreading.com/assets/src-CFCxIJ-z.js
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/cyberattacks-data-breaches/attackers-multi-hop-google-redirects-phishing-campaign
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.16.224.171 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
be521968c37872811ab72f8b196bf935d81b77e293a528cd885e87d0a161276b
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Origin
https://www.darkreading.com
sec-ch-ua-platform
"Linux"
Referer
https://www.darkreading.com/cyberattacks-data-breaches/attackers-multi-hop-google-redirects-phishing-campaign
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
br
cf-cache-status
HIT
etag
W/"8f0-1a049e42e70"
age
386806
x-content-type-options
nosniff
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Wed, 09 Sep 2026 00:42:00 GMT
content-type
text/javascript; charset=utf-8
vary
Accept-Encoding
last-modified
Fri, 28 Aug 2026 19:41:26 GMT
priority
u=1,i=?0
strict-transport-security
max-age=15552000; includeSubDomains; preload
cache-control
public, max-age=31536000, immutable
cf-ray
a38226878b50ebbc-YYZ
accept-ranges
bytes
server
cloudflare
GET
H3
200
src-kHUyKM2I.js Show response
www.darkreading.com/assets/
4 KB
2 KB
132ms
118ms
Script
text/javascript
104.16.224.171
Cloudflare
General
Full URL
https://www.darkreading.com/assets/src-kHUyKM2I.js
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/cyberattacks-data-breaches/attackers-multi-hop-google-redirects-phishing-campaign
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.16.224.171 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
3976eb6108c0c3830dbc859e1d59c599fff669a02a702e8eedb23e3a157b8935
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Origin
https://www.darkreading.com
sec-ch-ua-platform
"Linux"
Referer
https://www.darkreading.com/cyberattacks-data-breaches/attackers-multi-hop-google-redirects-phishing-campaign
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
br
cf-cache-status
HIT
etag
W/"1023-1a049e42e70"
age
386806
x-content-type-options
nosniff
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Wed, 09 Sep 2026 00:42:00 GMT
content-type
text/javascript; charset=utf-8
vary
Accept-Encoding
last-modified
Fri, 28 Aug 2026 19:41:26 GMT
priority
u=1,i=?0
strict-transport-security
max-age=15552000; includeSubDomains; preload
cache-control
public, max-age=31536000, immutable
cf-ray
a38226878b51ebbc-YYZ
accept-ranges
bytes
server
cloudflare
GET
H3
200
src-CcXIt3uR2.js Show response
www.darkreading.com/assets/
199 KB
29 KB
131ms
116ms
Script
text/javascript
104.16.224.171
Cloudflare
General
Full URL
https://www.darkreading.com/assets/src-CcXIt3uR2.js
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/cyberattacks-data-breaches/attackers-multi-hop-google-redirects-phishing-campaign
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.16.224.171 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
84c62cd198db434007c55dd0fea3b9be6429738f29b1f0bc4cbca97d82837d78
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Origin
https://www.darkreading.com
sec-ch-ua-platform
"Linux"
Referer
https://www.darkreading.com/cyberattacks-data-breaches/attackers-multi-hop-google-redirects-phishing-campaign
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
br
cf-cache-status
HIT
etag
W/"31d46-1a049e42e70"
age
386806
x-content-type-options
nosniff
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Wed, 09 Sep 2026 00:42:00 GMT
content-type
text/javascript; charset=utf-8
vary
Accept-Encoding
last-modified
Fri, 28 Aug 2026 19:41:26 GMT
priority
u=1,i=?0
strict-transport-security
max-age=15552000; includeSubDomains; preload
cache-control
public, max-age=31536000, immutable
cf-ray
a38226878b54ebbc-YYZ
accept-ranges
bytes
server
cloudflare
GET
H3
200
src-BhpFIaGo.js Show response
www.darkreading.com/assets/
3 KB
2 KB
133ms
119ms
Script
text/javascript
104.16.224.171
Cloudflare
General
Full URL
https://www.darkreading.com/assets/src-BhpFIaGo.js
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/cyberattacks-data-breaches/attackers-multi-hop-google-redirects-phishing-campaign
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.16.224.171 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
cccfb6b5ce14e0a0da911f1ad670cdb3be336a5dd8d9c356c7c5ff4c49e2008f
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Origin
https://www.darkreading.com
sec-ch-ua-platform
"Linux"
Referer
https://www.darkreading.com/cyberattacks-data-breaches/attackers-multi-hop-google-redirects-phishing-campaign
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
br
cf-cache-status
HIT
etag
W/"b38-1a049e42e70"
age
386806
x-content-type-options
nosniff
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Wed, 09 Sep 2026 00:42:00 GMT
content-type
text/javascript; charset=utf-8
vary
Accept-Encoding
last-modified
Fri, 28 Aug 2026 19:41:26 GMT
priority
u=1,i=?0
strict-transport-security
max-age=15552000; includeSubDomains; preload
cache-control
public, max-age=31536000, immutable
cf-ray
a38226878b55ebbc-YYZ
accept-ranges
bytes
server
cloudflare
GET
H3
200
esm-DyRx2uMK.js Show response
www.darkreading.com/assets/
5 KB
2 KB
141ms
127ms
Script
text/javascript
104.16.224.171
Cloudflare
General
Full URL
https://www.darkreading.com/assets/esm-DyRx2uMK.js
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/cyberattacks-data-breaches/attackers-multi-hop-google-redirects-phishing-campaign
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.16.224.171 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
a4ec7ab35c1f1abdeebda6c7197e823f5be9faf3a4c3d3165f95492eea497b3c
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Origin
https://www.darkreading.com
sec-ch-ua-platform
"Linux"
Referer
https://www.darkreading.com/cyberattacks-data-breaches/attackers-multi-hop-google-redirects-phishing-campaign
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
br
cf-cache-status
HIT
etag
W/"14ef-1a049e42e70"
age
386806
x-content-type-options
nosniff
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Wed, 09 Sep 2026 00:42:00 GMT
content-type
text/javascript; charset=utf-8
vary
Accept-Encoding
last-modified
Fri, 28 Aug 2026 19:41:26 GMT
priority
u=1,i=?0
strict-transport-security
max-age=15552000; includeSubDomains; preload
cache-control
public, max-age=31536000, immutable
cf-ray
a38226878b59ebbc-YYZ
accept-ranges
bytes
server
cloudflare
GET
H3
200
src-BiXivG1B.js Show response
www.darkreading.com/assets/
3 KB
2 KB
141ms
127ms
Script
text/javascript
104.16.224.171
Cloudflare
General
Full URL
https://www.darkreading.com/assets/src-BiXivG1B.js
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/cyberattacks-data-breaches/attackers-multi-hop-google-redirects-phishing-campaign
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.16.224.171 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
b79fdda616593d07f44733403b823f460e90fa5a618568c376bbb34975f26383
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Origin
https://www.darkreading.com
sec-ch-ua-platform
"Linux"
Referer
https://www.darkreading.com/cyberattacks-data-breaches/attackers-multi-hop-google-redirects-phishing-campaign
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
br
cf-cache-status
HIT
etag
W/"ae7-1a049e42e70"
age
386806
x-content-type-options
nosniff
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Wed, 09 Sep 2026 00:42:00 GMT
content-type
text/javascript; charset=utf-8
vary
Accept-Encoding
last-modified
Fri, 28 Aug 2026 19:41:26 GMT
priority
u=1,i=?0
strict-transport-security
max-age=15552000; includeSubDomains; preload
cache-control
public, max-age=31536000, immutable
cf-ray
a38226878b5cebbc-YYZ
accept-ranges
bytes
server
cloudflare
GET
H3
200
src-CONPej5R.js Show response
www.darkreading.com/assets/
2 KB
1 KB
140ms
127ms
Script
text/javascript
104.16.224.171
Cloudflare
General
Full URL
https://www.darkreading.com/assets/src-CONPej5R.js
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/cyberattacks-data-breaches/attackers-multi-hop-google-redirects-phishing-campaign
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.16.224.171 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
fd23c567a45464d99d9d43eaad0024a215afd7cc283bdb4165bc8027d1f51fdc
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Origin
https://www.darkreading.com
sec-ch-ua-platform
"Linux"
Referer
https://www.darkreading.com/cyberattacks-data-breaches/attackers-multi-hop-google-redirects-phishing-campaign
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
br
cf-cache-status
HIT
etag
W/"709-1a049e42e70"
age
386806
x-content-type-options
nosniff
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Wed, 09 Sep 2026 00:42:00 GMT
content-type
text/javascript; charset=utf-8
vary
Accept-Encoding
last-modified
Fri, 28 Aug 2026 19:41:26 GMT
priority
u=1,i=?0
strict-transport-security
max-age=15552000; includeSubDomains; preload
cache-control
public, max-age=31536000, immutable
cf-ray
a38226878b5debbc-YYZ
accept-ranges
bytes
server
cloudflare
GET
H3
200
toNumber-8NcC1lp_.js Show response
www.darkreading.com/assets/
594 B
665 B
141ms
128ms
Script
text/javascript
104.16.224.171
Cloudflare
General
Full URL
https://www.darkreading.com/assets/toNumber-8NcC1lp_.js
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/cyberattacks-data-breaches/attackers-multi-hop-google-redirects-phishing-campaign
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.16.224.171 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
0d10a3f078e9dc1c013ec5327502a0c8565c455964b267be5f4f47cd7bea5a05
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Origin
https://www.darkreading.com
sec-ch-ua-platform
"Linux"
Referer
https://www.darkreading.com/cyberattacks-data-breaches/attackers-multi-hop-google-redirects-phishing-campaign
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
br
cf-cache-status
HIT
etag
W/"252-1a049e42e70"
age
386806
x-content-type-options
nosniff
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Wed, 09 Sep 2026 00:42:00 GMT
content-type
text/javascript; charset=utf-8
vary
Accept-Encoding
last-modified
Fri, 28 Aug 2026 19:41:26 GMT
priority
u=1,i=?0
strict-transport-security
max-age=15552000; includeSubDomains; preload
cache-control
public, max-age=31536000, immutable
cf-ray
a38226878b5febbc-YYZ
server
cloudflare
GET
H3
200
src-k4Q05SNF.js Show response
www.darkreading.com/assets/
1 KB
1 KB
141ms
128ms
Script
text/javascript
104.16.224.171
Cloudflare
General
Full URL
https://www.darkreading.com/assets/src-k4Q05SNF.js
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/cyberattacks-data-breaches/attackers-multi-hop-google-redirects-phishing-campaign
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.16.224.171 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
4d7f0b91eb2a2681e129dca66a794bd34f686fcb6da8f2f8dd151205ec99fbf9
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Origin
https://www.darkreading.com
sec-ch-ua-platform
"Linux"
Referer
https://www.darkreading.com/cyberattacks-data-breaches/attackers-multi-hop-google-redirects-phishing-campaign
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
br
cf-cache-status
HIT
etag
W/"5f2-1a049e42e70"
age
386806
x-content-type-options
nosniff
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Wed, 09 Sep 2026 00:42:00 GMT
content-type
text/javascript; charset=utf-8
vary
Accept-Encoding
last-modified
Fri, 28 Aug 2026 19:41:26 GMT
priority
u=1,i=?0
strict-transport-security
max-age=15552000; includeSubDomains; preload
cache-control
public, max-age=31536000, immutable
cf-ray
a38226878b61ebbc-YYZ
accept-ranges
bytes
server
cloudflare
GET
H3
200
src-TrwGNFtC2.js Show response
www.darkreading.com/assets/
4 KB
2 KB
136ms
123ms
Script
text/javascript
104.16.224.171
Cloudflare
General
Full URL
https://www.darkreading.com/assets/src-TrwGNFtC2.js
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/cyberattacks-data-breaches/attackers-multi-hop-google-redirects-phishing-campaign
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.16.224.171 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
2485fd33845e20167ba3611159fe83582162987add3adcde7c849f7dbe83ff70
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Origin
https://www.darkreading.com
sec-ch-ua-platform
"Linux"
Referer
https://www.darkreading.com/cyberattacks-data-breaches/attackers-multi-hop-google-redirects-phishing-campaign
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
br
cf-cache-status
HIT
etag
W/"107e-1a049e42e70"
age
386806
x-content-type-options
nosniff
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Wed, 09 Sep 2026 00:42:00 GMT
content-type
text/javascript; charset=utf-8
vary
Accept-Encoding
last-modified
Fri, 28 Aug 2026 19:41:26 GMT
priority
u=1,i=?0
strict-transport-security
max-age=15552000; includeSubDomains; preload
cache-control
public, max-age=31536000, immutable
cf-ray
a38226878b62ebbc-YYZ
accept-ranges
bytes
server
cloudflare
GET
H3
200
src-ncxLImPM.js Show response
www.darkreading.com/assets/
332 B
544 B
136ms
124ms
Script
text/javascript
104.16.224.171
Cloudflare
General
Full URL
https://www.darkreading.com/assets/src-ncxLImPM.js
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/cyberattacks-data-breaches/attackers-multi-hop-google-redirects-phishing-campaign
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.16.224.171 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
b251be5432fcfb47ce9a326fd733053ce397600896d3776fe29942a316c154c8
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Origin
https://www.darkreading.com
sec-ch-ua-platform
"Linux"
Referer
https://www.darkreading.com/cyberattacks-data-breaches/attackers-multi-hop-google-redirects-phishing-campaign
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
br
cf-cache-status
HIT
etag
W/"14c-1a049e42e70"
age
386806
x-content-type-options
nosniff
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Wed, 09 Sep 2026 00:42:00 GMT
content-type
text/javascript; charset=utf-8
vary
Accept-Encoding
last-modified
Fri, 28 Aug 2026 19:41:26 GMT
priority
u=1,i=?0
strict-transport-security
max-age=15552000; includeSubDomains; preload
cache-control
public, max-age=31536000, immutable
cf-ray
a38226878b63ebbc-YYZ
server
cloudflare
GET
H3
200
extends-CvVTau-c.js Show response
www.darkreading.com/assets/
276 B
483 B
136ms
124ms
Script
text/javascript
104.16.224.171
Cloudflare
General
Full URL
https://www.darkreading.com/assets/extends-CvVTau-c.js
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/cyberattacks-data-breaches/attackers-multi-hop-google-redirects-phishing-campaign
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.16.224.171 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
fc93a0d4be920888d2b441cdd134610294d5699f6fe46e1391bd07e7222e36c3
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Origin
https://www.darkreading.com
sec-ch-ua-platform
"Linux"
Referer
https://www.darkreading.com/cyberattacks-data-breaches/attackers-multi-hop-google-redirects-phishing-campaign
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
br
cf-cache-status
HIT
etag
W/"114-1a049e42e70"
age
386806
x-content-type-options
nosniff
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Wed, 09 Sep 2026 00:42:00 GMT
content-type
text/javascript; charset=utf-8
vary
Accept-Encoding
last-modified
Fri, 28 Aug 2026 19:41:26 GMT
priority
u=1,i=?0
strict-transport-security
max-age=15552000; includeSubDomains; preload
cache-control
public, max-age=31536000, immutable
cf-ray
a38226878b65ebbc-YYZ
server
cloudflare
GET
H3
200
src-DNhy1b0m.js Show response
www.darkreading.com/assets/
6 KB
3 KB
136ms
124ms
Script
text/javascript
104.16.224.171
Cloudflare
General
Full URL
https://www.darkreading.com/assets/src-DNhy1b0m.js
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/cyberattacks-data-breaches/attackers-multi-hop-google-redirects-phishing-campaign
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.16.224.171 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
d26c0cc69f4b271a2533e9ef40fe7cd3dda20f997b8367dc72fcc8a986381d0e
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Origin
https://www.darkreading.com
sec-ch-ua-platform
"Linux"
Referer
https://www.darkreading.com/cyberattacks-data-breaches/attackers-multi-hop-google-redirects-phishing-campaign
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
br
cf-cache-status
HIT
etag
W/"162e-1a049e42e70"
age
386806
x-content-type-options
nosniff
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Wed, 09 Sep 2026 00:42:00 GMT
content-type
text/javascript; charset=utf-8
vary
Accept-Encoding
last-modified
Fri, 28 Aug 2026 19:41:26 GMT
priority
u=1,i=?0
strict-transport-security
max-age=15552000; includeSubDomains; preload
cache-control
public, max-age=31536000, immutable
cf-ray
a38226878b67ebbc-YYZ
accept-ranges
bytes
server
cloudflare
GET
H3
200
striptags-BwxRt8hs.js Show response
www.darkreading.com/assets/
2 KB
1 KB
136ms
124ms
Script
text/javascript
104.16.224.171
Cloudflare
General
Full URL
https://www.darkreading.com/assets/striptags-BwxRt8hs.js
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/cyberattacks-data-breaches/attackers-multi-hop-google-redirects-phishing-campaign
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.16.224.171 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
535b45acb602e0a8a25af5f0c4e53c53a3a698966921cb7a438dc3cc6e44b4bc
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Origin
https://www.darkreading.com
sec-ch-ua-platform
"Linux"
Referer
https://www.darkreading.com/cyberattacks-data-breaches/attackers-multi-hop-google-redirects-phishing-campaign
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
br
cf-cache-status
HIT
etag
W/"6a5-1a049e42e70"
age
386806
x-content-type-options
nosniff
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Wed, 09 Sep 2026 00:42:00 GMT
content-type
text/javascript; charset=utf-8
vary
Accept-Encoding
last-modified
Fri, 28 Aug 2026 19:41:26 GMT
priority
u=1,i=?0
strict-transport-security
max-age=15552000; includeSubDomains; preload
cache-control
public, max-age=31536000, immutable
cf-ray
a38226878b68ebbc-YYZ
accept-ranges
bytes
server
cloudflare
GET
H3
200
src-CUYznDQu2.js Show response
www.darkreading.com/assets/
4 KB
2 KB
136ms
124ms
Script
text/javascript
104.16.224.171
Cloudflare
General
Full URL
https://www.darkreading.com/assets/src-CUYznDQu2.js
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/cyberattacks-data-breaches/attackers-multi-hop-google-redirects-phishing-campaign
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.16.224.171 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
5500d1f1ae6f288310cf5c362ff87e517171d0fc36399e26b7e2ff2fb6d566f0
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Origin
https://www.darkreading.com
sec-ch-ua-platform
"Linux"
Referer
https://www.darkreading.com/cyberattacks-data-breaches/attackers-multi-hop-google-redirects-phishing-campaign
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
br
cf-cache-status
HIT
etag
W/"ee5-1a049e42e70"
age
238633
x-content-type-options
nosniff
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Wed, 09 Sep 2026 00:42:00 GMT
content-type
text/javascript; charset=utf-8
vary
Accept-Encoding
last-modified
Fri, 28 Aug 2026 19:41:26 GMT
priority
u=1,i=?0
strict-transport-security
max-age=15552000; includeSubDomains; preload
cache-control
public, max-age=31536000, immutable
cf-ray
a38226878b6aebbc-YYZ
accept-ranges
bytes
server
cloudflare
GET
H3
200
_topic._slug._index-DTV8CPNA.js Show response
www.darkreading.com/assets/
178 B
415 B
136ms
125ms
Script
text/javascript
104.16.224.171
Cloudflare
General
Full URL
https://www.darkreading.com/assets/_topic._slug._index-DTV8CPNA.js
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/cyberattacks-data-breaches/attackers-multi-hop-google-redirects-phishing-campaign
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.16.224.171 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
bd50cc94a0a03287f7df0e603d33354f44d83553516177a9741e9c97ba5b5ec1
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Origin
https://www.darkreading.com
sec-ch-ua-platform
"Linux"
Referer
https://www.darkreading.com/cyberattacks-data-breaches/attackers-multi-hop-google-redirects-phishing-campaign
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
br
cf-cache-status
HIT
etag
W/"b2-1a049e42e70"
age
386798
x-content-type-options
nosniff
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Wed, 09 Sep 2026 00:42:00 GMT
content-type
text/javascript; charset=utf-8
vary
Accept-Encoding
last-modified
Fri, 28 Aug 2026 19:41:26 GMT
priority
u=1,i=?0
strict-transport-security
max-age=15552000; includeSubDomains; preload
cache-control
public, max-age=31536000, immutable
cf-ray
a38226878b6debbc-YYZ
server
cloudflare
GET
H3
200
_topic._slug._index-afTYREi0.js Show response
www.darkreading.com/assets/
37 KB
14 KB
137ms
125ms
Script
text/javascript
104.16.224.171
Cloudflare
General
Full URL
https://www.darkreading.com/assets/_topic._slug._index-afTYREi0.js
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/cyberattacks-data-breaches/attackers-multi-hop-google-redirects-phishing-campaign
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.16.224.171 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
ed4de0ecb7c4d4513898281a04f5fb9fdc8310dc765e457b459e9cb8523e2e32
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Origin
https://www.darkreading.com
sec-ch-ua-platform
"Linux"
Referer
https://www.darkreading.com/cyberattacks-data-breaches/attackers-multi-hop-google-redirects-phishing-campaign
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
br
cf-cache-status
HIT
etag
W/"9559-1a049e42e70"
age
386806
x-content-type-options
nosniff
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Wed, 09 Sep 2026 00:42:00 GMT
content-type
text/javascript; charset=utf-8
vary
Accept-Encoding
last-modified
Fri, 28 Aug 2026 19:41:26 GMT
priority
u=1,i=?0
strict-transport-security
max-age=15552000; includeSubDomains; preload
cache-control
public, max-age=31536000, immutable
cf-ray
a38226878b6eebbc-YYZ
accept-ranges
bytes
server
cloudflare
GET
H3
200
string-DkYk6B6i.js Show response
www.darkreading.com/assets/
413 B
581 B
144ms
132ms
Script
text/javascript
104.16.224.171
Cloudflare
General
Full URL
https://www.darkreading.com/assets/string-DkYk6B6i.js
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/cyberattacks-data-breaches/attackers-multi-hop-google-redirects-phishing-campaign
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.16.224.171 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
330cfac836596b446dd5d2ebe0fd374a3a1e857cd7ce21b278ba138c95b5a73f
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Origin
https://www.darkreading.com
sec-ch-ua-platform
"Linux"
Referer
https://www.darkreading.com/cyberattacks-data-breaches/attackers-multi-hop-google-redirects-phishing-campaign
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
br
cf-cache-status
HIT
etag
W/"19d-1a049e42e70"
age
386806
x-content-type-options
nosniff
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Wed, 09 Sep 2026 00:42:00 GMT
content-type
text/javascript; charset=utf-8
vary
Accept-Encoding
last-modified
Fri, 28 Aug 2026 19:41:26 GMT
priority
u=1,i=?0
strict-transport-security
max-age=15552000; includeSubDomains; preload
cache-control
public, max-age=31536000, immutable
cf-ray
a38226878b70ebbc-YYZ
server
cloudflare
GET
H3
200
src-B2wrd9a_.js Show response
www.darkreading.com/assets/
2 KB
1 KB
144ms
132ms
Script
text/javascript
104.16.224.171
Cloudflare
General
Full URL
https://www.darkreading.com/assets/src-B2wrd9a_.js
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/cyberattacks-data-breaches/attackers-multi-hop-google-redirects-phishing-campaign
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.16.224.171 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
36c7bdc5d707ecd54df5d193a2b74a31bf80159178d7013030744829132083c5
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Origin
https://www.darkreading.com
sec-ch-ua-platform
"Linux"
Referer
https://www.darkreading.com/cyberattacks-data-breaches/attackers-multi-hop-google-redirects-phishing-campaign
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
br
cf-cache-status
HIT
etag
W/"7df-1a049e42e70"
age
386806
x-content-type-options
nosniff
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Wed, 09 Sep 2026 00:42:00 GMT
content-type
text/javascript; charset=utf-8
vary
Accept-Encoding
last-modified
Fri, 28 Aug 2026 19:41:26 GMT
priority
u=1,i=?0
strict-transport-security
max-age=15552000; includeSubDomains; preload
cache-control
public, max-age=31536000, immutable
cf-ray
a38226878b72ebbc-YYZ
accept-ranges
bytes
server
cloudflare
GET
H3
200
src-Dtt3jOgP.js Show response
www.darkreading.com/assets/
4 KB
2 KB
147ms
135ms
Script
text/javascript
104.16.224.171
Cloudflare
General
Full URL
https://www.darkreading.com/assets/src-Dtt3jOgP.js
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/cyberattacks-data-breaches/attackers-multi-hop-google-redirects-phishing-campaign
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.16.224.171 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
5b82ceed49c561460b386ccd3e3f9a372d14f16a4612c1bd9dead4d1e0ee1303
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Origin
https://www.darkreading.com
sec-ch-ua-platform
"Linux"
Referer
https://www.darkreading.com/cyberattacks-data-breaches/attackers-multi-hop-google-redirects-phishing-campaign
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
br
cf-cache-status
HIT
etag
W/"1070-1a049e42e70"
age
386806
x-content-type-options
nosniff
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Wed, 09 Sep 2026 00:42:00 GMT
content-type
text/javascript; charset=utf-8
vary
Accept-Encoding
last-modified
Fri, 28 Aug 2026 19:41:26 GMT
priority
u=1,i=?0
strict-transport-security
max-age=15552000; includeSubDomains; preload
cache-control
public, max-age=31536000, immutable
cf-ray
a38226878b74ebbc-YYZ
accept-ranges
bytes
server
cloudflare
GET
H3
200
src-DyBmp5FV.js Show response
www.darkreading.com/assets/
1 KB
923 B
147ms
136ms
Script
text/javascript
104.16.224.171
Cloudflare
General
Full URL
https://www.darkreading.com/assets/src-DyBmp5FV.js
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/cyberattacks-data-breaches/attackers-multi-hop-google-redirects-phishing-campaign
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.16.224.171 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
eaaf572ec605b5ae0d08d19e0d1ceac366c0787a3cf81a6d69addcf1259315a6
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Origin
https://www.darkreading.com
sec-ch-ua-platform
"Linux"
Referer
https://www.darkreading.com/cyberattacks-data-breaches/attackers-multi-hop-google-redirects-phishing-campaign
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
br
cf-cache-status
HIT
etag
W/"479-1a049e42e70"
age
386806
x-content-type-options
nosniff
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Wed, 09 Sep 2026 00:42:00 GMT
content-type
text/javascript; charset=utf-8
vary
Accept-Encoding
last-modified
Fri, 28 Aug 2026 19:41:26 GMT
priority
u=1,i=?0
strict-transport-security
max-age=15552000; includeSubDomains; preload
cache-control
public, max-age=31536000, immutable
cf-ray
a38226878b75ebbc-YYZ
accept-ranges
bytes
server
cloudflare
GET
H3
200
src-B5NvusuV.js Show response
www.darkreading.com/assets/
15 KB
5 KB
148ms
136ms
Script
text/javascript
104.16.224.171
Cloudflare
General
Full URL
https://www.darkreading.com/assets/src-B5NvusuV.js
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/cyberattacks-data-breaches/attackers-multi-hop-google-redirects-phishing-campaign
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.16.224.171 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
da2046ffb2d3a0b4077aeef8e2f5c43ff1d66f31b6d5bd72d16fd7d9b40b61ef
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Origin
https://www.darkreading.com
sec-ch-ua-platform
"Linux"
Referer
https://www.darkreading.com/cyberattacks-data-breaches/attackers-multi-hop-google-redirects-phishing-campaign
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
br
cf-cache-status
HIT
etag
W/"3a71-1a049e42e70"
age
386806
x-content-type-options
nosniff
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Wed, 09 Sep 2026 00:42:00 GMT
content-type
text/javascript; charset=utf-8
vary
Accept-Encoding
last-modified
Fri, 28 Aug 2026 19:41:26 GMT
priority
u=1,i=?0
strict-transport-security
max-age=15552000; includeSubDomains; preload
cache-control
public, max-age=31536000, immutable
cf-ray
a38226878b77ebbc-YYZ
accept-ranges
bytes
server
cloudflare
GET
H3
200
utils-D-tTJe50.js Show response
www.darkreading.com/assets/
152 B
418 B
149ms
137ms
Script
text/javascript
104.16.224.171
Cloudflare
General
Full URL
https://www.darkreading.com/assets/utils-D-tTJe50.js
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/cyberattacks-data-breaches/attackers-multi-hop-google-redirects-phishing-campaign
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.16.224.171 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
fa4413c3a67b20b38bc75d338c7e95e61ae6d81ef75780ab1d8dcc338c5ce04c
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Origin
https://www.darkreading.com
sec-ch-ua-platform
"Linux"
Referer
https://www.darkreading.com/cyberattacks-data-breaches/attackers-multi-hop-google-redirects-phishing-campaign
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
br
cf-cache-status
HIT
etag
W/"98-1a049e42e70"
age
386806
x-content-type-options
nosniff
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Wed, 09 Sep 2026 00:42:00 GMT
content-type
text/javascript; charset=utf-8
vary
Accept-Encoding
last-modified
Fri, 28 Aug 2026 19:41:26 GMT
priority
u=1,i=?0
strict-transport-security
max-age=15552000; includeSubDomains; preload
cache-control
public, max-age=31536000, immutable
cf-ray
a38226878b78ebbc-YYZ
server
cloudflare
GET
H3
200
src-CRywIVUS.js Show response
www.darkreading.com/assets/
4 KB
2 KB
139ms
126ms
Script
text/javascript
104.16.224.171
Cloudflare
General
Full URL
https://www.darkreading.com/assets/src-CRywIVUS.js
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/cyberattacks-data-breaches/attackers-multi-hop-google-redirects-phishing-campaign
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.16.224.171 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
1ad423b48fb9a711b223538639c4dc9c650b285c3b7d81b06bab621fcf0d021b
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Origin
https://www.darkreading.com
sec-ch-ua-platform
"Linux"
Referer
https://www.darkreading.com/cyberattacks-data-breaches/attackers-multi-hop-google-redirects-phishing-campaign
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
br
cf-cache-status
HIT
etag
W/"11f6-1a049e42e70"
age
386806
x-content-type-options
nosniff
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Wed, 09 Sep 2026 00:42:00 GMT
content-type
text/javascript; charset=utf-8
vary
Accept-Encoding
last-modified
Fri, 28 Aug 2026 19:41:26 GMT
priority
u=1,i=?0
strict-transport-security
max-age=15552000; includeSubDomains; preload
cache-control
public, max-age=31536000, immutable
cf-ray
a38226878b79ebbc-YYZ
accept-ranges
bytes
server
cloudflare
GET
H3
200
src-Bg255ssg.js Show response
www.darkreading.com/assets/
6 KB
3 KB
139ms
127ms
Script
text/javascript
104.16.224.171
Cloudflare
General
Full URL
https://www.darkreading.com/assets/src-Bg255ssg.js
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/cyberattacks-data-breaches/attackers-multi-hop-google-redirects-phishing-campaign
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.16.224.171 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
8e658680d8a076685e2c3045057ecce397e8a50d7300f2a38bad56509936b1a6
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Origin
https://www.darkreading.com
sec-ch-ua-platform
"Linux"
Referer
https://www.darkreading.com/cyberattacks-data-breaches/attackers-multi-hop-google-redirects-phishing-campaign
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
br
cf-cache-status
HIT
etag
W/"1794-1a049e42e70"
age
386806
x-content-type-options
nosniff
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Wed, 09 Sep 2026 00:42:00 GMT
content-type
text/javascript; charset=utf-8
vary
Accept-Encoding
last-modified
Fri, 28 Aug 2026 19:41:26 GMT
priority
u=1,i=?0
strict-transport-security
max-age=15552000; includeSubDomains; preload
cache-control
public, max-age=31536000, immutable
cf-ray
a38226878b7aebbc-YYZ
accept-ranges
bytes
server
cloudflare
GET
H3
200
email-decode.min.js Show response
www.darkreading.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/
1 KB
726 B
139ms
127ms
Script
application/javascript
104.16.224.171
Cloudflare
General
Full URL
https://www.darkreading.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/cyberattacks-data-breaches/attackers-multi-hop-google-redirects-phishing-campaign
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.16.224.171 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.darkreading.com/cyberattacks-data-breaches/attackers-multi-hop-google-redirects-phishing-campaign
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

cache-control
public
content-encoding
br
x-content-type-options
nosniff
cf-ray
a38226878b7debbc-YYZ
expires
Fri, 11 Sep 2026 00:42:00 GMT
date
Wed, 09 Sep 2026 00:42:00 GMT
content-type
application/javascript
vary
accept-encoding
server
cloudflare
x-frame-options
DENY
GET
H3
200
embed.js Show response
www.instagram.com/
104 KB
34 KB
275ms
212ms
Script
application/x-javascript
157.240.241.174
Facebook
General
Full URL
https://www.instagram.com/embed.js
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/cyberattacks-data-breaches/attackers-multi-hop-google-redirects-phishing-campaign
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
157.240.241.174 New York, United States, ASN32934 (FACEBOOK - Facebook, Inc., US),
Reverse DNS
instagram-p42-shv-02-lga3.fbcdn.net
Software
/
Resource Hash
55764398ad1d7ef49429fdc69ff35d6215b3f0549fad4d906587ae810c3f1bd0
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-md5
PqM134vuNiHsR4xafjVFxA==
access-control-expose-headers
X-FB-Content-MD5
x-stack
www
content-encoding
zstd
etag
"1c6aa84ed9ec0d462d9c62361bb0216d"
origin-trial
ArDvqjFKr1fHThlSM8Kkp74sxlOCFTeqYJMXCGqCG/VJmcYlO/0UavmpqPDit2KppDf1THInNpwA36GmtgPOug8AAAB2eyJvcmlnaW4iOiJodHRwczovL3d3dy5pbnN0YWdyYW0uY29tOjQ0MyIsImZlYXR1cmUiOiJDcmFzaFJlcG9ydGluZ1N0b3JhZ2VBUEkiLCJleHBpcnkiOjE3NzY3Mjk2MDAsImlzU3ViZG9tYWluIjp0cnVlfQ==
x-content-type-options
nosniff
report-to
{"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.instagram.com\/error\/ig_web_error_reports\/?device_level=unknown&brsid=7683329364431560558&cpp=C3&cv=1047029842&st=1788914521107"}]}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.instagram.com\/error\/ig_web_error_reports\/"}],"group":"permissions_policy"}
expires
Wed, 09 Sep 2026 01:02:01 GMT
alt-svc
h3=":443"; ma=86400
edge-control
cache-maxage=1200s
date
Wed, 09 Sep 2026 00:42:01 GMT
content-type
application/x-javascript; charset=utf-8
vary
Accept-Encoding
x-fb-debug
NlIjJPUwq3TiHQ3Gpt5SOG0KQG+0hp0T5li9tpSNh5aWqrJ8H/ZTXaYQ3Uc70SEUJ83m7A91cULctaL5c2O6MA==
priority
u=3,i
x-frame-options
DENY
strict-transport-security
max-age=31536000; preload; includeSubDomains
reporting-endpoints
coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", default="https://www.instagram.com/error/ig_web_error_reports/?device_level=unknown&brsid=7683329364431560558&cpp=C3&cv=1047029842&st=1788914521107", permissions_policy="https://www.instagram.com/error/ig_web_error_reports/"
x-fb-content-md5
274c5f705cfd35de5ee73336d870386c
cache-control
public,max-age=1200,stale-while-revalidate=3600
timing-allow-origin
*
cross-origin-opener-policy
same-origin-allow-popups
x-fb-connection-quality
EXCELLENT; q=0.9, rtt=32, rtx=0, c=34, mss=1232, tbw=5297, tp=9, tpl=0, uplat=178, ullat=0
cross-origin-resource-policy
cross-origin
permissions-policy
accelerometer=(self), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(self), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(self), compute-pressure=(), display-capture=(self), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(self), gyroscope=(self), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(self), midi=(), otp-credentials=(self), payment=(), picture-in-picture=(self), private-state-token-issuance=(), publickey-credentials-get=(self "https://*.facebook.com" "https://facebook.com"), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
document-policy
force-load-at-top, include-js-call-stacks-in-crash-reports
access-control-allow-origin
*
content-length
34905
origin-agent-cluster
?1
GET
H2
200
v31edd6df95cf4e85bb4c19e7a9bdbcba1788362987495 Show response
static.cloudflareinsights.com/beacon.min.js/
30 KB
10 KB
569ms
29ms
Script
text/javascript
104.16.80.73
Cloudflare
General
Full URL
https://static.cloudflareinsights.com/beacon.min.js/v31edd6df95cf4e85bb4c19e7a9bdbcba1788362987495
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/cyberattacks-data-breaches/attackers-multi-hop-google-redirects-phishing-campaign
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.16.80.73 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
08c4fd72f9d96a7aa554510dff2c293973b1b092dff1b9b282bce9111b50ef41

Request headers

Origin
https://www.darkreading.com
sec-ch-ua-platform
"Linux"
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

cache-control
public, max-age=86400
content-encoding
gzip
etag
W/"2026.9.1"
cross-origin-resource-policy
cross-origin
cf-ray
a382268b0af9ccd9-YYZ
access-control-allow-origin
*
date
Wed, 09 Sep 2026 00:42:00 GMT
content-type
text/javascript;charset=UTF-8
last-modified
Wed, 02 Sep 2026 15:29:47 GMT
server
cloudflare
GET
H3
200
ui.js Show response
transcend-cdn.com/cm/ef49a3f1-d8c1-47d6-88fc-50e41130631f/
383 KB
99 KB
51ms
45ms
Script
text/javascript
104.18.40.238
Cloudflare
General
Full URL
https://transcend-cdn.com/cm/ef49a3f1-d8c1-47d6-88fc-50e41130631f/ui.js
Requested by
Host: transcend-cdn.com
URL: https://transcend-cdn.com/cm/ef49a3f1-d8c1-47d6-88fc-50e41130631f/airgap.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.18.40.238 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
c44a7e5f9cce6273bb31dd5f35330610f9c4722781976a8de3bfa9017e6775d4
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Origin
https://www.darkreading.com
sec-ch-ua-platform
"Linux"
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

access-control-max-age
86400
content-encoding
br
cf-cache-status
HIT
etag
W/"b7894ac2b6a595b6205982e63652acc1"
age
18092
expect-ct
max-age=86400, enforce
access-control-allow-methods
GET,HEAD,OPTIONS
x-content-type-options
nosniff
expires
Wed, 09 Sep 2026 00:43:01 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Wed, 09 Sep 2026 00:42:01 GMT
content-type
text/javascript
content-disposition
inline
priority
u=3,i=?0
cache-control
public, max-age=60
timing-allow-origin
*
referrer-policy
same-origin
cf-ray
a382268c6c069dab-YYZ
access-control-allow-origin
*
x-xss-protection
1; mode=block
server
cloudflare
HEAD
H2
200
/
marketingplatform.google.com/about/enterprise/
Redirect Chain
  • https://www3.doubleclick.net/
  • https://marketingplatform.google.com/about/enterprise/
0
0
162ms
43ms
Fetch
text/html
172.253.63.139
Google LLC
General
Full URL
https://marketingplatform.google.com/about/enterprise/
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/cyberattacks-data-breaches/attackers-multi-hop-google-redirects-phishing-campaign
Protocol
H2
Server
172.253.63.139 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
bi-in-f139.1e100.net
Software
/
Resource Hash

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
Referer
https://www.darkreading.com/

Response headers

Redirect headers

cache-control
public, max-age=1800
location
https://marketingplatform.google.com/about/enterprise/
age
386
cross-origin-resource-policy
cross-origin
x-content-type-options
nosniff
expires
Wed, 09 Sep 2026 01:05:35 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
251
x-xss-protection
0
date
Wed, 09 Sep 2026 00:35:35 GMT
content-type
text/html; charset=UTF-8
server
sffe
GET
H3
200
p-2ed681a8.js Show response
www.darkreading.com/next-gen/at/tt-ld/
6 KB
3 KB
97ms
94ms
Script
application/javascript
104.16.224.171
Cloudflare
General
Full URL
https://www.darkreading.com/next-gen/at/tt-ld/p-2ed681a8.js
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/cyberattacks-data-breaches/attackers-multi-hop-google-redirects-phishing-campaign
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.16.224.171 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare / Express
Resource Hash
a7403a4b996d89599db6c005ac2e64e411b1ddd5fbc5371b8205394c3c4138bc

Request headers

Origin
https://www.darkreading.com
sec-ch-ua-platform
"Linux"
Referer
https://www.darkreading.com/next-gen/at/tt-ld/tt-nextgen-ld.esm.js
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
br
cf-cache-status
BYPASS
etag
W/"163f-19bbd75e9a0"
expires
Wed, 09 Sep 2026 02:42:01 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Wed, 09 Sep 2026 00:42:01 GMT
content-type
application/javascript; charset=UTF-8
last-modified
Wed, 14 Jan 2026 17:03:00 GMT
vary
Origin, accept-encoding
priority
u=1,i=?0
cache-control
public, max-age=7200
access-control-allow-credentials
true
via
1.1 google
cf-ray
a382268c6a3febbc-YYZ
access-control-allow-origin
https://www.darkreading.com
x-powered-by
Express
server
cloudflare
GET
DATA
200
OK
truncated
/
1 KB
0
Image
image/svg+xml

General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
aadb196ed2b721bfb6e2ad333ca3d428f7a54d2ec8016c8bec14837eaf3bc831

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
Referer

Response headers

Content-Type
image/svg+xml
GET
DATA
200
OK
truncated
/
226 B
0
Image
image/svg+xml

General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
15115297ec6731b5b41ab2785d14417410a77cb120faeb4331d62d4ba7e9c08a

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
Origin
https://www.darkreading.com
Referer

Response headers

Content-Type
image/svg+xml
GET
DATA
200
OK
truncated
/
549 B
0
Image
image/svg+xml

General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
ba6b44b70bc203ce8827cbdfffbc551828b85d3bc99f87986eb55460391650c0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
Origin
https://www.darkreading.com
Referer

Response headers

Content-Type
image/svg+xml
GET
DATA
200
OK
truncated
/
480 B
0
Image
image/svg+xml

General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
6912769db3f136f517bd2f60fb407f73a3b5b69ca295f74339ae11a5b0f472b9

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
Origin
https://www.darkreading.com
Referer

Response headers

Content-Type
image/svg+xml
GET
DATA
200
OK
truncated
/
444 B
0
Image
image/svg+xml

General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
1c224545b65476f9b8e3b5642c7b0c13e44e344cbfe2431e975e89bf016c364f

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
Origin
https://www.darkreading.com
Referer

Response headers

Content-Type
image/svg+xml
GET
DATA
200
OK
truncated
/
418 B
0
Image
image/svg+xml

General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
1dd58d5422f0d3fd9583830827420a82d6d252833e94644111b923a265704b89

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
Origin
https://www.darkreading.com
Referer

Response headers

Content-Type
image/svg+xml
GET
DATA
200
OK
truncated
/
400 B
0
Image
image/svg+xml

General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
d4285d14d38db91e21c9f611e88ef36b3362f775f51dc2b6b01a6a614a7fb8ce

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
Origin
https://www.darkreading.com
Referer

Response headers

Content-Type
image/svg+xml
GET
DATA
200
OK
truncated
/
272 B
0
Image
image/svg+xml

General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
9047ea12a5e56f2ea31edb19a9607ac676bebaadd93e784579a9792f7cbc06ca

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
Origin
https://www.darkreading.com
Referer

Response headers

Content-Type
image/svg+xml
GET
DATA
200
OK
truncated
/
404 B
0
Image
image/svg+xml

General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
c7bd3c4a8128d2ad65585c34e6f15c904e881e2b56059f7d8b495a4c617870e4

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
Origin
https://www.darkreading.com
Referer

Response headers

Content-Type
image/svg+xml
GET
DATA
200
OK
truncated
/
1 KB
0
Image
image/svg+xml

General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
fc34f67885ec4c7d3ff5a2dfa3c88575342a3a2631ae8fbaa3fd3956afd3e5eb

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
Origin
https://www.darkreading.com
Referer

Response headers

Content-Type
image/svg+xml
GET
DATA
200
OK
truncated
/
740 B
0
Image
image/svg+xml

General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
f43e6b4ba3e7823aff3535b1dba26d5375fc71c3fca8b5f3c83ca5fb66e9e9b7

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
Origin
https://www.darkreading.com
Referer

Response headers

Content-Type
image/svg+xml
GET
DATA
200
OK
truncated
/
772 B
0
Image
image/svg+xml

General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
2213746846613d6abe65df8474b049bc20d491832a9c5947ec850495709de68a

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
Origin
https://www.darkreading.com
Referer

Response headers

Content-Type
image/svg+xml
GET
DATA
200
OK
truncated
/
704 B
0
Image
image/svg+xml

General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
e0f00e4b87a4db0a7c2901c82c2c8cb164ead449f22b2a6f115b79e3397ace72

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
Origin
https://www.darkreading.com
Referer

Response headers

Content-Type
image/svg+xml
GET
DATA
200
OK
truncated
/
407 B
0
Image
image/svg+xml

General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
70d5964301416e02a05ee395a16fb20a0ae656b661abc2ebb32fe7db16d7a120

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
Origin
https://www.darkreading.com
Referer

Response headers

Content-Type
image/svg+xml
GET
DATA
200
OK
truncated
/
747 B
0
Image
image/svg+xml

General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
a02994557f5b07d95ea5b4e0ff88a513780e27630c4b3c3c299f9617ab0f5b56

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
Origin
https://www.darkreading.com
Referer

Response headers

Content-Type
image/svg+xml
GET
DATA
200
OK
truncated
/
334 B
0
Image
image/svg+xml

General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
d6c48c8d650f2d3c593a2fe2933498f23f1f0e3c630925b03660d580476dbd3d

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
Origin
https://www.darkreading.com
Referer

Response headers

Content-Type
image/svg+xml
GET
DATA
200
OK
truncated
/
1022 B
0
Image
image/svg+xml

General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
ec0ac285d03d4854ac26ee89f752d3a84b93598cb78230c23cce3f288d10f0bd

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
Origin
https://www.darkreading.com
Referer

Response headers

Content-Type
image/svg+xml
GET
DATA
200
OK
truncated
/
570 B
0
Image
image/svg+xml

General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
50ef46d43afaef28f41d70f151d3fe77591dfad4b220bcac8ad890ad6265679e

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
Origin
https://www.darkreading.com
Referer

Response headers

Content-Type
image/svg+xml
GET
DATA
200
OK
truncated
/
627 B
0
Image
image/svg+xml

General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
e9fd4048203c3423700cd4fc6ad4b362bbf9ba1e3fc350b057c6a15b2b09d204

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
Origin
https://www.darkreading.com
Referer

Response headers

Content-Type
image/svg+xml
GET
DATA
200
OK
truncated
/
897 B
0
Image
image/svg+xml

General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
045baaf054023b76d8ac44d8bdf9d031c911aabcf1b7d4a76d49a0395a91f8d2

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
Origin
https://www.darkreading.com
Referer

Response headers

Content-Type
image/svg+xml
GET
H3
200
UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa1ZL7.woff2
fonts.gstatic.com/s/inter/v20/
47 KB
47 KB
93ms
42ms
Font
font/woff2
142.251.211.131
Google LLC
General
Full URL
https://fonts.gstatic.com/s/inter/v20/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa1ZL7.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Inter:wght@100;200;300;400;500;600;700;800;900&display=swap
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.211.131 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
lclgaa-au-in-f3.1e100.net
Software
sffe /
Resource Hash
3100e775e8616cd2611beecfa23a4263d7037586789b43f035236a2e6fbd4c62
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
https://www.darkreading.com
sec-ch-ua-platform
"Linux"
Referer
https://fonts.googleapis.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

age
25915
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options
nosniff
expires
Wed, 08 Sep 2027 17:30:06 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Tue, 08 Sep 2026 17:30:06 GMT
last-modified
Tue, 09 Sep 2025 18:33:53 GMT
content-type
font/woff2
cache-control
public, max-age=31536000
timing-allow-origin
*
cross-origin-opener-policy
same-origin; report-to="apps-themes"
cross-origin-resource-policy
cross-origin
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges
bytes
access-control-allow-origin
*
content-length
48256
x-xss-protection
0
server
sffe
GET
H2
200
pubhtml Show response
docs.google.com/spreadsheets/d/e/2PACX-1vQsygsynrhlYSFLOwZ9IaqURE4cQ3rGo07MkUiECTl3zXlINi_MWVmfxgjSgmvPhGmk0kPdS8DBzkoj/ Frame B76A
88 KB
27 KB
303ms
207ms
Document
text/html
142.250.217.14
Google LLC
General
Full URL
https://docs.google.com/spreadsheets/d/e/2PACX-1vQsygsynrhlYSFLOwZ9IaqURE4cQ3rGo07MkUiECTl3zXlINi_MWVmfxgjSgmvPhGmk0kPdS8DBzkoj/pubhtml?gid=326945225&widget=false&headers=false&chrome=false
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/cyberattacks-data-breaches/attackers-multi-hop-google-redirects-phishing-campaign
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.217.14 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
pnlgaa-as-in-f14.1e100.net
Software
ESF /
Resource Hash
59c231fca803894ce5d39b909ff51e6e7a67a03c3c218b39d2e1507b519ed133
Security Headers
Name Value
Content-Security-Policy require-trusted-types-for 'script';report-uri https://csp.withgoogle.com/csp/docs-tt base-uri 'self';object-src 'self';report-uri https://docs.google.com/spreadsheets/cspreport;script-src 'report-sample' 'nonce-noFiWEUT2mJevkbagpZE3A' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';worker-src 'self' blob:
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.darkreading.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0
sec-ch-ua-platform
"Linux"

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
no-cache, no-store, max-age=0, must-revalidate
content-encoding
gzip
content-security-policy
require-trusted-types-for 'script';report-uri https://csp.withgoogle.com/csp/docs-tt base-uri 'self';object-src 'self';report-uri https://docs.google.com/spreadsheets/cspreport;script-src 'report-sample' 'nonce-noFiWEUT2mJevkbagpZE3A' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';worker-src 'self' blob:
content-type
text/html; charset=utf-8
date
Wed, 09 Sep 2026 00:42:01 GMT
document-policy
include-js-call-stacks-in-crash-reports
expires
Mon, 01 Jan 1990 00:00:00 GMT
origin-trial
AjyTYHf8xEAhAVTh+xijZ3UXTXlMphOHFXjhD3+Actoe+f2FNuWk3attcE3NSlrBekTItGxJqARYCSiIONcWXgYAAABveyJvcmlnaW4iOiJodHRwczovL2dvb2dsZS5jb206NDQzIiwiZmVhdHVyZSI6IkNyYXNoUmVwb3J0aW5nU3RvcmFnZUFQSSIsImV4cGlyeSI6MTc3NjcyOTYwMCwiaXNTdWJkb21haW4iOnRydWV9,AqC/Qix3G13EOijgi8REB7561k6Amd5kUmmrICdsJGTmoxbSslCnhfyf16w1cyZdM9ymZNS1akp9kP2jx65eTgoAAAB1eyJvcmlnaW4iOiJodHRwczovL2dvb2dsZS5jb206NDQzIiwiZmVhdHVyZSI6IldlYkFzc2VtYmx5Q3VzdG9tRGVzY3JpcHRvcnNWMiIsImV4cGlyeSI6MTc5MzY2NDAwMCwiaXNTdWJkb21haW4iOnRydWV9
p3p
CP="This is not a P3P policy! See g.co/p3phelp for more info."
pragma
no-cache
referrer-policy
strict-origin-when-cross-origin
reporting-endpoints
default="/spreadsheets/d/e/2PACX-1vQsygsynrhlYSFLOwZ9IaqURE4cQ3rGo07MkUiECTl3zXlINi_MWVmfxgjSgmvPhGmk0kPdS8DBzkoj/web-reports?bl=editors.spreadsheets-frontend_20260902.00_p5&context=eJwV1WdYFFcXB_Bhd-YcygILy9JZll3KLtIRsWABVEAjiDEu0USjYu8C1misWLF3Y8eKNWo0tkSNvaHGjlEiVQRBASkC7__98HvOPP9z7537YZ4zlrltdpibhCNWJuGkwiQstzYJe5Qm4Ts7k6CxNwl-apPwN_zpahIc3ExCoMYkZEOq3iRc8jUJjf4mwTrAJLQKNAlrgkxCZqhJ2BhuErZCcTeTUJeAM1JMQiTk9jcJb0E7xCS0HmMSukLVNJNgNt0kPJ9jEkogZ5NJOA_995gEx1yT4As5z5BBhpgiLIRgyxShM7QoUwRbuxThr_YpQi4MiEoRxkBWYoqwDcKnpgix8Eb9UAjzL5O1hydXq2Sv4VX-J9k7eB30WVYI1j0_y9RQE1oja4Lu8TWyRPh2Xo1sAAwb80U2Dk5H1ckuQvfhdbJE8FxWJ_ODxzPqZa9g6e162RoIza2XtYMk-waZCV7Pa5AVwv2dDbKnIBvQLLMEjdAi84U57i2yxXB2WovsLzhpK8jPgyxfkFtC4W4zed0eM7mQbSaXXZPJ1xnk8l_hcV-5_BWsnCuXb4Rei-TyFJhRKJfPg2hLUW70EuWhsPxje3EdfEmKEq9vjBLvQ83hKLEJ6iI7ikLbjmLRxo5iFcwe1UXMhCvu0eJtUCdEi1p43SNaLISaddFiE4yOiREng_znGNEKjjvFimfBNzlWDIJlU2LFtVBxLFashSenY8UuhbGi4UBXMQTufewqPoFyqIE2lV3FThANCTAHFsMNeADWVV1FNXiBEb4Z3U3sCxmTuomzYPuabuI-UFzqJjrAlBvdxL-Kuok3oWtEd_EbyB3fXXwLg-rixBFwXh0v9hkTL_aHjaoEcQc0OSeI5i4J4k7uIR6AAUk7pKt9dkh34OpIVDgwaod0Fhaf2SGtAv8OO6U1b3ZK9Z93SmbVO6UzcAOCBu6SHjvskV7BLKc9Uhas_rhH2gxFY7OlClBNzZb0EA3JEFOQLfWA8el7pSngsXCv5AM98_ZKAyDSa58UmLhPioAFF_dJK6HD4P1ST3gtHJDKQfI8IFlD3vcHpAKwOXxAcoTtpYekfbAgMEdaCRY9cyQ7CE3MkdrBwvU5Uhb0v3pYGg2ZQ49KKyBnynvpJMSteC-F3C6T2kLYyzLpyqsy6TaYd_4gKeHcHx-kK-B55YPkB0dSyqXTULu5XGqG-VvKpWUg7W2RGL5vsKKBkDteQc9BWqCgM1sVdAG2_aqg3bD1gIL2wHNba3oLitPW5AD2Z63JFZJKrckEaWXWNA2mXrOhX-DFcFvy2WFLgaB3VVIr0PRWUu5BJT2B-YeUtBhuvVDSfZD725EVJHRBPWlHKjjw0I7OQlI3ezLBL4PtaRHMPmpPmTAz1572wAsvFeVDrb-KmuFyoIqGRqpoDDi3VZEWWg1RUTjoHqrIH4Y9VpHTKQfyg3N5DnQFynupqQbcp6vJG-7PUNNTsM9Rkyvwbkeyhc2vHGkX3MhzpAcQVuNIMZCocaJ-oBnrRL4wbooTzYKf1jrRSEj76ERBgjO1gcFaZxoFeUecqQC63HSmeBj70pnSoWS3C1WCfR9XcoKMX1xpFgxd6kpj4OcYN1oAuavc6DmY93Ana-j4tzt1A9s8d3IA39fu1Ape_-BBhXBqtgdVZHnQZ5DWepAaujz1oHh4LNeQNlhDPvAxUUPVML23hmaD-UENWUP8IQ31guDDGlr3UkObYWuehnaCS5WGNBD0SUPhsH6AJ_0625N2wSu5lt5CMWnpIyxpo6XV0LG_lrpB5SAt1UHLKC0t26ylvvu1NBo6_aGl7nDsppbOgG-tltrAlLleNBsi13tR5__b40VxkJzvRd_DyAAdTYSQYB21hR_jdDQEjmXq6AzELdFREvyyU0eL4Od7OpoLve7rqA_Mg0Uw7oGOJsNW2Al9cnVkgtwPOnoLPh31FAiqDD25geUMPdnCMBgNS2fqaSWs-FlPa0H_RE-tIK5OT0mwwtybtsMkW1-aC6u8fWkT2Jh8yRE8XviSDxQs8KNSGC0aaDIskQy0GrzZQAEw28ZAmVCiNFA57LAzUDbsjDTQcXgw20D_wKvdBnoHx58a6CxsKTLQbvgppT1NhJtCB1p7uANthdknOtB8KIUKuPRbB7oKt092oAdQnBiF7ySKbkyKogfwdnYUFcH5G1F0B_4rjKL3ULC-I32AVKETpUPjkk4kX9qJtlp0pj1gq-lMnnA3qjPlwfvenakBEvd3poGw6O8utBL6Z0XTaNBtiyZ_uJwbTbfA4n002cGqnBhyGRdLXmBIi6UQKJ8aSzWwc14sHYAtK2PpEFwqiaX7cIK60mXYpu5Ke-FFUlfKh08VXakBmu27E6m608w53Wk-RE2Mo2gwy4gjCyjKiaMKKLgTRx_g2fM4egPx-XHUG1K-xtGDoHh6Bn5v4ykYDoxOoLPgt-o_CoDOxe8oCXw-vqNAuKQroOvQ3LuAKLmAPsIXmDipgDLgbUkBFUKv0gLqAzdrCugBaOoLyBcqAouoGqYlFNEcyDpYROthTU4RbYGH8AIuVxTRdajtWUzN4JFUTD7wNq2YKiH1dDGlQ8GZYiqFv-8V010ov19MNTByUQmNA-XmEtLCxewSugYvL5bQG6ArJWQDYz6WYPaVUPfdpdQPeuaWUjLcr39PT2GeXRkthVmhZTQfKkaW0eNJZfQOti8oo6Mg6_OBLOHhmQ_0AtbHl9M2eJxUTi9BN7yc_GFGZjnNg-nPy2ku1JaVUzO8iKqgfMhJqaDzYDhTQd-Ef6RksF_8kXqd-kjfwaSOldTwYyXJBlaSanglucGh-ZW0Ma-Syt9W0nfmVRTSuorYVEVmKVX0KK2K_oOc9VWk2FRF356oovWnkd2oomJY9LqKsmCG-InU0icaG_WJ0uH1N5_o7uhPdOfIJ8qFZIfPND_5My2DokGfKXHIZwpRVZNpRjW9nllNDw9W0zMoPV5NVdDnajVNg25l1ZQA7YJqqDPEQS_4DgbAUBgFk2Aq_AIL4d3qGiqDO2trKBeu36qhuxBYUkNhMKqihibAVJgFC2EZZMEa2AX74RichisNNXQDrjyvpRswt6KWMuHJ51p6CR3VXygWdg38Qq1GfKELs77QVbCs-UJWXEfXFXXk5lFHXXR1NLOhjuZDnqyeCmCDWE_bQXSpJwWETq6ndnDnWD11Ol5PXSD-eT31hjYv66k9fFjUQNY5DRRwuYGaAhpJDGykC1GNdAVeDWikS9Ma6SosmNNIy8E-q5Gc4cG9RnoCkY8a6fNvX6kRhuR_pRX_faXtsEHdRNsha3ATrYfLvzbRdUjb30QzofZUEzXDvUdN9AgaWppIJjSTTN5MlpAU1kwmUGU0kwvMXNFM82DthWbaDCH5zdQG_KQWCoTjmhaKC26hXrBwVQsthZ8-tdBweBor8L8waoHA4-FWtcAPYW29wFthncmMN4LjQDO-tduMH8KN62asvWnGS9rLeAUMz5TxGMg_JWO32zL2gsQKGdc5yHmaWs6zQOEkZweoc5Gz4Crndjo5J0D6dDn_DCdPy1lrLXK5TuQbySLfA7tUkV2gbqbIg-aJ_Odaka-B1WX0IPKByF3hMLx_KLL2H5HN3SUe00bigT9LPBwu_yfxDfDrQRwAhf2IyyDjN-IZcOoT8QXoP5N5EFSpzLkWbsab8z3I6m_O2yBjoDnPgr3TzPkgrJttzh0yzbnNKXPu9tmcd3015_1Q0tqCyyEj0oJnxVvwAhgx2oLHQWOOBZe8sOAKuN5gwXfgiIUln4b-7Sx5CKT9YMnTIWWmJf8IEVmW3BE-X7TkOjD_y5KVkFpsyWPgDjyEdSWW3MvXiscYrfhSNyu2TrRiFfj1teLF66x4BYy_ZMVpcPeOFT-EpQVWXFVhxfWwRqbgTbDfT8HHwDdcwQGwpLWCR_RUsOtYBUdOUHAULE9X8FoQ9io4ARLB_aKC7z5W8D_g24K90Braw6N4a34GpmRrHgH6ldZshPwr1nzumTUr_rVmawiASMmG46DKxYatfWxYBcG-NtzLz4a_A3d_G_YGfUcb_nGPDdc9teEmsPlkww4Qa2fLCXByqC1nbLDlBYW2vBzq1Uqu1yq5BX5PUvKhFCXLRyjZAiomKrkaLmYoOX2OkqeDz14lBxxQchC0u6fkaFjxTMnrobNkhzvacUmwHVfD6FA7ngwz-tjxHBjWz45jh9hxPPy2y47PwIljdvwH7Dhlx7_Y2PMiuOlhz49hkcGeN8Lohfb8ZLk9v4SJK-05A079ac8rrtvzOhDq7FmCRzNV3He_ir-H8ZdVnA4tN1R8kx049_8mOfAPGQ48GK4tceB7sGo1sjUO3HunA1ccduBqOHvMgY_eceBToHjpwCsLHXhPsQPrndUcDkpPNatB46Xm1RFqdm-DZ9CCDrzBFwzgDwEQAt_Gqfn3jWpuyFVzxWM1Z1s4sqatI-uh5zhHTgbjIUcOhcOXHbnxpSObvXLkQJUTR4Ai3IkdYFusE--G-hQnVs9y4rxHTpwP6Y1OPAOUemd2hmdJzlwMswc4cyb4DnXmIBh81JmHQ-h5Z7a55MyO8PaWM7-H8jfOPKTAmUeC0xdndoe0emeeCUObnPmQ1oWXh7tw5VAXFlJdeOQ4F54xzYXnwZpzLpx00YUXVGINWDW48PooV-7U25WjIRbKB7qyYZgrB4Jbpisv2-_K-qPIwOWYKxuh_WlX7gwW11zZBjL_c-UV8K7KlUuhX60r_wCzmlx5F5zQu_HvcMTfjY_BCTgJp-EMXApw4w9D3bgK4se6cS-YmO7GX7a6cdYJN6685cZ1cOG-G29rceMYV3fuA5GB7tzx_6LcOQYyY915A5yLc-c_IXGZO38LUXvcuSuse-_OA8vceSi0cvTg83oP_guS23nwYIia6cExoJnrwd4QstuDu-z14N7Q9MiDl5Z48Cp4p9bw6hANb4A6aILVP2n4tzQNn4NBWzQ8DC78ruHSPzRcAVfPafgmTPlLw7NhUL6GU8H_q4ZrLT25GY4YPPkivI705HG9PDkD9vXx5KMQM9iT4yBmiCf3gf5TPXkQjD3vyeYPPNkaxr_y5CkgvEMGMaKWkyEFRum0PAGmwiwY2V7LXSdo-RsYP1HLWydpeRfkbdLyO8i_puUiGPdAyxvBKVfLDs-17A7DX2l5DOx4q-X94FepZUdzL9bAPJUXLwa5txczlAZ48UfID_biInCL82ItaBK8OAQS53ixfpsXGyG4xosj4WCQjo9DUpiOTbCqo47zO-nYLVbHXiCfr2MV7Fqg44PQJVPH8aDcoGM1OMOgYh3-NTrWu-u5FYT763n0SD1PgLzJeq6AGQv1XJ6l5xrotEnPyi16_ilbz9dL9Zyq9OaxkGbvzQ9V3qxTe7M_PHBH5uvN06AwyZtXjfDm9fB6pzff3OvN9-HiY2--AuX_IHvjzc_By9yHQ-FAlA8fgexEH04d6cPpIPzpw-ZgDeWPfLgGFjf7cBb0Z18eBOn-vjwFbCN82avAl9tZ-rGl0Y_tYUKQH08Fwwg_bgu1Y_x4yyQ_3gHP7vnxG5D9g_VwJMjAJ8Em2MBDQgw8EromGTgB_l1p4HdQ-puB6_MM3AK1BaggFhr4dwsjX4C_4TY8gudwN9zID-Ex7Ght5GyY2MHIU2EmLIMVUUbMGiPrOhm5NQyAwfBhkpGrQJFhZDvYsMDIW6F4OXpg2GbkQFiXbeRfIeeCkU9C8CUjR4LstpHNwfTMyD_ArTwj3yjFnaB_tZEHgXWDke1hkpU_j1X588_wbpI_l2X4cyP0neLPqXBnrj8_gleQD4WL_bkG5mzy59un0YOnr_25CNq99edOkPgF-2HNV3_eAqN8W_HcNq34fXQr_gi3x7XiB5A8vxWfyW7Fs3oEcMD8AI6Ct40BnNUSwOthjVMg34oL5PvQdkUgd4Lu8A30hf7wAwyG0TABZsMCWA5rYAvshJTfA3kgZJ8L5A5_B3IXePRvIFeZB7GZRRBLyiBuMqL6B_GFCUF8FT6sC-JqUFgEszucDQnmqz2D-cW8YH4Dv94L5oIXwVxTFMxNMMIYwuNgTUwIbwRpfAgroPv8EO4J4Wah3B5CvUO5DbgHhXIAPI0MxXwL5Y3tQ_koDEgO5X9NoVwIi1JCeQksg-WwElbDtyNCeeSGUB4P63JDObU0lMeA2YdQZqisDOWrX0L5Joz6ivc5hnF3aAkPY7F1GFdCHURFhnEsmHUIY4KkzmH8EwyMD-OhMBYmweDhYTwKZjwN43Yvw7gT1L8P42b4rjyMh0G_gHAeAKagcN4VHs7r24bzVnA4Fs4aSIfp0FgZzmZV4XwBLoPpczj_CN07tWaPTa1ZB2O9I3gyNMdEMMdG8MEeEZy2MoJnwP21Ebx3ewQ_PRjBeVB6P4IrIPZlBMfDPlUbzgF7hfmLp_OekLIue89zM1e73hlDxo5KGzksNT593Nh-o4ZN1QUMSx2VPmFyWlDaxMnDBqeiNyw9LXD45Anj04eNTx0UFhLWJqRdSFhQSMigiRH_A_ZeNw8&build-label=editors.spreadsheets-frontend_20260902.00_p5&imp-sid=CIqB1fSh4JYDFSHqzgAdYy8Qxg&is-cached-offline=false&cellSizeBucket=RITZ_SHEET_CELLS_50K_TO_100K&wcrumsspbp=true"
server
ESF
x-content-type-options
nosniff
x-l2-request-path
l2-managed-6
x-robots-tag
noindex, nofollow, nosnippet
x-xss-protection
0
GET

pubhtml
docs.google.com/spreadsheets/d/e/2PACX-1vQsygsynrhlYSFLOwZ9IaqURE4cQ3rGo07MkUiECTl3zXlINi_MWVmfxgjSgmvPhGmk0kPdS8DBzkoj/ Frame E849
0
0


GET
H2
200
pubhtml Show response
docs.google.com/spreadsheets/d/e/2PACX-1vQsygsynrhlYSFLOwZ9IaqURE4cQ3rGo07MkUiECTl3zXlINi_MWVmfxgjSgmvPhGmk0kPdS8DBzkoj/ Frame DA69
80 KB
26 KB
1002ms
910ms
Document
text/html
142.250.217.14
Google LLC
General
Full URL
https://docs.google.com/spreadsheets/d/e/2PACX-1vQsygsynrhlYSFLOwZ9IaqURE4cQ3rGo07MkUiECTl3zXlINi_MWVmfxgjSgmvPhGmk0kPdS8DBzkoj/pubhtml?gid=1145058527&single=false&widget=false&headers=false&chrome=false
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/cyberattacks-data-breaches/attackers-multi-hop-google-redirects-phishing-campaign
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.217.14 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
pnlgaa-as-in-f14.1e100.net
Software
ESF /
Resource Hash
7dc7de8e1e174ef601b8663e87c1f5f8e5730d425674999caaa35ca80a4d6298
Security Headers
Name Value
Content-Security-Policy require-trusted-types-for 'script';report-uri https://csp.withgoogle.com/csp/docs-tt base-uri 'self';object-src 'self';report-uri https://docs.google.com/spreadsheets/cspreport;script-src 'report-sample' 'nonce-pR7jrkvpgic1MS4O_I3rtw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';worker-src 'self' blob:
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.darkreading.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0
sec-ch-ua-platform
"Linux"

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
no-cache, no-store, max-age=0, must-revalidate
content-encoding
gzip
content-security-policy
require-trusted-types-for 'script';report-uri https://csp.withgoogle.com/csp/docs-tt base-uri 'self';object-src 'self';report-uri https://docs.google.com/spreadsheets/cspreport;script-src 'report-sample' 'nonce-pR7jrkvpgic1MS4O_I3rtw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';worker-src 'self' blob:
content-type
text/html; charset=utf-8
date
Wed, 09 Sep 2026 00:42:02 GMT
document-policy
include-js-call-stacks-in-crash-reports
expires
Mon, 01 Jan 1990 00:00:00 GMT
origin-trial
AjyTYHf8xEAhAVTh+xijZ3UXTXlMphOHFXjhD3+Actoe+f2FNuWk3attcE3NSlrBekTItGxJqARYCSiIONcWXgYAAABveyJvcmlnaW4iOiJodHRwczovL2dvb2dsZS5jb206NDQzIiwiZmVhdHVyZSI6IkNyYXNoUmVwb3J0aW5nU3RvcmFnZUFQSSIsImV4cGlyeSI6MTc3NjcyOTYwMCwiaXNTdWJkb21haW4iOnRydWV9,AqC/Qix3G13EOijgi8REB7561k6Amd5kUmmrICdsJGTmoxbSslCnhfyf16w1cyZdM9ymZNS1akp9kP2jx65eTgoAAAB1eyJvcmlnaW4iOiJodHRwczovL2dvb2dsZS5jb206NDQzIiwiZmVhdHVyZSI6IldlYkFzc2VtYmx5Q3VzdG9tRGVzY3JpcHRvcnNWMiIsImV4cGlyeSI6MTc5MzY2NDAwMCwiaXNTdWJkb21haW4iOnRydWV9
p3p
CP="This is not a P3P policy! See g.co/p3phelp for more info."
pragma
no-cache
referrer-policy
strict-origin-when-cross-origin
reporting-endpoints
default="/spreadsheets/d/e/2PACX-1vQsygsynrhlYSFLOwZ9IaqURE4cQ3rGo07MkUiECTl3zXlINi_MWVmfxgjSgmvPhGmk0kPdS8DBzkoj/web-reports?bl=editors.spreadsheets-frontend_20260902.00_p5&context=eJwV1WdYFFcXB_Bhd-YcygJLWTrLsktbehGxYKEo2ECNyaImGhUbdgFrJBbEir0bew_2Eo0tltgVUGPHKJEqgqCgFIH3_374PWee_5l7Zz7c51zTsrY7jA3CETODcEphELLNDcIepUH43sogqK0NgrfKIPwNfzkZBCdngxCgNgh7IVlnEC57GYQmX4Ng7m8Q_AIMwppAg5AVYhA2hhmErVDazSDU98AeSQYhAvIHGYS3oBluENqMMwixUDPDIBjNNAjP5xqEMsjZZBAuwKA9BsEu3yB4Qc4zZJAuJgkLIcg0SegCrcokwdIqSbjSIUnIh8GRScI4yE5IErZB2PQkIQbeqB4Kob4Vsg7w5HqN7DW8KvwkewevAz_LisG812eZCupC6mTN0D2-TpYA382vkw2GkeO-yibAmch62SXoPqpelgBuy-pl3vB4VoPsFSy92yBbAyH5DbL2kGjdKDPA6_mNsmLI3dkoewqywS0yU1ALrTIvmOvSKlsM52a0yq7AKUtBfgFkhYLcFIp3G8nr9xjJhb1GctkNmXydj1z-GzweIJe_gpXz5PKN0GeRXJ4Es4rl8vkQZSrK9e6iPASWf-wgroOviZHizY2RYi7UHY4Um6E-opMotOsklmzsJNZAxtiuYhbcd4kS_wFVjyhRA697RonFULcuSmyGlOhocSrIf4kWzeC4fYx4Drz6xYiBsGxajLgWqo7FiF_gyZkYsWtxjOhzMFYMhgcfY8UnUAl10LY6VuwMUdADlsIauAV5YF4TK6rAHfSwELKhd0o3cQCkT-kmzoHta7qJ-0FxuZtoC9NudROvlHQTb0NseHexN-RP7C6-haH1ceJouKCKF_uPixcHwUabHuIOaHboIRo79hB3ck_xIAxO3CFd779DugfXx6DCwbE7pHOw-OwOaRX4dtwprXmzU2r4vFMyqt0pnYVbEDhkl_TYdo_0CubY75GyYfXHPdJmKBm_V6oCm-l7JR1EQT-ILtor9YTktH3SeHBduE_yhF4F-6TBEOG-XwpI2C-FQ-al_dJK6DjsgNQLXgsHpUqQ3A5K5lAw8KBUBBaHD0p2sL38d2k_ZAbkSCvBpFeOZAUhCTlSe1i4PkfKhkHXD0spkDXiqLQCcqa9l05B3Ir3UvDdCqkdhL6skK69qpDugnGXD5ISzv_5QboGbtc-SN5wJKlSOgNfNldKLbBgS6W0DKR9rRLDd41mlAT5ExX0HKRMBZ3dqqCLsO03Be2GrQcVtAeeW5rTW1CcMSdbsD5nTk6QWG5OBkitMKcZMP2GBf0KL0ZZkucOSwoAnZOS_EDdV0n5h5T0BBb8rqTFcOeFknJB7mtFZtCjK-opK7KBgw-t6BwkdrMmA_w6zJoWQcZRa8qC2fnWtAdeuNtQIXzxtaEWuBpgQyMibGgcOLSzIQ34DbehMNA-tCFfGPnYhuxP25I3nC-wpWtQ2UdFdeAyU0UekDtLRU_BOkdFTsC77cgSNr-yo11wq8CO8iC0zo6iIVZtT71BPd6evGDCNHuaAz-vtacxkPrRngIFB2oLwzQONBYKjjhQEXS97UDxMP6lA6VB2W5Hqgbr_k5kD-m_OtEcGLHUicbBL9HOlAn5q5zpORj3dCFz6PS3C3UDywIXsgWv1y7kB69_dKViOJ3hSlXZrvQZpLWupIKuT10pHh7L1aQJUpMnfExQUy3M7KumDDA-pCZziP9dTX0g6LCa1r1U02bYWqCmneBYoyY1BH5SUxisH-xGv2W40S54JdfQWyglDX2EJW01tBo6DdJQN6geqqF6aB2roWWbNTTggIZSoPOfGuoOx25r6Cx4fdFQW5g2z50yIGK9O3X5vz3uFAf9Ct1pIIzx19JkCA7SUjv4KU5Lw-FYlpbOQtwSLSXCrzu1tAh-eaCledAnV0v9YT4sggl5WpoKW2En9M_XkgHyP2jpLXh20lEA2KTryBlMZ-nIEkZCCiydraOVsOIXHa0F3RMd-UFcvY4SYYWxB22HyZZeNBdWeXjRJrAweJEduL7wIk8oyvSmckgRfWgqLJF8aDV4sA_5Q4aFD2VBmdKHKmGHlQ_thZ0RPnQc8jJ86B94tduH3sHxpz50DraU-NBu-DmpA02G20JHWnu4I22FjBMdaQGUQxVcPtmRrsPdUx0pD0oTInFOIunWlEjKgxcZkfQGLtyKpHvwX3EkvYei9Z3oAyQLnSkNmpZ0JvnSzrTVpAvtAUt1F3KD-5FdqADe9-1CjZBwoAsNgUV_d6WVMCg7ilJAuy2KfOFqfhTdAZP3UWQFq3KiyXFCDLmDT2oMBUPl9Biqg53zY-ggbFkZQ7_D5bIYyoUTFEtXYZsqlvbBi8RYKoRPVbHUCC3W3YlsutPsud1pAUROjqMoMEqPIxMoyYmjKii6F0cf4NnzOHoD8YVx1BeSvsVRXmA8PQPvt_EUBAdTetA58F71H_lDl9J3lAieH99RAFzWFtFNaOlbRNSviD7CV5g8pYjS4W1ZERVDn_Ii6g-364ooD9QNReQFVQElVAszepTQXMg-VELrYU1OCW2Bh_ACrlaV0E0QepeSMbgmlpInvE0tpWpIPlNKaVB0tpTK4e8HpXQfKnNLqQ7GLCqjCaDcXEYauLS3jG7Ay0tl9AboWhlZwLiPZZh9ZdR9dzn9AL3yy6kf5Da8p6cw36qClsKckApaAFVjKujxlAp6B9szK-goyPp_IFN4ePYDvYD18ZW0DR4nVtJL0I6qJF-YlVVJ82Hm80qaB18qKqkFXkRWUSHkJFXRBfA5W0W9wz5SP7Be_JH6nP5I38OUTtXU-FM1yYZUk82oanKGwwuqaWNBNVW-rabvjWsouE0NsaGGjJJq6FFqDf0Hh9bXkGJTDX13ooY2n0F2q4ZKYdHrGsqGWeInUkmfaHzkJ0qDV70_0f2UT3TvyCfKh-9tP9OCfp9pGZQM_UwJwz9TsE0tGWbV0uvZtfTwUC09g_LjtVQD_a_X0gzoVlFL8dA-sI66QBz0ge9hMIyAsTAFpsOvsBDera6jCri3to7y4eadOroPAWV1FApjq-poEkyHObAQlsFa2Ay74AAcgzNwrbGObsG151_oFsyr-kJZ8OTzF3oJnVRfKQZ2DflKfqO_0sU5X-k6mNZ9JTOup5uKenJ2raeu2nqa3VhPC6BA1kBFsEFsoO0gOjaQAkKmNlB7uHesgTofb6CuEP-8gfpC25cN1AE-LGok85xG8r_aSM3-TSQGNNHFyCa6Bq8GN9HlGU10HTLnNtFysM5uIgfIe9BETyDiURN9PvmNmmB44Tda8d832g4bVM20HbKHNdN6uPpbM92E1APNNBu-nG6mFnjwqJkeQWNrM8mEFpLJW8gUEkNbyAA26S3kCLNXtNB8WHuxhTZDcGELtQVvqZUC4Li6leKCWqkPLFzVSkvh50-tNAqexgj8L4zNFHgi3KkV-CGsbRB4K6wzGPFGcBpixHd2G_FDuHXTiN1uG3H3ZiNe0kHGK2BUlozHQeFpGTvflbE7JFTJuN5WzjNUcp4DCns520K9o5wFJzm318q5B5w6I2c3c5ErtSLf6ifyA7BKFtkR6meLPHS-yH-tFfkGmF1FDyLyRI6Fw_D-ociaf0Q2dpF4XFuJh_wi8Si4-p_Et8C7J7E_FP9AXAHpJ4lnwelPxBdh0GzmoVBjY8xf4Ha8MT-A7EHGvA3ShxjzHNg3w5gPwboMY-6YZczhp42522dj3vXNmA9AWRsTroS0CBOeE2_CmTA6xYQnQFOOCZe9MOEquNlowvfgiIkpn4FB7U15OKT-aMozIWm2Kf8E4dmm3Ak-XzLlejC-YspKSC415XFwDx7CujJTTvAy43F6M77czYzNE8zYBrwHmPHidWa8AiZeNuNUeHTPjJ_B0iIzrqky4wZYI1PwJjjgreBj4BWmYH9Y0kbBo3sp2Gm8giMmKTgSlqcpeC0I-xTcAxLA5ZKC7z9W8D_g1Yq10AY6wKN4c34Ghn7mPBp0K81ZD4XXzPnsI3M-_8ycFf-aswX4QzvJguOhxtGCzT0t2AaCvCy4j7cFfw8uvhbsAbpOFlz_1IKbweKTBdtCjJUl94BTIyw5fYMlZxZb8nJoVCm5QaPkVvgjUcm_JylZPlrJJlA1Wcm1cCldyWlzlTwTPPcp2f-gkgOh_QMlR8GKZ0peD10kK46DsiArroWUECueCrP6W_FcGPmDFccMt-J4OLnLis_CiWNW_CfsOG3Fv1pY8yK47WrNj2GRjzVvhJSF1vxkuTW_hMkrrTkdTv9lzStuWvM6EOqtWYLc2TY84IAND4SJV204DWS3bfg223I-5E2x5R_TbXkY3Fhiyw9g1Wpka2y5705brjpsy7Vw7pgtH71ny6dB8dKWVxbb8p5SW9Y5qDgMlG4qVoHaXcWrw1Xs0hbPoAEteIAX-IAv-EMwfBen4j82qrgxX8VVj1W818SO1e3sWAe9JthxP9D_bschcPiqHTe9tGOjV3YcYGPP4aAIs2db2BZjz7uhIcmeVXPsueCRPRdCWpM9zwKlzoEdYAs8S3TgUsgY7MBZ4DXCgQNh2FEHHgUhFxzY4rID28HbOw78HirfOPDwIgceA_ZfHdgFUhsceDaMaHbgHI0jLw9z5OoRjiwkO_KYCY48a4Yjz4c15x058ZIjZ1bjHTBrdOT1kU7cua8Td4VoqBzixD4jnTgAnLOcePkBJ9YdRQaOx5xYDx3OOHEXMLnhxBaQ9Z8Tr4B3NU5cDslfnDgF5jQ78W44oXPmP-CIrzMfgxNwCs7AWbjs78wfRjhzDcSPd-Y-MDnNmb9udebsE85cfceZ6-FirjNva3XmaCcX7g8RAS7c6f8iXTgasmJceAOcj3PhvyBhmQt_B5F7XDgW1r134SEVLjwC_Oxc-YLOla9Av_auPAwiZ7tyNKjnubIHBO925W-PXHlpmSuvgncqNa8OVvMGqIdmWP2zmk-mqvk8DN2i5pFw6Q81l_-p5iq4fl7Nt2HaFTVnwNBCNSeD3zc1fzF14xY46uPGl-F1hBtP6OPG6bC_P3KIHubGcRA93I37w6DpbjwUxl5wY-M8NzaHia_ceBoI75BBtKjhfpAEY7UangRTYBqM6aDh2Eka7g0TJ2t46xQN74KCTRp-B4U3NFwCE_I0vBHs8zVs-1zDLjDqlYbHwY63Gj4A3tUatjN2ZzXMt3HnxSD3cGeGcn93_giFQe5cAs5x7qwBdQ93DoaEue6s2-bOejB_5s5Bde4cAYcCtXwcBoZqeRis7KTlws5ado7RsjvIFmjZGnZlavkQdM3ScjwoN2hZBY4wtFSLu0bLOhcd-0GYr45Txuh4EhRM1XEVzFqo48psHddB5006ttqi45_36vhmuY6TlR48HlKtPfihjQdrVR7sC3kuyLw8eAYUJ3rwqtEevB5e7_Tg2_s8OBfOPvbgi_DhH2RvPPg5uBt7cggcjPTkI7A3wZOTx3hyGgh_ebIxmIPyiieroPKRJ9fB4hZPzoZB7MVDIc3Xi6eBZbgXuxd5cXtTbzbVe7M1TAr05ungPdqbI-DLOG_eMsWbd8CzB978BhT_eLMtHAn04VNgEeTDw4N9eAzEJvpwD_h3pQ-_g_KTPtxQ4MOt8KUIFcRiH_7DRM8X4W-4C4_gOdwP0_NDeAw72uh5L0zuqOfpMBuWwYpIPeaNnrWd9dwGBsMwKJmi5wqgdD2bwYZMPW-F0uV6_gA-2_QcAOv26vk3yLmo51PQ_rKeo0B2V8_GYHim5x_hToGeb5Xjn2BArZ4Hgnmjnq1hipkvj7fx5V_g3RRfrkj35SYYMM2Xk-HePF9-BK-gEIoX-3IdzN3ky3fPoAdPX_tyCbR_68udIeEr1sOab768BcZ6-fG8tn78PsqPP8LdCX6cBwMz_LjfAj_-c68fz-npz_4L_DkS3jb5c3arP6-HNfYBHBEXwHcgF9qtCODO0B16wwAYBMNhDKTAJMiATFgOa2AL7ISkPwJ4COw9H8Ad_w7grvDo3wCuMQ5kI5NAlpSB3KxH9Q3ki5MC-Tp8WBfItaAwCWIXOBccxNd7BfGL-UH8Bn57EMRFL4K4riSIm2G0PpgnwJroYN4I0sRgVkD3BcHcC8KMQrgDhHiEcFtwCQxhf3gaEYKZF8IbOoTwURjcL4T_NYRwMSxKCuElsAyWw0pYDd-NDuExG0J4IqzLD-Hk8hAeB0YfQpihpjqEr38N4dsw9hu-ZxfK3aE1LJTFNqFcDfUQGRHKMWDUMZQJEruE8s8wJD6UR8B4mAIDRyGHmU9DOexlKLeDhveh3AI_VIbyKPjBP4wHQ1JgGO8PC-P17cJ4K9geC2M1pMFMaKoOY6OaML4IV8HwOYx_gu6d27DrpjashVSPcJ4JLdHhzDHhfKhnOKeuDOdZkLs2nHdtD-enh8K5AHJPhnN5bjhXQczLcI6H_TZtOQeszYxfPp3_hJS3F621drLqmz58_NjUMSOT49MmjP9h7MjpWv-RyWPTJk1NDUydPHXksGT0RqalBoyaOmli2siJyUNDg0PbBrcPDg0MDh46Ofx_a9Q73A&build-label=editors.spreadsheets-frontend_20260902.00_p5&imp-sid=CNjc9vSh4JYDFeONWQQdiLglRg&is-cached-offline=false&cellSizeBucket=RITZ_SHEET_CELLS_50K_TO_100K&wcrumsspbp=true"
server
ESF
x-content-type-options
nosniff
x-l2-request-path
l2-managed-6
x-robots-tag
noindex, nofollow, nosnippet
x-xss-protection
0
GET
H2
200
DarkReading_CommemorativeLogo_Horizontal_Color.svg
eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt230dd3db8101173b/69efb479be3c031b8592eb73/
12 KB
5 KB
44ms
37ms
Image
image/svg+xml
104.17.160.85
Cloudflare
General
Full URL
https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt230dd3db8101173b/69efb479be3c031b8592eb73/DarkReading_CommemorativeLogo_Horizontal_Color.svg?width=476&auto=webp&quality=80
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/cyberattacks-data-breaches/attackers-multi-hop-google-redirects-phishing-campaign
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.17.160.85 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
45358ab134126981ee0d682a81f911b31b01c5436c77aa4f57c9dce33567e4d0
Security Headers
Name Value
Content-Security-Policy default-src 'none'; navigate-to 'none'; form-action 'none'; img-src data:; style-src 'unsafe-inline';
Strict-Transport-Security max-age=31557600

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

x-request-id
439b7ed8-fc9c-4ab3-a25d-4246f0f54ac2
access-control-expose-headers
*
surrogate-key
blt6d90778a997de1cd.sys_assets blt6d90778a997de1cd.sys_assets.blt230dd3db8101173b.download
cf-cache-status
HIT
etag
W/"cfFT3pZSK5id0O4nSUp_yyHk7p-vldJ1kirhc017RfDQ"
age
2503399
cache-tag
blt6d90778a997de1cd.sys_assets blt6d90778a997de1cd.sys_assets.blt230dd3db8101173b.download
cf-resized
internal=ok/h q=0 n=11+0 c=0+1 v=2026.8.2 l=12087 f=false c2=0 wv=2026.9.0
x-api-key
blt6d90778a997de1cd
access-control-allow-methods
GET,HEAD,PUT,PATCH,POST,DELETE,OPTIONS
content-encoding
br
x-cache
HIT, HIT
date
Wed, 09 Sep 2026 00:42:01 GMT
content-type
image/svg+xml
content-disposition
inline; filename=DarkReading_CommemorativeLogo_Horizontal_Color.svg
x-runtime
94ms
last-modified
Wed, 05 Aug 2026 02:33:23 GMT
x-contentstack-organization
blt5948195ac13977b0
access-control-allow-headers
*
strict-transport-security
max-age=31557600
content-security-policy
default-src 'none'; navigate-to 'none'; form-action 'none'; img-src data:; style-src 'unsafe-inline';
cache-control
public, max-age=31536000
x-timer
203
via
a29368678904379a-IAD
cf-ray
a382268d898046b5-YYZ
access-control-allow-origin
*
server
cloudflare
GET
H2
200
1571751486317.jpg
eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blte0c88f087d1ad6f5/67c609df64f983454c3dd40b/
3 KB
3 KB
42ms
36ms
Image
image/webp
104.17.160.85
Cloudflare
General
Full URL
https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blte0c88f087d1ad6f5/67c609df64f983454c3dd40b/1571751486317.jpg?width=100&auto=webp&quality=80&disable=upscale
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/cyberattacks-data-breaches/attackers-multi-hop-google-redirects-phishing-campaign
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.17.160.85 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
3457c4968b15da7b05818eb03da51a269b1df78815a7fd0171be32791838aa1f
Security Headers
Name Value
Content-Security-Policy default-src 'none'; navigate-to 'none'; form-action 'none'; img-src data:; style-src 'unsafe-inline';
Strict-Transport-Security max-age=31557600

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

x-request-id
5ae2cb39-7492-4158-9cdd-96f4250292ad
access-control-expose-headers
*
surrogate-key
blt6d90778a997de1cd.sys_assets blt6d90778a997de1cd.sys_assets.blte0c88f087d1ad6f5.download
cf-cache-status
HIT
etag
"cfAKp-Hq2AZJOi362UNCD8PjvxWw0n4rEIrsI7hXggDQ"
age
2243462
cache-tag
blt6d90778a997de1cd.sys_assets blt6d90778a997de1cd.sys_assets.blte0c88f087d1ad6f5.download
cf-resized
internal=ok/h q=0 n=13+0 c=0+2 v=2026.8.2 l=3052 f=false c2=0 wv=2026.9.0
x-api-key
blt6d90778a997de1cd
access-control-allow-methods
GET,HEAD,PUT,PATCH,POST,DELETE,OPTIONS
x-cache
HIT, HIT
date
Wed, 09 Sep 2026 00:42:01 GMT
content-type
image/webp
content-disposition
inline; filename=1571751486317.webp
x-runtime
45ms
last-modified
Wed, 12 Aug 2026 18:58:03 GMT
x-contentstack-organization
blt5948195ac13977b0
access-control-allow-headers
*
strict-transport-security
max-age=31557600
content-security-policy
default-src 'none'; navigate-to 'none'; form-action 'none'; img-src data:; style-src 'unsafe-inline';
cache-control
public, max-age=31536000
x-timer
203
via
a2ac32867b51c698-EWR
cf-ray
a382268d898646b5-YYZ
accept-ranges
bytes
access-control-allow-origin
*
content-length
3052
server
cloudflare
GET
H2
200
BH2026_ConfGuide.png
eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/bltcd6c2f866cf0478d/6a7f323395c07927dfcf5058/
9 KB
10 KB
50ms
44ms
Image
image/webp
104.17.160.85
Cloudflare
General
Full URL
https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/bltcd6c2f866cf0478d/6a7f323395c07927dfcf5058/BH2026_ConfGuide.png?width=1400&auto=webp&quality=80&disable=upscale
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/cyberattacks-data-breaches/attackers-multi-hop-google-redirects-phishing-campaign
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.17.160.85 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
168c8a42c64acec93c37be6971498385095546ea885b878f182ab4f23088d4f3
Security Headers
Name Value
Content-Security-Policy default-src 'none'; navigate-to 'none'; form-action 'none'; img-src data:; style-src 'unsafe-inline';
Strict-Transport-Security max-age=31557600

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

x-request-id
b23356d6-bba3-4db5-ba0d-5bf80bf9e913
access-control-expose-headers
*
surrogate-key
blt6d90778a997de1cd.sys_assets blt6d90778a997de1cd.sys_assets.bltcd6c2f866cf0478d.download
cf-cache-status
HIT
etag
"cfN3rtffBBHsRNqJSs1ZSlLwoN_QAgviMf7M7J3R1uDQ"
age
1919212
cache-tag
blt6d90778a997de1cd.sys_assets blt6d90778a997de1cd.sys_assets.bltcd6c2f866cf0478d.download
cf-resized
internal=ok/h q=0 n=12+0 c=0+6 v=2026.8.2 l=9522 f=false c2=0 wv=2026.9.0
x-api-key
blt6d90778a997de1cd
access-control-allow-methods
GET,HEAD,PUT,PATCH,POST,DELETE,OPTIONS
x-cache
HIT, HIT
date
Wed, 09 Sep 2026 00:42:01 GMT
content-type
image/webp
content-disposition
inline; filename=BH2026_ConfGuide.webp
x-runtime
70ms
last-modified
Fri, 14 Aug 2026 15:20:21 GMT
x-contentstack-organization
blt5948195ac13977b0
access-control-allow-headers
*
strict-transport-security
max-age=31557600
content-security-policy
default-src 'none'; navigate-to 'none'; form-action 'none'; img-src data:; style-src 'unsafe-inline';
cache-control
public, max-age=31536000
x-timer
204
via
a2cb1ec928b76cd2-ATL
cf-ray
a382268d898a46b5-YYZ
accept-ranges
bytes
access-control-allow-origin
*
content-length
9522
server
cloudflare
GET
H2
200
Delta_Vegas-Janice_Chen-GettyImages-2269887409.jpg
eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt873948c65f62f170/6a874b480989859872d1eb89/
93 KB
94 KB
51ms
45ms
Image
image/webp
104.17.160.85
Cloudflare
General
Full URL
https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt873948c65f62f170/6a874b480989859872d1eb89/Delta_Vegas-Janice_Chen-GettyImages-2269887409.jpg?width=1400&auto=webp&quality=80&disable=upscale
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/cyberattacks-data-breaches/attackers-multi-hop-google-redirects-phishing-campaign
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.17.160.85 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
d80f72d687677b724e0117f31786898988fb3407de88175e3380aba81ac2ea5d
Security Headers
Name Value
Content-Security-Policy default-src 'none'; navigate-to 'none'; form-action 'none'; img-src data:; style-src 'unsafe-inline';
Strict-Transport-Security max-age=31557600

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

x-request-id
ce57100c-8ff3-422b-a6bd-964fa66254f7
access-control-expose-headers
*
surrogate-key
blt6d90778a997de1cd.sys_assets blt6d90778a997de1cd.sys_assets.blt873948c65f62f170.download
cf-cache-status
HIT
etag
"cfW1fvQ0sGnHACymNAOEpLMvDK5HF5pHG5trnzBX3ZDQ"
age
1462758
cache-tag
blt6d90778a997de1cd.sys_assets blt6d90778a997de1cd.sys_assets.blt873948c65f62f170.download
cf-resized
internal=ok/h q=0 n=9+0 c=22+98 v=2026.8.5 l=95684 f=false c2=0 wv=2026.9.0
x-api-key
blt6d90778a997de1cd
access-control-allow-methods
GET,HEAD,PUT,PATCH,POST,DELETE,OPTIONS
x-cache
HIT, HIT
date
Wed, 09 Sep 2026 00:42:01 GMT
content-type
image/webp
content-disposition
inline; filename=Delta_Vegas-Janice_Chen-GettyImages-2269887409.webp
x-runtime
69ms
last-modified
Thu, 20 Aug 2026 18:45:30 GMT
x-contentstack-organization
blt5948195ac13977b0
access-control-allow-headers
*
strict-transport-security
max-age=31557600
content-security-policy
default-src 'none'; navigate-to 'none'; form-action 'none'; img-src data:; style-src 'unsafe-inline';
cache-control
public, max-age=31536000
x-timer
204
via
a2f6a6aafa89267a-ATL
cf-ray
a382268d898c46b5-YYZ
accept-ranges
bytes
access-control-allow-origin
*
content-length
95684
server
cloudflare
GET
H2
200
katie_mo_and_Rob_Wright.png
eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/bltd0c2b7a8187293ac/6a837f44db552afa32e2f029/
36 KB
37 KB
46ms
41ms
Image
image/webp
104.17.160.85
Cloudflare
General
Full URL
https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/bltd0c2b7a8187293ac/6a837f44db552afa32e2f029/katie_mo_and_Rob_Wright.png?width=1400&auto=webp&quality=80&disable=upscale
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/cyberattacks-data-breaches/attackers-multi-hop-google-redirects-phishing-campaign
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.17.160.85 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
f4f8b95015da358676252caa53516ffcc51129c4bc4e155d65452f5f9d03363c
Security Headers
Name Value
Content-Security-Policy default-src 'none'; navigate-to 'none'; form-action 'none'; img-src data:; style-src 'unsafe-inline';
Strict-Transport-Security max-age=31557600

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

x-request-id
cf6768c1-0f1f-41cf-8ba0-7c7e06704dc6
access-control-expose-headers
*
surrogate-key
blt6d90778a997de1cd.sys_assets blt6d90778a997de1cd.sys_assets.bltd0c2b7a8187293ac.download
cf-cache-status
HIT
etag
"cfAKs_TOtBg7kX3Ag02EImmwpcSy6R1432IrAZNtcRDQ"
age
1390277
cache-tag
blt6d90778a997de1cd.sys_assets blt6d90778a997de1cd.sys_assets.bltd0c2b7a8187293ac.download
cf-resized
internal=ok/h q=0 n=17+0 c=8+74 v=2026.8.5 l=37062 f=false c2=0 wv=2026.9.0
x-api-key
blt6d90778a997de1cd
access-control-allow-methods
GET,HEAD,PUT,PATCH,POST,DELETE,OPTIONS
x-cache
HIT, HIT
date
Wed, 09 Sep 2026 00:42:01 GMT
content-type
image/webp
content-disposition
inline; filename=katie_mo_and_Rob_Wright.webp
x-runtime
72ms
last-modified
Mon, 17 Aug 2026 22:46:43 GMT
x-contentstack-organization
blt5948195ac13977b0
access-control-allow-headers
*
strict-transport-security
max-age=31557600
content-security-policy
default-src 'none'; navigate-to 'none'; form-action 'none'; img-src data:; style-src 'unsafe-inline';
cache-control
public, max-age=31536000
x-timer
204
via
a2fd903aa8b4369b-IAD
cf-ray
a382268d899046b5-YYZ
accept-ranges
bytes
access-control-allow-origin
*
content-length
37062
server
cloudflare
GET
H2
200
google_preferred_source_badge_dark@2x.png
eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/bltff3a0a2bc5f6a16d/69b4449a3306d6728d1ec53b/
5 KB
5 KB
45ms
40ms
Image
image/webp
104.17.160.85
Cloudflare
General
Full URL
https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/bltff3a0a2bc5f6a16d/69b4449a3306d6728d1ec53b/google_preferred_source_badge_dark@2x.png?width=320&auto=webp&quality=80&disable=upscale
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/cyberattacks-data-breaches/attackers-multi-hop-google-redirects-phishing-campaign
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.17.160.85 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
39a0f0b83b93ee59b337157a19de61d4d36d06731a13d3162e43af8407e1cc63
Security Headers
Name Value
Content-Security-Policy default-src 'none'; navigate-to 'none'; form-action 'none'; img-src data:; style-src 'unsafe-inline';
Strict-Transport-Security max-age=31557600

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

x-request-id
1577c83c-80cb-4fcd-acf5-0ec4b53c17f1
access-control-expose-headers
*
surrogate-key
blt6d90778a997de1cd.sys_assets blt6d90778a997de1cd.sys_assets.bltff3a0a2bc5f6a16d.download
cf-cache-status
HIT
etag
"cfiAkkdFFE-kZSeCS2qumsc5KGVGwUgigU1jPEWOC-DQ"
age
1302533
cache-tag
blt6d90778a997de1cd.sys_assets blt6d90778a997de1cd.sys_assets.bltff3a0a2bc5f6a16d.download
cf-resized
internal=ok/h q=0 n=14+0 c=0+7 v=2026.8.5 l=4744 f=false c2=0 wv=2026.9.0
x-api-key
blt6d90778a997de1cd
access-control-allow-methods
GET,HEAD,PUT,PATCH,POST,DELETE,OPTIONS
x-cache
HIT, HIT
date
Wed, 09 Sep 2026 00:42:01 GMT
content-type
image/webp
content-disposition
inline; filename=google_preferred_source_badge_dark%402x.webp
x-runtime
81ms
last-modified
Fri, 21 Aug 2026 21:49:54 GMT
x-contentstack-organization
blt5948195ac13977b0
access-control-allow-headers
*
strict-transport-security
max-age=31557600
content-security-policy
default-src 'none'; navigate-to 'none'; form-action 'none'; img-src data:; style-src 'unsafe-inline';
cache-control
public, max-age=31536000
x-timer
204
via
a305ee6bae7f8cc6-EWR
cf-ray
a382268d899146b5-YYZ
accept-ranges
bytes
access-control-allow-origin
*
content-length
4744
server
cloudflare
GET
H2
200
DR_Report.png
eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/bltf83ce48d191dd0f4/6a851bed5a1e313d8a221ef7/
37 KB
38 KB
67ms
62ms
Image
image/webp
104.17.160.85
Cloudflare
General
Full URL
https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/bltf83ce48d191dd0f4/6a851bed5a1e313d8a221ef7/DR_Report.png?width=800&auto=webp&quality=80&disable=upscale
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/cyberattacks-data-breaches/attackers-multi-hop-google-redirects-phishing-campaign
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.17.160.85 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
471efe947296ae9b94ec872ccf7061c4abd02e654b416a115975f514df629529
Security Headers
Name Value
Content-Security-Policy default-src 'none'; navigate-to 'none'; form-action 'none'; img-src data:; style-src 'unsafe-inline';
Strict-Transport-Security max-age=31557600

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

x-request-id
b17ef5b5-765e-493a-9b09-fe4cd8c03245
access-control-expose-headers
*
surrogate-key
blt6d90778a997de1cd.sys_assets blt6d90778a997de1cd.sys_assets.bltf83ce48d191dd0f4.download
cf-cache-status
HIT
etag
"cfpgxNZ2B8uMEgdQAOvx7olwmshRbCNLv9qtMZYfIIDQ"
age
1331551
cache-tag
blt6d90778a997de1cd.sys_assets blt6d90778a997de1cd.sys_assets.bltf83ce48d191dd0f4.download
cf-resized
internal=ok/h q=0 n=171+0 c=3+28 v=2026.8.5 l=38370 f=false c2=0 wv=2026.9.0
x-api-key
blt6d90778a997de1cd
access-control-allow-methods
GET,HEAD,PUT,PATCH,POST,DELETE,OPTIONS
x-cache
HIT, HIT
date
Wed, 09 Sep 2026 00:42:01 GMT
content-type
image/webp
content-disposition
inline; filename=DR_Report.webp
x-runtime
116ms
last-modified
Mon, 24 Aug 2026 14:49:29 GMT
x-contentstack-organization
blt5948195ac13977b0
access-control-allow-headers
*
strict-transport-security
max-age=31557600
content-security-policy
default-src 'none'; navigate-to 'none'; form-action 'none'; img-src data:; style-src 'unsafe-inline';
cache-control
public, max-age=31536000
x-timer
204
via
a30329f6383e729c-EWR
cf-ray
a382268d899246b5-YYZ
accept-ranges
bytes
access-control-allow-origin
*
content-length
38370
server
cloudflare
GET
H2
200
What_Every_Enterprise_Should_Know.jpg
eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blte0c3a250cca1fc96/6a8f2fac7e86cc2bfddc2676/
18 KB
19 KB
65ms
61ms
Image
image/webp
104.17.160.85
Cloudflare
General
Full URL
https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blte0c3a250cca1fc96/6a8f2fac7e86cc2bfddc2676/What_Every_Enterprise_Should_Know.jpg?width=800&auto=webp&quality=80&disable=upscale
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/cyberattacks-data-breaches/attackers-multi-hop-google-redirects-phishing-campaign
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.17.160.85 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
fbb2212f43ee569fc127a0b96e364c8ef735677c40a8537c1f21ed8bc4ee1020
Security Headers
Name Value
Content-Security-Policy default-src 'none'; navigate-to 'none'; form-action 'none'; img-src data:; style-src 'unsafe-inline';
Strict-Transport-Security max-age=31557600

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

x-request-id
3d3314d3-d67c-4d1f-877e-6ea0488b1a25
access-control-expose-headers
*
surrogate-key
blt6d90778a997de1cd.sys_assets blt6d90778a997de1cd.sys_assets.blte0c3a250cca1fc96.download
cf-cache-status
HIT
etag
"cfJP7dlT07ML91XjmRrbiTs8L_PAvDU0FCPpT4_aLtDQ"
age
1145601
cache-tag
blt6d90778a997de1cd.sys_assets blt6d90778a997de1cd.sys_assets.blte0c3a250cca1fc96.download
cf-resized
internal=ok/h q=0 n=22+0 c=1+26 v=2026.8.5 l=18486 f=false c2=0 wv=2026.9.0
x-api-key
blt6d90778a997de1cd
access-control-allow-methods
GET,HEAD,PUT,PATCH,POST,DELETE,OPTIONS
x-cache
HIT, HIT
date
Wed, 09 Sep 2026 00:42:01 GMT
content-type
image/webp
content-disposition
inline; filename=What_Every_Enterprise_Should_Know.webp
x-runtime
38ms
last-modified
Wed, 26 Aug 2026 18:25:50 GMT
x-contentstack-organization
blt5948195ac13977b0
access-control-allow-headers
*
strict-transport-security
max-age=31557600
content-security-policy
default-src 'none'; navigate-to 'none'; form-action 'none'; img-src data:; style-src 'unsafe-inline';
cache-control
public, max-age=31536000
x-timer
205
via
a314e5c29ab3d826-EWR
cf-ray
a382268d899546b5-YYZ
accept-ranges
bytes
access-control-allow-origin
*
content-length
18486
server
cloudflare
GET
H3
200
cm.css
transcend-cdn.com/cm/ef49a3f1-d8c1-47d6-88fc-50e41130631f/
17 KB
4 KB
32ms
31ms
Stylesheet
text/css
104.18.40.238
Cloudflare
General
Full URL
https://transcend-cdn.com/cm/ef49a3f1-d8c1-47d6-88fc-50e41130631f/cm.css
Requested by
Host: transcend-cdn.com
URL: https://transcend-cdn.com/cm/ef49a3f1-d8c1-47d6-88fc-50e41130631f/airgap.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.18.40.238 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
375f6fd0b27cc726acaed8b4731e7f53282e17eab3fbe781eb80b4e2a79d5caa
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

access-control-max-age
86400
content-encoding
br
cf-cache-status
HIT
etag
W/"47a2877a73b0c1f4635e6d7f4a656efb"
age
48507
expect-ct
max-age=86400, enforce
access-control-allow-methods
GET,HEAD,OPTIONS
x-content-type-options
nosniff
expires
Wed, 09 Sep 2026 00:43:01 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Wed, 09 Sep 2026 00:42:01 GMT
content-type
text/css
content-disposition
inline
priority
u=0,i=?0
cache-control
public, max-age=60
timing-allow-origin
*
referrer-policy
same-origin
cf-ray
a382268e3d944b56-YYZ
access-control-allow-origin
*
x-xss-protection
1; mode=block
server
cloudflare
GET
H3
200
en.json Show response
transcend-cdn.com/cm/ef49a3f1-d8c1-47d6-88fc-50e41130631f/translations/
10 KB
3 KB
35ms
34ms
Fetch
application/json
104.18.40.238
Cloudflare
General
Full URL
https://transcend-cdn.com/cm/ef49a3f1-d8c1-47d6-88fc-50e41130631f/translations/en.json
Requested by
Host: transcend-cdn.com
URL: https://transcend-cdn.com/cm/ef49a3f1-d8c1-47d6-88fc-50e41130631f/airgap.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.18.40.238 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
a51b8ad17e42e9878ed13632659b4f42c3ed5853285da135abf80b3e79e4584d
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

access-control-max-age
86400
content-encoding
br
cf-cache-status
HIT
etag
W/"d2eb96b8ba44c2c9aeb6792db7525fca"
age
18092
expect-ct
max-age=86400, enforce
access-control-allow-methods
GET,HEAD,OPTIONS
x-content-type-options
nosniff
expires
Wed, 09 Sep 2026 00:43:01 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Wed, 09 Sep 2026 00:42:01 GMT
content-type
application/json
content-disposition
inline
priority
u=1,i
cache-control
public, max-age=60
timing-allow-origin
*
referrer-policy
same-origin
cf-ray
a382268e3a0c9dab-YYZ
access-control-allow-origin
*
x-xss-protection
1; mode=block
server
cloudflare
GET
H3
200
main.js Show response
www.darkreading.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/330e41bb475c/ Frame B054
Redirect Chain
  • https://www.darkreading.com/cdn-cgi/challenge-platform/scripts/jsd/main.js
  • https://www.darkreading.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/330e41bb475c/main.js?
21 KB
10 KB
31ms
30ms
Script
application/javascript
104.16.224.171
Cloudflare
General
Full URL
https://www.darkreading.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/330e41bb475c/main.js?
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/cyberattacks-data-breaches/attackers-multi-hop-google-redirects-phishing-campaign
Protocol
H3
Server
104.16.224.171 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
f4adedc72137ec9068158765430238adf4abe92a9cfa76a5dcaf3eaee1323235
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
Referer

Response headers

cache-control
max-age=14400, stale-if-error=10800, stale-while-revalidate=10800, public
content-encoding
br
x-content-type-options
nosniff
cf-ray
a38226928f7debbc-YYZ
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Wed, 09 Sep 2026 00:42:02 GMT
content-type
application/javascript; charset=UTF-8
server
cloudflare
priority
u=3,i=?0

Redirect headers

cache-control
max-age=300, stale-if-error=10800, stale-while-revalidate=10800, public
location
/cdn-cgi/challenge-platform/h/g/scripts/jsd/330e41bb475c/main.js?
cf-ray
a382268eb9c2ebbc-YYZ
access-control-allow-origin
*
alt-svc
h3=":443"; ma=86400
content-length
0
server-timing
cfExtPri
date
Wed, 09 Sep 2026 00:42:01 GMT
server
cloudflare
priority
u=3,i=?0
GET
H2
200
css
fonts.googleapis.com/ Frame B76A
15 KB
1 KB
159ms
67ms
Stylesheet
text/css
142.251.167.95
Google LLC
General
Full URL
https://fonts.googleapis.com/css?kit=TrRn_cawiauSGymlkgY3lekzMFivVqLDBnXnWDs7xuSurckZKAF09_I-3FaURnfHGLqwaF1VvfJKw_xrQEfwwQ
Requested by
Host: docs.google.com
URL: https://docs.google.com/spreadsheets/d/e/2PACX-1vQsygsynrhlYSFLOwZ9IaqURE4cQ3rGo07MkUiECTl3zXlINi_MWVmfxgjSgmvPhGmk0kPdS8DBzkoj/pubhtml?gid=326945225&widget=false&headers=false&chrome=false
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
142.251.167.95 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
ww-in-f95.1e100.net
Software
ESF /
Resource Hash
159ca2165c7f4a101209bf5e952695e20f5bdc408468212d24dca0a4f0a5ecc1
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://docs.google.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
gzip
x-content-type-options
nosniff
expires
Wed, 09 Sep 2026 00:42:02 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Wed, 09 Sep 2026 00:42:02 GMT
content-type
text/css; charset=utf-8
vary
Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
last-modified
Wed, 09 Sep 2026 00:42:02 GMT
x-frame-options
SAMEORIGIN
strict-transport-security
max-age=31536000
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
cross-origin-opener-policy
same-origin-allow-popups
cross-origin-resource-policy
cross-origin
access-control-allow-origin
*
x-xss-protection
0
server
ESF
GET
H2
200
2837645074-waffle_k_ltr.css
docs.google.com/static/spreadsheets2/client/css/ Frame B76A
4 MB
487 KB
41ms
36ms
Stylesheet
text/css
142.250.217.14
Google LLC
General
Full URL
https://docs.google.com/static/spreadsheets2/client/css/2837645074-waffle_k_ltr.css
Requested by
Host: docs.google.com
URL: https://docs.google.com/spreadsheets/d/e/2PACX-1vQsygsynrhlYSFLOwZ9IaqURE4cQ3rGo07MkUiECTl3zXlINi_MWVmfxgjSgmvPhGmk0kPdS8DBzkoj/pubhtml?gid=326945225&widget=false&headers=false&chrome=false
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.217.14 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
pnlgaa-as-in-f14.1e100.net
Software
sffe /
Resource Hash
c7e008af9806590bd59b39a737925756e996613e8ed92caf152caba1087b064d
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://docs.google.com/spreadsheets/d/e/2PACX-1vQsygsynrhlYSFLOwZ9IaqURE4cQ3rGo07MkUiECTl3zXlINi_MWVmfxgjSgmvPhGmk0kPdS8DBzkoj/pubhtml?gid=326945225&widget=false&headers=false&chrome=false
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
gzip
age
561420
report-to
{"group":"apps-spreadsheets","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-spreadsheets"}]}
x-content-type-options
nosniff
expires
Thu, 02 Sep 2027 12:45:02 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Wed, 02 Sep 2026 12:45:02 GMT
last-modified
Wed, 02 Sep 2026 12:14:51 GMT
content-type
text/css
vary
Accept-Encoding, Origin
cache-control
public, max-age=31536000
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="apps-spreadsheets"
content-length
497860
x-xss-protection
0
server
sffe
GET

UcCO3FwrK3iLTeHuS_nVMrMxCp50SjIw2boKoduKmMEVuLyfMZ0.woff2
https://docs.google.com/persistent/docs/fonts/ Frame B76A
0
0


GET

UcCO3FwrK3iLTeHuS_nVMrMxCp50SjIw2boKoduKmMEVuFuYMZ0.woff2
https://docs.google.com/persistent/docs/fonts/ Frame B76A
0
0


GET

UcCM3FwrK3iLTcvneQg7Ca725JhhKnNqk4j1ebLhAm8SrXTc2dthiA.woff2
https://docs.google.com/persistent/docs/fonts/ Frame B76A
0
0


GET

UcCM3FwrK3iLTcvneQg7Ca725JhhKnNqk4j1ebLhAm8SrXTcPtxhiA.woff2
https://docs.google.com/persistent/docs/fonts/ Frame B76A
0
0


GET
H3
200
UcCO3FwrK3iLTeHuS_nVMrMxCp50SjIw2boKoduKmMEVuLyfMZ0.woff2
fonts.gstatic.com/s/inter/v20/ Frame B76A
106 KB
106 KB
97ms
48ms
Font
font/woff2
142.251.211.131
Google LLC
General
Full URL
https://fonts.gstatic.com/s/inter/v20/UcCO3FwrK3iLTeHuS_nVMrMxCp50SjIw2boKoduKmMEVuLyfMZ0.woff2
Requested by
Host: docs.google.com
URL: https://docs.google.com/spreadsheets/d/e/2PACX-1vQsygsynrhlYSFLOwZ9IaqURE4cQ3rGo07MkUiECTl3zXlINi_MWVmfxgjSgmvPhGmk0kPdS8DBzkoj/pubhtml?gid=326945225&widget=false&headers=false&chrome=false
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.211.131 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
lclgaa-au-in-f3.1e100.net
Software
sffe /
Resource Hash
21ab4e91a62b1c86daf7bda3818f8cf0721f91cd664a9d135923c1ed6b694e90
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
https://docs.google.com
sec-ch-ua-platform
"Linux"
Referer
https://docs.google.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

age
32135
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options
nosniff
expires
Wed, 08 Sep 2027 15:46:27 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Tue, 08 Sep 2026 15:46:27 GMT
last-modified
Tue, 09 Sep 2025 18:41:52 GMT
content-type
font/woff2
cache-control
public, max-age=31536000
timing-allow-origin
*
cross-origin-opener-policy
same-origin; report-to="apps-themes"
cross-origin-resource-policy
cross-origin
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges
bytes
access-control-allow-origin
*
content-length
108656
x-xss-protection
0
server
sffe
GET
H3
200
UcCO3FwrK3iLTeHuS_nVMrMxCp50SjIw2boKoduKmMEVuFuYMZ0.woff2
fonts.gstatic.com/s/inter/v20/ Frame B76A
110 KB
110 KB
127ms
78ms
Font
font/woff2
142.251.211.131
Google LLC
General
Full URL
https://fonts.gstatic.com/s/inter/v20/UcCO3FwrK3iLTeHuS_nVMrMxCp50SjIw2boKoduKmMEVuFuYMZ0.woff2
Requested by
Host: docs.google.com
URL: https://docs.google.com/spreadsheets/d/e/2PACX-1vQsygsynrhlYSFLOwZ9IaqURE4cQ3rGo07MkUiECTl3zXlINi_MWVmfxgjSgmvPhGmk0kPdS8DBzkoj/pubhtml?gid=326945225&widget=false&headers=false&chrome=false
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.211.131 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
lclgaa-au-in-f3.1e100.net
Software
sffe /
Resource Hash
2f1d6b087793b04e2b40bf7a3aafb87efbf7f46f94d17771533ade3404e8874e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
https://docs.google.com
sec-ch-ua-platform
"Linux"
Referer
https://docs.google.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

age
28183
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options
nosniff
expires
Wed, 08 Sep 2027 16:52:19 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Tue, 08 Sep 2026 16:52:19 GMT
last-modified
Tue, 09 Sep 2025 18:36:03 GMT
content-type
font/woff2
cache-control
public, max-age=31536000
timing-allow-origin
*
cross-origin-opener-policy
same-origin; report-to="apps-themes"
cross-origin-resource-policy
cross-origin
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges
bytes
access-control-allow-origin
*
content-length
112444
x-xss-protection
0
server
sffe
GET
H3
200
UcCM3FwrK3iLTcvneQg7Ca725JhhKnNqk4j1ebLhAm8SrXTc2dthiA.woff2
fonts.gstatic.com/s/inter/v20/ Frame B76A
111 KB
111 KB
91ms
43ms
Font
font/woff2
142.251.211.131
Google LLC
General
Full URL
https://fonts.gstatic.com/s/inter/v20/UcCM3FwrK3iLTcvneQg7Ca725JhhKnNqk4j1ebLhAm8SrXTc2dthiA.woff2
Requested by
Host: docs.google.com
URL: https://docs.google.com/spreadsheets/d/e/2PACX-1vQsygsynrhlYSFLOwZ9IaqURE4cQ3rGo07MkUiECTl3zXlINi_MWVmfxgjSgmvPhGmk0kPdS8DBzkoj/pubhtml?gid=326945225&widget=false&headers=false&chrome=false
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.211.131 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
lclgaa-au-in-f3.1e100.net
Software
sffe /
Resource Hash
09d554ab27e1b02ce25d6f5faf71e2e07e77c28beb4019dbcfcd43ec7558d3df
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
https://docs.google.com
sec-ch-ua-platform
"Linux"
Referer
https://docs.google.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

age
494010
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options
nosniff
expires
Fri, 03 Sep 2027 07:28:32 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Thu, 03 Sep 2026 07:28:32 GMT
last-modified
Tue, 09 Sep 2025 18:40:02 GMT
content-type
font/woff2
cache-control
public, max-age=31536000
timing-allow-origin
*
cross-origin-opener-policy
same-origin; report-to="apps-themes"
cross-origin-resource-policy
cross-origin
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges
bytes
access-control-allow-origin
*
content-length
114132
x-xss-protection
0
server
sffe
GET
H3
200
UcCM3FwrK3iLTcvneQg7Ca725JhhKnNqk4j1ebLhAm8SrXTcPtxhiA.woff2
fonts.gstatic.com/s/inter/v20/ Frame B76A
116 KB
116 KB
96ms
64ms
Font
font/woff2
142.251.211.131
Google LLC
General
Full URL
https://fonts.gstatic.com/s/inter/v20/UcCM3FwrK3iLTcvneQg7Ca725JhhKnNqk4j1ebLhAm8SrXTcPtxhiA.woff2
Requested by
Host: docs.google.com
URL: https://docs.google.com/spreadsheets/d/e/2PACX-1vQsygsynrhlYSFLOwZ9IaqURE4cQ3rGo07MkUiECTl3zXlINi_MWVmfxgjSgmvPhGmk0kPdS8DBzkoj/pubhtml?gid=326945225&widget=false&headers=false&chrome=false
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.211.131 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
lclgaa-au-in-f3.1e100.net
Software
sffe /
Resource Hash
6c39aad192892b45820650e0043e81fa4f7a5c4fe24dfda8849c444a22a73800
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
https://docs.google.com
sec-ch-ua-platform
"Linux"
Referer
https://docs.google.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

age
28531
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options
nosniff
expires
Wed, 08 Sep 2027 16:46:31 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Tue, 08 Sep 2026 16:46:31 GMT
last-modified
Tue, 09 Sep 2025 18:40:49 GMT
content-type
font/woff2
cache-control
public, max-age=31536000
timing-allow-origin
*
cross-origin-opener-policy
same-origin; report-to="apps-themes"
cross-origin-resource-policy
cross-origin
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges
bytes
access-control-allow-origin
*
content-length
118340
x-xss-protection
0
server
sffe
POST
H3
200
a3822686f8b7ebbc Show response
www.darkreading.com/cdn-cgi/challenge-platform/h/g/jsd/oneshot/330e41bb475c/0.600858357601363:1788912315:pLPC1GKVMzuuNBdW-HZdTlyULiTOdCklD_fSI-HIkf0/ Frame B054
0
892 B
50ms
43ms
XHR
text/plain
104.16.224.171
Cloudflare
General
Full URL
https://www.darkreading.com/cdn-cgi/challenge-platform/h/g/jsd/oneshot/330e41bb475c/0.600858357601363:1788912315:pLPC1GKVMzuuNBdW-HZdTlyULiTOdCklD_fSI-HIkf0/a3822686f8b7ebbc
Requested by
Host: transcend-cdn.com
URL: https://transcend-cdn.com/cm/ef49a3f1-d8c1-47d6-88fc-50e41130631f/airgap.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.16.224.171 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua-platform
"Linux"
Referer
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
Content-Type
text/plain;charset=UTF-8
sec-ch-ua-mobile
?0

Response headers

timing-allow-origin
https://www.darkreading.com
cf-ray
a3822693dc7aebbc-YYZ
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
content-length
0
cf-chl-out-s
XW9rOa0OA1AvJ2RgKyRmpw==$rSP0w8GQQ1U2MMvO0k4VvQ==
date
Wed, 09 Sep 2026 00:42:02 GMT
content-type
text/plain; charset=UTF-8
server
cloudflare
priority
u=1,i
GET
H2
200
css
fonts.googleapis.com/ Frame DA69
15 KB
0
3ms
2ms
Stylesheet
text/css
142.251.167.95
Google LLC
General
Full URL
https://fonts.googleapis.com/css?kit=TrRn_cawiauSGymlkgY3lekzMFivVqLDBnXnWDs7xuSurckZKAF09_I-3FaURnfHGLqwaF1VvfJKw_xrQEfwwQ
Requested by
Host: docs.google.com
URL: https://docs.google.com/spreadsheets/d/e/2PACX-1vQsygsynrhlYSFLOwZ9IaqURE4cQ3rGo07MkUiECTl3zXlINi_MWVmfxgjSgmvPhGmk0kPdS8DBzkoj/pubhtml?gid=1145058527&single=false&widget=false&headers=false&chrome=false
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
142.251.167.95 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
ww-in-f95.1e100.net
Software
ESF /
Resource Hash
159ca2165c7f4a101209bf5e952695e20f5bdc408468212d24dca0a4f0a5ecc1
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://docs.google.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
gzip
x-content-type-options
nosniff
expires
Wed, 09 Sep 2026 00:42:02 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Wed, 09 Sep 2026 00:42:02 GMT
content-type
text/css; charset=utf-8
vary
Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
last-modified
Wed, 09 Sep 2026 00:42:02 GMT
x-frame-options
SAMEORIGIN
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
cross-origin-opener-policy
same-origin-allow-popups
cross-origin-resource-policy
cross-origin
access-control-allow-origin
*
x-xss-protection
0
server
ESF
GET
H2
200
2837645074-waffle_k_ltr.css
docs.google.com/static/spreadsheets2/client/css/ Frame DA69
4 MB
0
3ms
3ms
Stylesheet
text/css
142.250.217.14
Google LLC
General
Full URL
https://docs.google.com/static/spreadsheets2/client/css/2837645074-waffle_k_ltr.css
Requested by
Host: docs.google.com
URL: https://docs.google.com/spreadsheets/d/e/2PACX-1vQsygsynrhlYSFLOwZ9IaqURE4cQ3rGo07MkUiECTl3zXlINi_MWVmfxgjSgmvPhGmk0kPdS8DBzkoj/pubhtml?gid=1145058527&single=false&widget=false&headers=false&chrome=false
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.217.14 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
pnlgaa-as-in-f14.1e100.net
Software
sffe /
Resource Hash
c7e008af9806590bd59b39a737925756e996613e8ed92caf152caba1087b064d
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://docs.google.com/spreadsheets/d/e/2PACX-1vQsygsynrhlYSFLOwZ9IaqURE4cQ3rGo07MkUiECTl3zXlINi_MWVmfxgjSgmvPhGmk0kPdS8DBzkoj/pubhtml?gid=1145058527&single=false&widget=false&headers=false&chrome=false
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
gzip
age
561420
report-to
{"group":"apps-spreadsheets","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-spreadsheets"}]}
x-content-type-options
nosniff
expires
Thu, 02 Sep 2027 12:45:02 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Wed, 02 Sep 2026 12:45:02 GMT
last-modified
Wed, 02 Sep 2026 12:14:51 GMT
content-type
text/css
vary
Accept-Encoding, Origin
cache-control
public, max-age=31536000
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="apps-spreadsheets"
content-length
497860
x-xss-protection
0
server
sffe
GET
H3
200
pubads_impl.js Show response
securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202609030101/
689 KB
212 KB
39ms
38ms
Script
text/javascript
142.251.211.130
Google LLC
General
Full URL
https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202609030101/pubads_impl.js?cb=122880906
Requested by
Host: transcend-cdn.com
URL: https://transcend-cdn.com/cm/ef49a3f1-d8c1-47d6-88fc-50e41130631f/airgap.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.211.130 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
lclgaa-au-in-f2.1e100.net
Software
cafe /
Resource Hash
d8e05b22b77a9d212ca5f1a1f2a6f96bd8cb06d98a9c8a342178fe62bb24898c
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
br
etag
1987170804211470865
age
42749
x-content-type-options
nosniff
expires
Wed, 08 Sep 2027 12:49:33 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date
Tue, 08 Sep 2026 12:49:33 GMT
content-disposition
attachment; filename="f.txt"
content-type
text/javascript; charset=UTF-8
vary
Accept-Encoding
cache-control
public, immutable, max-age=31536000
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
access-control-allow-origin
*
content-length
216950
x-xss-protection
0
server
cafe
GET
H2
200
css
fonts.googleapis.com/ Frame B76A
10 KB
2 KB
80ms
79ms
Stylesheet
text/css
142.251.167.95
Google LLC
General
Full URL
https://fonts.googleapis.com/css?family=Google+Sans
Requested by
Host: docs.google.com
URL: https://docs.google.com/static/spreadsheets2/client/css/2837645074-waffle_k_ltr.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
142.251.167.95 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
ww-in-f95.1e100.net
Software
ESF /
Resource Hash
9a8bb89f6247a8f5da6393ef01b189fc4c100fb0a5d1d14218466056eabf218d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://docs.google.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
gzip
x-content-type-options
nosniff
expires
Wed, 09 Sep 2026 00:42:02 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Wed, 09 Sep 2026 00:42:02 GMT
content-type
text/css; charset=utf-8
vary
Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
last-modified
Wed, 09 Sep 2026 00:06:41 GMT
x-frame-options
SAMEORIGIN
strict-transport-security
max-age=31536000
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
cross-origin-opener-policy
same-origin-allow-popups
cross-origin-resource-policy
cross-origin
access-control-allow-origin
*
x-xss-protection
0
server
ESF
GET
H3
200
/ Show response
connect.facebook.net/en_US/bundle/sdk.js/
266 KB
79 KB
46ms
37ms
Script
application/x-javascript
157.240.241.1
Facebook
General
Full URL
https://connect.facebook.net/en_US/bundle/sdk.js/
Requested by
Host: transcend-cdn.com
URL: https://transcend-cdn.com/cm/ef49a3f1-d8c1-47d6-88fc-50e41130631f/airgap.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
157.240.241.1 New York, United States, ASN32934 (FACEBOOK - Facebook, Inc., US),
Reverse DNS
xx-fbcdn-shv-02-lga3.fbcdn.net
Software
/
Resource Hash
fe9086f7b61c86277e5f5a104214ce8f4d7e4c6c31ad3967b822287c684eb6fb
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

Origin
https://www.darkreading.com
sec-ch-ua-platform
"Linux"
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-md5
gjj2IzNSeeh810LsmcOFGg==
access-control-expose-headers
X-FB-Content-MD5
content-encoding
gzip
etag
"de11c5cf54fe91cea7ceb6d7f181cd0e"
report-to
{"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options
nosniff
expires
Wed, 09 Sep 2026 00:53:46 GMT
alt-svc
h3=":443"; ma=86400
date
Wed, 09 Sep 2026 00:42:02 GMT
content-type
application/x-javascript; charset=utf-8
vary
Accept-Encoding
cross-origin-embedder-policy-report-only
require-corp;report-to="coep_report"
priority
u=3,i
x-frame-options
DENY
strict-transport-security
max-age=31536000; preload; includeSubDomains
reporting-endpoints
coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
x-fb-content-md5
c86647a961c0f071aefdd4b4701b36c0
cache-control
public,max-age=1200,stale-while-revalidate=3600
x-fb-debug
/CN++Y5sdcWv8kTNwbtDLl04RzYXCxaHZWntG/ZB7W5ogvrd9JWJX6auESZTouLUkrCsU52nAuAgxC1hUyvegA==
cross-origin-opener-policy
same-origin-allow-popups;report-to="coop_report"
x-fb-connection-quality
UNKNOWN; q=-1, rtt=-1, rtx=0, c=20, mss=1232, tbw=2330, tp=5, tpl=0, uplat=2, ullat=-1
cross-origin-resource-policy
cross-origin
permissions-policy
accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
document-policy
force-load-at-top, include-js-call-stacks-in-crash-reports
access-control-allow-origin
*
content-length
80834
origin-agent-cluster
?1
POST
H2
204
26981ed0d57bbad37e728ff58134270c
csp.withgoogle.com/csp/proto/ Frame DA69
0
0
336ms
84ms
Ping
text/html
142.251.167.141
Google LLC
General
Full URL
https://csp.withgoogle.com/csp/proto/26981ed0d57bbad37e728ff58134270c
Requested by
Host: docs.google.com
URL: https://docs.google.com/spreadsheets/d/e/2PACX-1vQsygsynrhlYSFLOwZ9IaqURE4cQ3rGo07MkUiECTl3zXlINi_MWVmfxgjSgmvPhGmk0kPdS8DBzkoj/pubhtml?gid=1145058527&single=false&widget=false&headers=false&chrome=false
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.251.167.141 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
ww-in-f141.1e100.net
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://docs.google.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
Content-Type
text/plain;charset=UTF-8
sec-ch-ua-mobile
?0

Response headers

GET
H3
200
UcCO3FwrK3iLTeHuS_nVMrMxCp50SjIw2boKoduKmMEVuLyfMZ0.woff2
fonts.gstatic.com/s/inter/v20/ Frame DA69
106 KB
0
97ms
48ms
Font
font/woff2
142.251.211.131
Google LLC
General
Full URL
https://fonts.gstatic.com/s/inter/v20/UcCO3FwrK3iLTeHuS_nVMrMxCp50SjIw2boKoduKmMEVuLyfMZ0.woff2
Requested by
Host: docs.google.com
URL: https://docs.google.com/spreadsheets/d/e/2PACX-1vQsygsynrhlYSFLOwZ9IaqURE4cQ3rGo07MkUiECTl3zXlINi_MWVmfxgjSgmvPhGmk0kPdS8DBzkoj/pubhtml?gid=326945225&widget=false&headers=false&chrome=false
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.211.131 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
lclgaa-au-in-f3.1e100.net
Software
sffe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
https://docs.google.com
Referer
https://docs.google.com/

Response headers

age
32135
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options
nosniff
expires
Wed, 08 Sep 2027 15:46:27 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Tue, 08 Sep 2026 15:46:27 GMT
last-modified
Tue, 09 Sep 2025 18:41:52 GMT
content-type
font/woff2
cache-control
public, max-age=31536000
timing-allow-origin
*
cross-origin-opener-policy
same-origin; report-to="apps-themes"
cross-origin-resource-policy
cross-origin
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges
bytes
access-control-allow-origin
*
content-length
108656
x-xss-protection
0
server
sffe
GET

UcCO3FwrK3iLTeHuS_nVMrMxCp50SjIw2boKoduKmMEVuLyfMZ0.woff2
https://docs.google.com/persistent/docs/fonts/ Frame DA69
0
0


GET
H3
200
UcCO3FwrK3iLTeHuS_nVMrMxCp50SjIw2boKoduKmMEVuFuYMZ0.woff2
fonts.gstatic.com/s/inter/v20/ Frame DA69
110 KB
0
127ms
78ms
Font
font/woff2
142.251.211.131
Google LLC
General
Full URL
https://fonts.gstatic.com/s/inter/v20/UcCO3FwrK3iLTeHuS_nVMrMxCp50SjIw2boKoduKmMEVuFuYMZ0.woff2
Requested by
Host: docs.google.com
URL: https://docs.google.com/spreadsheets/d/e/2PACX-1vQsygsynrhlYSFLOwZ9IaqURE4cQ3rGo07MkUiECTl3zXlINi_MWVmfxgjSgmvPhGmk0kPdS8DBzkoj/pubhtml?gid=326945225&widget=false&headers=false&chrome=false
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.211.131 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
lclgaa-au-in-f3.1e100.net
Software
sffe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
https://docs.google.com
Referer
https://docs.google.com/

Response headers

age
28183
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options
nosniff
expires
Wed, 08 Sep 2027 16:52:19 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Tue, 08 Sep 2026 16:52:19 GMT
last-modified
Tue, 09 Sep 2025 18:36:03 GMT
content-type
font/woff2
cache-control
public, max-age=31536000
timing-allow-origin
*
cross-origin-opener-policy
same-origin; report-to="apps-themes"
cross-origin-resource-policy
cross-origin
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges
bytes
access-control-allow-origin
*
content-length
112444
x-xss-protection
0
server
sffe
GET

UcCO3FwrK3iLTeHuS_nVMrMxCp50SjIw2boKoduKmMEVuFuYMZ0.woff2
https://docs.google.com/persistent/docs/fonts/ Frame DA69
0
0


GET
H3
200
UcCM3FwrK3iLTcvneQg7Ca725JhhKnNqk4j1ebLhAm8SrXTc2dthiA.woff2
fonts.gstatic.com/s/inter/v20/ Frame DA69
111 KB
0
91ms
43ms
Font
font/woff2
142.251.211.131
Google LLC
General
Full URL
https://fonts.gstatic.com/s/inter/v20/UcCM3FwrK3iLTcvneQg7Ca725JhhKnNqk4j1ebLhAm8SrXTc2dthiA.woff2
Requested by
Host: docs.google.com
URL: https://docs.google.com/spreadsheets/d/e/2PACX-1vQsygsynrhlYSFLOwZ9IaqURE4cQ3rGo07MkUiECTl3zXlINi_MWVmfxgjSgmvPhGmk0kPdS8DBzkoj/pubhtml?gid=326945225&widget=false&headers=false&chrome=false
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.211.131 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
lclgaa-au-in-f3.1e100.net
Software
sffe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
https://docs.google.com
Referer
https://docs.google.com/

Response headers

age
494010
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options
nosniff
expires
Fri, 03 Sep 2027 07:28:32 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Thu, 03 Sep 2026 07:28:32 GMT
last-modified
Tue, 09 Sep 2025 18:40:02 GMT
content-type
font/woff2
cache-control
public, max-age=31536000
timing-allow-origin
*
cross-origin-opener-policy
same-origin; report-to="apps-themes"
cross-origin-resource-policy
cross-origin
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges
bytes
access-control-allow-origin
*
content-length
114132
x-xss-protection
0
server
sffe
GET

UcCM3FwrK3iLTcvneQg7Ca725JhhKnNqk4j1ebLhAm8SrXTc2dthiA.woff2
https://docs.google.com/persistent/docs/fonts/ Frame DA69
0
0


GET
H3
200
UcCM3FwrK3iLTcvneQg7Ca725JhhKnNqk4j1ebLhAm8SrXTcPtxhiA.woff2
fonts.gstatic.com/s/inter/v20/ Frame DA69
116 KB
0
96ms
64ms
Font
font/woff2
142.251.211.131
Google LLC
General
Full URL
https://fonts.gstatic.com/s/inter/v20/UcCM3FwrK3iLTcvneQg7Ca725JhhKnNqk4j1ebLhAm8SrXTcPtxhiA.woff2
Requested by
Host: docs.google.com
URL: https://docs.google.com/spreadsheets/d/e/2PACX-1vQsygsynrhlYSFLOwZ9IaqURE4cQ3rGo07MkUiECTl3zXlINi_MWVmfxgjSgmvPhGmk0kPdS8DBzkoj/pubhtml?gid=326945225&widget=false&headers=false&chrome=false
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.211.131 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
lclgaa-au-in-f3.1e100.net
Software
sffe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
https://docs.google.com
Referer
https://docs.google.com/

Response headers

age
28531
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options
nosniff
expires
Wed, 08 Sep 2027 16:46:31 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Tue, 08 Sep 2026 16:46:31 GMT
last-modified
Tue, 09 Sep 2025 18:40:49 GMT
content-type
font/woff2
cache-control
public, max-age=31536000
timing-allow-origin
*
cross-origin-opener-policy
same-origin; report-to="apps-themes"
cross-origin-resource-policy
cross-origin
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges
bytes
access-control-allow-origin
*
content-length
118340
x-xss-protection
0
server
sffe
GET

UcCM3FwrK3iLTcvneQg7Ca725JhhKnNqk4j1ebLhAm8SrXTcPtxhiA.woff2
https://docs.google.com/persistent/docs/fonts/ Frame DA69
0
0


GET
H2
200
css
fonts.googleapis.com/ Frame DA69
10 KB
0
0ms
0ms
Stylesheet
text/css
142.251.167.95
Google LLC
General
Full URL
https://fonts.googleapis.com/css?family=Google+Sans
Requested by
Host: docs.google.com
URL: https://docs.google.com/static/spreadsheets2/client/css/2837645074-waffle_k_ltr.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
142.251.167.95 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
ww-in-f95.1e100.net
Software
ESF /
Resource Hash
9a8bb89f6247a8f5da6393ef01b189fc4c100fb0a5d1d14218466056eabf218d
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://docs.google.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
gzip
x-content-type-options
nosniff
expires
Wed, 09 Sep 2026 00:42:02 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Wed, 09 Sep 2026 00:42:02 GMT
content-type
text/css; charset=utf-8
vary
Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
last-modified
Wed, 09 Sep 2026 00:06:41 GMT
x-frame-options
SAMEORIGIN
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
cross-origin-opener-policy
same-origin-allow-popups
cross-origin-resource-policy
cross-origin
access-control-allow-origin
*
x-xss-protection
0
server
ESF
GET
H2
200
3834 Show response
fundingchoicesmessages.google.com/i/
226 KB
72 KB
221ms
122ms
Script
application/javascript
142.250.217.238
Google LLC
General
Full URL
https://fundingchoicesmessages.google.com/i/3834?ers=3
Requested by
Host: transcend-cdn.com
URL: https://transcend-cdn.com/cm/ef49a3f1-d8c1-47d6-88fc-50e41130631f/airgap.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.217.238 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
pnlgaa-ay-in-f14.1e100.net
Software
ESF /
Resource Hash
386e14f00a7ea1226e20c70b81f1798757c1da8823e36ed33ec40bcc7666fbae
Security Headers
Name Value
Content-Security-Policy require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-rC2exyI31eGnsgnDc4ERfA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
gzip
x-content-type-options
nosniff
expires
Mon, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Wed, 09 Sep 2026 00:42:03 GMT
content-type
application/javascript; charset=utf-8
x-frame-options
SAMEORIGIN
reporting-endpoints
default="/_/ContributorServingWebSwitchboardHttp/web-reports?context=eJzjStHikmJw1pBiaL15jnU6EJcsOs_aBsRdQDwHiA0VLrE6A_GH-susP4C4SOIKawsQf6q6wSpSfYP1W7EvG0eJLxvLW3-2hdMC2VYCsYhBEJsMEKcdDGfLA2Ihbo7b15qusgl8uN8rpKSRlF8Yn5yfV1KUmVRakl-UlpyWWpxaVJZaFG9kYGRmYGlgrmdgHl9gAACrbzqH"
content-security-policy
require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-rC2exyI31eGnsgnDc4ERfA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
cache-control
no-cache, no-store, max-age=0, must-revalidate
timing-allow-origin
*
cross-origin-opener-policy
same-origin
pragma
no-cache
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy
cross-origin
permissions-policy
ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
x-xss-protection
0
server
ESF
GET

waffle_sprite53.png
ssl.gstatic.com/docs/spreadsheets/ Frame B76A
0
0


GET
H3
200
4Ua_rENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RFD48TE63OOYKtrwEIJllpyk.woff2
fonts.gstatic.com/s/googlesans/v70/ Frame B76A
22 KB
22 KB
38ms
37ms
Font
font/woff2
142.251.211.131
Google LLC
General
Full URL
https://fonts.gstatic.com/s/googlesans/v70/4Ua_rENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RFD48TE63OOYKtrwEIJllpyk.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Google+Sans
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.211.131 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
lclgaa-au-in-f3.1e100.net
Software
sffe /
Resource Hash
2634df0d79333ea639d7079f566163bb700a57783d3a8f09061c6b11a8a78bcb
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
https://docs.google.com
sec-ch-ua-platform
"Linux"
Referer
https://fonts.googleapis.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

age
29514
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options
nosniff
expires
Wed, 08 Sep 2027 16:30:08 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Tue, 08 Sep 2026 16:30:08 GMT
last-modified
Tue, 21 Jul 2026 18:27:49 GMT
content-type
font/woff2
cache-control
public, max-age=31536000
timing-allow-origin
*
cross-origin-opener-policy
same-origin; report-to="apps-themes"
cross-origin-resource-policy
cross-origin
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges
bytes
access-control-allow-origin
*
content-length
22048
x-xss-protection
0
server
sffe
GET

waffle_sprite53.png
ssl.gstatic.com/docs/spreadsheets/ Frame DA69
0
0


GET
H3
200
4Ua_rENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RFD48TE63OOYKtrwEIJllpyk.woff2
fonts.gstatic.com/s/googlesans/v70/ Frame DA69
22 KB
0
20ms
20ms
Font
font/woff2
142.251.211.131
Google LLC
General
Full URL
https://fonts.gstatic.com/s/googlesans/v70/4Ua_rENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RFD48TE63OOYKtrwEIJllpyk.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Google+Sans
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.211.131 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
lclgaa-au-in-f3.1e100.net
Software
sffe /
Resource Hash
2634df0d79333ea639d7079f566163bb700a57783d3a8f09061c6b11a8a78bcb
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
https://docs.google.com
sec-ch-ua-platform
"Linux"
Referer
https://fonts.googleapis.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

age
29514
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options
nosniff
expires
Wed, 08 Sep 2027 16:30:08 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Tue, 08 Sep 2026 16:30:08 GMT
last-modified
Tue, 21 Jul 2026 18:27:49 GMT
content-type
font/woff2
cache-control
public, max-age=31536000
timing-allow-origin
*
cross-origin-opener-policy
same-origin; report-to="apps-themes"
cross-origin-resource-policy
cross-origin
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges
bytes
access-control-allow-origin
*
content-length
22048
x-xss-protection
0
server
sffe
GET
H3
200
informaLogoCross-SPlaD0EU.png
www.darkreading.com/assets/
45 KB
0
1ms
1ms
Image
image/png
104.16.224.171
Cloudflare
General
Full URL
https://www.darkreading.com/assets/informaLogoCross-SPlaD0EU.png
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/cyberattacks-data-breaches/attackers-multi-hop-google-redirects-phishing-campaign
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.16.224.171 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
b8fea27508e12f35d3d691181bcb7df458290820b1af4611c6f7ed17188ecac7
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.darkreading.com/cyberattacks-data-breaches/attackers-multi-hop-google-redirects-phishing-campaign
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

cf-cache-status
HIT
etag
W/"13688-1a049e42e70"
age
386806
cf-bgj
imgq:100,h2pri
x-content-type-options
nosniff
cf-polished
ok, orig_size=79496
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Wed, 09 Sep 2026 00:42:00 GMT
content-type
image/png
last-modified
Fri, 28 Aug 2026 19:41:26 GMT
vary
accept-encoding
priority
u=4,i
cache-control
public, max-age=31536000, immutable
cf-ray
a38226878b7cebbc-YYZ
accept-ranges
bytes
content-length
45916
server
cloudflare
GET
H2
200
hopscotch-LeoPatrizi-GettyImages-1303877346.jpg
eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt03ee880bdb37bd5a/6aa06071aa16bb4982ce6be0/
66 KB
0
5ms
5ms
Image
image/webp
104.17.160.85
Cloudflare
General
Full URL
https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt03ee880bdb37bd5a/6aa06071aa16bb4982ce6be0/hopscotch-LeoPatrizi-GettyImages-1303877346.jpg?width=1280&auto=webp&quality=80&disable=upscale
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/cyberattacks-data-breaches/attackers-multi-hop-google-redirects-phishing-campaign
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.17.160.85 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
9e3ac9037c7fcdbb4f020f4e28f693402bc5b40ed5c44868616a55bc97bb3a8e
Security Headers
Name Value
Content-Security-Policy default-src 'none'; navigate-to 'none'; form-action 'none'; img-src data:; style-src 'unsafe-inline';

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

x-request-id
64724db0-e07f-4264-9d60-372719ff9b95
access-control-expose-headers
*
surrogate-key
blt6d90778a997de1cd.sys_assets blt6d90778a997de1cd.sys_assets.blt03ee880bdb37bd5a.download
cf-cache-status
HIT
etag
"cfCUoUBmd8MpqaROegE7vihMxhYTQhf9zcdjWfOyvKDQ"
age
18302
cache-tag
blt6d90778a997de1cd.sys_assets blt6d90778a997de1cd.sys_assets.blt03ee880bdb37bd5a.download
cf-resized
internal=ok/h q=0 n=93+4 c=260+130 v=2026.9.0 l=67698 f=false c2=7 wv=2026.9.0
x-api-key
blt6d90778a997de1cd
access-control-allow-methods
GET,HEAD,PUT,PATCH,POST,DELETE,OPTIONS
x-cache
HIT, HIT
date
Wed, 09 Sep 2026 00:42:00 GMT
content-type
image/webp
content-disposition
inline; filename=hopscotch-LeoPatrizi-GettyImages-1303877346.webp
x-runtime
38ms
last-modified
Tue, 08 Sep 2026 19:22:26 GMT
x-contentstack-organization
blt5948195ac13977b0
access-control-allow-headers
*
content-security-policy
default-src 'none'; navigate-to 'none'; form-action 'none'; img-src data:; style-src 'unsafe-inline';
cache-control
public, max-age=31536000
x-timer
804
via
a38067aeecf87456-MIA
cf-ray
a382268b097646b5-YYZ
accept-ranges
bytes
access-control-allow-origin
*
content-length
67698
server
cloudflare
GET
H3
200
pubhtml Show response
docs.google.com/spreadsheets/d/e/2PACX-1vQsygsynrhlYSFLOwZ9IaqURE4cQ3rGo07MkUiECTl3zXlINi_MWVmfxgjSgmvPhGmk0kPdS8DBzkoj/ Frame 5FAE
80 KB
20 KB
418ms
416ms
Document
text/html
142.250.217.14
Google LLC
General
Full URL
https://docs.google.com/spreadsheets/d/e/2PACX-1vQsygsynrhlYSFLOwZ9IaqURE4cQ3rGo07MkUiECTl3zXlINi_MWVmfxgjSgmvPhGmk0kPdS8DBzkoj/pubhtml?gid=1145058527&single=false&widget=false&headers=false&chrome=false
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/cyberattacks-data-breaches/attackers-multi-hop-google-redirects-phishing-campaign
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.217.14 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
pnlgaa-as-in-f14.1e100.net
Software
ESF /
Resource Hash
d90fe39eba8eaebf701870d919de3fc238c08d9ab20a49feb77fd3eae721d5b0
Security Headers
Name Value
Content-Security-Policy require-trusted-types-for 'script';report-uri https://csp.withgoogle.com/csp/docs-tt base-uri 'self';object-src 'self';report-uri https://docs.google.com/spreadsheets/cspreport;script-src 'report-sample' 'nonce-nzNEh6qMKUDFhvpdNQPKug' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';worker-src 'self' blob:
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.darkreading.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0
sec-ch-ua-platform
"Linux"

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
private, max-age=300
content-encoding
gzip
content-security-policy
require-trusted-types-for 'script';report-uri https://csp.withgoogle.com/csp/docs-tt base-uri 'self';object-src 'self';report-uri https://docs.google.com/spreadsheets/cspreport;script-src 'report-sample' 'nonce-nzNEh6qMKUDFhvpdNQPKug' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';worker-src 'self' blob:
content-type
text/html; charset=utf-8
date
Wed, 09 Sep 2026 00:42:03 GMT
document-policy
include-js-call-stacks-in-crash-reports
expires
Wed, 09 Sep 2026 00:42:03 GMT
origin-trial
AjyTYHf8xEAhAVTh+xijZ3UXTXlMphOHFXjhD3+Actoe+f2FNuWk3attcE3NSlrBekTItGxJqARYCSiIONcWXgYAAABveyJvcmlnaW4iOiJodHRwczovL2dvb2dsZS5jb206NDQzIiwiZmVhdHVyZSI6IkNyYXNoUmVwb3J0aW5nU3RvcmFnZUFQSSIsImV4cGlyeSI6MTc3NjcyOTYwMCwiaXNTdWJkb21haW4iOnRydWV9,AqC/Qix3G13EOijgi8REB7561k6Amd5kUmmrICdsJGTmoxbSslCnhfyf16w1cyZdM9ymZNS1akp9kP2jx65eTgoAAAB1eyJvcmlnaW4iOiJodHRwczovL2dvb2dsZS5jb206NDQzIiwiZmVhdHVyZSI6IldlYkFzc2VtYmx5Q3VzdG9tRGVzY3JpcHRvcnNWMiIsImV4cGlyeSI6MTc5MzY2NDAwMCwiaXNTdWJkb21haW4iOnRydWV9
p3p
CP="This is not a P3P policy! See g.co/p3phelp for more info."
referrer-policy
strict-origin-when-cross-origin
reporting-endpoints
default="/spreadsheets/d/e/2PACX-1vQsygsynrhlYSFLOwZ9IaqURE4cQ3rGo07MkUiECTl3zXlINi_MWVmfxgjSgmvPhGmk0kPdS8DBzkoj/web-reports?bl=editors.spreadsheets-frontend_20260902.00_p5&context=eJwV1WdYFFcXB_Bhd-YcygJLWTrLsktbehGxYKEo2ECNyaImGhUbdgFrJBbEir0bew_WqNHYYos1AmqsYJRIFUFQUIrA-38__J4zz__MvTMf7nOuaXn7XcYG4ZiZQTitMAjZ5gZhn9IgfGtlENTWBsFbZRBuwp9OBsHJ2SAEqA3CfkjWGYQrXgah2dcgmPsbBL8Ag7Au0CBkhRiEzWEGYTuU9TAIDb2wR5JBiID8IQbhDWhGGoR2EwxCLNTOMghGsw3C8_kGoRxythiEizBkn0GwyzcIXpDzDBmki0nCYggyTRK6QZsySbC0ShKudkoS8mFoZJIwAbITkoQdEDYzSYiB16qHQqhvpawTPLlRK3sFBUUfZW_hVeAnWQmY9_kkU0F9SL2sBXrG18sS4JuF9bKhMHrCF9kkOBvZILsMPcc0yBLAbUWDzBsez2mUFcDye42ydRCS3yjrCInWTTIDvFrYJCuB3N1NsqcgG9oqMwW10CbzgvkubbKlcH5Wm-wqnLYU5BdBViTITaFkr5G8YZ-RXNhvJJf9JZNv8JHLf4HHg-TyAli9QC7fDP2WyOVJMKdELl8IUaaiXO8uykNg5YdO4gb4khgp3tocKeZC_dFIsQUaIrqIQocuYunmLmItZIzvLmbBdZco8R6oekWJGnjVO0osgfoNUWILpERHi9NB_lO0aAYn7WPE8-A1IEYMhBUzYsT1UH0iRvwMT87GiN1LYkSfw7FiMDz4ECs-gSqoh_Y1sWJXiIJesBzWwW3IA_PaWFEF7qCHxZANfVN6iIMgfVoPcR7sXNdDPAiKKz1EW5hxu4d4tbSHeAdiw3uKfSF_ck_xDQxviBPHwkVVvDhwQrw4BDbb9BJ3QYtDL9HYsZe4m3uLh2Fo4i7pxsBd0n24MQ4VDo_fJZ2Hped2SWvAt_Nuad3r3VLjp92SUd1u6RzchsBhe6THtvukAphnv0_KhrUf9klboXTifqkabGbul3QQBQMguni_1BuS0w5IE8F18QHJE_oUHpCGQoT7QSkg4aAUDpmXD0qrofOIQ1IfeCUclqpAcjssmUPh4MNSMVgcPSzZwc6KX6WDkBmQI60Gkz45khWEJORIHWHxxhwpG4bcOCqlQNao49IqyJnxTjoNcaveScH3KqUOEPqyUrpeUCndA-Nu7yUlXPjjvXQd3K6_l7zhWFKVdBY-b62SWmHRtippBUgH2iSGb5rMKAnyJyvoOUiZCjq3XUGXYMcvCtoL2w8raB88tzSnN6A4a062YH3enJwgscKcDJBaaU6zYOZfFvQzvBhjSZ67LCkAdE5K8gN1fyXlH1HSE1j0q5KWwt0XSsoFua8VmUGv7qinrcgGDj-0ovOQ2MOaDPDzCGtaAhnHrSkL5uZb0z544W5DRfDZ14Za4VqADY2KsKEJ4NDBhjTgN9KGwkD70IZ8YfRjG7I_Y0vecKHQlq5DVT8V1YPLbBV5QO4cFT0F6xwVOQHvtSNL2FpgR3vgdqEd5UFovR1FQ6zanvqCeqI9ecGkGfY0D35cb0_jIPWDPQUKDtQeRmgcaDwUHnOgYuh-x4HiYeJLB0qD8r2OVAPWA53IHtJ_dqJ5MGq5E02An6KdKRPy1zjTczDu7ULm0OWmC_UAy0IXsgWvVy7kB6--d6USOJPhStXZrvQJpPWupILuT10pHh7L1aQJUpMnfEhQUx3M7q-mDDA-oiZziP9VTf0g6KiaNrxU01bYXqim3eBYqyY1BH5UUxhsHOpGv2S40R4okGvoDZSRhj7AsvYaWgtdhmioB9QM11ADtI3X0IqtGhp0SEMp0PUPDfWEE3c0dA68PmuoPcxY4E4ZELHRnbr93z53ioMBRe40GMb5a2kqBAdpqQP8EKelkXAiS0vnIG6ZlhLh591aWgI_PdDSAuiXq6WBsBCWwKQ8LU2H7bAbBuZryQD577X0Bjy76CgAbNJ15Aymc3RkCaMhBZbP1dFqWPWTjtaD7omO_CCuQUeJsMrYg3bCVEsvmg9rPLxoC1gYvMgOXF94kScUZ3pTBaSIPjQdlkk-tBY82If8IcPCh7KgXOlDVbDLyof2w-4IHzoJeRk-9A8U7PWht3DyqQ-dh22lPrQXfkzqRFPhjtCZ1h_tTNsh41RnWgQVUA1XfutMN-De6c6UB2UJkTgnkXR7WiTlwYuMSHoNF29H0n34rySS3kHxxi70HpKFrpQGzcu6knx5V9pu0o32gaW6G7nB35HdqBDe9e9GTZBwqBsNgyU3u9NqGJIdRSmg3RFFvnAtP4rugsm7KLKCNTnR5DgphtzBJzWGgqFqZgzVw-6FMXQYtq2OoV_hSnkM5cIpiqVrsEMVSwfgRWIsFcHH6lhqglbrnkQ2PWnu_J60CCKnxlEUGKXHkQmU5sRRNRTfj6P38Ox5HL2G-KI46g9JX-MoLzCenoH3m3gKgsMpveg8eK_5j_yhW9lbSgTPD28pAK5oi-kWtPYvJhpQTB_gC0ydVkzp8Ka8mEqgX0UxDYQ79cWUB-rGYvKC6oBSqoNZvUppPmQfKaWNsC6nlLbBQ3gB16pL6RYIfcvIGFwTy8gT3qSWUQ0kny2jNCg-V0YVcPNBGf0NVbllVA_jlpTTJFBuLScNXN5fTn_By8vl9BroejlZwIQP5Zh95dRzbwV9B33yK2gA5Da-o6ew0KqSlsO8kEpaBNXjKunxtEp6CzszK-k4yAa-J1N4eO49vYCN8VW0Ax4nVtFL0I6pIl-Yk1VFC2H28ypaAJ8rq6gVXkRWUxHkJFXTRfA5V019wz7QALBe-oH6nflA38K0LjXU9EMNyYbVkM2YGnKGo4tqaHNhDVW9qaFvjWspuF0tsaGWjJJq6VFqLf0HRzbWkmJLLX1zqpa2nkV2u5bKYMmrWsqGOeJHUkkfaWLkR0qDgr4f6e-Uj3T_2EfKh29tP9GiAZ9oBZQO_0QJIz9RsE0dGebU0au5dfTwSB09g4qTdVQLA2_U0SzoUVlH8dAxsJ66QRz0g29hKIyC8TANZsLPsBjerq2nSri_vp7y4dbdevobAsrrKRTGV9fTFJgJ82AxrID1sBX2wCE4AWfhelM93Ybrzz_TbVhQ_Zmy4Mmnz_QSuqi-UAzsGfaF_MZ-oUvzvtANMK3_QmbcQLcUDeTs2kDdtQ00t6mBFkGhrJGKYZPYSDtBdGwkBYRMb6SOcP9EI3U92UjdIf55I_WH9i8bqRO8X9JE5jlN5H-tiVr8m0kMaKZLkc10HQqGNtOVWc10AzLnN9NKsM5uJgfIe9BMTyDiUTN9-u0rNcPIoq-06r-vtBM2qVpoJ2SPaKGNcO2XFroFqYdaaC58PtNCrfDgUQs9gqa2FpIJrSSTt5IpJIa2kgFs0lvJEeauaqWFsP5SK22F4KJWag_eUhsFwEl1G8UFtVE_WLymjZbDjx_baAw8jRH4XxifKfBkuFsn8ENY3yjwdthgMOLN4DTMiO_uNeKHcPuWEbvdMeKeLUa8rJOMV8GYLBlPgKIzMna-J2N3SKiWcYOtnGep5DwPFPZytoUGRzkLTnLuqJVzLzh9Vs5u5iJXaUW-PUDkB2CVLLIjNMwVefhCkf9cL_JfYHYNPYjIEzkWjsK7hyJr_hHZ2EXiCe0lHvaTxGPg2n8S3wbv3sT-UPIdcSWk_0Y8B858JL4EQ-YyD4daG2P-DHfijfkBZA8x5h2QPsyY58GBWcZ8BDZkGHPnLGMOP2PMPT4Z856vxnwIytuZcBWkRZjwvHgTzoSxKSY8CZpzTLj8hQlXw60mE74Px0xM-SwM6WjKIyH1e1OeDUlzTfkHCM825S7w6bIpN4DxVVNWQnKZKU-A-_AQNpSbcoKXGU_Qm_GVHmZsnmDGNuA9yIyXbjDjVTD5ihmnwqP7ZvwMlhebcW21GTfCOpmCt8AhbwWfAK8wBfvDsnYKHttHwU4TFRwxRcGRsDJNwetBOKDgXpAALpcV_PdjBf8DXm1YC-2gEzyKN-dnYBhgzmNBt9qc9VB03ZwvPDNnxb_mbAH-0EGy4HiodbRgc08LtoEgLwvu523B34KLrwV7gK6LBf-wz4IbnlpwC1h8tGBbiLGy5F5wepQlp2-y5MwSS14JTSolN2qU3Aa_Jyr51yQly8cq2QSqpyq5Di6nKzltvpJng-cBJfsfVnIgdHyg5ChY9UzJG6GbZMVxUB5kxXWQEmLF02HOQCueD6O_s-KYkVYcD7_tseJzcOqEFf8Bu85Y8c8W1rwE7rha82NY4mPNmyFlsTU_WWnNL2HqamtOhzN_WvOqW9a8AYQGa5Ygd64NDzpkw4Nh8jUbTgPZHRu-w7acD3nTbPn7dFseAX8ts-UHsGYtsnW23H-3LVcfteU6OH_Clo_ft-UzoHhpy6tLbHlfmS3rHFQcBko3FatA7a7iteEqdmmPZ9CAFjzAC3zAF_whGL6JU_Hvm1XclK_i6scq3m9ix-oOdqyDPpPseADof7XjEDh6zY6bX9qxUYEdB9jYczgowuzZFnbE2PNeaEyyZ9U8ey58ZM9FkNZsz3NAqXNgB9gGzxIduAwyhjpwFniNcuBAGHHcgcdAyEUHtrjiwHbw5q4Dv4Oq1w48stiBx4H9Fwd2gdRGB54Lo1ocOEfjyCvDHLlmlCMLyY48bpIjz5nlyAth3QVHTrzsyJk1eAfMmhx5Y6QTd-3vxN0hGqqGObHPaCcOAOcsJ155yIl1x5GB4wkn1kOns07cDUz-cmILyPrPiVfB21onroDkz06cAvNanHgvnNI58-9wzNeZT8ApOA1n4Rxc8Xfm96OcuRbiJzpzP5ia5sxftjtz9ilnrrnrzA1wKdeZd7Q5c7STCw-EiAAX7vJ_kS4cDVkxLrwJLsS58J-QsMKFv4HIfS4cCxveufCwShceBX52rnxR58pXYUBHVx4BkXNdORrUC1zZA4L3uvLXR668vNyV18BblZrXBqt5EzRAC6z9Uc2XUtV8E4ZvU_NouPy7miv-UHM13Lig5jsw46qaM2B4kZqTwe-rmj-bunErHPdx4yvwKsKNJ_Vz43Q4OBA5RI9w4ziIHunGA2HITDceDuMvurFxnhubw-QCN54BwltkEC1qeAAkwXithqfANJgB4zppOHaKhvvC5Kka3j5Nw3ugcIuG30LRXxouhUl5Gt4M9vkatn2uYRcYU6DhCbDrjYYPgXeNhu2M3VkNC23ceSnIPdyZocLfnT9AUZA7l4JznDtrQN3LnYMhYb4763a4sx7Mn7lzUL07R8CRQC2fhMGhWh4Bq7touairlp1jtOwOskVatoY9mVo-At2ztBwPyk1aVoEjDC_T4q7Rss5Fx34Q5qvjlHE6ngKF03VcDXMW67gqW8f10HWLjq226fjH_Tq-VaHjZKUHT4RUaw9-aOPBWpUH-0KeCzIvD54FJYkevGasB2-EV7s9-M4BD86Fc489-BK8_wfZaw9-Du7GnhwChyM9-RjsT_Dk5HGenAbCn55sDOagvOrJKqh65Mn1sLTVk7NhCHvxcEjz9eIZYBnuxe7FXtzR1JtN9d5sDVMCvXkmeI_15gj4PMGbt03z5l3w7IE3vwbFP95sC8cCffg0WAT58MhgHx4HsYk-3Av-Xe3Db6HiNx9uLPThNvhcjApiiQ__bqLnS3AT7sEjeA5_h-n5ITyGXe30vB-mdtbzTJgLK2BVpB7zRs_arnpuB0NhBJRO03MlULqezWBTpp63Q9lKPb8Hnx16DoAN-_X8C-Rc0vNp6HhFz1Egu6dnYzA80_P3cLdQz7cr8E8wqE7Pg8G8Sc_WMM3Mlyfa-PJP8HaaL1em-3IzDJrhy8lwf4EvP4ICKIKSpb5cD_O3-PK9s-jB01e-XAod3_hyV0j4gvWw7qsvb4PxXn68oL0fv4vy4w9wb5If58HgDD8esMiP_9jvx_N6-7P_In-OhDfN_pzd5s8bYZ19AEfEBfBdyIUOqwK4K_SEvjAIhsBIGAcpMAUyIBNWwjrYBrsh6fcAHgb7LwRw55sB3B0e_RvAtcaBbGQSyJIykFv0qL6BfGlKIN-A9xsCuQ4UJkHsAueDg_hGnyB-sTCIX8MvD4K4-EUQ15cGcQuM1QfzJFgXHcybQZoczArouSiY-0CYUQh3ghCPEG4PLoEh7A9PI0Iw80J4U6cQPg5DB4Twv4YQLoElSSG8DFbASlgNa-GbsSE8blMIT4YN-SGcXBHCE8DofQgz1NaE8I0vIXwHxn_F9-xCuSe0hYWy2C6Ua6ABIiNCOQaMOocyQWK3UP4RhsWH8iiYCNNg8BjkMPtpKIe9DOUO0PgulFvhu6pQHgPf-YfxUEgKDOODYWG8sUMYbwfbE2GshjSYDc01YWxUG8aX4BoYPoXxD9Czazt23dKOtZDqEc6zoTU6nDkmnI_0DufU1eE8B3LXh_OeneH89Eg4F0Lub-FckRvO1RDzMpzj4aBNe84Ba4VxwdOFT0h5_snrFTInq_7pIyeOTx03Ojk-bdLE78aPnqn1H508Pm3K9NTA1KnTR49IRm90WmrAmOlTJqeNnpw8PDQ4tH1wx-DQwODg4VPD_wd1nDxb&build-label=editors.spreadsheets-frontend_20260902.00_p5&imp-sid=CKPH1_Wh4JYDFeONWQQdiLglRg&is-cached-offline=false&cellSizeBucket=RITZ_SHEET_CELLS_50K_TO_100K&wcrumsspbp=true"
server
ESF
x-content-type-options
nosniff
x-l2-request-path
l2-managed-6
x-robots-tag
noindex, nofollow, nosnippet
x-xss-protection
0
GET
H3
200
pubhtml Show response
docs.google.com/spreadsheets/d/e/2PACX-1vQsygsynrhlYSFLOwZ9IaqURE4cQ3rGo07MkUiECTl3zXlINi_MWVmfxgjSgmvPhGmk0kPdS8DBzkoj/ Frame 3222
79 KB
20 KB
912ms
910ms
Document
text/html
142.250.217.14
Google LLC
General
Full URL
https://docs.google.com/spreadsheets/d/e/2PACX-1vQsygsynrhlYSFLOwZ9IaqURE4cQ3rGo07MkUiECTl3zXlINi_MWVmfxgjSgmvPhGmk0kPdS8DBzkoj/pubhtml?gid=0&single=false&widget=false&headers=false&chrome=false
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/cyberattacks-data-breaches/attackers-multi-hop-google-redirects-phishing-campaign
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.217.14 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
pnlgaa-as-in-f14.1e100.net
Software
ESF /
Resource Hash
0b97055e7c49281ce18323f206e972d36de6ebf50c5005af0a243d7acff3f47e
Security Headers
Name Value
Content-Security-Policy require-trusted-types-for 'script';report-uri https://csp.withgoogle.com/csp/docs-tt base-uri 'self';object-src 'self';report-uri https://docs.google.com/spreadsheets/cspreport;script-src 'report-sample' 'nonce-GEZFVg8ptg7XmeK1lLoQ6w' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';worker-src 'self' blob:
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.darkreading.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0
sec-ch-ua-platform
"Linux"

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
no-cache, no-store, max-age=0, must-revalidate
content-encoding
gzip
content-security-policy
require-trusted-types-for 'script';report-uri https://csp.withgoogle.com/csp/docs-tt base-uri 'self';object-src 'self';report-uri https://docs.google.com/spreadsheets/cspreport;script-src 'report-sample' 'nonce-GEZFVg8ptg7XmeK1lLoQ6w' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';worker-src 'self' blob:
content-type
text/html; charset=utf-8
date
Wed, 09 Sep 2026 00:42:04 GMT
document-policy
include-js-call-stacks-in-crash-reports
expires
Mon, 01 Jan 1990 00:00:00 GMT
origin-trial
AjyTYHf8xEAhAVTh+xijZ3UXTXlMphOHFXjhD3+Actoe+f2FNuWk3attcE3NSlrBekTItGxJqARYCSiIONcWXgYAAABveyJvcmlnaW4iOiJodHRwczovL2dvb2dsZS5jb206NDQzIiwiZmVhdHVyZSI6IkNyYXNoUmVwb3J0aW5nU3RvcmFnZUFQSSIsImV4cGlyeSI6MTc3NjcyOTYwMCwiaXNTdWJkb21haW4iOnRydWV9,AqC/Qix3G13EOijgi8REB7561k6Amd5kUmmrICdsJGTmoxbSslCnhfyf16w1cyZdM9ymZNS1akp9kP2jx65eTgoAAAB1eyJvcmlnaW4iOiJodHRwczovL2dvb2dsZS5jb206NDQzIiwiZmVhdHVyZSI6IldlYkFzc2VtYmx5Q3VzdG9tRGVzY3JpcHRvcnNWMiIsImV4cGlyeSI6MTc5MzY2NDAwMCwiaXNTdWJkb21haW4iOnRydWV9
p3p
CP="This is not a P3P policy! See g.co/p3phelp for more info."
pragma
no-cache
referrer-policy
strict-origin-when-cross-origin
reporting-endpoints
default="/spreadsheets/d/e/2PACX-1vQsygsynrhlYSFLOwZ9IaqURE4cQ3rGo07MkUiECTl3zXlINi_MWVmfxgjSgmvPhGmk0kPdS8DBzkoj/web-reports?bl=editors.spreadsheets-frontend_20260902.00_p5&context=eJwV1WdUFHcXBvBhd-ZeygJLWTrLsktbehGxYKEo2ECNyaImGhUbdgFrJBbEir0bFbsGa9RobLHEHgE1dowSqSIICkoReJ_3w-_cOc-d-5_5MOeOaXn7XcYG4aiZQTilMAjZ5gZhr9IgfGtlENTWBsFbZRD-gj-dDIKTs0EIUBuEfZCsMwiXvQxCs69BMPc3CH4BBmFdoEHICjEIm8MMwnYo62EQGnrhjCSDEAEFQwzCG9CMNAjtJhiEWKidZRCMZhuEZ_MNQjnkbjEIF2DIXoNgX4BZyH2KDNLFJGExBJkmCd2gTZkkWFolCVc6JQkFMDQySZgA2QlJwg4Im5kkxMBr1QMh1LdS1gkeX6-VvYKXRR9lb-FV4CdZCZj3-SRTQX1IvawFesbXyxLgm4X1sqEwesIX2SQ4E9kguwQ9xzTIEsBtRYPMGx7NaZS9hOV3G2XrIKSgUdYREq2bZAZ4tbBJVgJ5OU2yJyAb2iozBbXQJvOC-S5tsqVwblab7AqcshTkF0BWJMhNoWSPkbxhr5Fc2Gckl92QyTf4yOW_wKNBcvlLWL1ALt8M_ZbI5Ukwp0QuXwhRpqJc7y7KQ2Dlh07iBviSGCne3Bwp5kH9kUixBRoiuohChy5i6eYuYi1kjO8uZsE1lyjxLqh6RYkaeNU7SiyB-g1RYgukREeL00H-U7RoBifsY8Rz4DUgRgyEFTNixPVQfTxG_AyPz8SI3UtiRJ9DsWIw3P8QKz6GKqiH9jWxYleIgl6wHNbBLcgH89pYUQXuoIfFkA19U3qIgyB9Wg9xHuxc10M8AIrLPURbmHGrh3iltId4G2LDe4p9oWByT_ENDG-IE8fCBVW8OHBCvDgENtv0EndBi0Mv0dixl5jDvcVDMDRxl3R94C7pHlwfhwqHxu-SzsHSs7ukNeDbOUda9zpHavyUIxnV5Uhn4RYEDtstPbLdK72EefZ7pWxY-2GvtBVKJ-6TqsFm5j5JB1EwAKKL90m9ITltvzQRXBfvlzyhT-F-aShEuB-QAhIOSOGQeemAtBo6jzgo9YFXwiGpCiS3Q5I5FA4-JBWDxZFDkh3srPhVOgCZAbnSajDpkytZQUhCrtQRFm_MlbJhyPUjUgpkjTomrYLcGe-kUxC36p0UfLdS6gChLyqlay8rpbtg3O29pITzf7yXroHbtfeSNxxNqpLOwOetVVIrLNpWJa0AaX-bxPBNkxklQcFkBT0DKVNBZ7cr6CLs-EVBe2D7IQXthWeW5vQGFGfMyRasz5mTEyRWmJMBUivNaRbMvGFBP8PzMZbkucuSAkDnpCQ_UPdXUsFhJT2GRb8qaSncea6kPJD7WpEZ9OqOesqKbODQAys6B4k9rMkAP4-wpiWQccyasmBugTXthefuNlQEn31tqBWuBtjQqAgbmgAOHWxIA34jbSgMtA9syBdGP7Ih-9O25A3nC23pGlT1U1E9uMxWkQfkzVHRE7DOVZET8B47soStL-1oN9wqtKN8CK23o2iIVdtTX1BPtCcvmDTDnubBj-vtaRykfrCnQMGB2sMIjQONh8KjDlQM3W87UDxMfOFAaVC-x5FqwHqgE9lD-s9ONA9GLXeiCfBTtDNlQsEaZ3oGxr1dyBy6_OVCPcCy0IVsweuVC_nBq-9dqQROZ7hSdbYrfQJpvSupoPsTV4qHR3I1aYLU5AkfEtRUB7P7qykDjA-ryRzif1VTPwg6oqYNL9S0FbYXqikHHGvVpIbAj2oKg41D3eiXDDfaDS_lGnoDZaShD7CsvYbWQpchGuoBNcM11ABt4zW0YquGBh3UUAp0_UNDPeH4bQ2dBa_PGmoPMxa4UwZEbHSnbv-3153iYECROw2Gcf5amgrBQVrqAD_EaWkkHM_S0lmIW6alRPg5R0tL4Kf7WloA_fK0NBAWwhKYlK-l6bAdcmBggZYMUPBeS2_As4uOAsAmXUfOYDpHR5YwGlJg-VwdrYZVP-loPege68gP4hp0lAirjD1oJ0y19KL5sMbDi7aAhcGL7MD1uRd5QnGmN1VAiuhD02GZ5ENrwYN9yB8yLHwoC8qVPlQFu6x8aB_kRPjQCcjP8KF_4OUeH3oLJ5740DnYVupDe-DHpE40FW4LnWn9kc60HTJOdqZFUAHVcPm3znQd7p7qTPlQlhCJ7ySSbk2LpHx4nhFJr-HCrUi6B_-VRNI7KN7Yhd5DstCV0qB5WVeSL-9K20260V6wVHcjN_g7shsVwrv-3agJEg52o2Gw5K_utBqGZEdRCmh3RJEvXC2Iojtg8i6KrGBNbjQ5Toohd_BJjaFgqJoZQ_WQszCGDsG21TH0K1wuj6E8OEmxdBV2qGJpPzxPjKUi-FgdS03Qat2TyKYnzZ3fkxZB5NQ4igKj9DgygdLcOKqG4ntx9B6ePouj1xBfFEf9IelrHOUHxtNT8H4TT0FwKKUXnQPvNf-RP3Qre0uJ4PnhLQXAZW0x3YTW_sVEA4rpA3yBqdOKKR3elBdTCfSrKKaBcLu-mPJB3VhMXlAdUEp1MKtXKc2H7MOltBHW5ZbSNngAz-FqdSndBKFvGRmDa2IZecKb1DKqgeQzZZQGxWfLqAL-ul9Gf0NVXhnVw7gl5TQJlFvLSQOX9pXTDXhxqZxeA10rJwuY8KEcu6-ceu6poO-gT0EFDYC8xnf0BBZaVdJymBdSSYugelwlPZpWSW9hZ2YlHQPZwPdkCg_OvqfnsDG-inbAo8QqegHaMVXkC3OyqmghzH5WRQvgc2UVtcLzyGoqgtykaroAPmerqW_YBxoA1ks_UL_TH-hbmNalhpp-qCHZsBqyGVNDznBkUQ1tLqyhqjc19K1xLQW3qyU21JJRUi09TK2l_-DwxlpSbKmlb07W0tYzyG7VUhkseVVL2TBH_Egq6SNNjPxIafCy70f6O-Uj3Tv6kQrgW9tPtGjAJ1oBpcM_UcLITxRsU0eGOXX0am4dPThcR0-h4kQd1cLA63U0C3pU1lE8dAysp24QB_3gWxgKo2A8TIOZ8DMshrdr66kS7q2vpwK4eaee_oaA8noKhfHV9TQFZsI8WAwrYD1shd1wEI7DGbjWVE-34Nqzz3QLFlR_pix4_OkzvYAuqi8UA7uHfSG_sV_o4rwvdB1M67-QGTfQTUUDObs2UHdtA81taqBFUChrpGLYJDbSThAdG0kBIdMbqSPcO95IXU80UneIf9ZI_aH9i0bqBO-XNJF5bhP5X22iFv9mEgOa6WJkM12Dl0Ob6fKsZroOmfObaSVYZzeTA-Tfb6bHEPGwmT799pWaYWTRV1r131faCZtULbQTske00Ea4-ksL3YTUgy00Fz6fbqFWuP-whR5CU1sLyYRWkslbyRQSQ1vJADbpreQIc1e10kJYf7GVtkJwUSu1B2-pjQLghLqN4oLaqB8sXtNGy-HHj200Bp7ECPwvjM8UeDLcqRP4AaxvFHg7bDAY8WZwGmbEd_YY8QO4ddOI3W4bcc8WI17WScarYEyWjCdA0WkZO9-VsTskVMu4wVbOs1RyngcKeznbQoOjnAUnOXfUyrkXnDojZzdzkau0It8aIPJ9sEoW2REa5oo8fKHIf64X-QaYXUUPIvJFjoUj8O6ByJp_RDZ2kXhCe4mH_STxGLj6n8S3wLs3sT-UfEdcCem_Ec-B0x-JL8KQuczDodbGmD_D7Xhjvg_ZQ4x5B6QPM-Z5sH-WMR-GDRnG3DnLmMNPG3OPT8a8-6sxH4TydiZcBWkRJjwv3oQzYWyKCU-C5lwTLn9uwtVws8mE78FRE1M-A0M6mvJISP3elGdD0lxT_gHCs025C3y6ZMoNYHzFlJWQXGbKE-AePIAN5aac4GXGE_RmfLmHGZsnmLENeA8y46UbzHgVTL5sxqnw8J4ZP4XlxWZcW23GjbBOpuAtcNBbwcfBK0zB_rCsnYLH9lGw00QFR0xRcCSsTFPwehD2K7gXJIDLJQX__UjB_4BXG2ahHXSCh_Hm_BQMA8x5LOhWm7Meiq6Z8_mn5qz415wtwB86SBYcD7WOFmzuacE2EORlwf28LfhbcPG1YA_QdbHgYXstuOGJBbeAxUcLtoUYK0vuBadGWXL6JkvOLLHkldCkUnKjRslt8Huikn9NUrJ8rJJNoHqqkuvgUrqS0-YreTZ47ley_yElB0LH-0qOglVPlbwRuklWHAflQVZcBykhVjwd5gy04vkw-jsrjhlpxfHw224rPgsnj1vxH7DrtBX_bGHNS-C2qzU_giU-1rwZUhZb8-OV1vwCpq625nQ4_ac1r7ppzRtAaLBmCfLm2vCggzY8GCZfteE0kN224dtsywWQP82Wv0-35RFwY5kt34c1a5Gts-X-ObZcfcSW6-DccVs-ds-WT4PihS2vLrHlvWW2rHNQcRgo3VSsArW7iteGq9ilPa5BA1rwAC_wAV_wh2D4Jk7Fv29WcVOBiqsfqXifiR2rO9ixDvpMsuMBoP_VjkPgyFU7bn5hx0Yv7TjAxp7DQRFmz7awI8ae90Bjkj2r5tlz4UN7LoK0ZnueA0qdAzvANnia6MBlkDHUgbPAa5QDB8KIYw48BkIuOLDFZQe2gzd3HPgdVL124JHFDjwO7L84sAukNjrwXBjV4sC5GkdeGebINaMcWUh25HGTHHnOLEdeCOvOO3LiJUfOrME9YNbkyBsjnbhrfyfuDtFQNcyJfUY7cQA4ZznxyoNOrDuGDByPO7EeOp1x4m5gcsOJLSDrPydeBW9rnbgCkj87cQrMa3HiPXBS58y_w1FfZz4OJ-EUnIGzcNnfmd-PcuZaiJ_ozP1gapozf9nuzNknnbnmjjM3wMU8Z97R5szRTi48ECICXLjL_0W6cDRkxbjwJjgf58J_QsIKF_4GIve6cCxseOfCwypdeBT42bnyBZ0rX4EBHV15BETOdeVoUC9wZQ8I3uPKXx-68vJyV14Db1VqXhus5k3QAC2w9kc1V6eq-TMM36bm0XDpdzVX_IEcrp9X822YcUXNGTC8SM3J4PcVM6Zu3ArHfNz4MryKcONJ_dw4HQ4MRA7RI9w4DqJHuvFAGDLTjYfD-AtubJzvxuYw-aUbzwDhLTKIFjU8AJJgvFbDU2AazIBxnTQcO0XDfWHyVA1vn6bh3VC4RcNvoeiGhkthUr6GN4N9gYZtn2nYBca81PAE2PVGwwfBu0bDdsburIaFNu68FOQe7sxQ4e_OH6AoyJ1LwTnOnTWg7uXOwZAw3511O9xZD-ZP3Tmo3p0j4HCglk_A4FAtj4DVXbRc1FXLzjFadgfZIi1bw-5MLR-G7llajgflJi2rwBGGl2nxr9GyzkXHfhDmq-OUcTqeAoXTdVwNcxbruCpbx_XQdYuOrbbp-Md9Or5ZoeNkpQdPhFRrD35g48FalQf7Qr4LMi8PngUliR68ZqwHb4RXOR58e78H58HZRx58Ed7_g-y1Bz8Dd2NPDoFDkZ58FPYleHLyOE9OA-FPTzYGc1Be8WQVVD305HpY2urJ2TCEvXg4pPl68QywDPdi92Iv7mjqzaZ6b7aGKYHePBO8x3pzBHye4M3bpnnzLnh635tfg-Ifb7aFo4E-fAosgnx4ZLAPj4PYRB_uBf-u9uG3UPGbDzcW-nAbfC5GBbHEh3830fNF-AvuwkN4Bn-H6fkBPIJd7fS8D6Z21vNMmAsrYFWkHvtGz9quem4HQ2EElE7TcyVQup7NYFOmnrdD2Uo9vwefHXoOgA379PwL5F7U8ynoeFnPUSC7q2djMDzV8_dwp1DPtyrwTjCoTs-DwbxJz9YwzcyXJ9r48k_wdpovV6b7cjMMmuHLyXBvgS8_hJdQBCVLfbke5m_x5btn0IMnr3y5FDq-8eWukPAF87Duqy9vg_FefrygvR-_i_LjD3B3kh_nw-AMPx6wyI__2OfH83r7s_8if46EN83-nN3mzxthnX0AR8QF8B3Igw6rArgr9IS-MAiGwEgYBykwBTIgE1bCOtgGOZD0ewAPg33nA7jzXwHcHR7-G8C1xoFsZBLIkjKQW_SovoF8cUogX4f3GwK5DhQmQewC54KD-HqfIH6-MIhfwy_3g7j4eRDXlwZxC4zVB_MkWBcdzJtBmhzMCui5KJj7QJhRCHeCEI8Qbg8ugSHsD08iQrDzQnhTpxA-BkMHhPC_hhAugSVJIbwMVsBKWA1r4ZuxITxuUwhPhg0FIZxcEcITwOh9CDPU1oTw9S8hfBvGf8Xz7EK5J7SFhbLYLpRroAEiI0I5Bow6hzJBYrdQ_hGGxYfyKJgI02DwGOQw-0koh70I5Q7Q-C6UW-G7qlAeA9_5h_FQSAoM4wNhYbyxQxhvB9vjYayGNJgNzTVhbFQbxhfhKhg-hfEP0LNrO3bd0o61kOoRzrOhNTqcOSacD_cO59TV4TwH8taH8-6d4fzkcDgXQt5v4VyRF87VEPMinOPhgE17zgVrM-PCJwsfkzLn2i0XJ6v-6SMnjk8dNzo5Pm3SxO_Gj56p9R-dPD5tyvTUwNSp00ePSEZvdFpqwJjpUyanjZ6cPDw0OLR9cMfg0MDg4OFTw_8HEX08Dg&build-label=editors.spreadsheets-frontend_20260902.00_p5&imp-sid=CMWW9PWh4JYDFSpJWAYdPS04ug&is-cached-offline=false&cellSizeBucket=RITZ_SHEET_CELLS_50K_TO_100K&wcrumsspbp=true"
server
ESF
x-content-type-options
nosniff
x-l2-request-path
l2-managed-6
x-robots-tag
noindex, nofollow, nosnippet
x-xss-protection
0
GET
H3
200
pubhtml Show response
docs.google.com/spreadsheets/d/e/2PACX-1vQsygsynrhlYSFLOwZ9IaqURE4cQ3rGo07MkUiECTl3zXlINi_MWVmfxgjSgmvPhGmk0kPdS8DBzkoj/ Frame 36F5
81 KB
20 KB
900ms
899ms
Document
text/html
142.250.217.14
Google LLC
General
Full URL
https://docs.google.com/spreadsheets/d/e/2PACX-1vQsygsynrhlYSFLOwZ9IaqURE4cQ3rGo07MkUiECTl3zXlINi_MWVmfxgjSgmvPhGmk0kPdS8DBzkoj/pubhtml?gid=326945225&widget=false&headers=false&chrome=false
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/cyberattacks-data-breaches/attackers-multi-hop-google-redirects-phishing-campaign
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.217.14 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
pnlgaa-as-in-f14.1e100.net
Software
ESF /
Resource Hash
2ca9fe672ad918b11ff84229006723d16be995bf3e33d8838479741eb7204fb4
Security Headers
Name Value
Content-Security-Policy require-trusted-types-for 'script';report-uri https://csp.withgoogle.com/csp/docs-tt base-uri 'self';object-src 'self';report-uri https://docs.google.com/spreadsheets/cspreport;script-src 'report-sample' 'nonce-wiYfhigxk-j8lmGEjp12pQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';worker-src 'self' blob:
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.darkreading.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0
sec-ch-ua-platform
"Linux"

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
no-cache, no-store, max-age=0, must-revalidate
content-encoding
gzip
content-security-policy
require-trusted-types-for 'script';report-uri https://csp.withgoogle.com/csp/docs-tt base-uri 'self';object-src 'self';report-uri https://docs.google.com/spreadsheets/cspreport;script-src 'report-sample' 'nonce-wiYfhigxk-j8lmGEjp12pQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';worker-src 'self' blob:
content-type
text/html; charset=utf-8
date
Wed, 09 Sep 2026 00:42:04 GMT
document-policy
include-js-call-stacks-in-crash-reports
expires
Mon, 01 Jan 1990 00:00:00 GMT
origin-trial
AjyTYHf8xEAhAVTh+xijZ3UXTXlMphOHFXjhD3+Actoe+f2FNuWk3attcE3NSlrBekTItGxJqARYCSiIONcWXgYAAABveyJvcmlnaW4iOiJodHRwczovL2dvb2dsZS5jb206NDQzIiwiZmVhdHVyZSI6IkNyYXNoUmVwb3J0aW5nU3RvcmFnZUFQSSIsImV4cGlyeSI6MTc3NjcyOTYwMCwiaXNTdWJkb21haW4iOnRydWV9,AqC/Qix3G13EOijgi8REB7561k6Amd5kUmmrICdsJGTmoxbSslCnhfyf16w1cyZdM9ymZNS1akp9kP2jx65eTgoAAAB1eyJvcmlnaW4iOiJodHRwczovL2dvb2dsZS5jb206NDQzIiwiZmVhdHVyZSI6IldlYkFzc2VtYmx5Q3VzdG9tRGVzY3JpcHRvcnNWMiIsImV4cGlyeSI6MTc5MzY2NDAwMCwiaXNTdWJkb21haW4iOnRydWV9
p3p
CP="This is not a P3P policy! See g.co/p3phelp for more info."
pragma
no-cache
referrer-policy
strict-origin-when-cross-origin
reporting-endpoints
default="/spreadsheets/d/e/2PACX-1vQsygsynrhlYSFLOwZ9IaqURE4cQ3rGo07MkUiECTl3zXlINi_MWVmfxgjSgmvPhGmk0kPdS8DBzkoj/web-reports?bl=editors.spreadsheets-frontend_20260902.00_p5&context=eJwV1WdUFHcXBvBhd-ZeOgvL0lmWXdrSi4gFC0XBBmJMFjXRqNiwC1gjsWLF3it2Ddao0dhiSawRUGPHKJEqgqCgFIH3eT_8zp3z3Ln_mQ9z7pjWtN9tbBCOmRmE0-YGIdvCIOxTGIRvrQ2C2sYgeKsMwp_wh5NBcHI2CAFqg7AfUnQG4YqXQWj2NQgW_gbBL8AgrAs0CFkhBmFzmEHYDmU9DEJDL5yRbBAioGCwQXgDmhEGod14gxALtTMNgtEsg_BsnkEoh9wtBuEiDN5nEOwLMAu5T5FBhpgsLIYg02ShG7QpkgUr62ThaqdkoQCGRCYL4yE7IVnYCWEzkoUYeK16IIT6Vso6weMbtbJX8LLoo-wtvAr8JCsBiz6fZCqoD6mXtUDP-HpZAnyzoF42BEaN_yKbCGcjG2SXoefoBlkCuK1okHnDo9mNspew_G6jbB2EFDTKOkKiTZPMAK8WNMlKIC-nSfYEZENaZaagFtpkXjDPpU22FM7PbJNdhdNWgvwiyIoEuSmU7DWSN-wzkgv7jeSyv2TyDT5y-Q54NFAufwmr58vlm6HfErk8GWaXyOULIMpUlOvdRXkIrPzQSdwAXxIjxZubI8U8qD8aKbZAQ0QXUejQRSzd3EWshcxx3cUsuO4SJd4FVa8oUQOvekeJJVC_IUpsgdToaHEayH-KFs3gpH2MeB68kmLEQFgxPUZcD9UnYsTP8PhsjNi9JEb0ORwrBsP9D7HiY6iCemhfEyt2hSjoBcthHdyCfLCojRVV4A56WAzZ0De1hzgQMqb2EOfCrnU9xINgfqWHaAvTb_UQr5b2EG9DbHhPsS8UTOopvoFhDXHiGLioihcHjI8XB8NmZS9xN7Q49BKNHXuJOdxbPAxDEndLNwbslu7BjbGocHjcbuk8LD23W1oDvp1zpHWvc6TGTzmSUV2OdA5uQeDQPdIj233SS5hrv0_KhrUf9klboXTCfqkalDP2SzqIgiSILt4v9YaU9APSBHBdfEDyhD6FB6QhEOF-UApIOCiFw6LLB6XV0Hn4IakPvBIOS1UguR2WLKBw0GGpGCyPHpbsYFfFL9JBWBSQK60Gkz65kjWEJORKHWHxxlwpGwbfOCqlQtbI49IqyJ3-TjoNcaveScF3K6UOEPqiUrr-slK6C8bd3ksKuPD7e-k6uF1_L3nDseQq6Sx83loltcLCbVXSCpAOtEkM3zSZUTIUTDKnZyAtMqdz283pEuzcYU57Yfthc9oHz6ws6A2Yn7UgW7A5b0FOkFhhQQZIq7SgmTDjL0v6GZ6PtiLP3VYUADonBfmBur-CCo4o6DEs_EVBS-HOcwXlgdzXmsygV3fU09akhMMPrOk8JPawIQP8PNyGlkDmcRvKgjkFNrQPnrsrqQg--yqpFa4FKGlkhJLGg0MHJWnAb4SSwkD7QEm-MOqRkuzP2JI3XCi0petQ1U9F9eAyS0UekDdbRU_AJldFTsB77cgKtr60oz1wq9CO8iG03o6iIVZtT31BPcGevGDidHuaCz-ut6exkPbBngIFB2oPwzUONA4KjzlQMXS_7UDxMOGFA6VD-V5HqgGbAU5kDxk_O9FcGLncicbDT9HOtAgK1jjTMzDu7UIW0OVPF-oBVoUuZAter1zID15970olcCbTlaqzXekTSOtdSQXdn7hSPDySq0kTpCZP-JCgpjqY1V9NmWB8RE0WEP-LmvpB0FE1bXihpq2wvVBNOeBYqyY1BH5UUxhsHOJGOzLdaA-8lGvoDZSRhj7AsvYaWgtdBmuoB9QM01ADtI3T0IqtGhp4SEOp0PV3DfWEE7c1dA68PmuoPUyf706ZELHRnbr93z53ioOkIncaBGP9tTQFgoO01AF-iNPSCDiRpaVzELdMS4nwc46WlsBP97U0H_rlaWkALIAlMDFfS9NgO-TAgAItGaDgvZbegGcXHQWAMkNHzmA6W0dWMApSYfkcHa2GVT_paD3oHuvID-IadJQIq4w9aBdMsfKiebDGw4u2gKXBi-zA9bkXeULxIm-qgFTRh6bBMsmH1oIH-5A_ZFr6UBaUK3yoCnZb-9B-yInwoZOQn-lD_8DLvT70Fk4-8aHzsK3Uh_bCj8mdaArcFjrT-qOdaTtknupMC6ECquHKr53pBtw93ZnyoSwhEt9JJN2aGkn58Dwzkl7DxVuRdA_-K4mkd1C8sQu9hxShK6VD87KuJF_elbabdKN9YKXuRm7wd2Q3KoR3_btREyQc6kZDYcmf3Wk1DM6OolTQ7owiX7hWEEV3wORdFFnDmtxocpwYQ-7gkxZDwVA1I4bqIWdBDB2Gbatj6Be4Uh5DeXCKYuka7FTF0gF4nhhLRfCxOpaaoNWmJ5GyJ82Z15MWQuSUOIoCo4w4MoHS3DiqhuJ7cfQenj6Lo9cQXxRH_SH5axzlB8bTU_B-E09BcDi1F50H7zX_kT90K3tLieD54S0FwBVtMd2E1v7FREnF9AG-wJSpxZQBb8qLqQT6VRTTALhdX0z5oG4sJi-oDiilOpjZq5TmQfaRUtoI63JLaRs8gOdwrbqUboLQt4yMwTWxjDzhTVoZ1UDK2TJKh-JzZVQBf94vo7-hKq-M6mHsknKaCIqt5aSBy_vL6S94cbmcXgNdLydLGP-hHLuvnHruraDvoE9BBSVBXuM7egILrCtpOcwNqaSFUD22kh5NraS3sGtRJR0H2YD3ZAoPzr2n57Axvop2wqPEKnoB2tFV5Auzs6poAcx6VkXz4XNlFbXC88hqKoLc5Gq6CD7nqqlv2AdKApulH6jfmQ_0LUztUkNNP9SQbGgNKUfXkDMcXVhDmwtrqOpNDX1rXEvB7WqJDbVklFxLD9Nq6T84srGWzLfU0jenamnrWWS3aqkMlryqpWyYLX4klfSRJkR-pHR42fcj_Z36ke4d-0gF8K3tJ1qY9IlWQOmwT5Qw4hMFK-vIMLuOXs2powdH6ugpVJyso1oYcKOOZkKPyjqKh46B9dQN4qAffAtDYCSMg6kwA36GxfB2bT1Vwr319VQAN-_U098QUF5PoTCuup4mwwyYC4thBayHrbAHDsEJOAvXm-rpFlx_9pluwfzqz5QFjz99phfQRfWFYmDP0C_kN-YLXZr7hW6Aaf0XMuMGumneQM6uDdRd20BzmhpoIRTKGqkYNomNtAtEx0Yyh5BpjdQR7p1opK4nG6k7xD9rpP7Q_kUjdYL3S5rIIreJ_K81UYt_M4kBzXQpspmuw8shzXRlZjPdgEXzmmkl2GQ3kwPk32-mxxDxsJk-_fqVmmFE0Vda9d9X2gWbVC20C7KHt9BGuLajhW5C2qEWmgOfz7RQK9x_2EIPoamthWRCK8nkrWQKiaGtZABlRis5wpxVrbQA1l9qpa0QXNRK7cFbaqMAOKluo7igNuoHi9e00XL48WMbjYYnMQL_C-MWCTwJ7tQJ_ADWNwq8HTYYjHgzOA014jt7jfgB3LppxG63jbhnixEv6yTjVTA6S8bjoeiMjJ3vytgdEqpl3GAr55kqOc8Fc3s520KDo5wFJzl31Mq5F5w-K2c3C5GrtCLfShL5PliniOwIDXNEHrZA5D_Wi_wXmF1DDyLyRY6Fo_Dugciaf0Q2dpF4fHuJh_4k8Wi49p_Et8C7N7E_lHxHXAkZvxLPhjMfiS_B4DnMw6BWacyf4Xa8Md-H7MHGvBMyhhrzXDgw05iPwIZMY-6cZczhZ4y5xydj3vPVmA9BeTsTroL0CBOeG2_Ci2BMqglPhOZcEy5_bsLVcLPJhO_BMRNTPguDO5ryCEj73pRnQfIcU_4BwrNNuQt8umzKDWB81ZQVkFJmyuPhHjyADeWmnOBlxuP1ZnylhxlbJJixErwHmvHSDWa8CiZdMeM0eHjPjJ_C8mIzrq0240ZYJzPnLXDI25xPgFeYOfvDsnbmPKaPOTtNMOeIyeYcCSvTzXk9CAfMuRckgMtlc_77kTn_A15tmIV20AkexlvwUzAkWfAY0K22YD0UXbfgcw8t-MJTCzb_14ItwR86SJYcD7WOlmzhaclKCPKy5H7elvwtuPhasgfoulhywxNLbgHLj5ZsCzHWVtwLTo-04oxNVryoxIpXQpNKwY0aBbfBb4kK_iVZwfIxCjaB6ikKroPLGQpOn6fgWeB5QMH-hxUcCB3vKzgKVj1V8EboJllzHJQHWXMdpIZY8zSYPcCa58Go76w5ZoQ1x8Ove6z5HJw6Yc2_w-4z1vyzpQ0vgduuNvwIlvjY8GZIXWzDj1fa8AuYstqGM-DMHza86qYNbwChwYYlyJuj5IGHlDwIJl1TcjrIbiv5NttyAeRPteXvM2x5OPy1zJbvw5q1yNbZcv8cW64-ast1cP6ELR-_Z8tnwPyFLa8useV9Zbasc1BxGCjcVKwCtbuK14ar2KU9rkEDWvAAL_ABX_CHYPgmTsW_bVZxU4GKqx-peL-JHas72LEO-ky04yTQ_2LHIXD0mh03v7Bjo5d2HKC053AwD7NnW9gZY897oTHZnlVz7bnwoT0XQXqzPc8Ghc6BHWAbPE104DLIHOLAWeA10oEDYfhxBx4NIRcd2PKKA9vBmzsO_A6qXjvwiGIHHgv2XxzYBdIaHXgOjGxx4FyNI68Mc-SakY4spDjy2ImOPHumIy-AdRccOfGyIy-qwT1g1uTIGyOduGt_J-4O0VA11Il9RjlxADhnOfHKQ06sO44MHE84sR46nXXibmDylxNbQtZ_TrwK3tY6cQWkfHbiVJjb4sR74ZTOmX-DY77OfAJOwWk4C-fgir8zvx_pzLUQP8GZ-8GUdGf-st2Zs085c80dZ26AS3nOvLPNmaOdXHgARAS4cJf_i3ThaMiKceFNcCHOhf-AhBUu_A1E7nPhWNjwzoWHVrrwSPCzc-WLOle-CkkdXXk4RM5x5WhQz3dlDwje68pfH7ry8nJXXgNvVWpeG6zmTdAALbD2RzVvSFPzDhi2Tc2j4PJvaq74Xc3VcOOCmm_D9KtqzoRhRWpOAb-vav5s6satcNzHja_Aqwg3ntjPjTPg4ADkED3cjeMgeoQbD4DBM9x4GIy76MbG-W5sAZNeuvF0EN4ig2hRw0mQDOO0Gp4MU2E6jO2k4djJGu4Lk6ZoePtUDe-Bwi0afgtFf2m4FCbma3gz2Bdo2PaZhl1g9EsNj4fdbzR8CLxrNGxn7M5qWKB056Ug93Bnhgp_d_4ARUHuXArOce6sAXUvdw6GhHnurNvpznqweOrOQfXuHAFHArV8EgaFank4rO6i5aKuWnaO0bI7yBdqWQl7Fmn5CHTP0nI8KDZpWQWOMKxMi3-NlnUuOvaDMF8dp47V8WQonKbjapi9WMdV2Tquh65bdGy9Tcc_7tfxzQodpyg8eAKk2XjwA6UHa1Ue7Av5Lsi8PHgmlCR68JoxHrwRXuV48O0DHpwH5x558CV4_w-y1x78DNyNPTkEDkd68jHYn-DJKWM9OR2EPzzZGCxAcdWTVVD10JPrYWmrJ2fDYPbiYZDu68XTwSrci92LvbijqTeb6r3ZBiYHevMM8B7jzRHwebw3b5vqzbvh6X1vfg3m_3izLRwL9OHTYBnkwyOCfXgsxCb6cC_4d7UPv4WKX324sdCH2-BzMSqIJT78m4meL8GfcBcewjP4O0zPD-AR7G6n5_0wpbOeZ8AcWAGrIvXYN3rWdtVzOxgCw6F0qp4rgTL0bAabFul5O5St1PN78Nmp5wDYsF_POyD3kp5PQ8creo4C2V09G4PhqZ6_hzuFer5VgXeCgXV6HgQWTXq2galmvjxB6cs_wdupvlyZ4cvNMHC6L6fAvfm-_BBeQhGULPXlepi3xZfvnkUPnrzy5VLo-MaXu0LCF8zDuq--vA3Gefnx_PZ-_C7Kjz_A3Yl-nA-DMv04aaEf_77fj-f29mf_hf4cCW-a_Tm7zZ83wjr7AI6IC-A7kAcdVgVwV-gJfWEgDIYRMBZSYTJkwiJYCetgG-RA8m8BPBT2Xwjgzn8GcHd4-G8A1xoHspFJIEuKQG7Ro_oG8qXJgXwD3m8I5DqwMAliVzgfHMQ3-gTx8wVB_Bp23A_i4udBXF8axC0wRh_ME2FddDBvBmlSMJtDz4XB3AfCjEK4E4R4hHB7cAkMYX94EhGCnRfCmzqF8HEYkhTC_xpCuASWJIfwMlgBK2E1rIVvxoTw2E0hPAk2FIRwSkUIjwej9yHMUFsTwje-hPBtGPcVz7ML5Z7QFhbKYrtQroEGiIwI5Rgw6hzKBIndQvlHGBofyiNhAkyFQaORw_qMUN4Hs56EctiLUO4Aje9CuRW-qwrl0fCdfxgPgeTAMD4YFsYbO4TxdrA9EcZqSIdZ0FwTxka1YXwJroHhUxj_AD27tmPXLe1YC2ke4TwLWqPDmWPC-UjvcE5bHc6zIW99OO_ZFc5PjoRzIeT9Gs4VeeFcDTEvwjkeDirbcy7YmBkXPlnwmBRbitc6OFn3zxgxYVza2FEp8ekTJ3w3btQMrf-olHHpk6elBaZNmTZqeAp6o9LTAkZPmzwpfdSklGGhwaHtgzsGhwYGBw-bEv4_w7k-Xw&build-label=editors.spreadsheets-frontend_20260902.00_p5&imp-sid=CPW_8vWh4JYDFSpJWAYdPS04ug&is-cached-offline=false&cellSizeBucket=RITZ_SHEET_CELLS_50K_TO_100K&wcrumsspbp=true"
server
ESF
x-content-type-options
nosniff
x-l2-request-path
l2-managed-6
x-robots-tag
noindex, nofollow, nosnippet
x-xss-protection
0
GET
H2
200
DarkReading_CommemorativeLogo_Horizontal_Color.svg
eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt230dd3db8101173b/69efb479be3c031b8592eb73/
12 KB
0
2ms
2ms
Image
image/svg+xml
104.17.160.85
Cloudflare
General
Full URL
https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt230dd3db8101173b/69efb479be3c031b8592eb73/DarkReading_CommemorativeLogo_Horizontal_Color.svg?width=476&auto=webp&quality=80
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/cyberattacks-data-breaches/attackers-multi-hop-google-redirects-phishing-campaign
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.17.160.85 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
45358ab134126981ee0d682a81f911b31b01c5436c77aa4f57c9dce33567e4d0
Security Headers
Name Value
Content-Security-Policy default-src 'none'; navigate-to 'none'; form-action 'none'; img-src data:; style-src 'unsafe-inline';

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

x-request-id
439b7ed8-fc9c-4ab3-a25d-4246f0f54ac2
access-control-expose-headers
*
surrogate-key
blt6d90778a997de1cd.sys_assets blt6d90778a997de1cd.sys_assets.blt230dd3db8101173b.download
cf-cache-status
HIT
etag
W/"cfFT3pZSK5id0O4nSUp_yyHk7p-vldJ1kirhc017RfDQ"
age
2503399
cache-tag
blt6d90778a997de1cd.sys_assets blt6d90778a997de1cd.sys_assets.blt230dd3db8101173b.download
cf-resized
internal=ok/h q=0 n=11+0 c=0+1 v=2026.8.2 l=12087 f=false c2=0 wv=2026.9.0
x-api-key
blt6d90778a997de1cd
access-control-allow-methods
GET,HEAD,PUT,PATCH,POST,DELETE,OPTIONS
content-encoding
br
x-cache
HIT, HIT
date
Wed, 09 Sep 2026 00:42:01 GMT
content-type
image/svg+xml
content-disposition
inline; filename=DarkReading_CommemorativeLogo_Horizontal_Color.svg
x-runtime
94ms
last-modified
Wed, 05 Aug 2026 02:33:23 GMT
x-contentstack-organization
blt5948195ac13977b0
access-control-allow-headers
*
content-security-policy
default-src 'none'; navigate-to 'none'; form-action 'none'; img-src data:; style-src 'unsafe-inline';
cache-control
public, max-age=31536000
x-timer
203
via
a29368678904379a-IAD
cf-ray
a382268d898046b5-YYZ
access-control-allow-origin
*
server
cloudflare
GET
H2
200
1571751486317.jpg
eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blte0c88f087d1ad6f5/67c609df64f983454c3dd40b/
3 KB
0
4ms
4ms
Image
image/webp
104.17.160.85
Cloudflare
General
Full URL
https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blte0c88f087d1ad6f5/67c609df64f983454c3dd40b/1571751486317.jpg?width=100&auto=webp&quality=80&disable=upscale
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/cyberattacks-data-breaches/attackers-multi-hop-google-redirects-phishing-campaign
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.17.160.85 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
3457c4968b15da7b05818eb03da51a269b1df78815a7fd0171be32791838aa1f
Security Headers
Name Value
Content-Security-Policy default-src 'none'; navigate-to 'none'; form-action 'none'; img-src data:; style-src 'unsafe-inline';

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

x-request-id
5ae2cb39-7492-4158-9cdd-96f4250292ad
access-control-expose-headers
*
surrogate-key
blt6d90778a997de1cd.sys_assets blt6d90778a997de1cd.sys_assets.blte0c88f087d1ad6f5.download
cf-cache-status
HIT
etag
"cfAKp-Hq2AZJOi362UNCD8PjvxWw0n4rEIrsI7hXggDQ"
age
2243462
cache-tag
blt6d90778a997de1cd.sys_assets blt6d90778a997de1cd.sys_assets.blte0c88f087d1ad6f5.download
cf-resized
internal=ok/h q=0 n=13+0 c=0+2 v=2026.8.2 l=3052 f=false c2=0 wv=2026.9.0
x-api-key
blt6d90778a997de1cd
access-control-allow-methods
GET,HEAD,PUT,PATCH,POST,DELETE,OPTIONS
x-cache
HIT, HIT
date
Wed, 09 Sep 2026 00:42:01 GMT
content-type
image/webp
content-disposition
inline; filename=1571751486317.webp
x-runtime
45ms
last-modified
Wed, 12 Aug 2026 18:58:03 GMT
x-contentstack-organization
blt5948195ac13977b0
access-control-allow-headers
*
content-security-policy
default-src 'none'; navigate-to 'none'; form-action 'none'; img-src data:; style-src 'unsafe-inline';
cache-control
public, max-age=31536000
x-timer
203
via
a2ac32867b51c698-EWR
cf-ray
a382268d898646b5-YYZ
accept-ranges
bytes
access-control-allow-origin
*
content-length
3052
server
cloudflare
GET
H2
200
BH2026_ConfGuide.png
eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/bltcd6c2f866cf0478d/6a7f323395c07927dfcf5058/
9 KB
0
5ms
5ms
Image
image/webp
104.17.160.85
Cloudflare
General
Full URL
https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/bltcd6c2f866cf0478d/6a7f323395c07927dfcf5058/BH2026_ConfGuide.png?width=1400&auto=webp&quality=80&disable=upscale
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/cyberattacks-data-breaches/attackers-multi-hop-google-redirects-phishing-campaign
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.17.160.85 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
168c8a42c64acec93c37be6971498385095546ea885b878f182ab4f23088d4f3
Security Headers
Name Value
Content-Security-Policy default-src 'none'; navigate-to 'none'; form-action 'none'; img-src data:; style-src 'unsafe-inline';

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

x-request-id
b23356d6-bba3-4db5-ba0d-5bf80bf9e913
access-control-expose-headers
*
surrogate-key
blt6d90778a997de1cd.sys_assets blt6d90778a997de1cd.sys_assets.bltcd6c2f866cf0478d.download
cf-cache-status
HIT
etag
"cfN3rtffBBHsRNqJSs1ZSlLwoN_QAgviMf7M7J3R1uDQ"
age
1919212
cache-tag
blt6d90778a997de1cd.sys_assets blt6d90778a997de1cd.sys_assets.bltcd6c2f866cf0478d.download
cf-resized
internal=ok/h q=0 n=12+0 c=0+6 v=2026.8.2 l=9522 f=false c2=0 wv=2026.9.0
x-api-key
blt6d90778a997de1cd
access-control-allow-methods
GET,HEAD,PUT,PATCH,POST,DELETE,OPTIONS
x-cache
HIT, HIT
date
Wed, 09 Sep 2026 00:42:01 GMT
content-type
image/webp
content-disposition
inline; filename=BH2026_ConfGuide.webp
x-runtime
70ms
last-modified
Fri, 14 Aug 2026 15:20:21 GMT
x-contentstack-organization
blt5948195ac13977b0
access-control-allow-headers
*
content-security-policy
default-src 'none'; navigate-to 'none'; form-action 'none'; img-src data:; style-src 'unsafe-inline';
cache-control
public, max-age=31536000
x-timer
204
via
a2cb1ec928b76cd2-ATL
cf-ray
a382268d898a46b5-YYZ
accept-ranges
bytes
access-control-allow-origin
*
content-length
9522
server
cloudflare
GET
H2
200
Delta_Vegas-Janice_Chen-GettyImages-2269887409.jpg
eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt873948c65f62f170/6a874b480989859872d1eb89/
93 KB
0
7ms
7ms
Image
image/webp
104.17.160.85
Cloudflare
General
Full URL
https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt873948c65f62f170/6a874b480989859872d1eb89/Delta_Vegas-Janice_Chen-GettyImages-2269887409.jpg?width=1400&auto=webp&quality=80&disable=upscale
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/cyberattacks-data-breaches/attackers-multi-hop-google-redirects-phishing-campaign
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.17.160.85 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
d80f72d687677b724e0117f31786898988fb3407de88175e3380aba81ac2ea5d
Security Headers
Name Value
Content-Security-Policy default-src 'none'; navigate-to 'none'; form-action 'none'; img-src data:; style-src 'unsafe-inline';

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

x-request-id
ce57100c-8ff3-422b-a6bd-964fa66254f7
access-control-expose-headers
*
surrogate-key
blt6d90778a997de1cd.sys_assets blt6d90778a997de1cd.sys_assets.blt873948c65f62f170.download
cf-cache-status
HIT
etag
"cfW1fvQ0sGnHACymNAOEpLMvDK5HF5pHG5trnzBX3ZDQ"
age
1462758
cache-tag
blt6d90778a997de1cd.sys_assets blt6d90778a997de1cd.sys_assets.blt873948c65f62f170.download
cf-resized
internal=ok/h q=0 n=9+0 c=22+98 v=2026.8.5 l=95684 f=false c2=0 wv=2026.9.0
x-api-key
blt6d90778a997de1cd
access-control-allow-methods
GET,HEAD,PUT,PATCH,POST,DELETE,OPTIONS
x-cache
HIT, HIT
date
Wed, 09 Sep 2026 00:42:01 GMT
content-type
image/webp
content-disposition
inline; filename=Delta_Vegas-Janice_Chen-GettyImages-2269887409.webp
x-runtime
69ms
last-modified
Thu, 20 Aug 2026 18:45:30 GMT
x-contentstack-organization
blt5948195ac13977b0
access-control-allow-headers
*
content-security-policy
default-src 'none'; navigate-to 'none'; form-action 'none'; img-src data:; style-src 'unsafe-inline';
cache-control
public, max-age=31536000
x-timer
204
via
a2f6a6aafa89267a-ATL
cf-ray
a382268d898c46b5-YYZ
accept-ranges
bytes
access-control-allow-origin
*
content-length
95684
server
cloudflare
GET
H2
200
katie_mo_and_Rob_Wright.png
eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/bltd0c2b7a8187293ac/6a837f44db552afa32e2f029/
36 KB
0
7ms
7ms
Image
image/webp
104.17.160.85
Cloudflare
General
Full URL
https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/bltd0c2b7a8187293ac/6a837f44db552afa32e2f029/katie_mo_and_Rob_Wright.png?width=1400&auto=webp&quality=80&disable=upscale
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/cyberattacks-data-breaches/attackers-multi-hop-google-redirects-phishing-campaign
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.17.160.85 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
f4f8b95015da358676252caa53516ffcc51129c4bc4e155d65452f5f9d03363c
Security Headers
Name Value
Content-Security-Policy default-src 'none'; navigate-to 'none'; form-action 'none'; img-src data:; style-src 'unsafe-inline';

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

x-request-id
cf6768c1-0f1f-41cf-8ba0-7c7e06704dc6
access-control-expose-headers
*
surrogate-key
blt6d90778a997de1cd.sys_assets blt6d90778a997de1cd.sys_assets.bltd0c2b7a8187293ac.download
cf-cache-status
HIT
etag
"cfAKs_TOtBg7kX3Ag02EImmwpcSy6R1432IrAZNtcRDQ"
age
1390277
cache-tag
blt6d90778a997de1cd.sys_assets blt6d90778a997de1cd.sys_assets.bltd0c2b7a8187293ac.download
cf-resized
internal=ok/h q=0 n=17+0 c=8+74 v=2026.8.5 l=37062 f=false c2=0 wv=2026.9.0
x-api-key
blt6d90778a997de1cd
access-control-allow-methods
GET,HEAD,PUT,PATCH,POST,DELETE,OPTIONS
x-cache
HIT, HIT
date
Wed, 09 Sep 2026 00:42:01 GMT
content-type
image/webp
content-disposition
inline; filename=katie_mo_and_Rob_Wright.webp
x-runtime
72ms
last-modified
Mon, 17 Aug 2026 22:46:43 GMT
x-contentstack-organization
blt5948195ac13977b0
access-control-allow-headers
*
content-security-policy
default-src 'none'; navigate-to 'none'; form-action 'none'; img-src data:; style-src 'unsafe-inline';
cache-control
public, max-age=31536000
x-timer
204
via
a2fd903aa8b4369b-IAD
cf-ray
a382268d899046b5-YYZ
accept-ranges
bytes
access-control-allow-origin
*
content-length
37062
server
cloudflare
GET
H2
200
google_preferred_source_badge_dark@2x.png
eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/bltff3a0a2bc5f6a16d/69b4449a3306d6728d1ec53b/
5 KB
0
8ms
8ms
Image
image/webp
104.17.160.85
Cloudflare
General
Full URL
https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/bltff3a0a2bc5f6a16d/69b4449a3306d6728d1ec53b/google_preferred_source_badge_dark@2x.png?width=320&auto=webp&quality=80&disable=upscale
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/cyberattacks-data-breaches/attackers-multi-hop-google-redirects-phishing-campaign
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.17.160.85 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
39a0f0b83b93ee59b337157a19de61d4d36d06731a13d3162e43af8407e1cc63
Security Headers
Name Value
Content-Security-Policy default-src 'none'; navigate-to 'none'; form-action 'none'; img-src data:; style-src 'unsafe-inline';

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

x-request-id
1577c83c-80cb-4fcd-acf5-0ec4b53c17f1
access-control-expose-headers
*
surrogate-key
blt6d90778a997de1cd.sys_assets blt6d90778a997de1cd.sys_assets.bltff3a0a2bc5f6a16d.download
cf-cache-status
HIT
etag
"cfiAkkdFFE-kZSeCS2qumsc5KGVGwUgigU1jPEWOC-DQ"
age
1302533
cache-tag
blt6d90778a997de1cd.sys_assets blt6d90778a997de1cd.sys_assets.bltff3a0a2bc5f6a16d.download
cf-resized
internal=ok/h q=0 n=14+0 c=0+7 v=2026.8.5 l=4744 f=false c2=0 wv=2026.9.0
x-api-key
blt6d90778a997de1cd
access-control-allow-methods
GET,HEAD,PUT,PATCH,POST,DELETE,OPTIONS
x-cache
HIT, HIT
date
Wed, 09 Sep 2026 00:42:01 GMT
content-type
image/webp
content-disposition
inline; filename=google_preferred_source_badge_dark%402x.webp
x-runtime
81ms
last-modified
Fri, 21 Aug 2026 21:49:54 GMT
x-contentstack-organization
blt5948195ac13977b0
access-control-allow-headers
*
content-security-policy
default-src 'none'; navigate-to 'none'; form-action 'none'; img-src data:; style-src 'unsafe-inline';
cache-control
public, max-age=31536000
x-timer
204
via
a305ee6bae7f8cc6-EWR
cf-ray
a382268d899146b5-YYZ
accept-ranges
bytes
access-control-allow-origin
*
content-length
4744
server
cloudflare
GET
H2
200
DR_Report.png
eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/bltf83ce48d191dd0f4/6a851bed5a1e313d8a221ef7/
37 KB
0
8ms
8ms
Image
image/webp
104.17.160.85
Cloudflare
General
Full URL
https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/bltf83ce48d191dd0f4/6a851bed5a1e313d8a221ef7/DR_Report.png?width=800&auto=webp&quality=80&disable=upscale
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/cyberattacks-data-breaches/attackers-multi-hop-google-redirects-phishing-campaign
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.17.160.85 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
471efe947296ae9b94ec872ccf7061c4abd02e654b416a115975f514df629529
Security Headers
Name Value
Content-Security-Policy default-src 'none'; navigate-to 'none'; form-action 'none'; img-src data:; style-src 'unsafe-inline';

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

x-request-id
b17ef5b5-765e-493a-9b09-fe4cd8c03245
access-control-expose-headers
*
surrogate-key
blt6d90778a997de1cd.sys_assets blt6d90778a997de1cd.sys_assets.bltf83ce48d191dd0f4.download
cf-cache-status
HIT
etag
"cfpgxNZ2B8uMEgdQAOvx7olwmshRbCNLv9qtMZYfIIDQ"
age
1331551
cache-tag
blt6d90778a997de1cd.sys_assets blt6d90778a997de1cd.sys_assets.bltf83ce48d191dd0f4.download
cf-resized
internal=ok/h q=0 n=171+0 c=3+28 v=2026.8.5 l=38370 f=false c2=0 wv=2026.9.0
x-api-key
blt6d90778a997de1cd
access-control-allow-methods
GET,HEAD,PUT,PATCH,POST,DELETE,OPTIONS
x-cache
HIT, HIT
date
Wed, 09 Sep 2026 00:42:01 GMT
content-type
image/webp
content-disposition
inline; filename=DR_Report.webp
x-runtime
116ms
last-modified
Mon, 24 Aug 2026 14:49:29 GMT
x-contentstack-organization
blt5948195ac13977b0
access-control-allow-headers
*
content-security-policy
default-src 'none'; navigate-to 'none'; form-action 'none'; img-src data:; style-src 'unsafe-inline';
cache-control
public, max-age=31536000
x-timer
204
via
a30329f6383e729c-EWR
cf-ray
a382268d899246b5-YYZ
accept-ranges
bytes
access-control-allow-origin
*
content-length
38370
server
cloudflare
GET
H2
200
What_Every_Enterprise_Should_Know.jpg
eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blte0c3a250cca1fc96/6a8f2fac7e86cc2bfddc2676/
18 KB
0
9ms
9ms
Image
image/webp
104.17.160.85
Cloudflare
General
Full URL
https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blte0c3a250cca1fc96/6a8f2fac7e86cc2bfddc2676/What_Every_Enterprise_Should_Know.jpg?width=800&auto=webp&quality=80&disable=upscale
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/cyberattacks-data-breaches/attackers-multi-hop-google-redirects-phishing-campaign
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.17.160.85 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
fbb2212f43ee569fc127a0b96e364c8ef735677c40a8537c1f21ed8bc4ee1020
Security Headers
Name Value
Content-Security-Policy default-src 'none'; navigate-to 'none'; form-action 'none'; img-src data:; style-src 'unsafe-inline';

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

x-request-id
3d3314d3-d67c-4d1f-877e-6ea0488b1a25
access-control-expose-headers
*
surrogate-key
blt6d90778a997de1cd.sys_assets blt6d90778a997de1cd.sys_assets.blte0c3a250cca1fc96.download
cf-cache-status
HIT
etag
"cfJP7dlT07ML91XjmRrbiTs8L_PAvDU0FCPpT4_aLtDQ"
age
1145601
cache-tag
blt6d90778a997de1cd.sys_assets blt6d90778a997de1cd.sys_assets.blte0c3a250cca1fc96.download
cf-resized
internal=ok/h q=0 n=22+0 c=1+26 v=2026.8.5 l=18486 f=false c2=0 wv=2026.9.0
x-api-key
blt6d90778a997de1cd
access-control-allow-methods
GET,HEAD,PUT,PATCH,POST,DELETE,OPTIONS
x-cache
HIT, HIT
date
Wed, 09 Sep 2026 00:42:01 GMT
content-type
image/webp
content-disposition
inline; filename=What_Every_Enterprise_Should_Know.webp
x-runtime
38ms
last-modified
Wed, 26 Aug 2026 18:25:50 GMT
x-contentstack-organization
blt5948195ac13977b0
access-control-allow-headers
*
content-security-policy
default-src 'none'; navigate-to 'none'; form-action 'none'; img-src data:; style-src 'unsafe-inline';
cache-control
public, max-age=31536000
x-timer
205
via
a314e5c29ab3d826-EWR
cf-ray
a382268d899546b5-YYZ
accept-ranges
bytes
access-control-allow-origin
*
content-length
18486
server
cloudflare
OPTIONS
H2
200
darkreading
api.iiris.com/v4/recommend/public/content/recommend-items/it/cybersecurity/ Frame
0
0
204ms
135ms
Preflight
text/plain
172.64.150.107
Cloudflare
General
Full URL
https://api.iiris.com/v4/recommend/public/content/recommend-items/it/cybersecurity/darkreading
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.64.150.107 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type
Access-Control-Request-Method
POST
Origin
https://www.darkreading.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36

Response headers

access-control-allow-headers
content-type
access-control-allow-methods
DELETE, GET, HEAD, OPTIONS, PATCH, POST, PUT
access-control-allow-origin
*
access-control-max-age
600
cf-cache-status
DYNAMIC
cf-ray
a382269aba39c109-YYZ
content-length
2
content-type
text/plain; charset=utf-8
date
Wed, 09 Sep 2026 00:42:03 GMT
expect-ct
max-age=86400, enforce
referrer-policy
same-origin
server
cloudflare
strict-transport-security
max-age=15552000; includeSubDomains; preload
x-amz-apigw-id
DZ-2WHnDjoEFqiw=
x-amzn-remapped-connection
keep-alive
x-amzn-remapped-content-length
2
x-amzn-remapped-date
Wed, 09 Sep 2026 00:42:03 GMT
x-amzn-remapped-server
uvicorn
x-amzn-requestid
4ce16185-b024-4bbb-aa1c-82bef5982511
x-content-type-options
nosniff
x-frame-options
SAMEORIGIN
x-xss-protection
1; mode=block
GET
H2
200
spm.v1.min.js Show response
ak.sail-horizon.com/spm/
142 KB
49 KB
135ms
35ms
Script
application/javascript
13.249.91.42
Amazon.com
General
Full URL
https://ak.sail-horizon.com/spm/spm.v1.min.js
Requested by
Host: transcend-cdn.com
URL: https://transcend-cdn.com/cm/ef49a3f1-d8c1-47d6-88fc-50e41130631f/airgap.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.249.91.42 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-13-249-91-42.jfk52.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
617750f4f0f3b959ccf135602b4ec9e26d3dd04631936b24c1a2d09c888b334d

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

vary
Accept-Encoding
cache-control
max-age=600; must-revalidate
content-encoding
gzip
etag
W/"8d5c2e714d327e44d3e2a0444a7f641e"
age
401
via
1.1 f42ef40059bf51d47e55bd92308816ba.cloudfront.net (CloudFront)
x-cache
Hit from cloudfront
x-amz-cf-id
ECNLNaFchAexMIlVr-z2wcwV2pK1WHjRG1es9zbTuSQ-eTY0gJfh7w==
date
Wed, 09 Sep 2026 00:35:22 GMT
content-type
application/javascript
last-modified
Mon, 27 Jul 2026 13:40:27 GMT
server
AmazonS3
x-amz-cf-pop
JFK52-P9
x-amz-server-side-encryption
AES256
POST
H3
200
navigation-recent-content Show response
www.darkreading.com/api/
2 KB
1 KB
563ms
561ms
XHR
application/json
104.16.224.171
Cloudflare
General
Full URL
https://www.darkreading.com/api/navigation-recent-content
Requested by
Host: transcend-cdn.com
URL: https://transcend-cdn.com/cm/ef49a3f1-d8c1-47d6-88fc-50e41130631f/airgap.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.16.224.171 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
2ff07958376bccc54a01482c77d5e9d4f674f47bff5468978c58f54141e81d56
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.darkreading.com/cyberattacks-data-breaches/attackers-multi-hop-google-redirects-phishing-campaign
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0
newrelic
eyJ2IjpbMCwxXSwiZCI6eyJ0eSI6IkJyb3dzZXIiLCJhYyI6IjM5MzYzNDgiLCJhcCI6IjUzODYwMDE5OSIsImlkIjoiYzZiZTJmNzZlMGQyNjZlMiIsInRyIjoiZjc3ODMxMjRkYmZlNTY5ODcxNDViZmI0MmI3OWMwNTUiLCJ0aSI6MTc4ODkxNDUyMzIyNiwidGsiOiIzMjg4OTI1In19
traceparent
00-f7783124dbfe56987145bfb42b79c055-c6be2f76e0d266e2-01
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
Accept
application/json, text/plain, */*
Content-Type
application/json
tracestate
3288925@nr=0-1-3936348-538600199-c6be2f76e0d266e2----1788914523226

Response headers

strict-transport-security
max-age=15552000; includeSubDomains; preload
cache-control
no-cache
content-encoding
br
cf-cache-status
DYNAMIC
x-content-type-options
nosniff
cf-ray
a382269a4f40ebbc-YYZ
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Wed, 09 Sep 2026 00:42:03 GMT
content-type
application/json; charset=utf-8
vary
Accept-Encoding
server
cloudflare
priority
u=1,i
GET
H3
200
dynamic-module Show response
www.darkreading.com/api/
4 KB
2 KB
35ms
35ms
XHR
application/json
104.16.224.171
Cloudflare
General
Full URL
https://www.darkreading.com/api/dynamic-module?contentTypeUid=module_resources&uid=bltad604e58a4e82ba2&location=article
Requested by
Host: transcend-cdn.com
URL: https://transcend-cdn.com/cm/ef49a3f1-d8c1-47d6-88fc-50e41130631f/airgap.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.16.224.171 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
6b22088c72e238c837835c577e481308df760a83df640c78eed3f4d4cb6cc908
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.darkreading.com/cyberattacks-data-breaches/attackers-multi-hop-google-redirects-phishing-campaign
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0
newrelic
eyJ2IjpbMCwxXSwiZCI6eyJ0eSI6IkJyb3dzZXIiLCJhYyI6IjM5MzYzNDgiLCJhcCI6IjUzODYwMDE5OSIsImlkIjoiNTZhOTQwMjdlYmYxYjVlOSIsInRyIjoiZmEzY2Y4YjUzMGI4NDE4ZmIzMzc4ZThlYWYwZjY4Y2YiLCJ0aSI6MTc4ODkxNDUyMzIzMSwidGsiOiIzMjg4OTI1In19
traceparent
00-fa3cf8b530b8418fb3378e8eaf0f68cf-56a94027ebf1b5e9-01
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
Accept
application/json, text/plain, */*
tracestate
3288925@nr=0-1-3936348-538600199-56a94027ebf1b5e9----1788914523231

Response headers

strict-transport-security
max-age=15552000; includeSubDomains; preload
cache-control
public, max-age=300, s-maxage=432000, must-revalidate, stale-if-error=4320000
content-encoding
br
cf-cache-status
HIT
age
9751
x-content-type-options
nosniff
cf-ray
a382269a4f54ebbc-YYZ
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Wed, 09 Sep 2026 00:42:03 GMT
content-type
application/json; charset=utf-8
last-modified
Tue, 08 Sep 2026 21:59:31 GMT
server
cloudflare
priority
u=1,i
vary
Accept-Encoding
POST
H2
200
darkreading Show response
api.iiris.com/v4/recommend/public/content/recommend-items/it/cybersecurity/
5 KB
2 KB
164ms
162ms
XHR
application/json
172.64.150.107
Cloudflare
General
Full URL
https://api.iiris.com/v4/recommend/public/content/recommend-items/it/cybersecurity/darkreading
Requested by
Host: transcend-cdn.com
URL: https://transcend-cdn.com/cm/ef49a3f1-d8c1-47d6-88fc-50e41130631f/airgap.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.64.150.107 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
edef4f9fc96ff80cc70b3af54d1bc3aa84fc7b1a38389ce90c5dbb0b09929d5b
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
Accept
application/json, text/plain, */*
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
Content-Type
application/json
sec-ch-ua-mobile
?0

Response headers

x-amzn-remapped-content-length
4992
content-encoding
gzip
cf-cache-status
DYNAMIC
x-amzn-remapped-connection
keep-alive
expect-ct
max-age=86400, enforce
x-content-type-options
nosniff
x-amzn-requestid
b456c90e-8b9b-48d4-917f-d5f31cd9def8
x-amzn-remapped-server
uvicorn
expires
0
date
Wed, 09 Sep 2026 00:42:03 GMT
content-type
application/json
x-frame-options
SAMEORIGIN
strict-transport-security
max-age=15552000; includeSubDomains; preload
cache-control
no-cache, no-store, must-revalidate
x-amz-apigw-id
DZ-2YGYJjoEF3ag=
x-amzn-remapped-date
Wed, 09 Sep 2026 00:42:03 GMT
pragma
no-cache
referrer-policy
same-origin
cf-ray
a382269b9d27c109-YYZ
access-control-allow-origin
*
x-xss-protection
1; mode=block
server
cloudflare
GET
H3
200
p-a5a65463.entry.js Show response
www.darkreading.com/next-gen/at/tt-ld/
156 KB
49 KB
111ms
110ms
Script
application/javascript
104.16.224.171
Cloudflare
General
Full URL
https://www.darkreading.com/next-gen/at/tt-ld/p-a5a65463.entry.js
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/next-gen/at/tt-ld/p-2ed681a8.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.16.224.171 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare / Express
Resource Hash
f848629645b0a70606f542d96969c94949a86cfbe21ef9cb2405b521830d2ff3

Request headers

Origin
https://www.darkreading.com
sec-ch-ua-platform
"Linux"
Referer
https://www.darkreading.com/next-gen/at/tt-ld/p-2ed681a8.js
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
br
cf-cache-status
BYPASS
etag
W/"26e4e-19bbd75f170"
expires
Wed, 09 Sep 2026 02:42:03 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Wed, 09 Sep 2026 00:42:03 GMT
content-type
application/javascript; charset=UTF-8
last-modified
Wed, 14 Jan 2026 17:03:02 GMT
vary
Origin, accept-encoding
priority
u=1,i=?0
cache-control
public, max-age=7200
access-control-allow-credentials
true
via
1.1 google
cf-ray
a382269a5f6aebbc-YYZ
access-control-allow-origin
https://www.darkreading.com
x-powered-by
Express
server
cloudflare
GET
H2
200
bridged-agent.js Show response
loader.bridged.media/
6 KB
6 KB
153ms
36ms
Script
application/javascript
3.168.102.70
Amazon.com
General
Full URL
https://loader.bridged.media/bridged-agent.js
Requested by
Host: transcend-cdn.com
URL: https://transcend-cdn.com/cm/ef49a3f1-d8c1-47d6-88fc-50e41130631f/airgap.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
3.168.102.70 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-3-168-102-70.jfk52.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
6959eb0bc7311553a62bd07363eaade411b5e26ac80ceeecfd252cb2f16c1694

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

x-amz-version-id
vx7_qtVz0rZ1kfHWAbb2Pm1CX2301qci
etag
"821e2a619bd68935729c585568c7db95"
age
59638
via
1.1 88b020899fa30b97646f62e44ca6ea2a.cloudfront.net (CloudFront)
accept-ranges
bytes
x-cache
Hit from cloudfront
content-length
5882
x-amz-cf-id
R1Nhy2amXVZYywhKOJK4Om4jhD8CcdlZ9NVYMdCI_ygEerxtzKBTMQ==
date
Tue, 08 Sep 2026 12:57:29 GMT
content-type
application/javascript
last-modified
Mon, 03 Aug 2026 08:48:48 GMT
server
AmazonS3
x-amz-cf-pop
JFK52-P6
x-amz-server-side-encryption
AES256
GET
H3
200
current-weather Show response
www.darkreading.com/api/
56 B
289 B
33ms
32ms
XHR
application/json
104.16.224.171
Cloudflare
General
Full URL
https://www.darkreading.com/api/current-weather?zipCode=50036
Requested by
Host: transcend-cdn.com
URL: https://transcend-cdn.com/cm/ef49a3f1-d8c1-47d6-88fc-50e41130631f/airgap.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.16.224.171 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
77aade6364358da10b4c78dd9ef648f5400227c67196ae1d3a5244a4447427bf
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.darkreading.com/cyberattacks-data-breaches/attackers-multi-hop-google-redirects-phishing-campaign
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0
newrelic
eyJ2IjpbMCwxXSwiZCI6eyJ0eSI6IkJyb3dzZXIiLCJhYyI6IjM5MzYzNDgiLCJhcCI6IjUzODYwMDE5OSIsImlkIjoiZWQwZGVlNTgwMGE4ZjQzNSIsInRyIjoiYjc3MDA4MjE1MDJkOTA4MjI3Mzk5NmU4ODIxMmEwY2QiLCJ0aSI6MTc4ODkxNDUyMzI0MSwidGsiOiIzMjg4OTI1In19
traceparent
00-b7700821502d9082273996e88212a0cd-ed0dee5800a8f435-01
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
Accept
application/json, text/plain, */*
tracestate
3288925@nr=0-1-3936348-538600199-ed0dee5800a8f435----1788914523241

Response headers

strict-transport-security
max-age=15552000; includeSubDomains; preload
last-modified
Tue, 08 Sep 2026 23:44:13 GMT
content-encoding
br
cf-cache-status
HIT
age
3469
x-content-type-options
nosniff
cf-ray
a382269a5f7eebbc-YYZ
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Wed, 09 Sep 2026 00:42:03 GMT
content-type
application/json; charset=utf-8
vary
Accept-Encoding
server
cloudflare
priority
u=1,i
GET
H2
200
js Show response
www.googletagmanager.com/gtag/
546 KB
180 KB
78ms
76ms
Script
application/javascript
142.250.191.8
Google LLC
General
Full URL
https://www.googletagmanager.com/gtag/js?id=G-1X1EHQ3PFR&cx=c&gtm=4e6930
Requested by
Host: transcend-cdn.com
URL: https://transcend-cdn.com/cm/ef49a3f1-d8c1-47d6-88fc-50e41130631f/airgap.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.191.8 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
pnlgaa-az-in-f8.1e100.net
Software
Google Tag Manager /
Resource Hash
b8786ec54605a1c3d55215bfe50f5c6bca37f208b0d59e92364684271d7ce82d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
cache-control
private, max-age=900
content-encoding
zstd
cross-origin-resource-policy
cross-origin
access-control-allow-credentials
true
expires
Wed, 09 Sep 2026 00:42:03 GMT
access-control-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
184312
date
Wed, 09 Sep 2026 00:42:03 GMT
x-xss-protection
0
content-type
application/javascript; charset=UTF-8
vary
Accept-Encoding
server
Google Tag Manager
access-control-allow-headers
Cache-Control
GET
H2
200
js Show response
www.googletagmanager.com/gtag/
494 KB
165 KB
66ms
65ms
Script
application/javascript
142.250.191.8
Google LLC
General
Full URL
https://www.googletagmanager.com/gtag/js?id=G-8K02DKE4VC&cx=c&gtm=4e6930
Requested by
Host: transcend-cdn.com
URL: https://transcend-cdn.com/cm/ef49a3f1-d8c1-47d6-88fc-50e41130631f/airgap.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.191.8 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
pnlgaa-az-in-f8.1e100.net
Software
Google Tag Manager /
Resource Hash
79d4cc78785609224c96d8a2aecddb95c1e768381e0f23293224f3d501eae988
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
cache-control
private, max-age=900
content-encoding
zstd
cross-origin-resource-policy
cross-origin
access-control-allow-credentials
true
expires
Wed, 09 Sep 2026 00:42:03 GMT
access-control-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
168360
date
Wed, 09 Sep 2026 00:42:03 GMT
x-xss-protection
0
content-type
application/javascript; charset=UTF-8
vary
Accept-Encoding
server
Google Tag Manager
access-control-allow-headers
Cache-Control
GET
H2
200
iris-t.js Show response
widgets.iiris.com/iiris-tracker/v3.0/
215 KB
71 KB
135ms
55ms
Script
application/javascript
172.64.150.107
Cloudflare
General
Full URL
https://widgets.iiris.com/iiris-tracker/v3.0/iris-t.js
Requested by
Host: transcend-cdn.com
URL: https://transcend-cdn.com/cm/ef49a3f1-d8c1-47d6-88fc-50e41130631f/airgap.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.64.150.107 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
c5d1e20dc3d37b7b169efd23c4b6e03da91865b5bb5a954d8e277ee48610fa6c
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
gzip
etag
W/"a3ca0904d2e2b0e81c2273f771d0258f"
expect-ct
max-age=86400, enforce
report-to
{"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=URGWteXron26sgq%2BWV8lxb7LAhNMcF1SufIc0SvJ0P%2Bsh5U3euEqDnEvxeYxmw6eOr1t57GFDNB8W7egbYSbKXCyBcTn5C2G1d9jbN2RaXeiOzO1O4lHIk%2FI5EnuC7uCp0Ie12paXXoFu5osYDrVZl%2ByFT%2Fe7UIXP1O9jDUWOQ%3D%3D"}]}
x-content-type-options
nosniff
date
Wed, 09 Sep 2026 00:42:03 GMT
content-type
application/javascript
x-frame-options
SAMEORIGIN
strict-transport-security
max-age=15552000; includeSubDomains; preload
cache-control
public, max-age=0, must-revalidate
nel
{"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
referrer-policy
same-origin
cf-ray
a382269b5afb0643-YYZ
access-control-allow-origin
*
x-xss-protection
1; mode=block
server
cloudflare
GET
H2
200
chartbeat.js Show response
static.chartbeat.com/js/
41 KB
17 KB
135ms
40ms
Script
application/x-javascript
108.138.120.216
Amazon.com
General
Full URL
https://static.chartbeat.com/js/chartbeat.js
Requested by
Host: transcend-cdn.com
URL: https://transcend-cdn.com/cm/ef49a3f1-d8c1-47d6-88fc-50e41130631f/airgap.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
108.138.120.216 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-108-138-120-216.jfk50.r.cloudfront.net
Software
openresty /
Resource Hash
a613444e09a3ec07bef1e16e21a31193a624c1b213e75e32767e303dd4cd7bb1

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

cache-control
max-age=86400
content-encoding
gzip
etag
W/"6a62ac10-a310"
age
51200
cross-origin-resource-policy
cross-origin
via
1.1 e23983892b1c8fb4d47f943c0ee29028.cloudfront.net (CloudFront)
expires
Wed, 09 Sep 2026 10:28:43 GMT
x-cache
Hit from cloudfront
x-amz-cf-id
-Wi2D81q6WZR5Bo1s31dfzqhErs-r7Fca8sRNJG5MkKD5cS6f4sIdg==
date
Tue, 08 Sep 2026 10:28:43 GMT
content-type
application/x-javascript
last-modified
Fri, 24 Jul 2026 00:04:32 GMT
server
openresty
x-amz-cf-pop
JFK50-P4
vary
Accept-Encoding
GET
H2
200
/ Show response
6600d6d98e534115970f9529a45f3195.js.ubembed.com/
429 B
784 B
136ms
55ms
Script
application/javascript
104.18.39.181
Cloudflare
General
Full URL
https://6600d6d98e534115970f9529a45f3195.js.ubembed.com/
Requested by
Host: transcend-cdn.com
URL: https://transcend-cdn.com/cm/ef49a3f1-d8c1-47d6-88fc-50e41130631f/airgap.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.39.181 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
fe771c280663f3608eff2f112f2a5bf2840b832bbbcb2db3fb7a5bcda4215673

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

cache-control
max-age=0, must-revalidate
content-encoding
br
cf-cache-status
HIT
etag
W/"f476089a34b7da12c99fbc1a7f5c6116978c4fce"
age
4177
speculation-rules
"/cdn-cgi/speculation"
cf-ray
a382269b5a7ca247-YYZ
access-control-allow-origin
*
alt-svc
h3=":443"; ma=86400
date
Wed, 09 Sep 2026 00:42:03 GMT
content-type
application/javascript
vary
Accept-Encoding, Referer
server
cloudflare
GET
H2
200
hotjar-2610568.js Show response
static.hotjar.com/c/
20 KB
8 KB
157ms
46ms
Script
application/javascript
13.33.252.127
Amazon.com
General
Full URL
https://static.hotjar.com/c/hotjar-2610568.js?sv=6
Requested by
Host: transcend-cdn.com
URL: https://transcend-cdn.com/cm/ef49a3f1-d8c1-47d6-88fc-50e41130631f/airgap.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.33.252.127 New York, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-13-33-252-127.jfk50.r.cloudfront.net
Software
/
Resource Hash
506c0e9f9864188141da98c2d58f064351529365efd4f3f870f85815992f2e6d
Security Headers
Name Value
Strict-Transport-Security max-age=2592000; includeSubDomains
X-Content-Type-Options nosniff

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
br
etag
W/4be5be69e5e3ee4d84d3a7a2a0e4975e
age
39
x-content-type-options
nosniff
x-cache-hit
1
x-cache
Hit from cloudfront
x-amz-cf-id
TuD99lq5-82RfGalTaYYLTVmeDfjLngC5q6OGxXABmxEgFwcuDBedw==
date
Wed, 09 Sep 2026 00:41:24 GMT
content-type
application/javascript; charset=UTF-8
vary
Accept-Encoding
strict-transport-security
max-age=2592000; includeSubDomains
cache-control
max-age=60
cross-origin-resource-policy
cross-origin
via
1.1 14c5b6fdfe1b1584391cee9b27bdcf4a.cloudfront.net (CloudFront)
access-control-allow-origin
*
x-amz-cf-pop
JFK50-P10
GET
H/1.1
200
OK
jjabr51e3q Show response
www.clarity.ms/tag/
723 B
1 KB
234ms
71ms
Script
application/x-javascript
4.153.187.221
Microsoft Corpora...
General
Full URL
https://www.clarity.ms/tag/jjabr51e3q
Requested by
Host: transcend-cdn.com
URL: https://transcend-cdn.com/cm/ef49a3f1-d8c1-47d6-88fc-50e41130631f/airgap.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
4.153.187.221 Boydton, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),
Reverse DNS
Software
nginx /
Resource Hash
9bc8efd456da5579c6879e6de106b47b1f8313bc64a21cd2d5fa484d0b9f4a47

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

Cache-Control
no-cache, no-store
Connection
keep-alive
Request-Context
appId=cid-v1:a894a21c-0197-44e5-b203-3cbc01252c82
Expires
-1
Content-Length
723
Date
Wed, 09 Sep 2026 00:42:03 GMT
Content-Type
application/x-javascript
Server
nginx
GET
H/1.1
200
OK
dpm_b4c96d80854dd27e76d8cc9e21960eebda52e962.min.js Show response
s.dpmsrv.com/
679 KB
60 KB
150ms
38ms
Script
application/x-javascript
99.84.160.34
Amazon.com
General
Full URL
https://s.dpmsrv.com/dpm_b4c96d80854dd27e76d8cc9e21960eebda52e962.min.js
Requested by
Host: transcend-cdn.com
URL: https://transcend-cdn.com/cm/ef49a3f1-d8c1-47d6-88fc-50e41130631f/airgap.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
99.84.160.34 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-99-84-160-34.jfk50.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
7a3d5a521bceb13d1a912be12c352e4635719cce89ee38d1598ceb75918a85f4

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

Content-Encoding
gzip
ETag
"1559028d3acaf59c13497b729721421f"
Age
76995
Connection
keep-alive
Via
1.1 06cb9bed6e3c9f95e430c22405e0fd84.cloudfront.net (CloudFront)
Accept-Ranges
bytes
X-Cache
Hit from cloudfront
Content-Length
61185
X-Amz-Cf-Id
1MMgWvQse2SdAxJ2N7e_AVBWZcJwb3OnRr5AmYceU6plt4eLYTcx0A==
Date
Tue, 08 Sep 2026 03:18:49 GMT
Content-Type
application/x-javascript
Last-Modified
Tue, 04 Aug 2026 15:40:19 GMT
Server
AmazonS3
X-Amz-Cf-Pop
JFK50-P15
x-amz-server-side-encryption
AES256
GET
H2
200
pub.js Show response
pub.doubleverify.com/dvtag/19913272/DV424940/
115 KB
34 KB
123ms
59ms
Script
text/javascript
172.64.155.110
Cloudflare
General
Full URL
https://pub.doubleverify.com/dvtag/19913272/DV424940/pub.js
Requested by
Host: transcend-cdn.com
URL: https://transcend-cdn.com/cm/ef49a3f1-d8c1-47d6-88fc-50e41130631f/airgap.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.64.155.110 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
30cfa2edb52c5d8b995eea4a1b7f2e0b550da199b7ac44fa16ba88cea0bdceff
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
cache-control
public, max-age=900, stale-while-revalidate=3600
timing-allow-origin
*
content-encoding
br
access-control-expose-headers
Server-Timing, Cf-Ray
access-control-allow-credentials
true
cf-ray
a382269b5b66a204-YYZ
access-control-allow-origin
*
alt-svc
h3=":443"; ma=86400
date
Wed, 09 Sep 2026 00:42:03 GMT
content-type
text/javascript;charset=UTF-8
server
cloudflare
GET
H3
200
__manifest Show response
www.darkreading.com/
15 KB
2 KB
41ms
40ms
Fetch
application/json
104.16.224.171
Cloudflare
General
Full URL
https://www.darkreading.com/__manifest?paths=%2F%2C%2Fabout-us%2C%2Fadvertise%2C%2Fapplication-security%2C%2Fauthor%2C%2Fauthor%2Falexander-culafi%2C%2Fauthor%2Fjai-vijayan%2C%2Fauthor%2Frobert-wright%2C%2Fcloud-security%2C%2Fcyber-risk%2C%2Fcyber-risk%2Fdata-privacy%2C%2Fcyber-risk%2Fdelta-flight-disrupted-wi-fi-hack%2C%2Fcyberattacks-data-breaches%2C%2Fcyberattacks-data-breaches%2Fagentic-ai-new-insider-threat-model%2C%2Fcyberattacks-data-breaches%2Fai-warning-letter-missed-people%2C%2Fcyberattacks-data-breaches%2Fclickfix-targets-hotels-secondary-customer-attacks%2C%2Fcyberattacks-data-breaches%2Flarge-enterprises-fake-merger-acquisition-scams%2C%2Fcyberattacks-data-breaches%2Fopenai-agents-wiki-site-hugging-face-attack%2C%2Fcyberattacks-data-breaches%2Furl-obfuscation-still-a-phisher-s-phriend%2C%2Fcybersecurity-analytics%2C%2Fcybersecurity-operations%2C%2Fcybersecurity-operations%2Fcybersecurity-careers%2C%2Fcybersecurity-operations%2Fidentity-access-management-security%2C%2Fcybersecurity-operations%2Fperimeter%2C%2Fcybersecurity-operations%2Fphysical-security%2C%2Fdark-reading-polls%2C%2Fendpoint-security%2C%2Fendpoint-security%2Fmobile-security%2C%2Fendpoint-security%2Fphishing-tool-smart-redirects-bypass-email-security%2C%2Fendpoint-security%2Fremote-workforce%2C%2Fevents%2C%2Fics-ot-security%2C%2Fics-ot-security%2Fiot%2C%2Fkeyword%2C%2Fkeyword%2Fasia-pacific%2C%2Fkeyword%2Feurope%2C%2Fkeyword%2Fheard-it-from-a-ciso%2C%2Fkeyword%2Flatin-america%2C%2Fkeyword%2Fmiddle-east-africa%2C%2Flatest-news%2C%2Fpartner-perspectives%2C%2Fpodcasts%2C%2Fprogram%2C%2Fprogram%2Fblack-hat%2C%2Fprogram%2Fdarkreading-20th-anniversary%2C%2Fprogram%2Fdr-global%2C%2Fprogram%2Fdr-technology%2C%2Fprogram%2Fomdia-cybersecurity%2C%2Fprogram%2Fthe-edge%2C%2Fresources%2C%2Frss.xml%2C%2Fseries%2C%2Fseries%2Freporters-notebook%2C%2Fthreat-intelligence%2C%2Fvideos%2C%2Fvulnerabilities-threats%2C%2Fvulnerabilities-threats%2Fai-ending-era-hidden-vulnerabilities-are-vendors-ready%2C%2Fvulnerabilities-threats%2Finsider-threats%2C%2Fvulnerabilities-threats%2Fpatch-tuesday-another-record-974-cves&version=5ef1aa63
Requested by
Host: transcend-cdn.com
URL: https://transcend-cdn.com/cm/ef49a3f1-d8c1-47d6-88fc-50e41130631f/airgap.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.16.224.171 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
9b66c30135270b33ac0e207fa5732381a990b67021e79d546750fd9730ead00d
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.darkreading.com/cyberattacks-data-breaches/attackers-multi-hop-google-redirects-phishing-campaign
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0
newrelic
eyJ2IjpbMCwxXSwiZCI6eyJ0eSI6IkJyb3dzZXIiLCJhYyI6IjM5MzYzNDgiLCJhcCI6IjUzODYwMDE5OSIsImlkIjoiOGFjNmJlZjcwNTgyMjU4ZiIsInRyIjoiZmE4NGFiNmI0NzUxZTFhYWRhYTI5ZGRiZGY2YTRmOTkiLCJ0aSI6MTc4ODkxNDUyMzM0MSwidGsiOiIzMjg4OTI1In19
traceparent
00-fa84ab6b4751e1aadaa29ddbdf6a4f99-8ac6bef70582258f-01
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
tracestate
3288925@nr=0-1-3936348-538600199-8ac6bef70582258f----1788914523341

Response headers

strict-transport-security
max-age=15552000; includeSubDomains; preload
cache-control
public, max-age=31536000, immutable
content-encoding
br
cf-cache-status
HIT
age
9721
x-content-type-options
nosniff
last-modified
Tue, 08 Sep 2026 22:00:01 GMT
cf-ray
a382269b091eebbc-YYZ
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Wed, 09 Sep 2026 00:42:03 GMT
content-type
application/json; charset=utf-8
vary
Accept-Encoding
server
cloudflare
priority
u=1,i
POST
H3
200
collect
www.google.com/ccm/
0
0
104ms
56ms
Fetch
text/plain
142.251.154.119
Google LLC
General
Full URL
https://www.google.com/ccm/collect?rcb=18&frm=0&apvc=1&ae=g&auid=1481541718.1788914523&dt=Attackers%20Use%20Multi-Hop%20Google%20Redirects%20for%20Phishing&en=page_view&dl=https%3A%2F%2Fwww.darkreading.com%2Fcyberattacks-data-breaches%2Fattackers-multi-hop-google-redirects-phishing-campaign&scrsrc=www.googletagmanager.com&rnd=1738756375.1788914523&navt=n&npa=0&ep.ads_data_redaction=0&gtm=45He6930v891172384za200zd891172384xea&gcs=G111&gcd=13t3t3t3t5l1&dma=0&tag_exp=115616986~115938466~115938468~118131810~118897920~118897930~120385422~120469145~120469153&tft=1788914523367&tfd=3265&fmt=8
Requested by
Host: transcend-cdn.com
URL: https://transcend-cdn.com/cm/ef49a3f1-d8c1-47d6-88fc-50e41130631f/airgap.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.154.119 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
/
Resource Hash

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

POST
H3
204
collect
ad.doubleclick.net/ccm/s/
0
0
107ms
53ms
Fetch
text/html
142.251.167.148
Google LLC
General
Full URL
https://ad.doubleclick.net/ccm/s/collect?auid=1481541718.1788914523&gtm=45He6930v891172384za200zd891172384xea&fmt=8
Requested by
Host: transcend-cdn.com
URL: https://transcend-cdn.com/cm/ef49a3f1-d8c1-47d6-88fc-50e41130631f/airgap.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.167.148 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
ww-in-f148.1e100.net
Software
/
Resource Hash

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

GET
H2
200
standardchartered1800_winhorse_GettyImages-1344776566.jpg
eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/bltaf878ea5b4a138a7/6a7f5e48b01ed02ddabd5447/
175 KB
175 KB
35ms
34ms
Image
image/webp
104.17.160.85
Cloudflare
General
Full URL
https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/bltaf878ea5b4a138a7/6a7f5e48b01ed02ddabd5447/standardchartered1800_winhorse_GettyImages-1344776566.jpg?width=1400&auto=webp&quality=80&disable=upscale
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/cyberattacks-data-breaches/attackers-multi-hop-google-redirects-phishing-campaign
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.17.160.85 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
4d788b81a0093f7754fcf0a5d5278b8099c2810c198378d5925408f0e8877c2b
Security Headers
Name Value
Content-Security-Policy default-src 'none'; navigate-to 'none'; form-action 'none'; img-src data:; style-src 'unsafe-inline';
Strict-Transport-Security max-age=31557600

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

x-request-id
4ad16c13-ecde-4fe3-b7f4-78c9ea39b0bd
access-control-expose-headers
*
surrogate-key
blt6d90778a997de1cd.sys_assets blt6d90778a997de1cd.sys_assets.bltaf878ea5b4a138a7.download
cf-cache-status
HIT
etag
"cfgXDIv6bDH-0FfXCEsNpncsjMq-7wd3zPu3tEuNjeDQ"
age
1965002
cache-tag
blt6d90778a997de1cd.sys_assets blt6d90778a997de1cd.sys_assets.bltaf878ea5b4a138a7.download
cf-resized
internal=ok/h q=0 n=20+0 c=104+138 v=2026.8.2 l=178746 f=false c2=4 wv=2026.9.0
x-api-key
blt6d90778a997de1cd
access-control-allow-methods
GET,HEAD,PUT,PATCH,POST,DELETE,OPTIONS
x-cache
HIT, HIT
date
Wed, 09 Sep 2026 00:42:03 GMT
content-type
image/webp
content-disposition
inline; filename=standardchartered1800_winhorse_GettyImages-1344776566.webp
x-runtime
98ms
last-modified
Fri, 14 Aug 2026 18:28:24 GMT
x-contentstack-organization
blt5948195ac13977b0
access-control-allow-headers
*
strict-transport-security
max-age=31557600
content-security-policy
default-src 'none'; navigate-to 'none'; form-action 'none'; img-src data:; style-src 'unsafe-inline';
cache-control
public, max-age=31536000
x-timer
394
via
a2c6c0ea8a77f8a7-EWR
cf-ray
a382269b382546b5-YYZ
accept-ranges
bytes
access-control-allow-origin
*
content-length
178746
server
cloudflare
GET
H2
200
BridgedAgentVersion Show response
gateway.bridged.media/Configurations/
884 B
1 KB
450ms
152ms
Fetch
application/json
52.215.118.206
Amazon.com
General
Full URL
https://gateway.bridged.media/Configurations/BridgedAgentVersion?hostname=https://www.darkreading.com/cyberattacks-data-breaches/attackers-multi-hop-google-redirects-phishing-campaign
Requested by
Host: transcend-cdn.com
URL: https://transcend-cdn.com/cm/ef49a3f1-d8c1-47d6-88fc-50e41130631f/airgap.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
52.215.118.206 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-52-215-118-206.eu-west-1.compute.amazonaws.com
Software
/ Express
Resource Hash
91c94a92b359416c9756a5ce112b9b12f296463f3afbd21daef459c6ec18ac2c

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

access-control-allow-origin
*
content-length
884
date
Wed, 09 Sep 2026 00:42:03 GMT
etag
W/"374-Z3K0yFDpOwW9xqDNRb+Gax0oe6o"
content-type
application/json; charset=utf-8
x-powered-by
Express
vary
Accept-Encoding
GET
H2
200
simple Show response
api.sail-personalize.com/v1/personalize/
21 KB
5 KB
56ms
55ms
Fetch
application/json
99.83.154.140
Amazon.com
General
Full URL
https://api.sail-personalize.com/v1/personalize/simple?pageviews=1&isMobile=0
Requested by
Host: transcend-cdn.com
URL: https://transcend-cdn.com/cm/ef49a3f1-d8c1-47d6-88fc-50e41130631f/airgap.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
99.83.154.140 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
aa7557bb34ea5624b.awsglobalaccelerator.com
Software
/
Resource Hash
b872f8c9fc47a870dc1ca80a44307aa309b757c0eb03046f06733cc54053f799

Request headers

sec-ch-ua-platform
"Linux"
authorization
Bearer 12ab35a80530ffa5450add9c09f5de04
Referer
https://www.darkreading.com/
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0
x-lib-version
v1.0.1
x-referring-url
https://www.darkreading.com/cyberattacks-data-breaches/attackers-multi-hop-google-redirects-phishing-campaign
accept
application/json
content-type
application/json
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36

Response headers

cache-control
no-store
content-encoding
gzip
pragma
no-cache
allowedheaders
Content-Type,Authorization,X-Requested-With,Content-Length,Accept,Origin
access-control-allow-credentials
true
allowedorigins
*
expires
-1
access-control-allow-origin
*
allowedmethods
GET,OPTIONS
date
Wed, 09 Sep 2026 00:42:03 GMT
content-type
application/json
vary
Origin, Accept-Encoding
OPTIONS
H2
200
simple
api.sail-personalize.com/v1/personalize/ Frame
0
0
153ms
50ms
Preflight
text/plain
99.83.154.140
Amazon.com
General
Full URL
https://api.sail-personalize.com/v1/personalize/simple?pageviews=1&isMobile=0
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
99.83.154.140 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
aa7557bb34ea5624b.awsglobalaccelerator.com
Software
/
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
authorization,content-type,x-lib-version,x-referring-url
Access-Control-Request-Method
GET
Origin
https://www.darkreading.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Content-Type,Authorization,X-Requested-With,Content-Length,Accept,Origin,X-Lib-Version,X-Referring-URL
access-control-allow-methods
OPTIONS,GET,POST,PUT,DELETE
access-control-allow-origin
https://www.darkreading.com
access-control-max-age
1800
allow
HEAD,GET,OPTIONS
content-length
18
content-type
text/plain
date
Wed, 09 Sep 2026 00:42:03 GMT
vary
Origin
POST
H2
204
collect
analytics.google.com/g/
0
0
116ms
46ms
Fetch
text/plain
216.239.36.181
Google LLC
General
Full URL
https://analytics.google.com/g/collect?v=2&tid=G-8K02DKE4VC&gtm=45je6930v9241417933z8891172384za20gzb891172384zd891172384&_p=1788914523202&_gaz=1&gcs=G111&gcd=13t3t3t3t7l1&npa=1&dma=0&_eu=AAAAAGA&cid=1248964681.1788914524&frm=0&pscdl=noapi&rcb=3&sr=1600x1200&uaa=x86&uab=64&uafvl=Chromium%3B152.0.7977.82%7CGoogle%2520Chrome%3B152.0.7977.82%7CNot%253FA_Brand%3B24.0.0.0&uam=&uamb=0&uap=Linux&uapv=&uaw=0&ul=en-ca&gaf=2&_s=1&tag_exp=115938466~115938469~118897920~118897930~120213116~120385423~120469145~120469153~120914213&dr=&dt=Attackers%20Use%20Multi-Hop%20Google%20Redirects%20for%20Phishing%20Campaign&sid=1788914523&sct=1&seg=0&dl=https%3A%2F%2Fwww.darkreading.com%2Fcyberattacks-data-breaches%2Fattackers-multi-hop-google-redirects-phishing-campaign&en=page_view&_fv=1&_nsi=1&_ss=1&ep.content_type=article&ep.content_format=News&ep.content_publish_date=Sep%2008%2C%202026&ep.content_sub_brand=value%20not%20set&ep.content_buyer_journey=value%20not%20set&ep.content_id=bltb2aaea610dd27216&ep.content_title=Attackers%20Use%20Multi-Hop%20Google%20Redirects%20for%20Phishing%20Campaign&ep.content_legacy_path=value%20not%20set&ep.content_contributor=Alexander%20Culafi&ep.content_keyword=value%20not%20set&ep.content_series=value%20not%20set&ep.content_sponsor=value%20not%20set&ep.content_main_topic=Cyberattacks%20%26%20Data%20Breaches&ep.content_additional_topics=Cyber%20Risk%7CData%20Privacy%2CThreat%20Intelligence%2CEndpoint%20Security%7CRemote%20Workforce&ep.gtm_container_detail=GTM-5523ZCM%7C174&ep.ad_unit_path_code=%2F3618%2Fdarkreading.home%2Farticle%2Fcyberattacks-data-breaches&ep.content_program=value%20not%20set&ep.content_group=Cyberattacks%20%26%20Data%20Breaches&ep.content_all_topics=cyberattacks%20%26%20data%20breaches%7Cdata%20privacy%7Cremote%20workforce%7Cthreat%20intelligence&ep.informa_event_name=value%20not%20set&ep.envr=prod&ep.division=Informa%20TechTarget&tfd=3536
Requested by
Host: transcend-cdn.com
URL: https://transcend-cdn.com/cm/ef49a3f1-d8c1-47d6-88fc-50e41130631f/airgap.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
216.239.36.181 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
Golfe2 /
Resource Hash

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

cache-control
no-cache, no-store, must-revalidate
pragma
no-cache
cross-origin-resource-policy
cross-origin
access-control-allow-credentials
true
content-security-policy-report-only
script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:197:0
report-to
{"group":"ascnsrsggc:197:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:197:0"}],}
expires
Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin
https://www.darkreading.com
cross-origin-opener-policy-report-only
same-origin; report-to=ascnsrsggc:197:0
content-length
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Wed, 09 Sep 2026 00:42:03 GMT
content-type
text/plain
server
Golfe2
POST
H2
204
collect
stats.g.doubleclick.net/g/
0
561 B
141ms
53ms
Ping
text/plain
192.178.155.155
Google LLC
General
Full URL
https://stats.g.doubleclick.net/g/collect?v=2&tid=G-8K02DKE4VC&cid=1248964681.1788914524&gtm=45je6930v9241417933z8891172384za20gzb891172384zd891172384&rcb=3&aip=1&dma=0&gcs=G111&gcd=13t3t3t3t7l1&npa=1&frm=0&tag_exp=115938466~115938469~118897920~118897930~120213116~120385423~120469145~120469153~120914213
Requested by
Host: transcend-cdn.com
URL: https://transcend-cdn.com/cm/ef49a3f1-d8c1-47d6-88fc-50e41130631f/airgap.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.178.155.155 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
yuiadrs-in-f155.1e100.net
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

cache-control
no-cache, no-store, must-revalidate
pragma
no-cache
cross-origin-resource-policy
cross-origin
access-control-allow-credentials
true
content-security-policy-report-only
script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:165:0
report-to
{"group":"ascnsrsggc:165:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:165:0"}],}
expires
Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin
https://www.darkreading.com
cross-origin-opener-policy-report-only
same-origin; report-to=ascnsrsggc:165:0
content-length
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Wed, 09 Sep 2026 00:42:03 GMT
content-type
text/plain
server
Golfe2
GET
H3
200
ga-audiences
www.google.ca/ads/
42 B
63 B
152ms
103ms
Image
image/gif
64.233.180.94
Google LLC
General
Full URL
https://www.google.ca/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-8K02DKE4VC&cid=1248964681.1788914524&gtm=45je6930v9241417933z8891172384za20gzb891172384zd891172384&rcb=3&aip=1&dma=0&gcs=G111&gcd=13t3t3t3t7l1&npa=1&frm=0&tag_exp=115938466~115938469~118897920~118897930~120213116~120385423~120469145~120469153~120914213&z=1986712186
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/cyberattacks-data-breaches/attackers-multi-hop-google-redirects-phishing-campaign
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
64.233.180.94 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
on-in-f94.1e100.net
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

cache-control
no-cache, no-store, must-revalidate
timing-allow-origin
*
pragma
no-cache
cross-origin-resource-policy
cross-origin
x-content-type-options
nosniff
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length
42
date
Wed, 09 Sep 2026 00:42:03 GMT
x-xss-protection
0
content-type
image/gif
server
cafe
GET
H2
200
bundle.js Show response
assets.ubembed.com/universalscript/releases/v0.184.0/
186 KB
51 KB
122ms
38ms
Script
application/javascript
3.168.122.50
Amazon.com
General
Full URL
https://assets.ubembed.com/universalscript/releases/v0.184.0/bundle.js
Requested by
Host: transcend-cdn.com
URL: https://transcend-cdn.com/cm/ef49a3f1-d8c1-47d6-88fc-50e41130631f/airgap.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
3.168.122.50 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-3-168-122-50.jfk52.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
4491fdaf87c52bd480a77d73ad1dd94f34795eaf38f95503698c9909f01de0f2

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

vary
Accept-Encoding
cache-control
max-age=31536000
content-encoding
gzip
etag
W/"713505b9ffe640af4d6413451bd991b6"
age
661141
via
1.1 9190fdd67f95a969cd6107b6e005b45c.cloudfront.net (CloudFront)
x-cache
Hit from cloudfront
x-amz-cf-id
y6doTFdGSk9bW0HB7IDCpEi8P81tdRVuX9JqtrMm9EDQW8coUkkPCg==
date
Tue, 01 Sep 2026 09:03:02 GMT
content-type
application/javascript
last-modified
Wed, 06 Aug 2025 21:44:04 GMT
server
AmazonS3
x-amz-cf-pop
JFK52-P7
x-amz-server-side-encryption
AES256
GET
H2
200
ping
ping.chartbeat.net/
43 B
201 B
144ms
46ms
Image
image/gif
54.156.230.248
Amazon.com
General
Full URL
https://ping.chartbeat.net/ping?h=darkreading.com&p=%2Fcyberattacks-data-breaches%2Fattackers-multi-hop-google-redirects-phishing-campaign&u=9gw8EtgroLFfzMQ&d=darkreading.com&g=53678&g0=Cyberattacks%20%26%20Data%20Breaches&g1=Alexander%20Culafi&g4=article&g7=1788902019967&n=1&f=00001&c=0&x=0&m=0&y=5511&o=1600&w=1200&j=45&R=1&W=0&I=0&E=0&e=0&r=&PA=https%3A%2F%2Fwww.darkreading.com%2Fcyberattacks-data-breaches%2Fattackers-multi-hop-google-redirects-phishing-campaign&b=3567&t=UCLCzBsDNgOC9_FdpctFw-nPF6G&V=152&i=Attackers%20Use%20Multi-Hop%20Google%20Redirects%20for%20Phishing%20Campaign&tz=420&sn=1&sv=Cb0wbtDFQx3eBiJS0Kw4vpVlXwU4&sr=external&sd=1&im=067b2fff&_
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/cyberattacks-data-breaches/attackers-multi-hop-google-redirects-phishing-campaign
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
54.156.230.248 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-54-156-230-248.compute-1.amazonaws.com
Software
/
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

expires
0
cache-control
no-cache, no-store, must-revalidate
content-length
43
date
Wed, 09 Sep 2026 00:42:03 GMT
pragma
no-cache
content-type
image/gif
cross-origin-resource-policy
cross-origin
GET
H3
200
destination Show response
www.googletagmanager.com/gtag/
477 KB
161 KB
78ms
78ms
Script
application/javascript
142.250.191.8
Google LLC
General
Full URL
https://www.googletagmanager.com/gtag/destination?id=AW-1023206053&cx=c&gtm=4e6930
Requested by
Host: transcend-cdn.com
URL: https://transcend-cdn.com/cm/ef49a3f1-d8c1-47d6-88fc-50e41130631f/airgap.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.191.8 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
pnlgaa-az-in-f8.1e100.net
Software
Google Tag Manager /
Resource Hash
ed25afcb23e452ae6cfb1855f82c03acf0971fbf082fd4943bc9ba316094984a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
zstd
report-to
{"group":"ascgsrsghrgc:71:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgsrsghrgc:71:0"}],}
expires
Wed, 09 Sep 2026 00:42:03 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Wed, 09 Sep 2026 00:42:03 GMT
content-type
application/javascript; charset=UTF-8
vary
Accept-Encoding
access-control-allow-headers
Cache-Control
strict-transport-security
max-age=31536000; includeSubDomains
cache-control
private, max-age=900
cross-origin-resource-policy
cross-origin
access-control-allow-credentials
true
content-security-policy-report-only
script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgsrsghrgc:71:0
access-control-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to=ascgsrsghrgc:71:0
content-length
165034
x-xss-protection
0
server
Google Tag Manager
POST
H2
204
collect
analytics.google.com/g/
0
0
59ms
47ms
Fetch
text/plain
216.239.36.181
Google LLC
General
Full URL
https://analytics.google.com/g/collect?v=2&tid=G-1X1EHQ3PFR&gtm=45je6930v873922772z8891172384za20gzb891172384zd891172384&_p=1788914523202&_gaz=1&gcs=G111&gcd=13t3t3t3t7l1&npa=1&dma=0&_eu=AAAAAGAC&_geo=1&_rdi=1&cid=1248964681.1788914524&frm=0&pscdl=noapi&rcb=10&ul=en-ca&gaf=2&_s=1&tag_exp=115938466~115938469~118897920~118897930~120213116~120385423~120469145~120469153&dr=&dl=https%3A%2F%2Fwww.darkreading.com%2Fcyberattacks-data-breaches%2Fattackers-multi-hop-google-redirects-phishing-campaign&dt=Attackers%20Use%20Multi-Hop%20Google%20Redirects%20for%20Phishing%20Campaign&sid=1788914523&sct=1&seg=0&en=page_view&_fv=1&_ss=1&ep.content_type=article&ep.content_format=News&ep.content_publish_date=Sep%2008%2C%202026&ep.content_sub_brand=value%20not%20set&ep.content_buyer_journey=value%20not%20set&ep.content_id=bltb2aaea610dd27216&ep.content_title=Attackers%20Use%20Multi-Hop%20Google%20Redirects%20for%20Phishing%20Campaign&ep.content_legacy_path=value%20not%20set&ep.content_contributor=Alexander%20Culafi&ep.content_keyword=value%20not%20set&ep.content_series=value%20not%20set&ep.content_sponsor=value%20not%20set&ep.content_main_topic=Cyberattacks%20%26%20Data%20Breaches&ep.content_additional_topics=Cyber%20Risk%7CData%20Privacy%2CThreat%20Intelligence%2CEndpoint%20Security%7CRemote%20Workforce&ep.gtm_container_detail=GTM-5523ZCM%7C174&ep.ad_unit_path_code=%2F3618%2Fdarkreading.home%2Farticle%2Fcyberattacks-data-breaches&ep.content_program=value%20not%20set&ep.content_group=Cyberattacks%20%26%20Data%20Breaches&ep.content_all_topics=cyberattacks%20%26%20data%20breaches%7Cdata%20privacy%7Cremote%20workforce%7Cthreat%20intelligence&ep.informa_event_name=value%20not%20set&ep.envr=prod&ep.division=Informa%20TechTarget&tfd=3717
Requested by
Host: transcend-cdn.com
URL: https://transcend-cdn.com/cm/ef49a3f1-d8c1-47d6-88fc-50e41130631f/airgap.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
216.239.36.181 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
Golfe2 /
Resource Hash

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

cache-control
no-cache, no-store, must-revalidate
pragma
no-cache
cross-origin-resource-policy
cross-origin
access-control-allow-credentials
true
content-security-policy-report-only
script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:197:0
report-to
{"group":"ascnsrsggc:197:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:197:0"}],}
expires
Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin
https://www.darkreading.com
cross-origin-opener-policy-report-only
same-origin; report-to=ascnsrsggc:197:0
content-length
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Wed, 09 Sep 2026 00:42:03 GMT
content-type
text/plain
server
Golfe2
POST
H2
204
collect
stats.g.doubleclick.net/g/
0
57 B
60ms
49ms
Ping
text/plain
192.178.155.155
Google LLC
General
Full URL
https://stats.g.doubleclick.net/g/collect?v=2&tid=G-1X1EHQ3PFR&cid=1248964681.1788914524&gtm=45je6930v873922772z8891172384za20gzb891172384zd891172384&rcb=10&aip=1&dma=0&gcs=G111&gcd=13t3t3t3t7l1&npa=1&frm=0&tag_exp=115938466~115938469~118897920~118897930~120213116~120385423~120469145~120469153
Requested by
Host: transcend-cdn.com
URL: https://transcend-cdn.com/cm/ef49a3f1-d8c1-47d6-88fc-50e41130631f/airgap.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.178.155.155 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
yuiadrs-in-f155.1e100.net
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

cache-control
no-cache, no-store, must-revalidate
pragma
no-cache
cross-origin-resource-policy
cross-origin
access-control-allow-credentials
true
content-security-policy-report-only
script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:165:0
report-to
{"group":"ascnsrsggc:165:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:165:0"}],}
expires
Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin
https://www.darkreading.com
cross-origin-opener-policy-report-only
same-origin; report-to=ascnsrsggc:165:0
content-length
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Wed, 09 Sep 2026 00:42:03 GMT
content-type
text/plain
server
Golfe2
GET
H3
200
ga-audiences
www.google.ca/ads/
42 B
63 B
75ms
66ms
Image
image/gif
64.233.180.94
Google LLC
General
Full URL
https://www.google.ca/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-1X1EHQ3PFR&cid=1248964681.1788914524&gtm=45je6930v873922772z8891172384za20gzb891172384zd891172384&rcb=10&aip=1&dma=0&gcs=G111&gcd=13t3t3t3t7l1&npa=1&frm=0&tag_exp=115938466~115938469~118897920~118897930~120213116~120385423~120469145~120469153&z=1545831226
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/cyberattacks-data-breaches/attackers-multi-hop-google-redirects-phishing-campaign
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
64.233.180.94 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
on-in-f94.1e100.net
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

cache-control
no-cache, no-store, must-revalidate
timing-allow-origin
*
pragma
no-cache
cross-origin-resource-policy
cross-origin
x-content-type-options
nosniff
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length
42
date
Wed, 09 Sep 2026 00:42:03 GMT
x-xss-protection
0
content-type
image/gif
server
cafe
GET
H3
200
pub.json Show response
pub.doubleverify.com/dvtag/signals/ids/
65 B
312 B
137ms
96ms
Fetch
application/json
172.64.155.110
Cloudflare
General
Full URL
https://pub.doubleverify.com/dvtag/signals/ids/pub.json?ctx=19913272&cmp=DV424940&url=https%3A%2F%2Fdarkreading.com&ids=1&token=hQv5C45q8J%2FGbeeypApQ0DejOzV9p6i5RSrvR2%2BrnQ7vjOgjPIdpmO%2FmZS%2F9ojr87eOFTU7ermH8wjHE3jYgap6wTLxviQedRHrOyxk3mSnSkRoHTofV%2BNp2MLaGEfbsiVkwliYZkEQjOw%3D%3D
Requested by
Host: transcend-cdn.com
URL: https://transcend-cdn.com/cm/ef49a3f1-d8c1-47d6-88fc-50e41130631f/airgap.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.64.155.110 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
5edf6485ad683b961561f5ff0861a84befc784983de2cf40a8896bb71b8c395e
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
cache-control
private, max-age=900
timing-allow-origin
*
content-encoding
br
access-control-expose-headers
Server-Timing, Cf-Ray
access-control-allow-credentials
true
cf-ray
a382269e7b3136b4-YYZ
access-control-allow-origin
https://www.darkreading.com
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Wed, 09 Sep 2026 00:42:03 GMT
content-type
application/json
vary
origin, x-forwarded-for, user-agent
server
cloudflare
priority
u=1,i
GET
H3
200
pub.json Show response
pub.doubleverify.com/dvtag/signals/bsc/
292 B
415 B
85ms
55ms
Fetch
application/json
172.64.155.110
Cloudflare
General
Full URL
https://pub.doubleverify.com/dvtag/signals/bsc/pub.json?ctx=19913272&cmp=DV424940&url=https%3A%2F%2Fdarkreading.com%2Fcyberattacks-data-breaches%2Fattackers-multi-hop-google-redirects-phishing-campaign&bsc=1&token=hQv5C45q8J%2FGbeeypApQ0DejOzV9p6i5RSrvR2%2BrnQ7vjOgjPIdpmO%2FmZS%2F9ojr87eOFTU7ermH8wjHE3jYgap6wTLxviQedRHrOyxk3mSnSkRoHTofV%2BNp2MLaGEfbsiVkwliYZkEQjOw%3D%3D
Requested by
Host: transcend-cdn.com
URL: https://transcend-cdn.com/cm/ef49a3f1-d8c1-47d6-88fc-50e41130631f/airgap.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.64.155.110 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
9ec21fe562e76796b3fbd70d2a5a3d38efcba909c0fcc84b1471ee05e2bd36b6
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
cache-control
public, max-age=5573
timing-allow-origin
*
content-encoding
br
access-control-expose-headers
Server-Timing, Cf-Ray
access-control-allow-credentials
true
cf-ray
a382269e7b2c36b4-YYZ
access-control-allow-origin
https://www.darkreading.com
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Wed, 09 Sep 2026 00:42:03 GMT
content-type
application/json
vary
origin
server
cloudflare
priority
u=1,i
GET
H3
200
pub.json Show response
pub.doubleverify.com/dvtag/signals/vlp/
339 B
306 B
99ms
69ms
Fetch
application/json
172.64.155.110
Cloudflare
General
Full URL
https://pub.doubleverify.com/dvtag/signals/vlp/pub.json?ctx=19913272&cmp=DV424940&url=https%3A%2F%2Fdarkreading.com&vlp=1&slot-0-%2F3618%2Fdarkreading.home%2Farticle%2Fcyberattacks-data-breaches%40welcome_v=1x1&slot-1-%2F3618%2Fdarkreading.home%2Farticle%2Fcyberattacks-data-breaches%40bigsky_v=1x1&slot-2-%2F3618%2Fdarkreading.home%2Farticle%2Fcyberattacks-data-breaches%40wallpaper_v=1x1&slot-3-%2F3618%2Fdarkreading.home%2Farticle%2Fcyberattacks-data-breaches%40oop_v=1x1&slot-4-%2F3618%2Fdarkreading.home%2Farticle%2Fcyberattacks-data-breaches%40floor_v=1x1&slot-5-%2F3618%2Fdarkreading.home%2Farticle%2Fcyberattacks-data-breaches%40adhesion_v=1x1&token=hQv5C45q8J%2FGbeeypApQ0DejOzV9p6i5RSrvR2%2BrnQ7vjOgjPIdpmO%2FmZS%2F9ojr87eOFTU7ermH8wjHE3jYgap6wTLxviQedRHrOyxk3mSnSkRoHTofV%2BNp2MLaGEfbsiVkwliYZkEQjOw%3D%3D
Requested by
Host: transcend-cdn.com
URL: https://transcend-cdn.com/cm/ef49a3f1-d8c1-47d6-88fc-50e41130631f/airgap.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.64.155.110 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
9381df9ea9c532438b0a07c60bc6fc6021063ac94e7c125cee9d0cfb42020bc7
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
cache-control
public, max-age=3299
timing-allow-origin
*
content-encoding
br
access-control-expose-headers
Server-Timing, Cf-Ray
access-control-allow-credentials
true
cf-ray
a382269e7b2f36b4-YYZ
access-control-allow-origin
https://www.darkreading.com
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Wed, 09 Sep 2026 00:42:03 GMT
content-type
application/json
vary
origin
server
cloudflare
priority
u=1,i
OPTIONS
H2
200
ed0
c.darkreading.com/com.iiris/ Frame
0
0
511ms
411ms
Preflight
104.16.221.171
Cloudflare
General
Full URL
https://c.darkreading.com/com.iiris/ed0
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.16.221.171 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type
Access-Control-Request-Method
POST
Origin
https://www.darkreading.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Content-Type, SP-Anonymous
access-control-allow-origin
https://www.darkreading.com
access-control-max-age
600
alt-svc
h3=":443"; ma=86400
cf-cache-status
DYNAMIC
cf-ray
a382269f191f3703-YYZ
content-length
0
date
Wed, 09 Sep 2026 00:42:04 GMT
server
cloudflare
strict-transport-security
max-age=31536000; includeSubDomains
POST
H3
200
ed0 Show response
c.darkreading.com/com.iiris/
2 B
340 B
484ms
435ms
Fetch
text/plain
104.16.221.171
Cloudflare
General
Full URL
https://c.darkreading.com/com.iiris/ed0
Requested by
Host: transcend-cdn.com
URL: https://transcend-cdn.com/cm/ef49a3f1-d8c1-47d6-88fc-50e41130631f/airgap.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.16.221.171 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
content-type
application/json; charset=UTF-8
sec-ch-ua-mobile
?0

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
cf-cache-status
DYNAMIC
access-control-allow-credentials
true
cf-ray
a38226a20b11ab82-YYZ
access-control-allow-origin
https://www.darkreading.com
alt-svc
h3=":443"; ma=86400
content-length
2
server-timing
cfExtPri
date
Wed, 09 Sep 2026 00:42:04 GMT
content-type
text/plain
server
cloudflare
priority
u=1,i
GET
H2
200
modules.e762be2b6b709245aabb.js Show response
script.hotjar.com/
229 KB
57 KB
153ms
39ms
Script
application/javascript
99.84.160.95
Amazon.com
General
Full URL
https://script.hotjar.com/modules.e762be2b6b709245aabb.js
Requested by
Host: transcend-cdn.com
URL: https://transcend-cdn.com/cm/ef49a3f1-d8c1-47d6-88fc-50e41130631f/airgap.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
99.84.160.95 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-99-84-160-95.jfk50.r.cloudfront.net
Software
/
Resource Hash
afa2890b366a0c442ba0a51110a487d9b6ad0e96aab761777f775be1ce393aa6
Security Headers
Name Value
Strict-Transport-Security max-age=2592000; includeSubDomains
X-Content-Type-Options nosniff

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

x-robots-tag
none
content-encoding
br
etag
"e2ac1f759241ebb513f3655b5d637279"
age
1271935
x-content-type-options
nosniff
x-cache
Hit from cloudfront
x-amz-cf-id
99jQHqYJ6vw2opl0Z2R8-h1f40pqEdF7yPfF_9zNFUQDOY_3RNh2RQ==
date
Tue, 25 Aug 2026 07:23:08 GMT
content-type
application/javascript; charset=utf-8
last-modified
Tue, 25 Aug 2026 07:22:18 GMT
vary
Accept-Encoding
strict-transport-security
max-age=2592000; includeSubDomains
cache-control
max-age=31536000
cross-origin-resource-policy
cross-origin
via
1.1 b0380453c1d490e0143b23fb633d7e7c.cloudfront.net (CloudFront)
accept-ranges
bytes
access-control-allow-origin
*
content-length
57688
x-amz-cf-pop
JFK50-P15
GET
H2
200
css
fonts.googleapis.com/ Frame 5FAE
15 KB
0
3ms
2ms
Stylesheet
text/css
142.251.167.95
Google LLC
General
Full URL
https://fonts.googleapis.com/css?kit=TrRn_cawiauSGymlkgY3lekzMFivVqLDBnXnWDs7xuSurckZKAF09_I-3FaURnfHGLqwaF1VvfJKw_xrQEfwwQ
Requested by
Host: docs.google.com
URL: https://docs.google.com/spreadsheets/d/e/2PACX-1vQsygsynrhlYSFLOwZ9IaqURE4cQ3rGo07MkUiECTl3zXlINi_MWVmfxgjSgmvPhGmk0kPdS8DBzkoj/pubhtml?gid=1145058527&single=false&widget=false&headers=false&chrome=false
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
142.251.167.95 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
ww-in-f95.1e100.net
Software
ESF /
Resource Hash
159ca2165c7f4a101209bf5e952695e20f5bdc408468212d24dca0a4f0a5ecc1
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
https://docs.google.com/

Response headers

content-encoding
gzip
x-content-type-options
nosniff
expires
Wed, 09 Sep 2026 00:42:02 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Wed, 09 Sep 2026 00:42:02 GMT
content-type
text/css; charset=utf-8
vary
Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
last-modified
Wed, 09 Sep 2026 00:42:02 GMT
x-frame-options
SAMEORIGIN
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
cross-origin-opener-policy
same-origin-allow-popups
cross-origin-resource-policy
cross-origin
access-control-allow-origin
*
x-xss-protection
0
server
ESF
GET
H2
200
2837645074-waffle_k_ltr.css
docs.google.com/static/spreadsheets2/client/css/ Frame 5FAE
4 MB
0
2ms
1ms
Stylesheet
text/css
142.250.217.14
Google LLC
General
Full URL
https://docs.google.com/static/spreadsheets2/client/css/2837645074-waffle_k_ltr.css
Requested by
Host: docs.google.com
URL: https://docs.google.com/spreadsheets/d/e/2PACX-1vQsygsynrhlYSFLOwZ9IaqURE4cQ3rGo07MkUiECTl3zXlINi_MWVmfxgjSgmvPhGmk0kPdS8DBzkoj/pubhtml?gid=1145058527&single=false&widget=false&headers=false&chrome=false
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.217.14 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
pnlgaa-as-in-f14.1e100.net
Software
sffe /
Resource Hash
c7e008af9806590bd59b39a737925756e996613e8ed92caf152caba1087b064d
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://docs.google.com/spreadsheets/d/e/2PACX-1vQsygsynrhlYSFLOwZ9IaqURE4cQ3rGo07MkUiECTl3zXlINi_MWVmfxgjSgmvPhGmk0kPdS8DBzkoj/pubhtml?gid=1145058527&single=false&widget=false&headers=false&chrome=false
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
gzip
age
561420
report-to
{"group":"apps-spreadsheets","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-spreadsheets"}]}
x-content-type-options
nosniff
expires
Thu, 02 Sep 2027 12:45:02 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Wed, 02 Sep 2026 12:45:02 GMT
last-modified
Wed, 02 Sep 2026 12:14:51 GMT
content-type
text/css
vary
Accept-Encoding, Origin
cache-control
public, max-age=31536000
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="apps-spreadsheets"
content-length
497860
x-xss-protection
0
server
sffe
GET
H/1.1
200
OK
index.php Show response
a.dpmsrv.com/dpmpxl/
335 B
884 B
180ms
41ms
Script
text/javascript
100.60.18.88
Amazon.com
General
Full URL
https://a.dpmsrv.com/dpmpxl/index.php?zn=&sn=&sw=&sessionId=&q=xImp&v=1.x&ep%5BaUid%5D=&ep%5BaSid%5D=&ep%5BaSidCustom%5D=1&ep%5BcCid%5D=&cl=68&pixelIndex=0&r=500006&tzOffset=420&url=https%3A%2F%2Fwww.darkreading.com%2Fcyberattacks-data-breaches%2Fattackers-multi-hop-google-redirects-phishing-campaign&pageTitle=Attackers%20Use%20Multi-Hop%20Google%20Redirects%20for%20Phishing
Requested by
Host: transcend-cdn.com
URL: https://transcend-cdn.com/cm/ef49a3f1-d8c1-47d6-88fc-50e41130631f/airgap.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
100.60.18.88 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-100-60-18-88.compute-1.amazonaws.com
Software
/
Resource Hash
be687198e1faa5e63e4958dc3f91fa9c0dcf5c7fc8e09cd38fd7ebb07c02c51c

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

Access-Control-Max-Age
10
Cache-Control
no-cache, no-store, must-revalidate
content-encoding
gzip
Pragma
no-cache
Connection
keep-alive
Access-Control-Allow-Methods
GET, POST, PUT, DELETE, OPTIONS
Expires
0
Access-Control-Allow-Origin
*
P3P
CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Content-Length
261
Content-Type
text/javascript
Access-Control-Allow-Headers
content-type, accept
GET
H2
200
clarity.js Show response
scripts.clarity.ms/0.8.69/
73 KB
25 KB
269ms
84ms
Script
application/javascript
150.171.109.73
Microsoft Corpora...
General
Full URL
https://scripts.clarity.ms/0.8.69/clarity.js
Requested by
Host: transcend-cdn.com
URL: https://transcend-cdn.com/cm/ef49a3f1-d8c1-47d6-88fc-50e41130631f/airgap.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
150.171.109.73 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),
Reverse DNS
Software
/
Resource Hash
b79022e54da6b4e1f4ad388fa5247c14665cd17bfc4ceba082e88c1fbc2c0fb6

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

x-azure-ref
20260909T004204Z-154c47b99c4l6lkbhC1IADr2ew000000085g000000002yae
cache-control
public, max-age=86400
x-ms-version
2018-03-28
content-encoding
br
etag
W/"0x8DEFCF10CE0F12A"
x-fd-int-roxy-purgeid
0
x-ms-request-id
eb240a0c-b01e-0053-6cb2-3e0def000000
access-control-allow-origin
*
x-cache
TCP_HIT
date
Wed, 09 Sep 2026 00:42:04 GMT
content-type
application/javascript;charset=utf-8
vary
Accept-Encoding
last-modified
Tue, 18 Aug 2026 06:22:16 GMT
GET
H3
200
UcCO3FwrK3iLTeHuS_nVMrMxCp50SjIw2boKoduKmMEVuLyfMZ0.woff2
fonts.gstatic.com/s/inter/v20/ Frame 5FAE
106 KB
0
97ms
48ms
Font
font/woff2
142.251.211.131
Google LLC
General
Full URL
https://fonts.gstatic.com/s/inter/v20/UcCO3FwrK3iLTeHuS_nVMrMxCp50SjIw2boKoduKmMEVuLyfMZ0.woff2
Requested by
Host: docs.google.com
URL: https://docs.google.com/spreadsheets/d/e/2PACX-1vQsygsynrhlYSFLOwZ9IaqURE4cQ3rGo07MkUiECTl3zXlINi_MWVmfxgjSgmvPhGmk0kPdS8DBzkoj/pubhtml?gid=326945225&widget=false&headers=false&chrome=false
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.211.131 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
lclgaa-au-in-f3.1e100.net
Software
sffe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
https://docs.google.com
Referer
https://docs.google.com/

Response headers

age
32135
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options
nosniff
expires
Wed, 08 Sep 2027 15:46:27 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Tue, 08 Sep 2026 15:46:27 GMT
last-modified
Tue, 09 Sep 2025 18:41:52 GMT
content-type
font/woff2
cache-control
public, max-age=31536000
timing-allow-origin
*
cross-origin-opener-policy
same-origin; report-to="apps-themes"
cross-origin-resource-policy
cross-origin
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges
bytes
access-control-allow-origin
*
content-length
108656
x-xss-protection
0
server
sffe
GET

UcCO3FwrK3iLTeHuS_nVMrMxCp50SjIw2boKoduKmMEVuLyfMZ0.woff2
https://docs.google.com/persistent/docs/fonts/ Frame 5FAE
0
0


GET
H3
200
UcCO3FwrK3iLTeHuS_nVMrMxCp50SjIw2boKoduKmMEVuFuYMZ0.woff2
fonts.gstatic.com/s/inter/v20/ Frame 5FAE
110 KB
0
127ms
78ms
Font
font/woff2
142.251.211.131
Google LLC
General
Full URL
https://fonts.gstatic.com/s/inter/v20/UcCO3FwrK3iLTeHuS_nVMrMxCp50SjIw2boKoduKmMEVuFuYMZ0.woff2
Requested by
Host: docs.google.com
URL: https://docs.google.com/spreadsheets/d/e/2PACX-1vQsygsynrhlYSFLOwZ9IaqURE4cQ3rGo07MkUiECTl3zXlINi_MWVmfxgjSgmvPhGmk0kPdS8DBzkoj/pubhtml?gid=326945225&widget=false&headers=false&chrome=false
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.211.131 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
lclgaa-au-in-f3.1e100.net
Software
sffe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
https://docs.google.com
Referer
https://docs.google.com/

Response headers

age
28183
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options
nosniff
expires
Wed, 08 Sep 2027 16:52:19 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Tue, 08 Sep 2026 16:52:19 GMT
last-modified
Tue, 09 Sep 2025 18:36:03 GMT
content-type
font/woff2
cache-control
public, max-age=31536000
timing-allow-origin
*
cross-origin-opener-policy
same-origin; report-to="apps-themes"
cross-origin-resource-policy
cross-origin
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges
bytes
access-control-allow-origin
*
content-length
112444
x-xss-protection
0
server
sffe
GET

UcCO3FwrK3iLTeHuS_nVMrMxCp50SjIw2boKoduKmMEVuFuYMZ0.woff2
https://docs.google.com/persistent/docs/fonts/ Frame 5FAE
0
0


GET
H3
200
UcCM3FwrK3iLTcvneQg7Ca725JhhKnNqk4j1ebLhAm8SrXTc2dthiA.woff2
fonts.gstatic.com/s/inter/v20/ Frame 5FAE
111 KB
0
91ms
43ms
Font
font/woff2
142.251.211.131
Google LLC
General
Full URL
https://fonts.gstatic.com/s/inter/v20/UcCM3FwrK3iLTcvneQg7Ca725JhhKnNqk4j1ebLhAm8SrXTc2dthiA.woff2
Requested by
Host: docs.google.com
URL: https://docs.google.com/spreadsheets/d/e/2PACX-1vQsygsynrhlYSFLOwZ9IaqURE4cQ3rGo07MkUiECTl3zXlINi_MWVmfxgjSgmvPhGmk0kPdS8DBzkoj/pubhtml?gid=326945225&widget=false&headers=false&chrome=false
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.211.131 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
lclgaa-au-in-f3.1e100.net
Software
sffe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
https://docs.google.com
Referer
https://docs.google.com/

Response headers

age
494010
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options
nosniff
expires
Fri, 03 Sep 2027 07:28:32 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Thu, 03 Sep 2026 07:28:32 GMT
last-modified
Tue, 09 Sep 2025 18:40:02 GMT
content-type
font/woff2
cache-control
public, max-age=31536000
timing-allow-origin
*
cross-origin-opener-policy
same-origin; report-to="apps-themes"
cross-origin-resource-policy
cross-origin
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges
bytes
access-control-allow-origin
*
content-length
114132
x-xss-protection
0
server
sffe
GET

UcCM3FwrK3iLTcvneQg7Ca725JhhKnNqk4j1ebLhAm8SrXTc2dthiA.woff2
https://docs.google.com/persistent/docs/fonts/ Frame 5FAE
0
0


GET
H3
200
UcCM3FwrK3iLTcvneQg7Ca725JhhKnNqk4j1ebLhAm8SrXTcPtxhiA.woff2
fonts.gstatic.com/s/inter/v20/ Frame 5FAE
116 KB
0
96ms
64ms
Font
font/woff2
142.251.211.131
Google LLC
General
Full URL
https://fonts.gstatic.com/s/inter/v20/UcCM3FwrK3iLTcvneQg7Ca725JhhKnNqk4j1ebLhAm8SrXTcPtxhiA.woff2
Requested by
Host: docs.google.com
URL: https://docs.google.com/spreadsheets/d/e/2PACX-1vQsygsynrhlYSFLOwZ9IaqURE4cQ3rGo07MkUiECTl3zXlINi_MWVmfxgjSgmvPhGmk0kPdS8DBzkoj/pubhtml?gid=326945225&widget=false&headers=false&chrome=false
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.211.131 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
lclgaa-au-in-f3.1e100.net
Software
sffe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
https://docs.google.com
Referer
https://docs.google.com/

Response headers

age
28531
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options
nosniff
expires
Wed, 08 Sep 2027 16:46:31 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Tue, 08 Sep 2026 16:46:31 GMT
last-modified
Tue, 09 Sep 2025 18:40:49 GMT
content-type
font/woff2
cache-control
public, max-age=31536000
timing-allow-origin
*
cross-origin-opener-policy
same-origin; report-to="apps-themes"
cross-origin-resource-policy
cross-origin
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges
bytes
access-control-allow-origin
*
content-length
118340
x-xss-protection
0
server
sffe
GET

UcCM3FwrK3iLTcvneQg7Ca725JhhKnNqk4j1ebLhAm8SrXTcPtxhiA.woff2
https://docs.google.com/persistent/docs/fonts/ Frame 5FAE
0
0


GET
H2
200
css
fonts.googleapis.com/ Frame 5FAE
10 KB
0
0ms
0ms
Stylesheet
text/css
142.251.167.95
Google LLC
General
Full URL
https://fonts.googleapis.com/css?family=Google+Sans
Requested by
Host: docs.google.com
URL: https://docs.google.com/static/spreadsheets2/client/css/2837645074-waffle_k_ltr.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
142.251.167.95 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
ww-in-f95.1e100.net
Software
ESF /
Resource Hash
9a8bb89f6247a8f5da6393ef01b189fc4c100fb0a5d1d14218466056eabf218d
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
https://docs.google.com/

Response headers

content-encoding
gzip
x-content-type-options
nosniff
expires
Wed, 09 Sep 2026 00:42:02 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Wed, 09 Sep 2026 00:42:02 GMT
content-type
text/css; charset=utf-8
vary
Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
last-modified
Wed, 09 Sep 2026 00:06:41 GMT
x-frame-options
SAMEORIGIN
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
cross-origin-opener-policy
same-origin-allow-popups
cross-origin-resource-policy
cross-origin
access-control-allow-origin
*
x-xss-protection
0
server
ESF
GET
H3
200
4Ua_rENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RFD48TE63OOYKtrwEIJllpyk.woff2
fonts.gstatic.com/s/googlesans/v70/ Frame 5FAE
22 KB
0
20ms
20ms
Font
font/woff2
142.251.211.131
Google LLC
General
Full URL
https://fonts.gstatic.com/s/googlesans/v70/4Ua_rENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RFD48TE63OOYKtrwEIJllpyk.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Google+Sans
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.211.131 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
lclgaa-au-in-f3.1e100.net
Software
sffe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
https://docs.google.com
Referer
https://fonts.googleapis.com/

Response headers

age
29514
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options
nosniff
expires
Wed, 08 Sep 2027 16:30:08 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Tue, 08 Sep 2026 16:30:08 GMT
last-modified
Tue, 21 Jul 2026 18:27:49 GMT
content-type
font/woff2
cache-control
public, max-age=31536000
timing-allow-origin
*
cross-origin-opener-policy
same-origin; report-to="apps-themes"
cross-origin-resource-policy
cross-origin
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges
bytes
access-control-allow-origin
*
content-length
22048
x-xss-protection
0
server
sffe
GET
H2
200
waffle_sprite53.png
ssl.gstatic.com/docs/spreadsheets/ Frame 5FAE
8 KB
0
0ms
0ms
Image
image/png
142.251.211.195
Google LLC
General
Full URL
https://ssl.gstatic.com/docs/spreadsheets/waffle_sprite53.png
Requested by
Host: docs.google.com
URL: https://docs.google.com/static/spreadsheets2/client/css/2837645074-waffle_k_ltr.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.251.211.195 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
pnlgaa-ba-in-f3.1e100.net
Software
sffe /
Resource Hash
5b2f8581f3db2de166cbcbadf3e4256167ffb43d897d22e327840f9cd1d16405
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://docs.google.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

age
358077
report-to
{"group":"apps-spreadsheets","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-spreadsheets"}]}
x-content-type-options
nosniff
expires
Sat, 04 Sep 2027 21:14:05 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Fri, 04 Sep 2026 21:14:05 GMT
last-modified
Thu, 02 Nov 2023 22:48:00 GMT
content-type
image/png
cache-control
public, max-age=31536000
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
access-control-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="apps-spreadsheets"
content-length
8116
x-xss-protection
0
server
sffe
GET
H2
200
css
fonts.googleapis.com/ Frame 36F5
15 KB
0
3ms
2ms
Stylesheet
text/css
142.251.167.95
Google LLC
General
Full URL
https://fonts.googleapis.com/css?kit=TrRn_cawiauSGymlkgY3lekzMFivVqLDBnXnWDs7xuSurckZKAF09_I-3FaURnfHGLqwaF1VvfJKw_xrQEfwwQ
Requested by
Host: docs.google.com
URL: https://docs.google.com/spreadsheets/d/e/2PACX-1vQsygsynrhlYSFLOwZ9IaqURE4cQ3rGo07MkUiECTl3zXlINi_MWVmfxgjSgmvPhGmk0kPdS8DBzkoj/pubhtml?gid=326945225&widget=false&headers=false&chrome=false
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
142.251.167.95 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
ww-in-f95.1e100.net
Software
ESF /
Resource Hash
159ca2165c7f4a101209bf5e952695e20f5bdc408468212d24dca0a4f0a5ecc1
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
https://docs.google.com/

Response headers

content-encoding
gzip
x-content-type-options
nosniff
expires
Wed, 09 Sep 2026 00:42:02 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Wed, 09 Sep 2026 00:42:02 GMT
content-type
text/css; charset=utf-8
vary
Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
last-modified
Wed, 09 Sep 2026 00:42:02 GMT
x-frame-options
SAMEORIGIN
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
cross-origin-opener-policy
same-origin-allow-popups
cross-origin-resource-policy
cross-origin
access-control-allow-origin
*
x-xss-protection
0
server
ESF
GET
H2
200
2837645074-waffle_k_ltr.css
docs.google.com/static/spreadsheets2/client/css/ Frame 36F5
4 MB
0
2ms
1ms
Stylesheet
text/css
142.250.217.14
Google LLC
General
Full URL
https://docs.google.com/static/spreadsheets2/client/css/2837645074-waffle_k_ltr.css
Requested by
Host: docs.google.com
URL: https://docs.google.com/spreadsheets/d/e/2PACX-1vQsygsynrhlYSFLOwZ9IaqURE4cQ3rGo07MkUiECTl3zXlINi_MWVmfxgjSgmvPhGmk0kPdS8DBzkoj/pubhtml?gid=326945225&widget=false&headers=false&chrome=false
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.217.14 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
pnlgaa-as-in-f14.1e100.net
Software
sffe /
Resource Hash
c7e008af9806590bd59b39a737925756e996613e8ed92caf152caba1087b064d
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://docs.google.com/spreadsheets/d/e/2PACX-1vQsygsynrhlYSFLOwZ9IaqURE4cQ3rGo07MkUiECTl3zXlINi_MWVmfxgjSgmvPhGmk0kPdS8DBzkoj/pubhtml?gid=326945225&widget=false&headers=false&chrome=false

Response headers

content-encoding
gzip
age
561420
report-to
{"group":"apps-spreadsheets","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-spreadsheets"}]}
x-content-type-options
nosniff
expires
Thu, 02 Sep 2027 12:45:02 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Wed, 02 Sep 2026 12:45:02 GMT
last-modified
Wed, 02 Sep 2026 12:14:51 GMT
content-type
text/css
vary
Accept-Encoding, Origin
cache-control
public, max-age=31536000
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="apps-spreadsheets"
content-length
497860
x-xss-protection
0
server
sffe
GET
H2
200
css
fonts.googleapis.com/ Frame 3222
15 KB
0
3ms
2ms
Stylesheet
text/css
142.251.167.95
Google LLC
General
Full URL
https://fonts.googleapis.com/css?kit=TrRn_cawiauSGymlkgY3lekzMFivVqLDBnXnWDs7xuSurckZKAF09_I-3FaURnfHGLqwaF1VvfJKw_xrQEfwwQ
Requested by
Host: docs.google.com
URL: https://docs.google.com/spreadsheets/d/e/2PACX-1vQsygsynrhlYSFLOwZ9IaqURE4cQ3rGo07MkUiECTl3zXlINi_MWVmfxgjSgmvPhGmk0kPdS8DBzkoj/pubhtml?gid=0&single=false&widget=false&headers=false&chrome=false
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
142.251.167.95 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
ww-in-f95.1e100.net
Software
ESF /
Resource Hash
159ca2165c7f4a101209bf5e952695e20f5bdc408468212d24dca0a4f0a5ecc1
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
https://docs.google.com/

Response headers

content-encoding
gzip
x-content-type-options
nosniff
expires
Wed, 09 Sep 2026 00:42:02 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Wed, 09 Sep 2026 00:42:02 GMT
content-type
text/css; charset=utf-8
vary
Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
last-modified
Wed, 09 Sep 2026 00:42:02 GMT
x-frame-options
SAMEORIGIN
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
cross-origin-opener-policy
same-origin-allow-popups
cross-origin-resource-policy
cross-origin
access-control-allow-origin
*
x-xss-protection
0
server
ESF
GET
H2
200
2837645074-waffle_k_ltr.css
docs.google.com/static/spreadsheets2/client/css/ Frame 3222
4 MB
0
2ms
1ms
Stylesheet
text/css
142.250.217.14
Google LLC
General
Full URL
https://docs.google.com/static/spreadsheets2/client/css/2837645074-waffle_k_ltr.css
Requested by
Host: docs.google.com
URL: https://docs.google.com/spreadsheets/d/e/2PACX-1vQsygsynrhlYSFLOwZ9IaqURE4cQ3rGo07MkUiECTl3zXlINi_MWVmfxgjSgmvPhGmk0kPdS8DBzkoj/pubhtml?gid=0&single=false&widget=false&headers=false&chrome=false
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.217.14 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
pnlgaa-as-in-f14.1e100.net
Software
sffe /
Resource Hash
c7e008af9806590bd59b39a737925756e996613e8ed92caf152caba1087b064d
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://docs.google.com/spreadsheets/d/e/2PACX-1vQsygsynrhlYSFLOwZ9IaqURE4cQ3rGo07MkUiECTl3zXlINi_MWVmfxgjSgmvPhGmk0kPdS8DBzkoj/pubhtml?gid=0&single=false&widget=false&headers=false&chrome=false

Response headers

content-encoding
gzip
age
561420
report-to
{"group":"apps-spreadsheets","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-spreadsheets"}]}
x-content-type-options
nosniff
expires
Thu, 02 Sep 2027 12:45:02 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Wed, 02 Sep 2026 12:45:02 GMT
last-modified
Wed, 02 Sep 2026 12:14:51 GMT
content-type
text/css
vary
Accept-Encoding, Origin
cache-control
public, max-age=31536000
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="apps-spreadsheets"
content-length
497860
x-xss-protection
0
server
sffe
POST
H3
204
AGSKWxVq3qiJFcpbE9g2txPOXTt5x1Pe-8X71tTe7ZRTxHJuLE3A7KdGPFWIjn2QIkPJIykWnKn1S8Hy-V5fxcCKaWGiu5hrB6NcB-zzoFn0NK7l9-zgfe5aHviWROx9qXQjOg1DMrM-3g== Show response
fundingchoicesmessages.google.com/el/
0
28 B
138ms
73ms
XHR
text/html
142.250.217.238
Google LLC
General
Full URL
https://fundingchoicesmessages.google.com/el/AGSKWxVq3qiJFcpbE9g2txPOXTt5x1Pe-8X71tTe7ZRTxHJuLE3A7KdGPFWIjn2QIkPJIykWnKn1S8Hy-V5fxcCKaWGiu5hrB6NcB-zzoFn0NK7l9-zgfe5aHviWROx9qXQjOg1DMrM-3g==
Requested by
Host: transcend-cdn.com
URL: https://transcend-cdn.com/cm/ef49a3f1-d8c1-47d6-88fc-50e41130631f/airgap.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.217.238 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
pnlgaa-ay-in-f14.1e100.net
Software
ESF /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Content-Security-Policy script-src 'report-sample' 'nonce-JsizIBa3H7ycdkPZ_UY1dQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
Content-Type
text/plain
sec-ch-ua-mobile
?0

Response headers

access-control-max-age
86400
access-control-allow-methods
POST, GET, OPTIONS
x-content-type-options
nosniff
expires
Mon, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Wed, 09 Sep 2026 00:42:04 GMT
content-type
text/html; charset=utf-8
x-frame-options
SAMEORIGIN
reporting-endpoints
default="/_/ContributorLoggingHttp/web-reports?context=eJzj0tDikmLw1ZBi-FB_mfUHEC-cFsi2EohFDILYZIA47WA4Wx4QC_Fw3LnWdJVN4MbhL0cYlVyS8gvjk_PzSlLzSnQTU4p1QeyizKTSkvwiFHZqGUhFTn56emZeeryRgZGZgaWBuZ6BWXyBAQAGECzZ"
content-security-policy
script-src 'report-sample' 'nonce-JsizIBa3H7ycdkPZ_UY1dQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
cache-control
no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy
same-origin
pragma
no-cache
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials
true
permissions-policy
ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin
https://www.darkreading.com
content-length
0
x-xss-protection
0
server
ESF
POST
H3
204
AGSKWxVq3qiJFcpbE9g2txPOXTt5x1Pe-8X71tTe7ZRTxHJuLE3A7KdGPFWIjn2QIkPJIykWnKn1S8Hy-V5fxcCKaWGiu5hrB6NcB-zzoFn0NK7l9-zgfe5aHviWROx9qXQjOg1DMrM-3g== Show response
fundingchoicesmessages.google.com/el/
0
28 B
111ms
73ms
XHR
text/html
142.250.217.238
Google LLC
General
Full URL
https://fundingchoicesmessages.google.com/el/AGSKWxVq3qiJFcpbE9g2txPOXTt5x1Pe-8X71tTe7ZRTxHJuLE3A7KdGPFWIjn2QIkPJIykWnKn1S8Hy-V5fxcCKaWGiu5hrB6NcB-zzoFn0NK7l9-zgfe5aHviWROx9qXQjOg1DMrM-3g==
Requested by
Host: transcend-cdn.com
URL: https://transcend-cdn.com/cm/ef49a3f1-d8c1-47d6-88fc-50e41130631f/airgap.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.217.238 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
pnlgaa-ay-in-f14.1e100.net
Software
ESF /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Content-Security-Policy script-src 'report-sample' 'nonce-eqc6IB0h-mFqfYyDOjwfoA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
Content-Type
text/plain
sec-ch-ua-mobile
?0

Response headers

access-control-max-age
86400
access-control-allow-methods
POST, GET, OPTIONS
x-content-type-options
nosniff
expires
Mon, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Wed, 09 Sep 2026 00:42:04 GMT
content-type
text/html; charset=utf-8
x-frame-options
SAMEORIGIN
reporting-endpoints
default="/_/ContributorLoggingHttp/web-reports?context=eJzj0tDikmLw1JBi-FB_mfUHEC-cFsi2EohFDILYZIA47WA4Wx4QC_Fw3LnWdJVN4MCSliOMSi5J-YXxyfl5Jal5JbqJKcW6IHZRZlJpSX4RCju1DKQiJz89PTMvPd7IwMjMwNLAXM_ALL7AAADUMywu"
content-security-policy
script-src 'report-sample' 'nonce-eqc6IB0h-mFqfYyDOjwfoA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
cache-control
no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy
same-origin
pragma
no-cache
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials
true
permissions-policy
ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin
https://www.darkreading.com
content-length
0
x-xss-protection
0
server
ESF
POST
H3
204
AGSKWxVq3qiJFcpbE9g2txPOXTt5x1Pe-8X71tTe7ZRTxHJuLE3A7KdGPFWIjn2QIkPJIykWnKn1S8Hy-V5fxcCKaWGiu5hrB6NcB-zzoFn0NK7l9-zgfe5aHviWROx9qXQjOg1DMrM-3g== Show response
fundingchoicesmessages.google.com/el/
0
28 B
97ms
71ms
XHR
text/html
142.250.217.238
Google LLC
General
Full URL
https://fundingchoicesmessages.google.com/el/AGSKWxVq3qiJFcpbE9g2txPOXTt5x1Pe-8X71tTe7ZRTxHJuLE3A7KdGPFWIjn2QIkPJIykWnKn1S8Hy-V5fxcCKaWGiu5hrB6NcB-zzoFn0NK7l9-zgfe5aHviWROx9qXQjOg1DMrM-3g==
Requested by
Host: transcend-cdn.com
URL: https://transcend-cdn.com/cm/ef49a3f1-d8c1-47d6-88fc-50e41130631f/airgap.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.217.238 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
pnlgaa-ay-in-f14.1e100.net
Software
ESF /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Content-Security-Policy script-src 'report-sample' 'nonce-tfg22fZiHWfAfWeCKdur6A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
Content-Type
text/plain
sec-ch-ua-mobile
?0

Response headers

access-control-max-age
86400
access-control-allow-methods
POST, GET, OPTIONS
x-content-type-options
nosniff
expires
Mon, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Wed, 09 Sep 2026 00:42:04 GMT
content-type
text/html; charset=utf-8
x-frame-options
SAMEORIGIN
reporting-endpoints
default="/_/ContributorLoggingHttp/web-reports?context=eJzj0tDikmLw1JBi-FB_mfUHEC-cFsi2EohFDILYZIA47WA4Wx4QC_Fw3LnWdJVNYMXrT4cYlVyS8gvjk_PzSlLzSnQTU4p1QeyizKTSkvwiFHZqGUhFTn56emZeeryRgZGZgaWBuZ6BWXyBAQAAjizJ"
content-security-policy
script-src 'report-sample' 'nonce-tfg22fZiHWfAfWeCKdur6A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport
cache-control
no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy
same-origin
pragma
no-cache
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials
true
permissions-policy
ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin
https://www.darkreading.com
content-length
0
x-xss-protection
0
server
ESF
GET
H2
200
AGSKWxWxZnZwJ6dwNqUVd3KQ-Q_LsxU9x3c0A3n_ztyuXT1TuqsIXBzQEOfOnu00UjhsVb9Qev_rgvDVCxVN5s3hggzVKFy-D6WerOyqE0EtnDtyPsdIFcNBWXH2eJcAV7a7jldA6WQTKw== Show response
fundingchoicesmessages.google.com/f/
2 KB
2 KB
100ms
94ms
Script
application/javascript
142.250.217.238
Google LLC
General
Full URL
https://fundingchoicesmessages.google.com/f/AGSKWxWxZnZwJ6dwNqUVd3KQ-Q_LsxU9x3c0A3n_ztyuXT1TuqsIXBzQEOfOnu00UjhsVb9Qev_rgvDVCxVN5s3hggzVKFy-D6WerOyqE0EtnDtyPsdIFcNBWXH2eJcAV7a7jldA6WQTKw==?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNzg4OTE0NTI0LDM2NTAwMDAwMF0sbnVsbCxudWxsLG51bGwsW251bGwsWzddXSwiaHR0cHM6Ly93d3cuZGFya3JlYWRpbmcuY29tL2N5YmVyYXR0YWNrcy1kYXRhLWJyZWFjaGVzL2F0dGFja2Vycy1tdWx0aS1ob3AtZ29vZ2xlLXJlZGlyZWN0cy1waGlzaGluZy1jYW1wYWlnbiIsbnVsbCxbWzgsInd5YlhUOHR1bmZJIl0sWzksImVuLVVTIl0sWzE4LCJbW1tudWxsLDI3NTBdXV0iXSxbMzUsIjE3ODg5MTQ1MjQiXSxbMjYsIjE1Il0sWzE5LCIyIl0sWzE3LCJbMF0iXSxbMjQsIiJdLFsyNSwiW1szMTA5OTkwNl1dIl0sWzI5LCJmYWxzZSJdXV0
Requested by
Host: transcend-cdn.com
URL: https://transcend-cdn.com/cm/ef49a3f1-d8c1-47d6-88fc-50e41130631f/airgap.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.217.238 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
pnlgaa-ay-in-f14.1e100.net
Software
ESF /
Resource Hash
08d4ca45022e3ca82c82afd63a334787260edbcda786f8cf9ca47d2eb36d998e
Security Headers
Name Value
Content-Security-Policy script-src 'report-sample' 'nonce-i5kU6mdRfu-CYM1f42Csdw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
gzip
x-content-type-options
nosniff
expires
Mon, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Wed, 09 Sep 2026 00:42:04 GMT
content-type
application/javascript; charset=utf-8
x-frame-options
SAMEORIGIN
reporting-endpoints
default="/_/ContributorServingWebSwitchboardHttp/web-reports?context=eJzjytHikmLw0JBiOHnrNtNFIG69eY51OhCXLDrP2gbEXUA8B4gNFS6xOgPxh_rLrD-AuEjiCmsLEH-qusEqUn2D9VuxLxtHiS8by1t_toXTAtlWArGIQRCbDBCnHQxnywNiIR6OO9earrIJTGg9f4ZRSSMpvzA-OT-vpCgzqbQkvygtOS21OLWoLLUo3sjAyMzA0sBcz8A8vsAAAPYOP-E"
content-security-policy
script-src 'report-sample' 'nonce-i5kU6mdRfu-CYM1f42Csdw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport
cache-control
no-cache, no-store, max-age=0, must-revalidate
timing-allow-origin
*
cross-origin-opener-policy
same-origin
pragma
no-cache
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy
cross-origin
permissions-policy
ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
x-xss-protection
0
server
ESF
GET
H3
200
partnerpixels Show response
cm.g.doubleclick.net/ Frame 317A
41 B
63 B
191ms
68ms
Document
text/html
192.179.18.157
Google LLC
General
Full URL
https://cm.g.doubleclick.net/partnerpixels?gdpr=0&url=https%3A%2F%2Fwww.darkreading.com%2Fcyberattacks-data-breaches%2Fattackers-multi-hop-google-redirects-phishing-campaign
Requested by
Host: transcend-cdn.com
URL: https://transcend-cdn.com/cm/ef49a3f1-d8c1-47d6-88fc-50e41130631f/airgap.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
192.179.18.157 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
ry-in-f157.1e100.net
Software
HTTP server (unknown) /
Resource Hash
a09179dd962df38a01440ce2e4748c37bd832fe1ac2f65ad974490a89d63d129
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://www.darkreading.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0
sec-ch-ua-platform
"Linux"

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding
gzip
content-length
48
content-type
text/html; charset=UTF-8
date
Wed, 09 Sep 2026 00:42:04 GMT
referrer-policy
origin
server
HTTP server (unknown)
x-xss-protection
0
GET
H3
200
ads Show response
securepubads.g.doubleclick.net/gampad/
41 KB
16 KB
149ms
146ms
Fetch
text/plain
142.251.211.130
Google LLC
General
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?pvsid=2307685289986646&correlator=481576575132918&eid=122880806%2C122880910%2C122880938%2C31099902%2C122880906&output=ldjh&gdfp_req=1&vrg=202609030101&ptt=17&impl=fif&gdpr=0&iu_parts=3618%2Cdarkreading.home%2Carticle%2Ccyberattacks-data-breaches&enc_prev_ius=%2F0%2F1%2F2%2F3&prev_iu_szs=1x1&ifi=1&dids=welcome_v&adfs=3764261878&sfv=1-0-45&sc=1&cookie_enabled=1&abxe=1&dt=1788914524425&lmt=1788904724&adxs=0&adys=0&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=1&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-420&dmc=32&bc=31&nvt=1&uach=WyJMaW51eCIsIiIsIng4NiIsIiIsIjE1Mi4wLjc5NzcuODIiLG51bGwsMCxudWxsLCI2NCIsW1siQ2hyb21pdW0iLCIxNTIuMC43OTc3LjgyIl0sWyJHb29nbGUgQ2hyb21lIiwiMTUyLjAuNzk3Ny44MiJdLFsiTm90P0FfQnJhbmQiLCIyNC4wLjAuMCJdXSwwXQ..&url=https%3A%2F%2Fwww.darkreading.com%2Fcyberattacks-data-breaches%2Fattackers-multi-hop-google-redirects-phishing-campaign&vis=1&psz=1600x5510&msz=1600x0&fws=0&ohw=0&dlt=1788914520195&idt=2604&prev_scp=nid%3Dbltb2aaea610dd27216%26aid%3D904353%26reg%3Danonymous%26kw%3D%26ptype%3Darticle%26pos%3Dwelcome_v&cust_params=pterm%3Dcyberattacks-data-breaches%26sterm%3Ddata-privacy%252Cthreat-intelligence%252Cremote-workforce%26contentFormat%3Dnews%26contributor%3Dalexander-culafi%26isSponsored%3Dfalse%26gatedWithExternalForm%3Dfalse%26gatedWithSiteReg%3Dfalse%26paidGating%3Dfalse%26hideAds%3Dfalse%26ppc%3D0%26gdpr_banner%3Don&adks=2932576195&frm=20&eoidce=1&pgls=CAk.
Requested by
Host: transcend-cdn.com
URL: https://transcend-cdn.com/cm/ef49a3f1-d8c1-47d6-88fc-50e41130631f/airgap.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.211.130 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
lclgaa-au-in-f2.1e100.net
Software
cafe /
Resource Hash
c8f774ea9434c74467f889d2ce7c72915f3576e020664af6dbc0d4e7b4037bd4
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
br
google-lineitem-id
7321112809
x-content-type-options
nosniff
google-mediationtag-id
-2
google-mediationgroup-id
-2
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date
Wed, 09 Sep 2026 00:42:04 GMT
content-type
text/plain; charset=UTF-8
google-creative-id
138560099861
cache-control
no-cache, must-revalidate
timing-allow-origin
*
pragma
no-cache
cross-origin-resource-policy
cross-origin
access-control-allow-credentials
true
access-control-allow-origin
https://www.darkreading.com
content-length
16793
x-xss-protection
0
server
cafe
GET
H3
200
ads Show response
securepubads.g.doubleclick.net/gampad/
881 B
413 B
112ms
109ms
Fetch
text/plain
142.251.211.130
Google LLC
General
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?pvsid=2307685289986646&correlator=481576575132918&eid=122880806%2C122880910%2C122880938%2C31099902%2C122880906&output=ldjh&gdfp_req=1&vrg=202609030101&ptt=17&impl=fif&gdpr=0&iu_parts=3618%2Cdarkreading.home%2Carticle%2Ccyberattacks-data-breaches&enc_prev_ius=%2F0%2F1%2F2%2F3&prev_iu_szs=1x1&ifi=2&dids=bigsky_v&adfs=3438764142&sfv=1-0-45&sc=1&cookie_enabled=1&abxe=1&dt=1788914524435&lmt=1788904724&adxs=0&adys=0&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=2&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-420&dmc=32&bc=31&nvt=1&uach=WyJMaW51eCIsIiIsIng4NiIsIiIsIjE1Mi4wLjc5NzcuODIiLG51bGwsMCxudWxsLCI2NCIsW1siQ2hyb21pdW0iLCIxNTIuMC43OTc3LjgyIl0sWyJHb29nbGUgQ2hyb21lIiwiMTUyLjAuNzk3Ny44MiJdLFsiTm90P0FfQnJhbmQiLCIyNC4wLjAuMCJdXSwwXQ..&url=https%3A%2F%2Fwww.darkreading.com%2Fcyberattacks-data-breaches%2Fattackers-multi-hop-google-redirects-phishing-campaign&vis=1&psz=1600x5510&msz=1600x0&fws=0&ohw=0&dlt=1788914520195&idt=2604&prev_scp=nid%3Dbltb2aaea610dd27216%26aid%3D904353%26reg%3Danonymous%26kw%3D%26ptype%3Darticle%26pos%3Dbigsky_v&cust_params=pterm%3Dcyberattacks-data-breaches%26sterm%3Ddata-privacy%252Cthreat-intelligence%252Cremote-workforce%26contentFormat%3Dnews%26contributor%3Dalexander-culafi%26isSponsored%3Dfalse%26gatedWithExternalForm%3Dfalse%26gatedWithSiteReg%3Dfalse%26paidGating%3Dfalse%26hideAds%3Dfalse%26ppc%3D0%26gdpr_banner%3Don&adks=3136080566&frm=20&eoidce=1&pgls=CAk.
Requested by
Host: transcend-cdn.com
URL: https://transcend-cdn.com/cm/ef49a3f1-d8c1-47d6-88fc-50e41130631f/airgap.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.211.130 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
lclgaa-au-in-f2.1e100.net
Software
cafe /
Resource Hash
f2731381d27f3da7ecc6982dd253496b7a5b079435ed0f8815829f75375f13c4
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
br
google-lineitem-id
-2
x-content-type-options
nosniff
google-mediationtag-id
-2
google-mediationgroup-id
-2
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date
Wed, 09 Sep 2026 00:42:04 GMT
content-type
text/plain; charset=UTF-8
google-creative-id
-2
cache-control
no-cache, must-revalidate
timing-allow-origin
*
pragma
no-cache
cross-origin-resource-policy
cross-origin
access-control-allow-credentials
true
access-control-allow-origin
https://www.darkreading.com
content-length
383
x-xss-protection
0
server
cafe
GET
H3
200
ads Show response
securepubads.g.doubleclick.net/gampad/
12 KB
5 KB
104ms
101ms
Fetch
text/plain
142.251.211.130
Google LLC
General
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?pvsid=2307685289986646&correlator=481576575132918&eid=122880806%2C122880910%2C122880938%2C31099902%2C122880906&output=ldjh&gdfp_req=1&vrg=202609030101&ptt=17&impl=fif&gdpr=0&iu_parts=3618%2Cdarkreading.home%2Carticle%2Ccyberattacks-data-breaches&enc_prev_ius=%2F0%2F1%2F2%2F3&prev_iu_szs=1x1&ifi=3&dids=wallpaper_v&adfs=2899750393&sfv=1-0-45&ists=1&sc=1&cookie_enabled=1&abxe=1&dt=1788914524439&lmt=1788904724&adxs=800&adys=250&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=3&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-420&dmc=32&bc=31&nvt=1&uach=WyJMaW51eCIsIiIsIng4NiIsIiIsIjE1Mi4wLjc5NzcuODIiLG51bGwsMCxudWxsLCI2NCIsW1siQ2hyb21pdW0iLCIxNTIuMC43OTc3LjgyIl0sWyJHb29nbGUgQ2hyb21lIiwiMTUyLjAuNzk3Ny44MiJdLFsiTm90P0FfQnJhbmQiLCIyNC4wLjAuMCJdXSwwXQ..&url=https%3A%2F%2Fwww.darkreading.com%2Fcyberattacks-data-breaches%2Fattackers-multi-hop-google-redirects-phishing-campaign&vis=1&psz=1036x4703&msz=1036x0&fws=0&ohw=0&dlt=1788914520195&idt=2604&prev_scp=nid%3Dbltb2aaea610dd27216%26aid%3D904353%26reg%3Danonymous%26kw%3D%26ptype%3Darticle%26pos%3Dwallpaper_v&cust_params=pterm%3Dcyberattacks-data-breaches%26sterm%3Ddata-privacy%252Cthreat-intelligence%252Cremote-workforce%26contentFormat%3Dnews%26contributor%3Dalexander-culafi%26isSponsored%3Dfalse%26gatedWithExternalForm%3Dfalse%26gatedWithSiteReg%3Dfalse%26paidGating%3Dfalse%26hideAds%3Dfalse%26ppc%3D0%26gdpr_banner%3Don&adks=204097173&frm=20&eoidce=1&pgls=CAk.
Requested by
Host: transcend-cdn.com
URL: https://transcend-cdn.com/cm/ef49a3f1-d8c1-47d6-88fc-50e41130631f/airgap.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.211.130 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
lclgaa-au-in-f2.1e100.net
Software
cafe /
Resource Hash
cee417d7e2a8ecfc56ff1e02391e998c0ba4b5f0ca35174837dd7f13a7836a53
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
br
google-lineitem-id
7384623559
x-content-type-options
nosniff
google-mediationtag-id
-2
google-mediationgroup-id
-2
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date
Wed, 09 Sep 2026 00:42:04 GMT
content-type
text/plain; charset=UTF-8
google-creative-id
138569962399
cache-control
no-cache, must-revalidate
timing-allow-origin
*
pragma
no-cache
cross-origin-resource-policy
cross-origin
access-control-allow-credentials
true
access-control-allow-origin
https://www.darkreading.com
content-length
5441
x-xss-protection
0
server
cafe
GET
H3
200
ads Show response
securepubads.g.doubleclick.net/gampad/
881 B
412 B
107ms
103ms
Fetch
text/plain
142.251.211.130
Google LLC
General
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?pvsid=2307685289986646&correlator=481576575132918&eid=122880806%2C122880910%2C122880938%2C31099902%2C122880906&output=ldjh&gdfp_req=1&vrg=202609030101&ptt=17&impl=fif&gdpr=0&iu_parts=3618%2Cdarkreading.home%2Carticle%2Ccyberattacks-data-breaches&enc_prev_ius=%2F0%2F1%2F2%2F3&prev_iu_szs=1x1&ifi=4&dids=oop_v&adfs=1177369848&sfv=1-0-45&ists=1&sc=1&cookie_enabled=1&abxe=1&dt=1788914524443&lmt=1788904724&adxs=800&adys=250&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=4&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-420&dmc=32&bc=31&nvt=1&uach=WyJMaW51eCIsIiIsIng4NiIsIiIsIjE1Mi4wLjc5NzcuODIiLG51bGwsMCxudWxsLCI2NCIsW1siQ2hyb21pdW0iLCIxNTIuMC43OTc3LjgyIl0sWyJHb29nbGUgQ2hyb21lIiwiMTUyLjAuNzk3Ny44MiJdLFsiTm90P0FfQnJhbmQiLCIyNC4wLjAuMCJdXSwwXQ..&url=https%3A%2F%2Fwww.darkreading.com%2Fcyberattacks-data-breaches%2Fattackers-multi-hop-google-redirects-phishing-campaign&vis=1&psz=1036x4703&msz=1036x0&fws=0&ohw=0&dlt=1788914520195&idt=2604&prev_scp=nid%3Dbltb2aaea610dd27216%26aid%3D904353%26reg%3Danonymous%26kw%3D%26ptype%3Darticle%26pos%3Doop_v&cust_params=pterm%3Dcyberattacks-data-breaches%26sterm%3Ddata-privacy%252Cthreat-intelligence%252Cremote-workforce%26contentFormat%3Dnews%26contributor%3Dalexander-culafi%26isSponsored%3Dfalse%26gatedWithExternalForm%3Dfalse%26gatedWithSiteReg%3Dfalse%26paidGating%3Dfalse%26hideAds%3Dfalse%26ppc%3D0%26gdpr_banner%3Don&adks=1874135591&frm=20&eoidce=1&pgls=CAk.
Requested by
Host: transcend-cdn.com
URL: https://transcend-cdn.com/cm/ef49a3f1-d8c1-47d6-88fc-50e41130631f/airgap.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.211.130 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
lclgaa-au-in-f2.1e100.net
Software
cafe /
Resource Hash
cb09b32deb655cb1b6b3cdaae766bc9fffbb502513b97bacd65fe42248162e6a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
br
google-lineitem-id
-2
x-content-type-options
nosniff
google-mediationtag-id
-2
google-mediationgroup-id
-2
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date
Wed, 09 Sep 2026 00:42:04 GMT
content-type
text/plain; charset=UTF-8
google-creative-id
-2
cache-control
no-cache, must-revalidate
timing-allow-origin
*
pragma
no-cache
cross-origin-resource-policy
cross-origin
access-control-allow-credentials
true
access-control-allow-origin
https://www.darkreading.com
content-length
382
x-xss-protection
0
server
cafe
GET
H3
200
ads Show response
securepubads.g.doubleclick.net/gampad/
881 B
413 B
127ms
125ms
Fetch
text/plain
142.251.211.130
Google LLC
General
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?pvsid=2307685289986646&correlator=481576575132918&eid=122880806%2C122880910%2C122880938%2C31099902%2C122880906&output=ldjh&gdfp_req=1&vrg=202609030101&ptt=17&impl=fif&gdpr=0&iu_parts=3618%2Cdarkreading.home%2Carticle%2Ccyberattacks-data-breaches&enc_prev_ius=%2F0%2F1%2F2%2F3&prev_iu_szs=1x1&ifi=5&dids=floor_v&adfs=3502225121&sfv=1-0-45&sc=1&cookie_enabled=1&abxe=1&dt=1788914524446&lmt=1788904724&adxs=800&adys=250&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=5&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-420&dmc=32&bc=31&nvt=1&uach=WyJMaW51eCIsIiIsIng4NiIsIiIsIjE1Mi4wLjc5NzcuODIiLG51bGwsMCxudWxsLCI2NCIsW1siQ2hyb21pdW0iLCIxNTIuMC43OTc3LjgyIl0sWyJHb29nbGUgQ2hyb21lIiwiMTUyLjAuNzk3Ny44MiJdLFsiTm90P0FfQnJhbmQiLCIyNC4wLjAuMCJdXSwwXQ..&url=https%3A%2F%2Fwww.darkreading.com%2Fcyberattacks-data-breaches%2Fattackers-multi-hop-google-redirects-phishing-campaign&vis=1&psz=1036x4703&msz=1036x0&fws=0&ohw=0&dlt=1788914520195&idt=2604&prev_scp=nid%3Dbltb2aaea610dd27216%26aid%3D904353%26reg%3Danonymous%26kw%3D%26ptype%3Darticle%26pos%3Dfloor_v&cust_params=pterm%3Dcyberattacks-data-breaches%26sterm%3Ddata-privacy%252Cthreat-intelligence%252Cremote-workforce%26contentFormat%3Dnews%26contributor%3Dalexander-culafi%26isSponsored%3Dfalse%26gatedWithExternalForm%3Dfalse%26gatedWithSiteReg%3Dfalse%26paidGating%3Dfalse%26hideAds%3Dfalse%26ppc%3D0%26gdpr_banner%3Don&adks=3673977904&frm=20&eoidce=1&pgls=CAk.
Requested by
Host: transcend-cdn.com
URL: https://transcend-cdn.com/cm/ef49a3f1-d8c1-47d6-88fc-50e41130631f/airgap.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.211.130 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
lclgaa-au-in-f2.1e100.net
Software
cafe /
Resource Hash
607566616405ada86f97ae686f713fc9209445a7a3fb532ee89e7977a07fd4e8
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
br
google-lineitem-id
-2
x-content-type-options
nosniff
google-mediationtag-id
-2
google-mediationgroup-id
-2
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date
Wed, 09 Sep 2026 00:42:04 GMT
content-type
text/plain; charset=UTF-8
google-creative-id
-2
cache-control
no-cache, must-revalidate
timing-allow-origin
*
pragma
no-cache
cross-origin-resource-policy
cross-origin
access-control-allow-credentials
true
access-control-allow-origin
https://www.darkreading.com
content-length
383
x-xss-protection
0
server
cafe
GET
H3
200
ads Show response
securepubads.g.doubleclick.net/gampad/
881 B
411 B
115ms
113ms
Fetch
text/plain
142.251.211.130
Google LLC
General
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?pvsid=2307685289986646&correlator=481576575132918&eid=122880806%2C122880910%2C122880938%2C31099902%2C122880906&output=ldjh&gdfp_req=1&vrg=202609030101&ptt=17&impl=fif&gdpr=0&iu_parts=3618%2Cdarkreading.home%2Carticle%2Ccyberattacks-data-breaches&enc_prev_ius=%2F0%2F1%2F2%2F3&prev_iu_szs=1x1&ifi=6&dids=adhesion_v&adfs=3842241342&sfv=1-0-45&sc=1&cookie_enabled=1&abxe=1&dt=1788914524452&lmt=1788904724&adxs=800&adys=250&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=6&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-420&dmc=32&bc=31&nvt=1&uach=WyJMaW51eCIsIiIsIng4NiIsIiIsIjE1Mi4wLjc5NzcuODIiLG51bGwsMCxudWxsLCI2NCIsW1siQ2hyb21pdW0iLCIxNTIuMC43OTc3LjgyIl0sWyJHb29nbGUgQ2hyb21lIiwiMTUyLjAuNzk3Ny44MiJdLFsiTm90P0FfQnJhbmQiLCIyNC4wLjAuMCJdXSwwXQ..&url=https%3A%2F%2Fwww.darkreading.com%2Fcyberattacks-data-breaches%2Fattackers-multi-hop-google-redirects-phishing-campaign&vis=1&psz=1036x4703&msz=1036x0&fws=0&ohw=0&dlt=1788914520195&idt=2604&prev_scp=nid%3Dbltb2aaea610dd27216%26aid%3D904353%26reg%3Danonymous%26kw%3D%26ptype%3Darticle%26pos%3Dadhesion_v&cust_params=pterm%3Dcyberattacks-data-breaches%26sterm%3Ddata-privacy%252Cthreat-intelligence%252Cremote-workforce%26contentFormat%3Dnews%26contributor%3Dalexander-culafi%26isSponsored%3Dfalse%26gatedWithExternalForm%3Dfalse%26gatedWithSiteReg%3Dfalse%26paidGating%3Dfalse%26hideAds%3Dfalse%26ppc%3D0%26gdpr_banner%3Don&adks=753251962&frm=20&eoidce=1&pgls=CAk.
Requested by
Host: transcend-cdn.com
URL: https://transcend-cdn.com/cm/ef49a3f1-d8c1-47d6-88fc-50e41130631f/airgap.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.211.130 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
lclgaa-au-in-f2.1e100.net
Software
cafe /
Resource Hash
997d3562304451b154097dcb4f6403bb046091704b7d004ca43abdc84a92d82e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
br
google-lineitem-id
-2
x-content-type-options
nosniff
google-mediationtag-id
-2
google-mediationgroup-id
-2
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date
Wed, 09 Sep 2026 00:42:04 GMT
content-type
text/plain; charset=UTF-8
google-creative-id
-2
cache-control
no-cache, must-revalidate
timing-allow-origin
*
pragma
no-cache
cross-origin-resource-policy
cross-origin
access-control-allow-credentials
true
access-control-allow-origin
https://www.darkreading.com
content-length
381
x-xss-protection
0
server
cafe
GET
H3
200
container.html Show response
e8645ccad93e0ce44fd2d5a66aa4491b.safeframe.googlesyndication.com/safeframe/1-0-45/html/ Frame A774
7 KB
3 KB
325ms
60ms
Document
text/html
142.250.217.225
Google LLC
General
Full URL
https://e8645ccad93e0ce44fd2d5a66aa4491b.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html
Requested by
Host: transcend-cdn.com
URL: https://transcend-cdn.com/cm/ef49a3f1-d8c1-47d6-88fc-50e41130631f/airgap.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.217.225 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
mia07s62-in-f1.1e100.net
Software
sffe /
Resource Hash
f1a68bf826c55985468304f4284a09cb8a68e82503d764166e611a7c58a85a4b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.darkreading.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0
sec-ch-ua-platform
"Linux"

Response headers

accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
private, max-age=300
content-encoding
br
content-length
3121
content-type
text/html
cross-origin-opener-policy-report-only
same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy
cross-origin
date
Wed, 09 Sep 2026 00:42:04 GMT
expires
Wed, 09 Sep 2026 00:42:04 GMT
last-modified
Thu, 08 May 2025 23:15:48 GMT
report-to
{"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server
sffe
timing-allow-origin
*
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
0
GET
H3
200
/ Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/1023206053/
7 KB
3 KB
265ms
81ms
Script
text/javascript
142.250.191.2
Google LLC
General
Full URL
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1023206053/?random=1788914524569&cv=11&fst=1788914524569&bg=ffffff&guid=ON&async=1&gtm=45be6930v897046975z8891172384za20gzb891172384zd891172384xea&gcd=13t3t3t3t5l1&dma=0&tcfd=10000&tag_exp=115938466~115938469~118131810~118897920~118897930~120213116~120385422~120469145~120469153~120914213&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.darkreading.com%2Fcyberattacks-data-breaches%2Fattackers-multi-hop-google-redirects-phishing-campaign&rcb=15&frm=0&tiba=Attackers%20Use%20Multi-Hop%20Google%20Redirects%20for%20Phishing&hn=www.googleadservices.com&npa=0&pscdl=noapi&auid=1481541718.1788914523&uaa=x86&uab=64&uafvl=Chromium%3B152.0.7977.82%7CGoogle%2520Chrome%3B152.0.7977.82%7CNot%253FA_Brand%3B24.0.0.0&uamb=0&uam=&uap=Linux&uapv=&uaw=0&_tu=CA&ept=9&rfmt=3&fmt=4
Requested by
Host: transcend-cdn.com
URL: https://transcend-cdn.com/cm/ef49a3f1-d8c1-47d6-88fc-50e41130631f/airgap.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.191.2 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
pnlgaa-az-in-f2.1e100.net
Software
cafe /
Resource Hash
a24e369405612568ca58f21d4a8dcef1f005008eddac1ce8f7638fdf3967c258
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

cache-control
no-cache, must-revalidate
timing-allow-origin
*
content-encoding
br
pragma
no-cache
cross-origin-resource-policy
cross-origin
x-content-type-options
nosniff
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length
2712
date
Wed, 09 Sep 2026 00:42:04 GMT
x-xss-protection
0
content-type
text/javascript; charset=UTF-8
content-disposition
attachment; filename="f.txt"
server
cafe
POST
H3
200
/
www.google.com/rmkt/collect/1023206053/
0
0
56ms
53ms
Fetch
text/html
142.251.154.119
Google LLC
General
Full URL
https://www.google.com/rmkt/collect/1023206053/?random=1788914524569&cv=11&fst=1788914524569&fmt=8&bg=ffffff&guid=ON&async=1&gtm=45be6930v897046975z8891172384za20gzb891172384zd891172384xea&gcd=13t3t3t3t5l1&dma=0&tcfd=10000&tag_exp=115938466~115938469~118131810~118897920~118897930~120213116~120385422~120469145~120469153~120914213&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.darkreading.com%2Fcyberattacks-data-breaches%2Fattackers-multi-hop-google-redirects-phishing-campaign&rcb=15&frm=0&tiba=Attackers%20Use%20Multi-Hop%20Google%20Redirects%20for%20Phishing&hn=www.googleadservices.com&npa=0&pscdl=noapi&auid=1481541718.1788914523&uaa=x86&uab=64&uafvl=Chromium%3B152.0.7977.82%7CGoogle%2520Chrome%3B152.0.7977.82%7CNot%253FA_Brand%3B24.0.0.0&uamb=0&uam=&uap=Linux&uapv=&uaw=0&_tu=CA&ept=68&gcp=5
Requested by
Host: transcend-cdn.com
URL: https://transcend-cdn.com/cm/ef49a3f1-d8c1-47d6-88fc-50e41130631f/airgap.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.154.119 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
/
Resource Hash

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

POST
H3
200
collect
www.google.com/ccm/
0
0
65ms
62ms
Fetch
text/plain
142.251.154.119
Google LLC
General
Full URL
https://www.google.com/ccm/collect?rcb=15&frm=0&apvc=0&ae=g&auid=1481541718.1788914523&dt=Attackers%20Use%20Multi-Hop%20Google%20Redirects%20for%20Phishing&tid=AW-1023206053&dl=https%3A%2F%2Fwww.darkreading.com%2Fcyberattacks-data-breaches%2Fattackers-multi-hop-google-redirects-phishing-campaign&scrsrc=www.googletagmanager.com&rnd=1738756375.1788914523&navt=n&npa=0&_tu=CA&gtm=45be6930v897046975z8891172384za20gzb891172384zd891172384xea&gcs=G111&gcd=13t3t3t3t5l1&dma=0&tcfd=10000&tag_exp=115938466~115938469~118131810~118897920~118897930~120213116~120385422~120469145~120469153~120914213&tft=1788914524592&tfd=4491&tids=AW-1023206053&fmt=8
Requested by
Host: transcend-cdn.com
URL: https://transcend-cdn.com/cm/ef49a3f1-d8c1-47d6-88fc-50e41130631f/airgap.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.154.119 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
/
Resource Hash

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

GET
H2
200
bridged-loader.js Show response
loader.bridged.media/v1.134.9/
436 KB
96 KB
39ms
39ms
Script
application/javascript
3.168.102.70
Amazon.com
General
Full URL
https://loader.bridged.media/v1.134.9/bridged-loader.js
Requested by
Host: transcend-cdn.com
URL: https://transcend-cdn.com/cm/ef49a3f1-d8c1-47d6-88fc-50e41130631f/airgap.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
3.168.102.70 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-3-168-102-70.jfk52.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
c7874778f4d62f60496efb348550f8510788a8755964dd2867196234b9bd5092

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
gzip
x-amz-meta-git-sha
cd9aba1781f460186af939ff4b6ff9c008d67e66
etag
"0bcd286459eaf1e9356db96642d6d3aa"
x-amz-version-id
ZYyF2fKyggPIr.XxaF3Ei0zWlvaCe4nP
age
128688
x-cache
Hit from cloudfront
x-amz-cf-id
rVsAVwOxX-3SPqf3gbMZp-ftvT2OF93xi4xBA3fC3pUBAY_Ux7Y39g==
date
Mon, 07 Sep 2026 12:57:17 GMT
content-type
application/javascript
last-modified
Mon, 07 Sep 2026 09:25:19 GMT
cache-control
public, max-age=31536000, immutable
via
1.1 88b020899fa30b97646f62e44ca6ea2a.cloudfront.net (CloudFront)
accept-ranges
bytes
content-length
97521
x-amz-cf-pop
JFK52-P6
server
AmazonS3
x-amz-server-side-encryption
AES256
GET
H2
204
2610568 Show response
vc.hotjar.io/sessions/
0
231 B
212ms
99ms
XHR
text/plain
13.33.67.87
Amazon.com
General
Full URL
https://vc.hotjar.io/sessions/2610568?s=0.25&r=0.19679903848008606
Requested by
Host: transcend-cdn.com
URL: https://transcend-cdn.com/cm/ef49a3f1-d8c1-47d6-88fc-50e41130631f/airgap.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.33.67.87 New York, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-13-33-67-87.jfk50.r.cloudfront.net
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

via
1.1 d8ee07f5c6ac1b8b69325e218d2fdcda.cloudfront.net (CloudFront)
access-control-allow-origin
*
cache-control
no-store
x-cache
Miss from cloudfront
x-amz-cf-id
2RiMmEn243wfinAvldobJ1j9ED_CSS5SuO4-QLwcirQrFn2LMNQtUA==
date
Wed, 09 Sep 2026 00:42:04 GMT
x-amz-cf-pop
JFK50-P14
POST
H2
204
26981ed0d57bbad37e728ff58134270c
csp.withgoogle.com/csp/proto/ Frame 36F5
0
0
60ms
58ms
Ping
text/html
142.251.167.141
Google LLC
General
Full URL
https://csp.withgoogle.com/csp/proto/26981ed0d57bbad37e728ff58134270c
Requested by
Host: docs.google.com
URL: https://docs.google.com/spreadsheets/d/e/2PACX-1vQsygsynrhlYSFLOwZ9IaqURE4cQ3rGo07MkUiECTl3zXlINi_MWVmfxgjSgmvPhGmk0kPdS8DBzkoj/pubhtml?gid=326945225&widget=false&headers=false&chrome=false
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.251.167.141 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
ww-in-f141.1e100.net
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://docs.google.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
Content-Type
text/plain;charset=UTF-8
sec-ch-ua-mobile
?0

Response headers

GET
H3
200
UcCO3FwrK3iLTeHuS_nVMrMxCp50SjIw2boKoduKmMEVuLyfMZ0.woff2
fonts.gstatic.com/s/inter/v20/ Frame 36F5
106 KB
0
97ms
48ms
Font
font/woff2
142.251.211.131
Google LLC
General
Full URL
https://fonts.gstatic.com/s/inter/v20/UcCO3FwrK3iLTeHuS_nVMrMxCp50SjIw2boKoduKmMEVuLyfMZ0.woff2
Requested by
Host: docs.google.com
URL: https://docs.google.com/spreadsheets/d/e/2PACX-1vQsygsynrhlYSFLOwZ9IaqURE4cQ3rGo07MkUiECTl3zXlINi_MWVmfxgjSgmvPhGmk0kPdS8DBzkoj/pubhtml?gid=326945225&widget=false&headers=false&chrome=false
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.211.131 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
lclgaa-au-in-f3.1e100.net
Software
sffe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
https://docs.google.com
Referer
https://docs.google.com/

Response headers

age
32135
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options
nosniff
expires
Wed, 08 Sep 2027 15:46:27 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Tue, 08 Sep 2026 15:46:27 GMT
last-modified
Tue, 09 Sep 2025 18:41:52 GMT
content-type
font/woff2
cache-control
public, max-age=31536000
timing-allow-origin
*
cross-origin-opener-policy
same-origin; report-to="apps-themes"
cross-origin-resource-policy
cross-origin
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges
bytes
access-control-allow-origin
*
content-length
108656
x-xss-protection
0
server
sffe
GET

UcCO3FwrK3iLTeHuS_nVMrMxCp50SjIw2boKoduKmMEVuLyfMZ0.woff2
https://docs.google.com/persistent/docs/fonts/ Frame 36F5
0
0


GET
H3
200
UcCO3FwrK3iLTeHuS_nVMrMxCp50SjIw2boKoduKmMEVuFuYMZ0.woff2
fonts.gstatic.com/s/inter/v20/ Frame 36F5
110 KB
0
127ms
78ms
Font
font/woff2
142.251.211.131
Google LLC
General
Full URL
https://fonts.gstatic.com/s/inter/v20/UcCO3FwrK3iLTeHuS_nVMrMxCp50SjIw2boKoduKmMEVuFuYMZ0.woff2
Requested by
Host: docs.google.com
URL: https://docs.google.com/spreadsheets/d/e/2PACX-1vQsygsynrhlYSFLOwZ9IaqURE4cQ3rGo07MkUiECTl3zXlINi_MWVmfxgjSgmvPhGmk0kPdS8DBzkoj/pubhtml?gid=326945225&widget=false&headers=false&chrome=false
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.211.131 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
lclgaa-au-in-f3.1e100.net
Software
sffe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
https://docs.google.com
Referer
https://docs.google.com/

Response headers

age
28183
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options
nosniff
expires
Wed, 08 Sep 2027 16:52:19 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Tue, 08 Sep 2026 16:52:19 GMT
last-modified
Tue, 09 Sep 2025 18:36:03 GMT
content-type
font/woff2
cache-control
public, max-age=31536000
timing-allow-origin
*
cross-origin-opener-policy
same-origin; report-to="apps-themes"
cross-origin-resource-policy
cross-origin
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges
bytes
access-control-allow-origin
*
content-length
112444
x-xss-protection
0
server
sffe
GET

UcCO3FwrK3iLTeHuS_nVMrMxCp50SjIw2boKoduKmMEVuFuYMZ0.woff2
https://docs.google.com/persistent/docs/fonts/ Frame 36F5
0
0


GET
H3
200
UcCM3FwrK3iLTcvneQg7Ca725JhhKnNqk4j1ebLhAm8SrXTc2dthiA.woff2
fonts.gstatic.com/s/inter/v20/ Frame 36F5
111 KB
0
91ms
43ms
Font
font/woff2
142.251.211.131
Google LLC
General
Full URL
https://fonts.gstatic.com/s/inter/v20/UcCM3FwrK3iLTcvneQg7Ca725JhhKnNqk4j1ebLhAm8SrXTc2dthiA.woff2
Requested by
Host: docs.google.com
URL: https://docs.google.com/spreadsheets/d/e/2PACX-1vQsygsynrhlYSFLOwZ9IaqURE4cQ3rGo07MkUiECTl3zXlINi_MWVmfxgjSgmvPhGmk0kPdS8DBzkoj/pubhtml?gid=326945225&widget=false&headers=false&chrome=false
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.211.131 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
lclgaa-au-in-f3.1e100.net
Software
sffe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
https://docs.google.com
Referer
https://docs.google.com/

Response headers

age
494010
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options
nosniff
expires
Fri, 03 Sep 2027 07:28:32 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Thu, 03 Sep 2026 07:28:32 GMT
last-modified
Tue, 09 Sep 2025 18:40:02 GMT
content-type
font/woff2
cache-control
public, max-age=31536000
timing-allow-origin
*
cross-origin-opener-policy
same-origin; report-to="apps-themes"
cross-origin-resource-policy
cross-origin
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges
bytes
access-control-allow-origin
*
content-length
114132
x-xss-protection
0
server
sffe
GET

UcCM3FwrK3iLTcvneQg7Ca725JhhKnNqk4j1ebLhAm8SrXTc2dthiA.woff2
https://docs.google.com/persistent/docs/fonts/ Frame 36F5
0
0


GET
H3
200
UcCM3FwrK3iLTcvneQg7Ca725JhhKnNqk4j1ebLhAm8SrXTcPtxhiA.woff2
fonts.gstatic.com/s/inter/v20/ Frame 36F5
116 KB
0
96ms
64ms
Font
font/woff2
142.251.211.131
Google LLC
General
Full URL
https://fonts.gstatic.com/s/inter/v20/UcCM3FwrK3iLTcvneQg7Ca725JhhKnNqk4j1ebLhAm8SrXTcPtxhiA.woff2
Requested by
Host: docs.google.com
URL: https://docs.google.com/spreadsheets/d/e/2PACX-1vQsygsynrhlYSFLOwZ9IaqURE4cQ3rGo07MkUiECTl3zXlINi_MWVmfxgjSgmvPhGmk0kPdS8DBzkoj/pubhtml?gid=326945225&widget=false&headers=false&chrome=false
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.211.131 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
lclgaa-au-in-f3.1e100.net
Software
sffe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
https://docs.google.com
Referer
https://docs.google.com/

Response headers

age
28531
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options
nosniff
expires
Wed, 08 Sep 2027 16:46:31 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Tue, 08 Sep 2026 16:46:31 GMT
last-modified
Tue, 09 Sep 2025 18:40:49 GMT
content-type
font/woff2
cache-control
public, max-age=31536000
timing-allow-origin
*
cross-origin-opener-policy
same-origin; report-to="apps-themes"
cross-origin-resource-policy
cross-origin
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges
bytes
access-control-allow-origin
*
content-length
118340
x-xss-protection
0
server
sffe
GET

UcCM3FwrK3iLTcvneQg7Ca725JhhKnNqk4j1ebLhAm8SrXTcPtxhiA.woff2
https://docs.google.com/persistent/docs/fonts/ Frame 36F5
0
0


GET
H2
200
css
fonts.googleapis.com/ Frame 36F5
10 KB
0
0ms
0ms
Stylesheet
text/css
142.251.167.95
Google LLC
General
Full URL
https://fonts.googleapis.com/css?family=Google+Sans
Requested by
Host: docs.google.com
URL: https://docs.google.com/static/spreadsheets2/client/css/2837645074-waffle_k_ltr.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
142.251.167.95 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
ww-in-f95.1e100.net
Software
ESF /
Resource Hash
9a8bb89f6247a8f5da6393ef01b189fc4c100fb0a5d1d14218466056eabf218d
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
https://docs.google.com/

Response headers

content-encoding
gzip
x-content-type-options
nosniff
expires
Wed, 09 Sep 2026 00:42:02 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Wed, 09 Sep 2026 00:42:02 GMT
content-type
text/css; charset=utf-8
vary
Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
last-modified
Wed, 09 Sep 2026 00:06:41 GMT
x-frame-options
SAMEORIGIN
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
cross-origin-opener-policy
same-origin-allow-popups
cross-origin-resource-policy
cross-origin
access-control-allow-origin
*
x-xss-protection
0
server
ESF
GET
H3
200
UcCO3FwrK3iLTeHuS_nVMrMxCp50SjIw2boKoduKmMEVuLyfMZ0.woff2
fonts.gstatic.com/s/inter/v20/ Frame 3222
106 KB
0
97ms
48ms
Font
font/woff2
142.251.211.131
Google LLC
General
Full URL
https://fonts.gstatic.com/s/inter/v20/UcCO3FwrK3iLTeHuS_nVMrMxCp50SjIw2boKoduKmMEVuLyfMZ0.woff2
Requested by
Host: docs.google.com
URL: https://docs.google.com/spreadsheets/d/e/2PACX-1vQsygsynrhlYSFLOwZ9IaqURE4cQ3rGo07MkUiECTl3zXlINi_MWVmfxgjSgmvPhGmk0kPdS8DBzkoj/pubhtml?gid=326945225&widget=false&headers=false&chrome=false
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.211.131 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
lclgaa-au-in-f3.1e100.net
Software
sffe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
https://docs.google.com
Referer
https://docs.google.com/

Response headers

age
32135
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options
nosniff
expires
Wed, 08 Sep 2027 15:46:27 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Tue, 08 Sep 2026 15:46:27 GMT
last-modified
Tue, 09 Sep 2025 18:41:52 GMT
content-type
font/woff2
cache-control
public, max-age=31536000
timing-allow-origin
*
cross-origin-opener-policy
same-origin; report-to="apps-themes"
cross-origin-resource-policy
cross-origin
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges
bytes
access-control-allow-origin
*
content-length
108656
x-xss-protection
0
server
sffe
GET

UcCO3FwrK3iLTeHuS_nVMrMxCp50SjIw2boKoduKmMEVuLyfMZ0.woff2
https://docs.google.com/persistent/docs/fonts/ Frame 3222
0
0


GET
H3
200
UcCO3FwrK3iLTeHuS_nVMrMxCp50SjIw2boKoduKmMEVuFuYMZ0.woff2
fonts.gstatic.com/s/inter/v20/ Frame 3222
110 KB
0
127ms
78ms
Font
font/woff2
142.251.211.131
Google LLC
General
Full URL
https://fonts.gstatic.com/s/inter/v20/UcCO3FwrK3iLTeHuS_nVMrMxCp50SjIw2boKoduKmMEVuFuYMZ0.woff2
Requested by
Host: docs.google.com
URL: https://docs.google.com/spreadsheets/d/e/2PACX-1vQsygsynrhlYSFLOwZ9IaqURE4cQ3rGo07MkUiECTl3zXlINi_MWVmfxgjSgmvPhGmk0kPdS8DBzkoj/pubhtml?gid=326945225&widget=false&headers=false&chrome=false
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.211.131 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
lclgaa-au-in-f3.1e100.net
Software
sffe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
https://docs.google.com
Referer
https://docs.google.com/

Response headers

age
28183
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options
nosniff
expires
Wed, 08 Sep 2027 16:52:19 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Tue, 08 Sep 2026 16:52:19 GMT
last-modified
Tue, 09 Sep 2025 18:36:03 GMT
content-type
font/woff2
cache-control
public, max-age=31536000
timing-allow-origin
*
cross-origin-opener-policy
same-origin; report-to="apps-themes"
cross-origin-resource-policy
cross-origin
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges
bytes
access-control-allow-origin
*
content-length
112444
x-xss-protection
0
server
sffe
GET

UcCO3FwrK3iLTeHuS_nVMrMxCp50SjIw2boKoduKmMEVuFuYMZ0.woff2
https://docs.google.com/persistent/docs/fonts/ Frame 3222
0
0


GET
H3
200
UcCM3FwrK3iLTcvneQg7Ca725JhhKnNqk4j1ebLhAm8SrXTc2dthiA.woff2
fonts.gstatic.com/s/inter/v20/ Frame 3222
111 KB
0
91ms
43ms
Font
font/woff2
142.251.211.131
Google LLC
General
Full URL
https://fonts.gstatic.com/s/inter/v20/UcCM3FwrK3iLTcvneQg7Ca725JhhKnNqk4j1ebLhAm8SrXTc2dthiA.woff2
Requested by
Host: docs.google.com
URL: https://docs.google.com/spreadsheets/d/e/2PACX-1vQsygsynrhlYSFLOwZ9IaqURE4cQ3rGo07MkUiECTl3zXlINi_MWVmfxgjSgmvPhGmk0kPdS8DBzkoj/pubhtml?gid=326945225&widget=false&headers=false&chrome=false
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.211.131 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
lclgaa-au-in-f3.1e100.net
Software
sffe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
https://docs.google.com
Referer
https://docs.google.com/

Response headers

age
494010
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options
nosniff
expires
Fri, 03 Sep 2027 07:28:32 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Thu, 03 Sep 2026 07:28:32 GMT
last-modified
Tue, 09 Sep 2025 18:40:02 GMT
content-type
font/woff2
cache-control
public, max-age=31536000
timing-allow-origin
*
cross-origin-opener-policy
same-origin; report-to="apps-themes"
cross-origin-resource-policy
cross-origin
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges
bytes
access-control-allow-origin
*
content-length
114132
x-xss-protection
0
server
sffe
GET

UcCM3FwrK3iLTcvneQg7Ca725JhhKnNqk4j1ebLhAm8SrXTc2dthiA.woff2
https://docs.google.com/persistent/docs/fonts/ Frame 3222
0
0


GET
H3
200
UcCM3FwrK3iLTcvneQg7Ca725JhhKnNqk4j1ebLhAm8SrXTcPtxhiA.woff2
fonts.gstatic.com/s/inter/v20/ Frame 3222
116 KB
0
96ms
64ms
Font
font/woff2
142.251.211.131
Google LLC
General
Full URL
https://fonts.gstatic.com/s/inter/v20/UcCM3FwrK3iLTcvneQg7Ca725JhhKnNqk4j1ebLhAm8SrXTcPtxhiA.woff2
Requested by
Host: docs.google.com
URL: https://docs.google.com/spreadsheets/d/e/2PACX-1vQsygsynrhlYSFLOwZ9IaqURE4cQ3rGo07MkUiECTl3zXlINi_MWVmfxgjSgmvPhGmk0kPdS8DBzkoj/pubhtml?gid=326945225&widget=false&headers=false&chrome=false
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.211.131 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
lclgaa-au-in-f3.1e100.net
Software
sffe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
https://docs.google.com
Referer
https://docs.google.com/

Response headers

age
28531
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options
nosniff
expires
Wed, 08 Sep 2027 16:46:31 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Tue, 08 Sep 2026 16:46:31 GMT
last-modified
Tue, 09 Sep 2025 18:40:49 GMT
content-type
font/woff2
cache-control
public, max-age=31536000
timing-allow-origin
*
cross-origin-opener-policy
same-origin; report-to="apps-themes"
cross-origin-resource-policy
cross-origin
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges
bytes
access-control-allow-origin
*
content-length
118340
x-xss-protection
0
server
sffe
GET

UcCM3FwrK3iLTcvneQg7Ca725JhhKnNqk4j1ebLhAm8SrXTcPtxhiA.woff2
https://docs.google.com/persistent/docs/fonts/ Frame 3222
0
0


GET
H2
200
css
fonts.googleapis.com/ Frame 3222
10 KB
0
0ms
0ms
Stylesheet
text/css
142.251.167.95
Google LLC
General
Full URL
https://fonts.googleapis.com/css?family=Google+Sans
Requested by
Host: docs.google.com
URL: https://docs.google.com/static/spreadsheets2/client/css/2837645074-waffle_k_ltr.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
142.251.167.95 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
ww-in-f95.1e100.net
Software
ESF /
Resource Hash
9a8bb89f6247a8f5da6393ef01b189fc4c100fb0a5d1d14218466056eabf218d
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
https://docs.google.com/

Response headers

content-encoding
gzip
x-content-type-options
nosniff
expires
Wed, 09 Sep 2026 00:42:02 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Wed, 09 Sep 2026 00:42:02 GMT
content-type
text/css; charset=utf-8
vary
Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
last-modified
Wed, 09 Sep 2026 00:06:41 GMT
x-frame-options
SAMEORIGIN
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
cross-origin-opener-policy
same-origin-allow-popups
cross-origin-resource-policy
cross-origin
access-control-allow-origin
*
x-xss-protection
0
server
ESF
POST
H3
204
ping
pagead2.googlesyndication.com/pagead/
0
0
227ms
50ms
Fetch
image/gif
64.233.180.155
Google LLC
General
Full URL
https://pagead2.googlesyndication.com/pagead/ping?e=1
Requested by
Host: transcend-cdn.com
URL: https://transcend-cdn.com/cm/ef49a3f1-d8c1-47d6-88fc-50e41130631f/airgap.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
64.233.180.155 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
on-in-f155.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
Content-Type
text/plain;charset=UTF-8
sec-ch-ua-mobile
?0

Response headers

cache-control
no-cache, must-revalidate
timing-allow-origin
*
pragma
no-cache
cross-origin-resource-policy
cross-origin
x-content-type-options
nosniff
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length
0
date
Wed, 09 Sep 2026 00:42:05 GMT
x-xss-protection
0
content-type
image/gif
server
cafe
GET
H3
200
pub.json Show response
pub.doubleverify.com/dvtag/signals/vlp/
87 B
278 B
52ms
51ms
Fetch
application/json
172.64.155.110
Cloudflare
General
Full URL
https://pub.doubleverify.com/dvtag/signals/vlp/pub.json?ctx=19913272&cmp=DV424940&url=https%3A%2F%2Fdarkreading.com&vlp=1&slot-0-%2F3618%2Fdarkreading.home%2Farticle%2Fcyberattacks-data-breaches%40728_1v=&slot-1-%2F3618%2Fdarkreading.home%2Farticle%2Fcyberattacks-data-breaches%40resource_v=5x5&slot-2-%2F3618%2Fdarkreading.home%2Farticle%2Fcyberattacks-data-breaches%40300_1v=300x100%2C300x250%2C300x600&token=hQv5C45q8J%2FGbeeypApQ0DejOzV9p6i5RSrvR2%2BrnQ7vjOgjPIdpmO%2FmZS%2F9ojr87eOFTU7ermH8wjHE3jYgap6wTLxviQedRHrOyxk3mSnSkRoHTofV%2BNp2MLaGEfbsiVkwliYZkEQjOw%3D%3D
Requested by
Host: transcend-cdn.com
URL: https://transcend-cdn.com/cm/ef49a3f1-d8c1-47d6-88fc-50e41130631f/airgap.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.64.155.110 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
af0f75f5c80a8014ec3a94b586a8b9f1ea7b36829c87f5862b3e30b33a40a5b7
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
cache-control
public, max-age=0
timing-allow-origin
*
content-encoding
br
access-control-expose-headers
Server-Timing, Cf-Ray
access-control-allow-credentials
true
cf-ray
a38226a82b1936b4-YYZ
access-control-allow-origin
https://www.darkreading.com
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Wed, 09 Sep 2026 00:42:05 GMT
content-type
application/json
vary
origin
server
cloudflare
priority
u=1,i
GET
H3
200
4Ua_rENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RFD48TE63OOYKtrwEIJllpyk.woff2
fonts.gstatic.com/s/googlesans/v70/ Frame 36F5
22 KB
0
20ms
20ms
Font
font/woff2
142.251.211.131
Google LLC
General
Full URL
https://fonts.gstatic.com/s/googlesans/v70/4Ua_rENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RFD48TE63OOYKtrwEIJllpyk.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Google+Sans
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.211.131 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
lclgaa-au-in-f3.1e100.net
Software
sffe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
https://docs.google.com
Referer
https://fonts.googleapis.com/

Response headers

age
29514
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options
nosniff
expires
Wed, 08 Sep 2027 16:30:08 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Tue, 08 Sep 2026 16:30:08 GMT
last-modified
Tue, 21 Jul 2026 18:27:49 GMT
content-type
font/woff2
cache-control
public, max-age=31536000
timing-allow-origin
*
cross-origin-opener-policy
same-origin; report-to="apps-themes"
cross-origin-resource-policy
cross-origin
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges
bytes
access-control-allow-origin
*
content-length
22048
x-xss-protection
0
server
sffe
GET
H2
200
waffle_sprite53.png
ssl.gstatic.com/docs/spreadsheets/ Frame 36F5
8 KB
0
0ms
0ms
Image
image/png
142.251.211.195
Google LLC
General
Full URL
https://ssl.gstatic.com/docs/spreadsheets/waffle_sprite53.png
Requested by
Host: docs.google.com
URL: https://docs.google.com/static/spreadsheets2/client/css/2837645074-waffle_k_ltr.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.251.211.195 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
pnlgaa-ba-in-f3.1e100.net
Software
sffe /
Resource Hash
5b2f8581f3db2de166cbcbadf3e4256167ffb43d897d22e327840f9cd1d16405
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://docs.google.com/

Response headers

age
358077
report-to
{"group":"apps-spreadsheets","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-spreadsheets"}]}
x-content-type-options
nosniff
expires
Sat, 04 Sep 2027 21:14:05 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Fri, 04 Sep 2026 21:14:05 GMT
last-modified
Thu, 02 Nov 2023 22:48:00 GMT
content-type
image/png
cache-control
public, max-age=31536000
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
access-control-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="apps-spreadsheets"
content-length
8116
x-xss-protection
0
server
sffe
GET
H3
200
4Ua_rENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RFD48TE63OOYKtrwEIJllpyk.woff2
fonts.gstatic.com/s/googlesans/v70/ Frame 3222
22 KB
0
20ms
20ms
Font
font/woff2
142.251.211.131
Google LLC
General
Full URL
https://fonts.gstatic.com/s/googlesans/v70/4Ua_rENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RFD48TE63OOYKtrwEIJllpyk.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Google+Sans
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.211.131 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
lclgaa-au-in-f3.1e100.net
Software
sffe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
https://docs.google.com
Referer
https://fonts.googleapis.com/

Response headers

age
29514
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options
nosniff
expires
Wed, 08 Sep 2027 16:30:08 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Tue, 08 Sep 2026 16:30:08 GMT
last-modified
Tue, 21 Jul 2026 18:27:49 GMT
content-type
font/woff2
cache-control
public, max-age=31536000
timing-allow-origin
*
cross-origin-opener-policy
same-origin; report-to="apps-themes"
cross-origin-resource-policy
cross-origin
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges
bytes
access-control-allow-origin
*
content-length
22048
x-xss-protection
0
server
sffe
GET
H2
200
waffle_sprite53.png
ssl.gstatic.com/docs/spreadsheets/ Frame 3222
8 KB
0
0ms
0ms
Image
image/png
142.251.211.195
Google LLC
General
Full URL
https://ssl.gstatic.com/docs/spreadsheets/waffle_sprite53.png
Requested by
Host: docs.google.com
URL: https://docs.google.com/static/spreadsheets2/client/css/2837645074-waffle_k_ltr.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.251.211.195 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
pnlgaa-ba-in-f3.1e100.net
Software
sffe /
Resource Hash
5b2f8581f3db2de166cbcbadf3e4256167ffb43d897d22e327840f9cd1d16405
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://docs.google.com/

Response headers

age
358077
report-to
{"group":"apps-spreadsheets","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-spreadsheets"}]}
x-content-type-options
nosniff
expires
Sat, 04 Sep 2027 21:14:05 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Fri, 04 Sep 2026 21:14:05 GMT
last-modified
Thu, 02 Nov 2023 22:48:00 GMT
content-type
image/png
cache-control
public, max-age=31536000
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
access-control-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="apps-spreadsheets"
content-length
8116
x-xss-protection
0
server
sffe
GET
H/1.1
200
OK
blank.png
s.dpmsrv.com/
Redirect Chain
  • https://a.usbrowserspeed.com/cs?pid=d177d942cb8207b52f57818feb9bb79a7b77ce6e0ed688e3af36875661b9be1d&r=https%3A%2F%2Fs.dpmsrv.com%2Fblank.png&puid=dpmpixc%5B68%5Da%5BNA%5Ds%5B01a0839d-6074-7f28-872...
  • https://s.dpmsrv.com/blank.png
563 B
1 KB
35ms
35ms
Image
image/png
99.84.160.34
Amazon.com
General
Full URL
https://s.dpmsrv.com/blank.png
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/cyberattacks-data-breaches/attackers-multi-hop-google-redirects-phishing-campaign
Protocol
HTTP/1.1
Server
99.84.160.34 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-99-84-160-34.jfk50.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
275bbb87cacfdec0c1259a2356fb3f2858f18e6f842d1fa1e5c8e8c16eb9a120

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
Referer
https://www.darkreading.com/

Response headers

ETag
"0db3c937b3b1cedbed051c0f2592bc1e"
Age
77297
Connection
keep-alive
Via
1.1 06cb9bed6e3c9f95e430c22405e0fd84.cloudfront.net (CloudFront)
Accept-Ranges
bytes
X-Cache
Hit from cloudfront
Content-Length
563
X-Amz-Cf-Id
DqepUg95cSuVVmtG_WSo2XNlMIIvfj8zhgyfAIKf35G0AFoJh5EB5Q==
Date
Tue, 08 Sep 2026 03:13:50 GMT
Content-Type
image/png
Last-Modified
Tue, 11 Jun 2024 14:07:56 GMT
Server
AmazonS3
X-Amz-Cf-Pop
JFK50-P15
x-amz-server-side-encryption
AES256

Redirect headers

location
https://s.dpmsrv.com/blank.png
content-length
53
date
Wed, 09 Sep 2026 00:42:05 GMT
content-type
text/html; charset=utf-8
server
awselb/2.0
POST
H3
204
AGSKWxXBlb1BYnR6F-NGMctUiIQsrIYzarnzDyqV7J61DfwX1VVdQM7_ZsYWZF9h3ohz359V9B0QNRyUiGiNB6Kkv8thoK9FJajVdrfDzXgH-6FN_8j68FCFAlRNRKhkq2-Zqx3BTS2vnw== Show response
fundingchoicesmessages.google.com/el/
0
28 B
91ms
88ms
XHR
text/html
142.250.217.238
Google LLC
General
Full URL
https://fundingchoicesmessages.google.com/el/AGSKWxXBlb1BYnR6F-NGMctUiIQsrIYzarnzDyqV7J61DfwX1VVdQM7_ZsYWZF9h3ohz359V9B0QNRyUiGiNB6Kkv8thoK9FJajVdrfDzXgH-6FN_8j68FCFAlRNRKhkq2-Zqx3BTS2vnw==
Requested by
Host: transcend-cdn.com
URL: https://transcend-cdn.com/cm/ef49a3f1-d8c1-47d6-88fc-50e41130631f/airgap.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.217.238 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
pnlgaa-ay-in-f14.1e100.net
Software
ESF /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Content-Security-Policy require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-NjfKxFpSegcORwHbq8Mk1Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
Content-Type
text/plain
sec-ch-ua-mobile
?0

Response headers

access-control-max-age
86400
access-control-allow-methods
POST, GET, OPTIONS
x-content-type-options
nosniff
expires
Mon, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Wed, 09 Sep 2026 00:42:05 GMT
content-type
text/html; charset=utf-8
x-frame-options
SAMEORIGIN
reporting-endpoints
default="/_/ContributorLoggingHttp/web-reports?context=eJzjMtDikmLw1ZBiOHnrNtNFIP5Qf5n1BxAvnBbIthKIRQyC2GSAOO1gOFseEAvxcNy91nSVTeDB9GmbmJRckvIL45Pz80pS80p0E1OKdUHsosyk0pL8IhR2ahlIRU5-enpmXnq8kYGRmYGlgbmegVl8gQEAScQxVw"
content-security-policy
require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-NjfKxFpSegcORwHbq8Mk1Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
cache-control
no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy
same-origin
pragma
no-cache
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials
true
permissions-policy
ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin
https://www.darkreading.com
content-length
0
x-xss-protection
0
server
ESF
GET
H3
200
AGSKWxUkvG5klvrx4a7O8TLVRixTn9lHELA63tPCypGIPTF8fNdx8ySojfTbKvPVQHEcRW4xZ3us3F448bp8NVD5wYoitQVmL00zIQcnUWkP0HTc76e66P63EJra5jQVPJsyvXBE7q3dSA== Show response
fundingchoicesmessages.google.com/f/
9 KB
4 KB
136ms
135ms
Script
application/javascript
142.250.217.238
Google LLC
General
Full URL
https://fundingchoicesmessages.google.com/f/AGSKWxUkvG5klvrx4a7O8TLVRixTn9lHELA63tPCypGIPTF8fNdx8ySojfTbKvPVQHEcRW4xZ3us3F448bp8NVD5wYoitQVmL00zIQcnUWkP0HTc76e66P63EJra5jQVPJsyvXBE7q3dSA==?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNzg4OTE0NTI1LDYwNDAwMDAwMF0sbnVsbCxudWxsLG51bGwsW251bGwsWzcsOV0sbnVsbCwyLG51bGwsImVuIl0sImh0dHBzOi8vd3d3LmRhcmtyZWFkaW5nLmNvbS9jeWJlcmF0dGFja3MtZGF0YS1icmVhY2hlcy9hdHRhY2tlcnMtbXVsdGktaG9wLWdvb2dsZS1yZWRpcmVjdHMtcGhpc2hpbmctY2FtcGFpZ24iLG51bGwsW1s4LCJ3eWJYVDh0dW5mSSJdLFs5LCJlbi1VUyJdLFsxOCwiW1tbbnVsbCwyNzUwXV1dIl0sWzM1LCIxNzg4OTE0NTI0Il0sWzI2LCIxNSJdLFsxOSwiMiJdLFsxNywiWzBdIl0sWzI0LCIiXSxbMjUsIltbMzEwOTk5MDZdXSJdLFsyOSwiZmFsc2UiXV1d
Requested by
Host: transcend-cdn.com
URL: https://transcend-cdn.com/cm/ef49a3f1-d8c1-47d6-88fc-50e41130631f/airgap.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.217.238 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
pnlgaa-ay-in-f14.1e100.net
Software
ESF /
Resource Hash
51016a84acebc2e29a90994305d4209da890e3d82f74eab7306e8fb5b1f9e2a7
Security Headers
Name Value
Content-Security-Policy require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-xBNhtDpx2EwL9Dwd-67OYQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
gzip
x-content-type-options
nosniff
expires
Mon, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Wed, 09 Sep 2026 00:42:05 GMT
content-type
application/javascript; charset=utf-8
x-frame-options
SAMEORIGIN
reporting-endpoints
default="/_/ContributorServingWebSwitchboardHttp/web-reports?context=eJzjytHikmLw05BiOHnrNtNFIG69eY51OhCXLDrP2gbEXUA8B4gNFS6xOgPxh_rLrD-AuEjiCmsLEH-qusEqUn2D9VuxLxtHiS8by1t_toXTAtlWArGIQRCbDBCnHQxnywNiIR6Ou9earrIJLJh77BKTkkZSfmF8cn5eSVFmUmlJflFaclpqcWpRWWpRvJGBkZmBpYG5noF5fIEBAADwQA4"
content-security-policy
require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport, script-src 'report-sample' 'nonce-xBNhtDpx2EwL9Dwd-67OYQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist
cache-control
no-cache, no-store, max-age=0, must-revalidate
timing-allow-origin
*
cross-origin-opener-policy
same-origin
pragma
no-cache
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy
cross-origin
permissions-policy
ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
x-xss-protection
0
server
ESF
GET
H/1.1
200
OK
dvtp_src.js Show response
cdn.doubleverify.com/ Frame C77B
9 KB
4 KB
272ms
42ms
Script
text/javascript
23.210.73.49
AKAMAI-ASN1 Akama...
General
Full URL
https://cdn.doubleverify.com/dvtp_src.js
Requested by
Host: transcend-cdn.com
URL: https://transcend-cdn.com/cm/ef49a3f1-d8c1-47d6-88fc-50e41130631f/airgap.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
23.210.73.49 Secaucus, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),
Reverse DNS
a23-210-73-49.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
f78fa5032699676674f8888c09692d2c3fd210abde09e964fed1a97c2ed94549

Request headers

sec-ch-ua-platform
"Linux"
Referer
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

Access-Control-Expose-Headers
*
Cache-Control
max-age=3600
Content-Encoding
br
ETag
"9262973c7265bf021a0eb34db8628a8c"
Connection
keep-alive
Expires
Wed, 09 Sep 2026 01:42:05 GMT
Accept-Ranges
bytes
Access-Control-Allow-Origin
*
Content-Length
3510
Date
Wed, 09 Sep 2026 00:42:05 GMT
Content-Type
text/javascript
Last-Modified
Tue, 08 Sep 2026 10:12:43 GMT
GET
DATA
200
OK
truncated
/ Frame 04A9
208 B
0
Image
image/png

General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
3f1cedbb532f965d9eb4ef79997fb73ac5dafd3a29ae9084bdde660e2ec0bb2f

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
Referer

Response headers

Content-Type
image/png
GET
H3
200
view
securepubads.g.doubleclick.net/pcs/ Frame 336B
0
0
67ms
65ms
Fetch
image/gif
142.251.211.130
Google LLC
General
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstOszFjPBRccLRUE3h2boB9Wp7duD1vi070rK-ke_qz4ceLG-xqOXMcamUyjOIeEd32xMjymqhJwMWQcUZIGKRnX5DKJ44uOpbqmjq_QHPZHspsChe9Di1t4ckxFNzZ6qpcQldBJl9C9Auzw4ITCb-teclzEJpnTXc2BpVVfb0nog1ux4mO3omXz7vuNHEvadX7GQwRu2S4efaudf9mOWLGN7PlZyQE8ahAPTxZSoxa3XITbcsXV0hIMD74YgAZbLczNs8duumc_5RVCOnL-6GZNEJebmx6ebBs6BG9eM3K9-0ojltbu3YIWB88EtjhDMuITCHOPhtiTZ83OnhJWFsbaczP6AkpkLMMPTsX4c_txMybWJUZPUG9oNBqCOIPe7eDRnOqkNYhBJkhrabBCMv_SfayrmZ2YzVviaNYjsMOmBhEqZjp-fa9IoRwhdn0YIERtt4SOnDHbQbpPf3x-6TNpu29YEvzh6wZ887JWObBGE0s6A&sai=AMfl-YSwOTlpB-EvTlY-enHLdfB8oIVBLmFgtBCOlmb1dyy4CcLjqZpmMxN_pWo3kXcktDTrZGky0oPHUbaZ7l1GhDsRxLTQ51AkH4PJy71EkxHxfYps2fOS8R8iNCj6yJhHOBfFfkSgx7Zq7kthXfIsa-Z5HaUQb3LCSsmxrxM1obivxnkXsjxQrnaF_sPojqD_r-YaOzzBejENlDhXYY1BRxGFcpJ8HZrEElMUzY94nvo99B7o2IeGSoskbSKohg8kSVfWE7lta2h4df6gu9Z_a_zZ8OJVLAQvyj0k1nMIodVZIzzdaC0LLoHkaThbBidHvXahU-nCIqSoalef4ABPXVSKJWPMxap-LZoXdWXay9xpsJT6CyGALGI_03egveIhZ9AcRXfhzTrwnCV6&sig=Cg0ArKJSzOe9SJTYSaKcEAE&uach_m=%5BUACH%5D&urlfix=1&adurl=
Requested by
Host: transcend-cdn.com
URL: https://transcend-cdn.com/cm/ef49a3f1-d8c1-47d6-88fc-50e41130631f/airgap.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.211.130 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
lclgaa-au-in-f2.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

cache-control
private
timing-allow-origin
*
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
cross-origin-resource-policy
cross-origin
x-content-type-options
nosniff
access-control-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length
0
date
Wed, 09 Sep 2026 00:42:05 GMT
x-xss-protection
0
content-type
image/gif
server
cafe
GET
H2
200
dcmads.js Show response
www.googletagservices.com/dcm/ Frame 336B
17 KB
8 KB
237ms
40ms
Script
text/javascript
142.251.163.155
Google LLC
General
Full URL
https://www.googletagservices.com/dcm/dcmads.js
Requested by
Host: transcend-cdn.com
URL: https://transcend-cdn.com/cm/ef49a3f1-d8c1-47d6-88fc-50e41130631f/airgap.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.251.163.155 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
wv-in-f155.1e100.net
Software
sffe /
Resource Hash
019861425cded660bfef7bd9c28a9c113e067d63b3ec5863f0d38deb23c82ba8
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
gzip
age
686
report-to
{"group":"ads-dcm-tag","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-dcm-tag"}]}
x-content-type-options
nosniff
expires
Wed, 09 Sep 2026 01:30:39 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Wed, 09 Sep 2026 00:30:39 GMT
last-modified
Thu, 01 May 2025 13:47:29 GMT
content-type
text/javascript
vary
Accept-Encoding
cache-control
public, max-age=3600
cross-origin-opener-policy
same-origin; report-to="ads-dcm-tag"
cross-origin-resource-policy
cross-origin
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-dcm-tag
accept-ranges
bytes
content-length
7429
x-xss-protection
0
server
sffe
GET
H3
200
ufs_web_display.js Show response
pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ Frame 336B
239 KB
74 KB
220ms
40ms
Script
text/javascript
64.233.180.155
Google LLC
General
Full URL
https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js
Requested by
Host: transcend-cdn.com
URL: https://transcend-cdn.com/cm/ef49a3f1-d8c1-47d6-88fc-50e41130631f/airgap.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
64.233.180.155 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
on-in-f155.1e100.net
Software
cafe /
Resource Hash
5b0d6fda9d4c1601d352e39f939162c2e95e547915536847e3782a0a10dfd92d
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
br
etag
2640385400941753791
age
1021
x-content-type-options
nosniff
expires
Wed, 09 Sep 2026 01:25:04 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date
Wed, 09 Sep 2026 00:25:04 GMT
content-disposition
attachment; filename="f.txt"
content-type
text/javascript; charset=UTF-8
vary
Accept-Encoding
cache-control
public, max-age=3600, stale-while-revalidate=3600
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
content-length
75325
x-xss-protection
0
server
cafe
GET
H/1.1
200
OK
dvtp_src.js Show response
cdn.doubleverify.com/ Frame AEE8
9 KB
0
198ms
198ms
Script
text/javascript
23.210.73.49
AKAMAI-ASN1 Akama...
General
Full URL
https://cdn.doubleverify.com/dvtp_src.js
Requested by
Host: transcend-cdn.com
URL: https://transcend-cdn.com/cm/ef49a3f1-d8c1-47d6-88fc-50e41130631f/airgap.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
23.210.73.49 Secaucus, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),
Reverse DNS
a23-210-73-49.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
f78fa5032699676674f8888c09692d2c3fd210abde09e964fed1a97c2ed94549

Request headers

sec-ch-ua-platform
"Linux"
Referer
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

Access-Control-Expose-Headers
*
Cache-Control
max-age=3600
Content-Encoding
br
ETag
"9262973c7265bf021a0eb34db8628a8c"
Expires
Wed, 09 Sep 2026 01:42:05 GMT
Accept-Ranges
bytes
Access-Control-Allow-Origin
*
Content-Length
3510
Date
Wed, 09 Sep 2026 00:42:05 GMT
Content-Type
text/javascript
Last-Modified
Tue, 08 Sep 2026 10:12:43 GMT
POST
H2
201
LoaderJSConfigurations Show response
gateway.bridged.media/Campaign/
7 KB
3 KB
178ms
176ms
Fetch
application/json
52.215.118.206
Amazon.com
General
Full URL
https://gateway.bridged.media/Campaign/LoaderJSConfigurations
Requested by
Host: transcend-cdn.com
URL: https://transcend-cdn.com/cm/ef49a3f1-d8c1-47d6-88fc-50e41130631f/airgap.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
52.215.118.206 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-52-215-118-206.eu-west-1.compute.amazonaws.com
Software
/ Express
Resource Hash
dda6613eba0699fdf6bd9b946d1eeb5d14a66f9cf7e2e2719dc6f20044576e33

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
content-type
application/json
sec-ch-ua-mobile
?0

Response headers

access-control-allow-origin
*
content-encoding
br
date
Wed, 09 Sep 2026 00:42:06 GMT
etag
W/"1d4a-OMVERDyL4Mw+l+yEpVPZCvlKPpY"
content-type
application/json; charset=utf-8
x-powered-by
Express
vary
Accept-Encoding
GET
H3
200
/
www.google.com/pagead/1p-user-list/1023206053/
42 B
64 B
52ms
51ms
Image
image/gif
142.251.154.119
Google LLC
General
Full URL
https://www.google.com/pagead/1p-user-list/1023206053/?random=1788914524569&cv=11&fst=1788912000000&bg=ffffff&guid=ON&async=1&gtm=45be6930v897046975z8891172384za20gzb891172384zd891172384xea&gcd=13t3t3t3t5l1&dma=0&tcfd=10000&tag_exp=115938466~115938469~118131810~118897920~118897930~120213116~120385422~120469145~120469153~120914213&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.darkreading.com%2Fcyberattacks-data-breaches%2Fattackers-multi-hop-google-redirects-phishing-campaign&rcb=15&frm=0&tiba=Attackers%20Use%20Multi-Hop%20Google%20Redirects%20for%20Phishing&hn=www.googleadservices.com&npa=0&pscdl=noapi&auid=1481541718.1788914523&uaa=x86&uab=64&uafvl=Chromium%3B152.0.7977.82%7CGoogle%2520Chrome%3B152.0.7977.82%7CNot%253FA_Brand%3B24.0.0.0&uamb=0&uam=&uap=Linux&uapv=&uaw=0&_tu=CA&ept=9&rfmt=3&fmt=3&is_vtc=1&cid=CAQS4QEAQM4h3Hoc0wgUT31QQWTQW0mfAKdA8HiJg3c4pi2JqbfWFxFMECbt57ExXJK841k1QFQNF9UrF6seQNNUob-pAsPcuOBJtSlIw1G5A5V7gIsi0q3kGkhPfva9t5XEX_AfD7Dp_TlQByDgUtY2ku590aXa_tTy24pz9D-SHv-aWQ1eJvU7C54cPOVJegEgKgmG3GjVqlAc9-A5t80gbD0UzKGpE8bFEgK6LuJgxLChv_y8NvMBctAE8nm3YLp7FhQctQMrOHbFQN7Li5b05zO5TgElw1A6wx_gcZcVqTKNv7Y&random=936393913&rmt_tld=0&ipr=y
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/cyberattacks-data-breaches/attackers-multi-hop-google-redirects-phishing-campaign
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.154.119 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-security-policy
script-src 'none'; object-src 'none'
cache-control
no-cache, no-store, must-revalidate
timing-allow-origin
*
pragma
no-cache
cross-origin-resource-policy
cross-origin
x-content-type-options
nosniff
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length
42
date
Wed, 09 Sep 2026 00:42:05 GMT
x-xss-protection
0
content-type
image/gif
server
cafe
GET
H3
200
/
www.google.ca/pagead/1p-user-list/1023206053/
42 B
64 B
62ms
62ms
Image
image/gif
64.233.180.94
Google LLC
General
Full URL
https://www.google.ca/pagead/1p-user-list/1023206053/?random=1788914524569&cv=11&fst=1788912000000&bg=ffffff&guid=ON&async=1&gtm=45be6930v897046975z8891172384za20gzb891172384zd891172384xea&gcd=13t3t3t3t5l1&dma=0&tcfd=10000&tag_exp=115938466~115938469~118131810~118897920~118897930~120213116~120385422~120469145~120469153~120914213&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.darkreading.com%2Fcyberattacks-data-breaches%2Fattackers-multi-hop-google-redirects-phishing-campaign&rcb=15&frm=0&tiba=Attackers%20Use%20Multi-Hop%20Google%20Redirects%20for%20Phishing&hn=www.googleadservices.com&npa=0&pscdl=noapi&auid=1481541718.1788914523&uaa=x86&uab=64&uafvl=Chromium%3B152.0.7977.82%7CGoogle%2520Chrome%3B152.0.7977.82%7CNot%253FA_Brand%3B24.0.0.0&uamb=0&uam=&uap=Linux&uapv=&uaw=0&_tu=CA&ept=9&rfmt=3&fmt=3&is_vtc=1&cid=CAQS4QEAQM4h3Hoc0wgUT31QQWTQW0mfAKdA8HiJg3c4pi2JqbfWFxFMECbt57ExXJK841k1QFQNF9UrF6seQNNUob-pAsPcuOBJtSlIw1G5A5V7gIsi0q3kGkhPfva9t5XEX_AfD7Dp_TlQByDgUtY2ku590aXa_tTy24pz9D-SHv-aWQ1eJvU7C54cPOVJegEgKgmG3GjVqlAc9-A5t80gbD0UzKGpE8bFEgK6LuJgxLChv_y8NvMBctAE8nm3YLp7FhQctQMrOHbFQN7Li5b05zO5TgElw1A6wx_gcZcVqTKNv7Y&random=936393913&rmt_tld=1&ipr=y
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/cyberattacks-data-breaches/attackers-multi-hop-google-redirects-phishing-campaign
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
64.233.180.94 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
on-in-f94.1e100.net
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-security-policy
script-src 'none'; object-src 'none'
cache-control
no-cache, no-store, must-revalidate
timing-allow-origin
*
pragma
no-cache
cross-origin-resource-policy
cross-origin
x-content-type-options
nosniff
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length
42
date
Wed, 09 Sep 2026 00:42:05 GMT
x-xss-protection
0
content-type
image/gif
server
cafe
GET
H3
200
view
securepubads.g.doubleclick.net/pcs/ Frame 04A9
0
26 B
73ms
72ms
Image
image/gif
142.251.211.130
Google LLC
General
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsuZ2BeYQjaa3SGHz19B8PFQXgb8mpwB5AVUTOdtJ44StQGJ3uAePhGnJsEx5Hdpyki-Pgp7VE8E89TsFONBmxStc3iVBqkHflClO3-ZW9rA5iyS62ps-1G8g4TzAhf62DByA2k0SLqV_ys2gmBzI22Q0GaptAv4V6TuixIi_Hyx4hvAfU312UTu5I-f1aeZfgewXlU0XMWf6DglN0YK7ZUTVqF7TLGhOtMcozzQ77rHTbYL_Cx2CtsvjPCdbWx2d1kaAGbJ0pq0iX9Cetu_bZZmPcNBPqPjlhZ36MRYm9UmxSy-mVmVtW-Cx_2NeJFytaWu1GyQEQrBCkzNa7z3e4JXZrY5gd2ya7XRMjlHWJ2cMJh2Yh9278WGofN-63XtanGMPvcqr0cXMxCuLvD07Eq44vYSkMA9YSL8is5tezeKqk9_K-MBZRj-c5wlsHtiZQHpVMhhOEaUgLnyOXn6ezID-zpt5_0&sai=AMfl-YQxqe9YFE-C6qXl6cbYQ_NRRXY0ePyB7uBGlWp3PxPgo17-xa6-R3rnP2_gU4jgHQBSK-ktPZLfS9ko6v3ipI4n50sGB1wctBHKx3kCK576pGocpZOLwh6HUhI4NcoG5Xe0ucQ6XuxJFOSBqisbjewy6y1hUw7zRqpGXefBsV-wx0F1WCz5HxGobar2LBrGY7rD34uWkCulMsAz58BnjA4zdFVe0NvrjSA8NMpgR2z2h0KOIVH8dkHsaTzZNdrVD5xOvhptsMyd1ImN5Se8isMeZmBpY2OpLMbXi6ltudWaaHCsyO5o87MCulNPFgE0S1u7vuodTY4vvqOo1HIAkLJIqzUXq2M36qQPHuj0P7dWCueAk1tk_FOl8HYjORds5IHye2QUcaKntvE&sig=Cg0ArKJSzKtYjV8FFm9NEAE&uach_m=%5BUACH%5D&urlfix=1&adurl=
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/cyberattacks-data-breaches/attackers-multi-hop-google-redirects-phishing-campaign
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.211.130 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
lclgaa-au-in-f2.1e100.net
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

cache-control
private
timing-allow-origin
*
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
cross-origin-resource-policy
cross-origin
x-content-type-options
nosniff
access-control-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length
0
date
Wed, 09 Sep 2026 00:42:05 GMT
x-xss-protection
0
content-type
image/gif
server
cafe
GET
H2
200
7560865333346888068
tpc.googlesyndication.com/simgad/
245 KB
246 KB
232ms
68ms
Image
image/png
142.250.31.132
Google LLC
General
Full URL
https://tpc.googlesyndication.com/simgad/7560865333346888068?
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/cyberattacks-data-breaches/attackers-multi-hop-google-redirects-phishing-campaign
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.31.132 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
bj-in-f132.1e100.net
Software
sffe /
Resource Hash
f736d0b75fdb9e7125a41f3b87b4141c702e1b252ba66a36d661a166e983e2f7
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

report-to
{"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
x-content-type-options
nosniff
expires
Thu, 09 Sep 2027 00:42:06 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
allow-fenced-frame-automatic-beacons
true
date
Wed, 09 Sep 2026 00:42:06 GMT
content-type
image/png
last-modified
Wed, 29 Jul 2026 15:42:31 GMT
cache-control
public, max-age=31536000
timing-allow-origin
*
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
access-control-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="content-ads-owners"
content-length
250892
x-xss-protection
0
server
sffe
OPTIONS
H2
204
LoaderJSConfigurations
gateway.bridged.media/Campaign/ Frame
0
0
141ms
139ms
Preflight
52.215.118.206
Amazon.com
General
Full URL
https://gateway.bridged.media/Campaign/LoaderJSConfigurations
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
52.215.118.206 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-52-215-118-206.eu-west-1.compute.amazonaws.com
Software
/ Express
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type
Access-Control-Request-Method
POST
Origin
https://www.darkreading.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36

Response headers

access-control-allow-headers
content-type
access-control-allow-methods
GET,HEAD,PUT,PATCH,POST,DELETE
access-control-allow-origin
*
date
Wed, 09 Sep 2026 00:42:05 GMT
vary
Access-Control-Request-Headers
x-powered-by
Express
POST
H3
200
ed0 Show response
c.darkreading.com/com.iiris/
2 B
303 B
139ms
137ms
Fetch
text/plain
104.16.221.171
Cloudflare
General
Full URL
https://c.darkreading.com/com.iiris/ed0
Requested by
Host: transcend-cdn.com
URL: https://transcend-cdn.com/cm/ef49a3f1-d8c1-47d6-88fc-50e41130631f/airgap.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.16.221.171 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
content-type
application/json; charset=UTF-8
sec-ch-ua-mobile
?0

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
cf-cache-status
DYNAMIC
access-control-allow-credentials
true
cf-ray
a38226aacb8bab82-YYZ
access-control-allow-origin
https://www.darkreading.com
alt-svc
h3=":443"; ma=86400
content-length
2
server-timing
cfExtPri
date
Wed, 09 Sep 2026 00:42:06 GMT
content-type
text/plain
server
cloudflare
priority
u=1,i
POST
H3
204
/
vtrk.dv.tech/
0
198 B
93ms
60ms
Ping
text/plain
104.18.3.135
Cloudflare
General
Full URL
https://vtrk.dv.tech/?ec=dvtag&ea=ad-request&ctx=19913272&cmp=DV424940&cd111=success&cm106=0&cm107=490&cd112=modern&cd115=0&cm116=1&cm108=136&cm109=8&cm110=52&cm111=57&cm112=14&cm113=35014&cd102=b30b55d&cd103=&cd107=9bd90912-941c-4372-aed8-f37dc1c8c47e&cd109=modern&cd200=com&cd108=&cd105=19913272&cd106=DV424940&cd104=www.darkreading.com&cd199=https%3A%2F%2Fdarkreading.com%2Fcyberattacks-data-breaches%2Fattackers-multi-hop-google-redirects-phishing-campaign&cd101=ad-request&cm101=1&cid=f7ec5621-ac23-46ae-a7ff-7482c6c15ba6&t=event&v=1&z=f7ec5621-ac23-46ae-a7ff-7482c6c15ba6&cd160=f7ec5621-ac23-46ae-a7ff-7482c6c15ba6
Requested by
Host: transcend-cdn.com
URL: https://transcend-cdn.com/cm/ef49a3f1-d8c1-47d6-88fc-50e41130631f/airgap.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.18.3.135 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

cache-control
no-cache
access-control-allow-credentials
true
access-control-allow-methods
GET, POST, OPTIONS
cf-ray
a38226ab8c663704-YYZ
access-control-allow-origin
https://www.darkreading.com
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Wed, 09 Sep 2026 00:42:06 GMT
server
cloudflare
priority
u=4,i
GET
H3
200
ads Show response
securepubads.g.doubleclick.net/gampad/
88 KB
22 KB
118ms
117ms
Fetch
text/plain
142.251.211.130
Google LLC
General
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?pvsid=2307685289986646&correlator=481576575132918&eid=122880806%2C122880910%2C122880938%2C31099902%2C122880906&output=ldjh&gdfp_req=1&vrg=202609030101&ptt=17&impl=fif&gdpr=0&iu_parts=3618%2Cdarkreading.home%2Carticle%2Ccyberattacks-data-breaches&enc_prev_ius=%2F0%2F1%2F2%2F3&prev_iu_szs=320x50%7C600x250%7C728x90%7C970x90%7C970x250%7C1x1&fluid=height&ifi=7&dids=728_1v&adfs=1913955575&sfv=1-0-45&sc=1&cookie=ID%3Dd098e5690a7f8a0a%3AT%3D1788914524%3ART%3D1788914524%3AS%3DALNI_MbBjcnRDlV0FQ3jp-_O-_xFQQZODw&gpic=UID%3D000014f605764996%3AT%3D1788914524%3ART%3D1788914524%3AS%3DALNI_MYRK3NiUN0RrY3KpeXHBTOd-ck5eA&abxe=1&dt=1788914525955&lmt=1788904724&adxs=500&adys=251&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=7&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-420&dmc=32&bc=31&nvt=1&uach=WyJMaW51eCIsIiIsIng4NiIsIiIsIjE1Mi4wLjc5NzcuODIiLG51bGwsMCxudWxsLCI2NCIsW1siQ2hyb21pdW0iLCIxNTIuMC43OTc3LjgyIl0sWyJHb29nbGUgQ2hyb21lIiwiMTUyLjAuNzk3Ny44MiJdLFsiTm90P0FfQnJhbmQiLCIyNC4wLjAuMCJdXSwwXQ..&url=https%3A%2F%2Fwww.darkreading.com%2Fcyberattacks-data-breaches%2Fattackers-multi-hop-google-redirects-phishing-campaign&vis=1&psz=1036x5163&msz=1036x0&fws=0&ohw=0&psts=AOrYGsn0EZ60o5-h7UF-6-AXFMiixyGzVcFZUQqtZ-c9tSpnvjb8HgNuMMrrYaQKCP9W9ziGFmSXhmiGhbRCTVSjh6kx4Cx2-tqxu4rNq32x_3wrTXGrFL_nfg%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslVf6Fcp-PcyRAsjwNT7PQZFcksiuxRrLLqRyCkQBPIJiSMIZJVBWtNVuNSbfRduA3yjsSkIxDZaZ-kwinvwFaed1atxWGMUZUHdsnIwG8-xM-5obdx5F67Qfel1YUr%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a&dlt=1788914520195&idt=2604&prev_scp=nid%3Dbltb2aaea610dd27216%26aid%3D904353%26reg%3Danonymous%26kw%3D%26ptype%3Darticle%26pos%3D728_1v%26dvpub_ot_params%3D__DVPUB_OT__m%253A0%257C_dvp_uptpid%253A9bd90912%25252d941c%25252d4372%25252daed8%25252df37dc1c8c47e%257C_dvp_uptsid%253Ae3da704f%25252d167f%25252d431e%25252da509%25252d02085079738b%257C_dvp_uptsacnt%253A1%257C_dvp_qtpid%253A9bd90912%25252d941c%25252d4372%25252daed8%25252df37dc1c8c47e%26dv_upt_cwm%3D0%26dv__dvp_uptpid%3D9bd90912-941c-4372-aed8-f37dc1c8c47e%26dv__dvp_uptsid%3De3da704f-167f-431e-a509-02085079738b%26dv__dvp_uptsacnt%3D1%26dv__dvp_qtpid%3D9bd90912-941c-4372-aed8-f37dc1c8c47e%26pts_pid%3D9bd90912-941c-4372-aed8-f37dc1c8c47e%26pts_sid%3De3da704f-167f-431e-a509-02085079738b%26VLP%3D10%2C728x90_10%2C300x50_7%26qt_loaded%3Dbsc%2Cids%2Cvlp&cust_params=pterm%3Dcyberattacks-data-breaches%26sterm%3Ddata-privacy%252Cthreat-intelligence%252Cremote-workforce%26contentFormat%3Dnews%26contributor%3Dalexander-culafi%26isSponsored%3Dfalse%26gatedWithExternalForm%3Dfalse%26gatedWithSiteReg%3Dfalse%26paidGating%3Dfalse%26hideAds%3Dfalse%26ppc%3D0%26gdpr_banner%3Don%26BSC%3D87012038%252C84031001%252C74332595%252C74332596%252C74041059%252C80023001%252C74041060%252C74331564%252C74331570%252C80222006%252C74331567%252C74041087%252C74041097%252C74331587%252C80122006%252C74042114%252C74332568%252C84241001%252C74042083%252C74042128%252C74332586%26qt_loaded%3Dbsc%252Cids%26IDS%3D0&adks=47114165&frm=20&eo_id_str=ID%3D6bc0898c46326738%3AT%3D1788914524%3ART%3D1788914524%3AS%3DAA-AfjY3yrpbbzLi__jOqx52mGU8&pgls=CAk.
Requested by
Host: transcend-cdn.com
URL: https://transcend-cdn.com/cm/ef49a3f1-d8c1-47d6-88fc-50e41130631f/airgap.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.211.130 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
lclgaa-au-in-f2.1e100.net
Software
cafe /
Resource Hash
5478ce9216dacdf3231b370c55a0f57683789f2681f6b9b4ab2c811aa8b42028
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
br
google-lineitem-id
7384623559
x-content-type-options
nosniff
google-mediationtag-id
-2
google-mediationgroup-id
-2
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date
Wed, 09 Sep 2026 00:42:06 GMT
content-type
text/plain; charset=UTF-8
google-creative-id
138568952004
cache-control
no-cache, must-revalidate
timing-allow-origin
*
pragma
no-cache
cross-origin-resource-policy
cross-origin
access-control-allow-credentials
true
access-control-allow-origin
https://www.darkreading.com
content-length
22268
x-xss-protection
0
server
cafe
GET
H3
200
ads Show response
securepubads.g.doubleclick.net/gampad/
32 KB
15 KB
127ms
126ms
Fetch
text/plain
142.251.211.130
Google LLC
General
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?pvsid=2307685289986646&correlator=481576575132918&eid=122880806%2C122880910%2C122880938%2C31099902%2C122880906&output=ldjh&gdfp_req=1&vrg=202609030101&ptt=17&impl=fif&gdpr=0&iu_parts=3618%2Cdarkreading.home%2Carticle%2Ccyberattacks-data-breaches&enc_prev_ius=%2F0%2F1%2F2%2F3&prev_iu_szs=5x5&ifi=8&dids=resource_v&adfs=651338770&sfv=1-0-45&sc=1&cookie=ID%3Dd098e5690a7f8a0a%3AT%3D1788914524%3ART%3D1788914524%3AS%3DALNI_MbBjcnRDlV0FQ3jp-_O-_xFQQZODw&gpic=UID%3D000014f605764996%3AT%3D1788914524%3ART%3D1788914524%3AS%3DALNI_MYRK3NiUN0RrY3KpeXHBTOd-ck5eA&abxe=1&dt=1788914525960&lmt=1788904724&adxs=1154&adys=536&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=8&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-420&dmc=32&bc=31&nvt=1&uach=WyJMaW51eCIsIiIsIng4NiIsIiIsIjE1Mi4wLjc5NzcuODIiLG51bGwsMCxudWxsLCI2NCIsW1siQ2hyb21pdW0iLCIxNTIuMC43OTc3LjgyIl0sWyJHb29nbGUgQ2hyb21lIiwiMTUyLjAuNzk3Ny44MiJdLFsiTm90P0FfQnJhbmQiLCIyNC4wLjAuMCJdXSwwXQ..&url=https%3A%2F%2Fwww.darkreading.com%2Fcyberattacks-data-breaches%2Fattackers-multi-hop-google-redirects-phishing-campaign&vis=1&psz=324x32&msz=324x0&fws=0&ohw=0&psts=AOrYGsn0EZ60o5-h7UF-6-AXFMiixyGzVcFZUQqtZ-c9tSpnvjb8HgNuMMrrYaQKCP9W9ziGFmSXhmiGhbRCTVSjh6kx4Cx2-tqxu4rNq32x_3wrTXGrFL_nfg%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslVf6Fcp-PcyRAsjwNT7PQZFcksiuxRrLLqRyCkQBPIJiSMIZJVBWtNVuNSbfRduA3yjsSkIxDZaZ-kwinvwFaed1atxWGMUZUHdsnIwG8-xM-5obdx5F67Qfel1YUr%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a&dlt=1788914520195&idt=2604&prev_scp=nid%3Dbltb2aaea610dd27216%26aid%3D904353%26reg%3Danonymous%26kw%3D%26ptype%3Darticle%26pos%3Dresource_v%26dvpub_ot_params%3D__DVPUB_OT__m%253A0%257C_dvp_uptpid%253A9bd90912%25252d941c%25252d4372%25252daed8%25252df37dc1c8c47e%257C_dvp_uptsid%253A7f2ad076%25252d2ad1%25252d4480%25252db0f0%25252d1f764ac919da%257C_dvp_uptsacnt%253A1%257C_dvp_qtpid%253A9bd90912%25252d941c%25252d4372%25252daed8%25252df37dc1c8c47e%26dv_upt_cwm%3D0%26dv__dvp_uptpid%3D9bd90912-941c-4372-aed8-f37dc1c8c47e%26dv__dvp_uptsid%3D7f2ad076-2ad1-4480-b0f0-1f764ac919da%26dv__dvp_uptsacnt%3D1%26dv__dvp_qtpid%3D9bd90912-941c-4372-aed8-f37dc1c8c47e%26pts_pid%3D9bd90912-941c-4372-aed8-f37dc1c8c47e%26pts_sid%3D7f2ad076-2ad1-4480-b0f0-1f764ac919da%26VLP%3D7%2C5x5_7%26qt_loaded%3Dbsc%2Cids%2Cvlp&cust_params=pterm%3Dcyberattacks-data-breaches%26sterm%3Ddata-privacy%252Cthreat-intelligence%252Cremote-workforce%26contentFormat%3Dnews%26contributor%3Dalexander-culafi%26isSponsored%3Dfalse%26gatedWithExternalForm%3Dfalse%26gatedWithSiteReg%3Dfalse%26paidGating%3Dfalse%26hideAds%3Dfalse%26ppc%3D0%26gdpr_banner%3Don%26BSC%3D87012038%252C84031001%252C74332595%252C74332596%252C74041059%252C80023001%252C74041060%252C74331564%252C74331570%252C80222006%252C74331567%252C74041087%252C74041097%252C74331587%252C80122006%252C74042114%252C74332568%252C84241001%252C74042083%252C74042128%252C74332586%26qt_loaded%3Dbsc%252Cids%26IDS%3D0&adks=2262611008&frm=20&eo_id_str=ID%3D6bc0898c46326738%3AT%3D1788914524%3ART%3D1788914524%3AS%3DAA-AfjY3yrpbbzLi__jOqx52mGU8&pgls=CAk.
Requested by
Host: transcend-cdn.com
URL: https://transcend-cdn.com/cm/ef49a3f1-d8c1-47d6-88fc-50e41130631f/airgap.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.211.130 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
lclgaa-au-in-f2.1e100.net
Software
cafe /
Resource Hash
572da84006213adaf93733d624dd4cbcef755e07f36c61a20b4b7f9feaac7ae2
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
br
google-lineitem-id
7129991679
x-content-type-options
nosniff
google-mediationtag-id
-2
google-mediationgroup-id
-2
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date
Wed, 09 Sep 2026 00:42:06 GMT
content-type
text/plain; charset=UTF-8
google-creative-id
138568043700
cache-control
no-cache, must-revalidate
timing-allow-origin
*
pragma
no-cache
cross-origin-resource-policy
cross-origin
access-control-allow-credentials
true
access-control-allow-origin
https://www.darkreading.com
content-length
15353
x-xss-protection
0
server
cafe
GET
H3
200
ads Show response
securepubads.g.doubleclick.net/gampad/
88 KB
22 KB
134ms
133ms
Fetch
text/plain
142.251.211.130
Google LLC
General
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?pvsid=2307685289986646&correlator=481576575132918&eid=122880806%2C122880910%2C122880938%2C31099902%2C122880906&output=ldjh&gdfp_req=1&vrg=202609030101&ptt=17&impl=fif&gdpr=0&iu_parts=3618%2Cdarkreading.home%2Carticle%2Ccyberattacks-data-breaches&enc_prev_ius=%2F0%2F1%2F2%2F3&prev_iu_szs=300x100%7C300x250%7C300x600&ifi=9&dids=300_1v&adfs=3435265992&sfv=1-0-45&sc=1&cookie=ID%3Dd098e5690a7f8a0a%3AT%3D1788914524%3ART%3D1788914524%3AS%3DALNI_MbBjcnRDlV0FQ3jp-_O-_xFQQZODw&gpic=UID%3D000014f605764996%3AT%3D1788914524%3ART%3D1788914524%3AS%3DALNI_MYRK3NiUN0RrY3KpeXHBTOd-ck5eA&abxe=1&dt=1788914525965&lmt=1788904724&adxs=1006&adys=568&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=9&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=-420&dmc=32&bc=31&nvt=1&uach=WyJMaW51eCIsIiIsIng4NiIsIiIsIjE1Mi4wLjc5NzcuODIiLG51bGwsMCxudWxsLCI2NCIsW1siQ2hyb21pdW0iLCIxNTIuMC43OTc3LjgyIl0sWyJHb29nbGUgQ2hyb21lIiwiMTUyLjAuNzk3Ny44MiJdLFsiTm90P0FfQnJhbmQiLCIyNC4wLjAuMCJdXSwwXQ..&url=https%3A%2F%2Fwww.darkreading.com%2Fcyberattacks-data-breaches%2Fattackers-multi-hop-google-redirects-phishing-campaign&vis=1&psz=324x4798&msz=324x0&fws=0&ohw=0&psts=AOrYGsn0EZ60o5-h7UF-6-AXFMiixyGzVcFZUQqtZ-c9tSpnvjb8HgNuMMrrYaQKCP9W9ziGFmSXhmiGhbRCTVSjh6kx4Cx2-tqxu4rNq32x_3wrTXGrFL_nfg%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslVf6Fcp-PcyRAsjwNT7PQZFcksiuxRrLLqRyCkQBPIJiSMIZJVBWtNVuNSbfRduA3yjsSkIxDZaZ-kwinvwFaed1atxWGMUZUHdsnIwG8-xM-5obdx5F67Qfel1YUr%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a%2CAOrYGslXqzWxZnMwa10HhsoG5C0a&dlt=1788914520195&idt=2604&prev_scp=nid%3Dbltb2aaea610dd27216%26aid%3D904353%26reg%3Danonymous%26kw%3D%26ptype%3Darticle%26pos%3D300_1v%26dvpub_ot_params%3D__DVPUB_OT__m%253A0%257C_dvp_uptpid%253A9bd90912%25252d941c%25252d4372%25252daed8%25252df37dc1c8c47e%257C_dvp_uptsid%253A9f4f7ecd%25252d62d4%25252d4eec%25252d8905%25252db0868f668e99%257C_dvp_uptsacnt%253A1%257C_dvp_qtpid%253A9bd90912%25252d941c%25252d4372%25252daed8%25252df37dc1c8c47e%26dv_upt_cwm%3D0%26dv__dvp_uptpid%3D9bd90912-941c-4372-aed8-f37dc1c8c47e%26dv__dvp_uptsid%3D9f4f7ecd-62d4-4eec-8905-b0868f668e99%26dv__dvp_uptsacnt%3D1%26dv__dvp_qtpid%3D9bd90912-941c-4372-aed8-f37dc1c8c47e%26pts_pid%3D9bd90912-941c-4372-aed8-f37dc1c8c47e%26pts_sid%3D9f4f7ecd-62d4-4eec-8905-b0868f668e99%26VLP%3D7%2C300x250_7%26qt_loaded%3Dbsc%2Cids%2Cvlp&cust_params=pterm%3Dcyberattacks-data-breaches%26sterm%3Ddata-privacy%252Cthreat-intelligence%252Cremote-workforce%26contentFormat%3Dnews%26contributor%3Dalexander-culafi%26isSponsored%3Dfalse%26gatedWithExternalForm%3Dfalse%26gatedWithSiteReg%3Dfalse%26paidGating%3Dfalse%26hideAds%3Dfalse%26ppc%3D0%26gdpr_banner%3Don%26BSC%3D87012038%252C84031001%252C74332595%252C74332596%252C74041059%252C80023001%252C74041060%252C74331564%252C74331570%252C80222006%252C74331567%252C74041087%252C74041097%252C74331587%252C80122006%252C74042114%252C74332568%252C84241001%252C74042083%252C74042128%252C74332586%26qt_loaded%3Dbsc%252Cids%26IDS%3D0&adks=2557702780&frm=20&eo_id_str=ID%3D6bc0898c46326738%3AT%3D1788914524%3ART%3D1788914524%3AS%3DAA-AfjY3yrpbbzLi__jOqx52mGU8&pgls=CAk.
Requested by
Host: transcend-cdn.com
URL: https://transcend-cdn.com/cm/ef49a3f1-d8c1-47d6-88fc-50e41130631f/airgap.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.211.130 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
lclgaa-au-in-f2.1e100.net
Software
cafe /
Resource Hash
8c797d2ea9a03061a4fccdf6b1f2ac81dff405bd978007df1907ed59eb323ca4
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
br
google-lineitem-id
7384623559
x-content-type-options
nosniff
google-mediationtag-id
-2
google-mediationgroup-id
-2
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
date
Wed, 09 Sep 2026 00:42:06 GMT
content-type
text/plain; charset=UTF-8
google-creative-id
138572238837
cache-control
no-cache, must-revalidate
timing-allow-origin
*
pragma
no-cache
cross-origin-resource-policy
cross-origin
access-control-allow-credentials
true
access-control-allow-origin
https://www.darkreading.com
content-length
22259
x-xss-protection
0
server
cafe
GET
H2
200
impl_v106.js Show response
www.googletagservices.com/dcm/ Frame 336B
69 KB
26 KB
53ms
51ms
Script
text/javascript
142.251.163.155
Google LLC
General
Full URL
https://www.googletagservices.com/dcm/impl_v106.js
Requested by
Host: transcend-cdn.com
URL: https://transcend-cdn.com/cm/ef49a3f1-d8c1-47d6-88fc-50e41130631f/airgap.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.251.163.155 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
wv-in-f155.1e100.net
Software
sffe /
Resource Hash
f401201bf19e9fe9542fc5261acc0535464e8988438001c62c289d5c16004ec1
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
gzip
age
102458
report-to
{"group":"ads-dcm-tag","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-dcm-tag"}]}
x-content-type-options
nosniff
expires
Tue, 07 Sep 2027 20:14:28 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Mon, 07 Sep 2026 20:14:28 GMT
last-modified
Mon, 28 Apr 2025 15:28:15 GMT
content-type
text/javascript
vary
Accept-Encoding
cache-control
public, max-age=31536000
cross-origin-opener-policy
same-origin; report-to="ads-dcm-tag"
cross-origin-resource-policy
cross-origin
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-dcm-tag
accept-ranges
bytes
content-length
26861
x-xss-protection
0
server
sffe
GET
H/1.1
200
OK
dv-measurements10456.js Show response
cdn.doubleverify.com/ Frame F9C5
482 KB
96 KB
73ms
73ms
Script
text/javascript
23.210.73.49
AKAMAI-ASN1 Akama...
General
Full URL
https://cdn.doubleverify.com/dv-measurements10456.js
Requested by
Host: transcend-cdn.com
URL: https://transcend-cdn.com/cm/ef49a3f1-d8c1-47d6-88fc-50e41130631f/airgap.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
23.210.73.49 Secaucus, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),
Reverse DNS
a23-210-73-49.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
2f7d151682e4657b099b86a53e3314931c9a560fb9f889d7b1a63db730fa705d

Request headers

sec-ch-ua-platform
"Linux"
Referer
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

Access-Control-Expose-Headers
*
Cache-Control
max-age=31536000
Content-Encoding
br
ETag
"5f0ff395d23840dfbdfa6555d7dc5b94"
Connection
keep-alive
Expires
Thu, 09 Sep 2027 00:42:06 GMT
Accept-Ranges
bytes
Access-Control-Allow-Origin
*
Content-Length
97551
Date
Wed, 09 Sep 2026 00:42:06 GMT
Last-Modified
Tue, 08 Sep 2026 05:45:35 GMT
Content-Type
text/javascript
GET
H/1.1
200
OK
dv-measurements10456.js Show response
cdn.doubleverify.com/ Frame C119
482 KB
0
52ms
52ms
Script
text/javascript
23.210.73.49
AKAMAI-ASN1 Akama...
General
Full URL
https://cdn.doubleverify.com/dv-measurements10456.js
Requested by
Host: transcend-cdn.com
URL: https://transcend-cdn.com/cm/ef49a3f1-d8c1-47d6-88fc-50e41130631f/airgap.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
23.210.73.49 Secaucus, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),
Reverse DNS
a23-210-73-49.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
2f7d151682e4657b099b86a53e3314931c9a560fb9f889d7b1a63db730fa705d

Request headers

sec-ch-ua-platform
"Linux"
Referer
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

Access-Control-Expose-Headers
*
Cache-Control
max-age=31536000
Content-Encoding
br
ETag
"5f0ff395d23840dfbdfa6555d7dc5b94"
Expires
Thu, 09 Sep 2027 00:42:06 GMT
Accept-Ranges
bytes
Access-Control-Allow-Origin
*
Content-Length
97551
Date
Wed, 09 Sep 2026 00:42:06 GMT
Last-Modified
Tue, 08 Sep 2026 05:45:35 GMT
Content-Type
text/javascript
POST
H/1.1
204
No Content
collect Show response
e.clarity.ms/
0
283 B
181ms
51ms
XHR
text/plain
20.57.85.160
Microsoft Corpora...
General
Full URL
https://e.clarity.ms/collect
Requested by
Host: transcend-cdn.com
URL: https://transcend-cdn.com/cm/ef49a3f1-d8c1-47d6-88fc-50e41130631f/airgap.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
20.57.85.160 Boydton, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
Accept
application/x-clarity-gzip
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

Request-Context
appId=cid-v1:a449a586-8786-487f-a449-dc1b282a2628
Access-Control-Allow-Origin
https://www.darkreading.com
Date
Wed, 09 Sep 2026 00:42:06 GMT
Vary
Origin
Server
nginx
Connection
keep-alive
Access-Control-Allow-Credentials
true
GET
H3
200
__manifest Show response
www.darkreading.com/
7 KB
1 KB
38ms
34ms
Fetch
application/json
104.16.224.171
Cloudflare
General
Full URL
https://www.darkreading.com/__manifest?paths=%2Fauthor%2C%2Fauthor%2Fkristinabeek%2C%2Fcybersecurity-operations%2C%2Fcybersecurity-operations%2Fmission-driven-security-inside-global-bank-defense&version=5ef1aa63
Requested by
Host: transcend-cdn.com
URL: https://transcend-cdn.com/cm/ef49a3f1-d8c1-47d6-88fc-50e41130631f/airgap.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.16.224.171 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
efe0e0816748816f1d2cde2df3342b918136d4bc639938f57bffd8dfec12dd7c
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.darkreading.com/cyberattacks-data-breaches/attackers-multi-hop-google-redirects-phishing-campaign
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0
newrelic
eyJ2IjpbMCwxXSwiZCI6eyJ0eSI6IkJyb3dzZXIiLCJhYyI6IjM5MzYzNDgiLCJhcCI6IjUzODYwMDE5OSIsImlkIjoiYjkzOTA0YzA5NWIzMDYxZiIsInRyIjoiNjE2MDk5ZDNmNDZiZDk3ZDBkZTE4ZTRlZjUyN2Y0NTgiLCJ0aSI6MTc4ODkxNDUyNjA1NywidGsiOiIzMjg4OTI1In19
traceparent
00-616099d3f46bd97d0de18e4ef527f458-b93904c095b3061f-01
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
tracestate
3288925@nr=0-1-3936348-538600199-b93904c095b3061f----1788914526057

Response headers

strict-transport-security
max-age=15552000; includeSubDomains; preload
cache-control
public, max-age=31536000, immutable
content-encoding
br
cf-cache-status
HIT
age
386656
x-content-type-options
nosniff
last-modified
Fri, 04 Sep 2026 13:17:50 GMT
cf-ray
a38226abfea6ebbc-YYZ
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Wed, 09 Sep 2026 00:42:06 GMT
content-type
application/json; charset=utf-8
vary
Accept-Encoding
server
cloudflare
priority
u=1,i
GET
H3
200
B35832278.447559437;dc_ver=106.314;dc_eid=40004000;sz=640x480;u_sd=1;gdpr=0;dc_adk=2473714756;ord=nz29w6;click=https%3A%2F%2Fadclick.g.doubleclick.net%2Fpcs%2Fclick%3Fxai%3DAKAOjsu-r5iDaHcuPdbO75bl... Show response
ad.doubleclick.net/ddm/adi/N520403.127711DARKREADING/ Frame CA48
73 KB
34 KB
135ms
90ms
Document
text/html
142.251.167.149
Google LLC
General
Full URL
https://ad.doubleclick.net/ddm/adi/N520403.127711DARKREADING/B35832278.447559437;dc_ver=106.314;dc_eid=40004000;sz=640x480;u_sd=1;gdpr=0;dc_adk=2473714756;ord=nz29w6;click=https%3A%2F%2Fadclick.g.doubleclick.net%2Fpcs%2Fclick%3Fxai%3DAKAOjsu-r5iDaHcuPdbO75blbSNj10vv8HZuM0G-x-GopfMJoPQDiR4QZrtyhRzf8KycizHcd3aYMSQ6x8l5AkSj-mMjSpvqsMjHeyc2u3XoeapYIHvR06j-bNAWQH-BgGUpgioH4agm-rzvfJfROoUfFzpEjCcumBHsFGfOYBwdUUgR_4JvirmONr0A4ul4H5eYue80xgNVAgfmR4GGsBdN1lVy2_dVK0RMvK8t9QyFHOXZVf2d_3HcAs_IMsvtrGwhUD2cSYlvyfU27vLVcUPaBJJebidor5Q2pDfe_Fp6EPh2CPZQ6FKfiHClOHJqZU337mVDGg9R_6o0Yz8pYp9QIaT4-R5zpit01mkeBhMGLYV4WVjxxxFqPTZxf6Vd47kZCPftSPErpOLG1f9vSiLyazcPBzSMVTsz9XMPM-0gtBmfeiPY7kIl7SXlLPHJf-NdcSmMyj0%26sai%3DAMfl-YQqNeQ13sZJ-MA8hCfcA1W_3rEbLfDDHwWvRBcc8fDkaweii5sDV650asp4plTiRm4UeOBBC_4BXTQFx-6EL6roOz0ssNKnwScKeCdu9SrXwbHsLPGPruf9cBcQFzvMFGH7ygh3Lyar8ZBYCc6ObFrsemd9GIFnSDsQwNBFJopA-dr-qdaZMIrIVMWY4jjfH1eqPPIEXrn_wmwl8KC2wdEBFXJkzBdXgXwkLO7IAYAEaXR6CiL5305o9pXjpuQFSMccflOwmbACFuaBOeuNxTNyD5fJcl-5nOoWH6DHJbFDXgFiRC2jGFnbkc-lFXQ_uIRum02olGphNLEt3GwBFqfjTgQ9kYmkXRghbQj7eexd663KHQDnEFUc0AIqw02BKw_hcBKhXo5kZAVB%26sig%3DCg0ArKJSzGM8Rb0FbSVIEAE%26fbs_aeid%3D%255Bgw_fbsaeid%255D%26urlfix%3D1%26adurl%3D;uach=WyJMaW51eCIsIiIsIng4NiIsIiIsIjE1Mi4wLjc5NzcuODIiLG51bGwsMCxudWxsLCI2NCIsW1siQ2hyb21pdW0iLCIxNTIuMC43OTc3LjgyIl0sWyJHb29nbGUgQ2hyb21lIiwiMTUyLjAuNzk3Ny44MiJdLFsiTm90P0FfQnJhbmQiLCIyNC4wLjAuMCJdXSwwXQ..;dc_rfl=1,https%3A%2F%2Fwww.darkreading.com%2Fcyberattacks-data-breaches%2Fattackers-multi-hop-google-redirects-phishing-campaign$0;xdt=0;crlt=gwRwuG70(h;cmpl=8;gcsr=m;stc=1;chaa=1;sttr=87;prcl=s
Requested by
Host: transcend-cdn.com
URL: https://transcend-cdn.com/cm/ef49a3f1-d8c1-47d6-88fc-50e41130631f/airgap.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.167.149 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
ww-in-f149.1e100.net
Software
cafe /
Resource Hash
adb9a1a2e9e5ddcfb228ff9365a0254fe9f54202694a548a1701073badbd6013
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.darkreading.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0
sec-ch-ua-platform
"Linux"

Response headers

allow-fenced-frame-automatic-beacons
true
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
no-cache, must-revalidate
content-encoding
br
content-length
34735
content-type
text/html; charset=UTF-8
cross-origin-resource-policy
cross-origin
date
Wed, 09 Sep 2026 00:42:06 GMT
expires
Fri, 01 Jan 1990 00:00:00 GMT
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma
no-cache
server
cafe
timing-allow-origin
*
x-content-type-options
nosniff
x-xss-protection
0
GET
H3
200
view
securepubads.g.doubleclick.net/pcs/ Frame 336B
0
0
66ms
65ms
Fetch
image/gif
142.251.211.130
Google LLC
General
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstynowGHeHhaGwR3v_q88WVs886UdB02GCZycRndu09AGXGZfoU1mMSP0RqvzqkJt-jFSeKonzU__Utz4dLfqZSLrk3IfPvQgxx0Vq11L8jhKZo0cIxEARqr2q_OSuKXkbid1KNC2hu-4c4aFNvmNEqQxhiYpT5-D-qVxJ_XUWt7QHlqe1HnDcMn6d6EY25NBUZrigN5WJS0JsjRlXPvIxCrTz4m0eGUtk0ViAGbAN5XnzrdcYswfoKGEFvesUUPwXAgqpMmLPxUHZBPIFuJFNHemjdd4L1kPQxK7WhmWv_Zmw0cBKx6NVXKHivvhuv70A2oJxeP_5LWC5xCeCkZ7_VUk86t6QH_0lSTvZLYCq8wfMRLza_XuNI2LPIQ35hQ7F7dxFNoRjMPBQPg8iWsOwSZT8Z2hGI5pJ99lK93Gr_1V1qXn6ZP1GRKsl42g1--F3BpDkYNGf1KFjv6lcoLmLFnySUC1PrtA&sai=AMfl-YTqmBJ7Xz5o4Of_DJr7oXay44XRDX3zlwRYZBuE04P33wIFvQG-UyPEo8GOkGeT4XfNYiOya6I2W6WjPNLL6kHICZZDswAZVP3SWDhH3yi6mfmdg_hoObbpcka72hFSRefXl1bVweNCv1G7WXtVGpneNSJPwQgUL3pmeNWjoMTa_pwKl8TCICIGUQ8KfsyOgjbwSeCVqVbwemKu1n1JTa-Pt2lRj8naVJOgz2E8nrYytxWqolu6NO_kS-3ktRUuneSxVWlvFi8R2irkQ0IFDmw_msubKMpaCRBURYqpxS7XpgH0AfaEiX8X9pZzp-NZmGThMThUalWIPzCV6doTho3IpdPftNjkuKMSEa6xAbYUVj2tccWp0ouB1F9JVSE4a7TgHswl1vpSYeVY&sig=Cg0ArKJSzHuKAbkgciPQEAE&uach_m=%5BUACH%5D&urlfix=1&dett=3&adurl=
Requested by
Host: transcend-cdn.com
URL: https://transcend-cdn.com/cm/ef49a3f1-d8c1-47d6-88fc-50e41130631f/airgap.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.211.130 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
lclgaa-au-in-f2.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

cache-control
private
timing-allow-origin
*
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
cross-origin-resource-policy
cross-origin
x-content-type-options
nosniff
access-control-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length
0
date
Wed, 09 Sep 2026 00:42:06 GMT
x-xss-protection
0
content-type
image/gif
server
cafe
GET
H3
204
gen_204
pagead2.googlesyndication.com/pagead/ Frame 336B
0
0
51ms
50ms
Fetch
image/gif
64.233.180.155
Google LLC
General
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=fle-fetch-start2
Requested by
Host: transcend-cdn.com
URL: https://transcend-cdn.com/cm/ef49a3f1-d8c1-47d6-88fc-50e41130631f/airgap.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
64.233.180.155 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
on-in-f155.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

cache-control
no-cache, must-revalidate
timing-allow-origin
*
pragma
no-cache
cross-origin-resource-policy
cross-origin
x-content-type-options
nosniff
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length
0
date
Wed, 09 Sep 2026 00:42:06 GMT
x-xss-protection
0
content-type
image/gif
server
cafe
GET
H3
204
gen_204
pagead2.googlesyndication.com/pagead/ Frame 336B
0
0
51ms
51ms
Fetch
image/gif
64.233.180.155
Google LLC
General
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=colleague-executed&name=4
Requested by
Host: transcend-cdn.com
URL: https://transcend-cdn.com/cm/ef49a3f1-d8c1-47d6-88fc-50e41130631f/airgap.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
64.233.180.155 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
on-in-f155.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

cache-control
no-cache, must-revalidate
timing-allow-origin
*
pragma
no-cache
cross-origin-resource-policy
cross-origin
x-content-type-options
nosniff
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length
0
date
Wed, 09 Sep 2026 00:42:06 GMT
x-xss-protection
0
content-type
image/gif
server
cafe
GET
H3
200
/
www.darkreading.com/ Frame 336B
Redirect Chain
  • https://www.darkreading.com/sites/all/themes/penton_core_theme/images/ContentPillar_Welcome_1200.png
  • https://www.darkreading.com/
469 KB
469 KB
54ms
53ms
Image
text/html
104.16.224.171
Cloudflare
General
Full URL
https://www.darkreading.com/
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/cyberattacks-data-breaches/attackers-multi-hop-google-redirects-phishing-campaign
Protocol
H3
Server
104.16.224.171 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
2d4340865e72e84bdb264683f555a553c91dae343f941e6a368af27ce8c0fb35
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
Referer
https://www.darkreading.com/cyberattacks-data-breaches/attackers-multi-hop-google-redirects-phishing-campaign

Response headers

strict-transport-security
max-age=15552000; includeSubDomains; preload
cache-control
public, max-age=300, s-maxage=86400, must-revalidate, stale-if-error=864000
content-encoding
br
cf-cache-status
HIT
age
9749
x-content-type-options
nosniff
cf-ray
a38226adac44ebbc-YYZ
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Wed, 09 Sep 2026 00:42:06 GMT
content-type
text/html; charset=utf-8
last-modified
Tue, 08 Sep 2026 21:59:36 GMT
server
cloudflare
priority
u=1,i
vary
Accept-Encoding

Redirect headers

strict-transport-security
max-age=15552000; includeSubDomains; preload
cache-control
public, max-age=300
location
https://www.darkreading.com/
cf-cache-status
EXPIRED
cf-redirect-engine
performing
x-content-type-options
nosniff
cf-ray
a38226ac8899ebbc-YYZ
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
content-length
0
date
Wed, 09 Sep 2026 00:42:06 GMT
content-type
text/plain;charset=UTF-8
vary
accept-encoding
server
cloudflare
priority
u=3,i
GET
H3
200
reach_worklet.html Show response
www.googleadservices.com/pagead/managed/js/activeview/current/ Frame 140A
93 B
93 B
134ms
59ms
Document
text/html
142.251.167.157
Google LLC
General
Full URL
https://www.googleadservices.com/pagead/managed/js/activeview/current/reach_worklet.html
Requested by
Host: transcend-cdn.com
URL: https://transcend-cdn.com/cm/ef49a3f1-d8c1-47d6-88fc-50e41130631f/airgap.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.167.157 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
ww-in-f157.1e100.net
Software
cafe /
Resource Hash
136b3dfa7c254f92a9a3513c191c87c05f7c7ff7f82c6d648a33496c3c380593
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.darkreading.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0
sec-ch-ua-platform
"Linux"

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
private, max-age=3600, stale-while-revalidate=3600
content-encoding
br
content-length
69
content-type
text/html; charset=UTF-8
cross-origin-resource-policy
cross-origin
date
Wed, 09 Sep 2026 00:42:06 GMT
etag
9658810392779322030
expires
Wed, 09 Sep 2026 00:42:06 GMT
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server
cafe
timing-allow-origin
*
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
0
GET
H/1.1
200
OK
dvtp_src.js Show response
cdn.doubleverify.com/ Frame 336B
9 KB
0
198ms
198ms
Script
text/javascript
23.210.73.49
AKAMAI-ASN1 Akama...
General
Full URL
https://cdn.doubleverify.com/dvtp_src.js
Requested by
Host: transcend-cdn.com
URL: https://transcend-cdn.com/cm/ef49a3f1-d8c1-47d6-88fc-50e41130631f/airgap.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
23.210.73.49 Secaucus, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),
Reverse DNS
a23-210-73-49.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
f78fa5032699676674f8888c09692d2c3fd210abde09e964fed1a97c2ed94549

Request headers

Referer
https://www.darkreading.com/

Response headers

Access-Control-Expose-Headers
*
Cache-Control
max-age=3600
Content-Encoding
br
ETag
"9262973c7265bf021a0eb34db8628a8c"
Expires
Wed, 09 Sep 2026 01:42:05 GMT
Accept-Ranges
bytes
Access-Control-Allow-Origin
*
Content-Length
3510
Date
Wed, 09 Sep 2026 00:42:05 GMT
Content-Type
text/javascript
Last-Modified
Tue, 08 Sep 2026 10:12:43 GMT
HEAD
H2
200
/ Show response
ping.channel99.io/ Frame 336B
0
355 B
147ms
69ms
Fetch
image/png
172.67.163.34
Cloudflare
General
Full URL
https://ping.channel99.io/?C99=CT-W58QMB4&c00_s=am&c99_c=4080682313&c99_i=darkreading.com&c99_p=23311018763&c99_d=7321112809&c99_v=4467571816&c99_r=138560099861&rnd=2023229933
Requested by
Host: transcend-cdn.com
URL: https://transcend-cdn.com/cm/ef49a3f1-d8c1-47d6-88fc-50e41130631f/airgap.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.67.163.34 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

cf-cache-status
MISS
etag
"71a50dbba44c78128b221b7df7bb51f1"
x-cache
Hit from cloudfront
x-amz-cf-id
wGomEYNp-bMMlnCtfUlX5GKCkmZ2iAKpTF31Ryf2tXwJbFSijZPdtQ==
date
Wed, 09 Sep 2026 00:42:06 GMT
content-type
image/png
vary
Accept-Encoding
last-modified
Mon, 31 Aug 2026 21:20:41 GMT
cache-control
no-store
via
1.1 acc48333e8e2925c44d46b4d771ee3a4.cloudfront.net (CloudFront)
cf-ray
a38226ad1f2f0c26-YYZ
accept-ranges
bytes
access-control-allow-origin
*
content-length
95
x-amz-cf-pop
IAD61-P13
server
cloudflare
x-amz-server-side-encryption
AES256
GET
DATA
200
OK
truncated
/ Frame 336B
217 B
0
Image
image/png

General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
b257d6f1b49f616bcee91912d2209c45465f946292b9e578cb337c7087588e98

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
Referer

Response headers

Content-Type
image/png
GET
H/1.1
200
OK
dv-measurements10456.js Show response
cdn.doubleverify.com/ Frame F50A
482 KB
0
52ms
52ms
Script
text/javascript
23.210.73.49
AKAMAI-ASN1 Akama...
General
Full URL
https://cdn.doubleverify.com/dv-measurements10456.js
Requested by
Host: transcend-cdn.com
URL: https://transcend-cdn.com/cm/ef49a3f1-d8c1-47d6-88fc-50e41130631f/airgap.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
23.210.73.49 Secaucus, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),
Reverse DNS
a23-210-73-49.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
2f7d151682e4657b099b86a53e3314931c9a560fb9f889d7b1a63db730fa705d

Request headers

Referer
https://www.darkreading.com/

Response headers

Access-Control-Expose-Headers
*
Cache-Control
max-age=31536000
Content-Encoding
br
ETag
"5f0ff395d23840dfbdfa6555d7dc5b94"
Expires
Thu, 09 Sep 2027 00:42:06 GMT
Accept-Ranges
bytes
Access-Control-Allow-Origin
*
Content-Length
97551
Date
Wed, 09 Sep 2026 00:42:06 GMT
Last-Modified
Tue, 08 Sep 2026 05:45:35 GMT
Content-Type
text/javascript
GET
H3
200
view
securepubads.g.doubleclick.net/pcs/ Frame ED37
0
0
67ms
64ms
Fetch
image/gif
142.251.211.130
Google LLC
General
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjssZZMtRE-bllL5ghHHEbdPne5eIuIa8vBqb_sv44HE6ISJFanRqNfMOJfGx_zQquvloYm7OFP7IUbmtHb7Qvns662BXw15At3GBPX0yzijlxvjx1j2Ox8iBPm8yBvdozJKVfJZnzJQrlehdSvj8_v9D6sc85ZuaviA2HO73Hq69_pQ49CyA86x0q9hUxExaCSf80XPMEIJQUw4VpWtJLmt7nF04xkymzPXXKvIFH2b8jkMHkvw3oVJfcgZ9D7VvupxJsDZbpGmpfd1qUSMwGblFhSWffjh2yUlbOL1pEata_uXX8Vtb-tHJ93jHkfNSbSHMGwJQqUNi9R5gtoPZuVUvOZGhgzfX-gGf0sgn_gPCPtcJtPi5G1CHvgVO83EuCTkfN5U28Pgspgl10wwxUxlMcKYT7l2T01lzcXyBHvuJ21lZEr59h1DvQHI-xD_okZshSeC7lJmXO3PpD03K&sai=AMfl-YSQrJ276mBUSFM385Kp51BrmWtmjDZ5HSn8Y8L546UeWWkphDDEGuPhTHOx5kiUzQJPS1nz3iQJVYwNAO73NvGnzF7TirqBMVsIBTra2KvFkN_QcvdSczn5v1e3TbHpkrM11vRyah0mzugnOSj2GgK0dGPV2EzBXQF6k9fq9prvgwHsBK03OPzFKKlbw8e9VLeP-zVlMI4CbHHm7BGy8fnR4F6LiAy5eeuLGBwzT27nCk60W6xDdhzVQx7CvxdbvUvuhaD2YQjr4fl70nV2ZJs5UQDPx8EsNNvrd1pmQBW4FEF7GvnLu9Q3v8WHRAAHtyDSFB0C0AukIHfFxGv81LBCD1UoFcB_Mu2zowbH6xgysxDGKPoqiCc&sig=Cg0ArKJSzIJcbbL8VTUGEAE&uach_m=%5BUACH%5D&adurl=
Requested by
Host: transcend-cdn.com
URL: https://transcend-cdn.com/cm/ef49a3f1-d8c1-47d6-88fc-50e41130631f/airgap.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.211.130 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
lclgaa-au-in-f2.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

cache-control
private
timing-allow-origin
*
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
cross-origin-resource-policy
cross-origin
x-content-type-options
nosniff
access-control-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length
0
date
Wed, 09 Sep 2026 00:42:06 GMT
x-xss-protection
0
content-type
image/gif
server
cafe
GET
H2
200
window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20260904/r20110914/client/ Frame ED37
3 KB
1 KB
43ms
41ms
Script
text/javascript
142.250.31.132
Google LLC
General
Full URL
https://tpc.googlesyndication.com/pagead/js/r20260904/r20110914/client/window_focus_fy2021.js
Requested by
Host: transcend-cdn.com
URL: https://transcend-cdn.com/cm/ef49a3f1-d8c1-47d6-88fc-50e41130631f/airgap.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.31.132 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
bj-in-f132.1e100.net
Software
cafe /
Resource Hash
6866f5af8889d6c11bd994ef35abef4e520ad362671ede3485b9005baeef9a53
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
br
etag
8676712673563253577
age
52038
x-content-type-options
nosniff
expires
Tue, 22 Sep 2026 10:14:48 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date
Tue, 08 Sep 2026 10:14:48 GMT
content-disposition
attachment; filename="f.txt"
content-type
text/javascript; charset=UTF-8
vary
Accept-Encoding
cache-control
public, max-age=1209600
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
access-control-allow-origin
*
content-length
1227
x-xss-protection
0
server
cafe
GET
H3
200
ufs_web_display.js Show response
pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ Frame ED37
239 KB
0
220ms
40ms
Script
text/javascript
64.233.180.155
Google LLC
General
Full URL
https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js
Requested by
Host: transcend-cdn.com
URL: https://transcend-cdn.com/cm/ef49a3f1-d8c1-47d6-88fc-50e41130631f/airgap.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
64.233.180.155 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
on-in-f155.1e100.net
Software
cafe /
Resource Hash
5b0d6fda9d4c1601d352e39f939162c2e95e547915536847e3782a0a10dfd92d
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.darkreading.com/

Response headers

content-encoding
br
etag
2640385400941753791
age
1021
x-content-type-options
nosniff
expires
Wed, 09 Sep 2026 01:25:04 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date
Wed, 09 Sep 2026 00:25:04 GMT
content-disposition
attachment; filename="f.txt"
content-type
text/javascript; charset=UTF-8
vary
Accept-Encoding
cache-control
public, max-age=3600, stale-while-revalidate=3600
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
content-length
75325
x-xss-protection
0
server
cafe
GET
H3
204
gen_204
pagead2.googlesyndication.com/pagead/ Frame ED37
0
0
50ms
50ms
Fetch
image/gif
64.233.180.155
Google LLC
General
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=fle-fetch-start2
Requested by
Host: transcend-cdn.com
URL: https://transcend-cdn.com/cm/ef49a3f1-d8c1-47d6-88fc-50e41130631f/airgap.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
64.233.180.155 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
on-in-f155.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

cache-control
no-cache, must-revalidate
timing-allow-origin
*
pragma
no-cache
cross-origin-resource-policy
cross-origin
x-content-type-options
nosniff
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length
0
date
Wed, 09 Sep 2026 00:42:06 GMT
x-xss-protection
0
content-type
image/gif
server
cafe
GET
H3
204
gen_204
pagead2.googlesyndication.com/pagead/ Frame ED37
0
0
51ms
50ms
Fetch
image/gif
64.233.180.155
Google LLC
General
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=colleague-executed&name=4
Requested by
Host: transcend-cdn.com
URL: https://transcend-cdn.com/cm/ef49a3f1-d8c1-47d6-88fc-50e41130631f/airgap.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
64.233.180.155 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
on-in-f155.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

cache-control
no-cache, must-revalidate
timing-allow-origin
*
pragma
no-cache
cross-origin-resource-policy
cross-origin
x-content-type-options
nosniff
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length
0
date
Wed, 09 Sep 2026 00:42:06 GMT
x-xss-protection
0
content-type
image/gif
server
cafe
HEAD
H2
200
/ Show response
ping.channel99.io/ Frame ED37
0
146 B
88ms
87ms
Fetch
image/png
172.67.163.34
Cloudflare
General
Full URL
https://ping.channel99.io/?C99=CT-W58QMB4&c00_s=am&c99_c=4142175498&c99_i=darkreading.com&c99_p=23311018763&c99_d=7384623559&c99_v=5856710547&c99_r=138568952004&rnd=731564135
Requested by
Host: transcend-cdn.com
URL: https://transcend-cdn.com/cm/ef49a3f1-d8c1-47d6-88fc-50e41130631f/airgap.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.67.163.34 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

cf-cache-status
MISS
etag
"71a50dbba44c78128b221b7df7bb51f1"
x-cache
Hit from cloudfront
x-amz-cf-id
T70L0A3XnbUiNwXWMPM0mXWNnSjKi1uyntgjBe6JQWLhy09P23FoZQ==
date
Wed, 09 Sep 2026 00:42:06 GMT
content-type
image/png
last-modified
Mon, 31 Aug 2026 21:20:41 GMT
cache-control
no-store
via
1.1 04c7123123e5b9ec1da72d64551131e0.cloudfront.net (CloudFront)
cf-ray
a38226ad784e0c26-YYZ
accept-ranges
bytes
access-control-allow-origin
*
content-length
95
x-amz-cf-pop
YUL62-P3
server
cloudflare
x-amz-server-side-encryption
AES256
GET
H3
200
view
securepubads.g.doubleclick.net/pcs/ Frame ED37
0
0
63ms
62ms
Fetch
image/gif
142.251.211.130
Google LLC
General
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsuD6FDkJVin15EuYeNGsp_o8HhRHJGha-5ET3dqbEwDDEaVEb9LZaRGhcmyIzNlqnmn_GB9YYg8JU2bOkp9IkxnJojgB47KT_3egIRFKXpAkj17NO4MXNl54AeT-zPEFomuGzQnRqpb1C2OiEoJWRy7RJmxq1s8gyKa1UqqEpHQHn7eb1TUbpviR6u4keevpSMC_z6CheMyYV7y8qMBpCp-uwFU1ejPiR3f95_oExddYJiSe8o4eiUDk7ZAhml3ZMB_o8dOAxqX1aOGBlrNJhVdLD8eyMM63ba8DMkGK2XEU1cO7d0_bzdNI3IZkNjfQ6I6WFaR95pf4nJIr4N1vqKdgkejQbFJEpufirhb_utka_dMWhtUq02RMFWc8gGzoG_BHmIdRX4y2Wg1UH0T1ZhW4YH30VR3GVsRc0U6x9wct9IjdbL81IkLFnAKDqtM-4Lp2MMJCDembA9B0HYtZDk&sai=AMfl-YTKsg14qSfciIJ2AKhYwzvXO89QP8RpHhUa8T9Mnk-CNFNOuf20yNKySTpA5oQrueANOuZ2vrlkcEqaG6DSow7hAbRas8rhDETK_WVHtQ1SGaoWDuS7Bwa1ATHbCO97Iu_iSKgJYeppg0ibqqCLREuOlTncbg0qK0b9oAh10wy4GYodL59kUVYH918eyaXgIBZt_oRSfAXLmUxW8xfuMw5yaW4Ap9QJrmXaX2pFGdGLRZlG6582LvgDQBdizdF-OD1aKlap6S4pWgl84a4XjhNkCyPkoDoNfUK5hoT8dbAXlx9iKVzH7cpXo5_svEwAVwyhUjNzYVYdyhiBJ9HmyudqTNE_ij3YlPFU6NIfWccLZwWIJotXWbI&sig=Cg0ArKJSzMgLgyc7hP5jEAE&uach_m=%5BUACH%5D&dett=5&adurl=
Requested by
Host: transcend-cdn.com
URL: https://transcend-cdn.com/cm/ef49a3f1-d8c1-47d6-88fc-50e41130631f/airgap.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.211.130 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
lclgaa-au-in-f2.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

cache-control
private
timing-allow-origin
*
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
cross-origin-resource-policy
cross-origin
x-content-type-options
nosniff
access-control-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length
0
date
Wed, 09 Sep 2026 00:42:06 GMT
x-xss-protection
0
content-type
image/gif
server
cafe
GET
H2
200
3425365685780898387
tpc.googlesyndication.com/simgad/ Frame ED37
24 KB
24 KB
55ms
53ms
Image
image/png
142.250.31.132
Google LLC
General
Full URL
https://tpc.googlesyndication.com/simgad/3425365685780898387
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/cyberattacks-data-breaches/attackers-multi-hop-google-redirects-phishing-campaign
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.31.132 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
bj-in-f132.1e100.net
Software
sffe /
Resource Hash
f7240ab4766caaa9e3a9bf1b480a0ff32039956c62ab02b4f3729fd3733fecd2
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

report-to
{"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
x-content-type-options
nosniff
expires
Thu, 09 Sep 2027 00:42:06 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
allow-fenced-frame-automatic-beacons
true
date
Wed, 09 Sep 2026 00:42:06 GMT
content-type
image/png
last-modified
Wed, 29 Jul 2026 15:45:42 GMT
cache-control
public, max-age=31536000
timing-allow-origin
*
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
access-control-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="content-ads-owners"
content-length
24207
x-xss-protection
0
server
sffe
GET

l
www.google.com/ads/measurement/ Frame ED37
0
0


GET
H/1.1
200
OK
dvtp_src.js Show response
cdn.doubleverify.com/ Frame BF2A
9 KB
0
198ms
198ms
Script
text/javascript
23.210.73.49
AKAMAI-ASN1 Akama...
General
Full URL
https://cdn.doubleverify.com/dvtp_src.js
Requested by
Host: transcend-cdn.com
URL: https://transcend-cdn.com/cm/ef49a3f1-d8c1-47d6-88fc-50e41130631f/airgap.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
23.210.73.49 Secaucus, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),
Reverse DNS
a23-210-73-49.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
f78fa5032699676674f8888c09692d2c3fd210abde09e964fed1a97c2ed94549

Request headers

Referer

Response headers

Access-Control-Expose-Headers
*
Cache-Control
max-age=3600
Content-Encoding
br
ETag
"9262973c7265bf021a0eb34db8628a8c"
Expires
Wed, 09 Sep 2026 01:42:05 GMT
Accept-Ranges
bytes
Access-Control-Allow-Origin
*
Content-Length
3510
Date
Wed, 09 Sep 2026 00:42:05 GMT
Content-Type
text/javascript
Last-Modified
Tue, 08 Sep 2026 10:12:43 GMT
GET
DATA
200
OK
truncated
/ Frame ED37
209 B
0
Image
image/png

General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
cc0afc8aa8234018404b89c9c33ce7cbbef3c2eb6ef9769b63c8e0dbeedbf021

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
Referer

Response headers

Content-Type
image/png
GET
H3
200
view
securepubads.g.doubleclick.net/pcs/ Frame 2A36
0
0
66ms
65ms
Fetch
image/gif
142.251.211.130
Google LLC
General
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvrFGIvL5CCIEhBapq9ejpDF29SFCuPPodlwMW5vCaen06GtJ512Ob16gTcV2bXUmmkPdruI5FRuYW5cDLswNC1PY9vvM-mI_er6LI6C42xGDqBIffI40CwrIMIbenugESJ6vweO_Fcn-wJGCcJ-9E2hRe6R-4sC3zLogznZ12eL9VW0eK9Lp8WeegC0kPpggKtBpscBLZno13J3LuiMlbwxW-M_gogLMNBfjDmL8VSvOn4Mbmq_7Mgb5mS4775Abyv8Wi51uMP7LW92rJGe5Rv-qdqYMX-jOqZsXZ1kmaHcASW1fXxzDV5z34z0uKQCc_iFBNx35MzgYzgqrDhEj1cnFBaFibXigsIKYSh_qnzGejRhCH4YstJ1Jdpb8saffw2S3NVsLISLDnpXOAMyH_XiCpAIVDw2fgBv67IFqOxGnAR9hmFKGSzRvIq0GkmkP63Jztp7udeN3mWB92RAT1CYiE&sai=AMfl-YSxCc8S7VMsbqSmtvcCtv1j2b46afsRr3KG0AjDatW6fJqHTJ2hwkBhIJEl4iCYXRZGOhjTk5c90b2J-hStgBYrJU-PphjaPNkuEBh7erz_UHlZJS1izoqENUwywAR7iQw54c3lXDGStKXYeA9NOYaxXkWLAuqOT2Wy8qOjrnkVvhMaO7r5p8jNYdu0ZULSnlHDVhfg56DTKulhSWxNcEzaYoGonOLMNbKIvq15zMFB5VJixjeEQezHsaLr_MaxqO_D8Z32N4vP54Es3nEjtfg8Le584xF_UGHOGBuCrZHvN5KwBfGrseFzp7WeTFKcurd_UcXETOjhx8DYw7RaucWifv90_LUUlVWnoa2QLYpCJIvR8KwAIDI&sig=Cg0ArKJSzHKlV4c6OMe8EAE&uach_m=%5BUACH%5D&urlfix=1&adurl=
Requested by
Host: transcend-cdn.com
URL: https://transcend-cdn.com/cm/ef49a3f1-d8c1-47d6-88fc-50e41130631f/airgap.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.211.130 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
lclgaa-au-in-f2.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

cache-control
private
timing-allow-origin
*
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
cross-origin-resource-policy
cross-origin
x-content-type-options
nosniff
access-control-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length
0
date
Wed, 09 Sep 2026 00:42:06 GMT
x-xss-protection
0
content-type
image/gif
server
cafe
GET
H3
200
ufs_web_display.js Show response
pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ Frame 2A36
239 KB
0
220ms
40ms
Script
text/javascript
64.233.180.155
Google LLC
General
Full URL
https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js
Requested by
Host: transcend-cdn.com
URL: https://transcend-cdn.com/cm/ef49a3f1-d8c1-47d6-88fc-50e41130631f/airgap.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
64.233.180.155 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
on-in-f155.1e100.net
Software
cafe /
Resource Hash
5b0d6fda9d4c1601d352e39f939162c2e95e547915536847e3782a0a10dfd92d
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.darkreading.com/

Response headers

content-encoding
br
etag
2640385400941753791
age
1021
x-content-type-options
nosniff
expires
Wed, 09 Sep 2026 01:25:04 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date
Wed, 09 Sep 2026 00:25:04 GMT
content-disposition
attachment; filename="f.txt"
content-type
text/javascript; charset=UTF-8
vary
Accept-Encoding
cache-control
public, max-age=3600, stale-while-revalidate=3600
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
content-length
75325
x-xss-protection
0
server
cafe
GET
H3
204
gen_204
pagead2.googlesyndication.com/pagead/ Frame 2A36
0
0
50ms
50ms
Fetch
image/gif
64.233.180.155
Google LLC
General
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=fle-fetch-start2
Requested by
Host: transcend-cdn.com
URL: https://transcend-cdn.com/cm/ef49a3f1-d8c1-47d6-88fc-50e41130631f/airgap.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
64.233.180.155 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
on-in-f155.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

cache-control
no-cache, must-revalidate
timing-allow-origin
*
pragma
no-cache
cross-origin-resource-policy
cross-origin
x-content-type-options
nosniff
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length
0
date
Wed, 09 Sep 2026 00:42:06 GMT
x-xss-protection
0
content-type
image/gif
server
cafe
GET
H3
204
gen_204
pagead2.googlesyndication.com/pagead/ Frame 2A36
0
0
51ms
51ms
Fetch
image/gif
64.233.180.155
Google LLC
General
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=colleague-executed&name=4
Requested by
Host: transcend-cdn.com
URL: https://transcend-cdn.com/cm/ef49a3f1-d8c1-47d6-88fc-50e41130631f/airgap.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
64.233.180.155 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
on-in-f155.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

cache-control
no-cache, must-revalidate
timing-allow-origin
*
pragma
no-cache
cross-origin-resource-policy
cross-origin
x-content-type-options
nosniff
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length
0
date
Wed, 09 Sep 2026 00:42:06 GMT
x-xss-protection
0
content-type
image/gif
server
cafe
HEAD
H2
200
/ Show response
ping.channel99.io/ Frame 2A36
0
137 B
101ms
101ms
Fetch
image/png
172.67.163.34
Cloudflare
General
Full URL
https://ping.channel99.io/?C99=CT-W58QMB4&c00_s=am&c99_c=3886181507&c99_i=darkreading.com&c99_p=23311018763&c99_d=7129991679&c99_v=5857754385&c99_r=138568043700&rnd=1306973893
Requested by
Host: transcend-cdn.com
URL: https://transcend-cdn.com/cm/ef49a3f1-d8c1-47d6-88fc-50e41130631f/airgap.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.67.163.34 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

cf-cache-status
MISS
etag
"71a50dbba44c78128b221b7df7bb51f1"
x-cache
Hit from cloudfront
x-amz-cf-id
Ewe-nCTAjCfcG12BW1r0xs-raxSkONPga48c_YcE7jl29DA_XNDtRA==
date
Wed, 09 Sep 2026 00:42:06 GMT
content-type
image/png
last-modified
Mon, 31 Aug 2026 21:20:41 GMT
cache-control
no-store
via
1.1 e5bd19c9ce69fd482f1f3a86b9b516c2.cloudfront.net (CloudFront)
cf-ray
a38226ae0a660c26-YYZ
accept-ranges
bytes
access-control-allow-origin
*
content-length
95
x-amz-cf-pop
YUL62-P3
server
cloudflare
x-amz-server-side-encryption
AES256
GET
H3
200
view
securepubads.g.doubleclick.net/pcs/ Frame 2A36
0
0
107ms
105ms
Fetch
image/gif
142.251.211.130
Google LLC
General
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsuFSXncqJkgHbveJ_MRxZWu5OVHg_qT1bE165PMr3mJcTFomo4whkFaFhpP9xL_GD3V5roJjoo_uzXm13LEwfZEBvbasXI5DlS_oHZDy5iGzWL7DBbwqBEgp7tDtNzCBpzR4R0a6k2mKa45uIu-vwjlGSg7eOPg7tGcNh1lCjbA2CZ-Yhpovhf8wFsjI-mDD-e2LC5ZwpoXcwOCHE9_LuluZiLnZyxh5_ELyZi7vDMUh2eiZeUYgLzSBPAyAzHUPrrxOJ5ihD2xHO9_zcT-AAI3Ibk6zmjn1NG-5Vd_WC-gX5FXud44jLUQP9wk6o185WNh3RWoIEjxogrzDsOxFGwHCC9fymKIg-_TjvQmJIWLTFOTaT8mai8Yy2_9FZfOGluZcKRn4KTDG3U0sbuUIaAClAlKGzWPGgDIVTGGlx49W1fjieqz8qvNv9H_6UG5x6Vb6nfbLNv5NpN4i7RiK8LUBlEZbQ&sai=AMfl-YQHNdvjPfyWUvzQBQUSo3rkJhGUfE-ElzQaNAVfRRnlp8yofYVPQJfCSBq_jlB7u3xPrRusgqdeeSncaKWXtIiRXg3JFWK0WQNZX5QLyuo1FR1Xi-Pi04ORnTQS_3z_mYJ9Vv1md88mrCFTUObPx4zuS-LiwTAtYK91UpogUe-2E3YS3-pbADZN5_mj9bamOH0OvFDblWyv2vIo-1jDBX4aXBRiOXKjd84WpuJtRXfdKWNocTdwh-onot_3G2ppT88IawPRrMBWoT0pbg3oIwi6kdUn-v_8LN69FekYNBRjNAMd5l06nN2SdZLiiW7yN4mQPDtdyme8kNwbHkWgPvfuesvdH8sVzaZ1Kn8tE4U1FJFhGKUJHh0&sig=Cg0ArKJSzDGRjl6otplnEAE&uach_m=%5BUACH%5D&urlfix=1&vt=11&igpp=1&dett=5&adurl=
Requested by
Host: transcend-cdn.com
URL: https://transcend-cdn.com/cm/ef49a3f1-d8c1-47d6-88fc-50e41130631f/airgap.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.211.130 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
lclgaa-au-in-f2.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

cache-control
private
timing-allow-origin
*
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
cross-origin-resource-policy
cross-origin
x-content-type-options
nosniff
access-control-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length
0
date
Wed, 09 Sep 2026 00:42:06 GMT
x-xss-protection
0
content-type
image/gif
server
cafe
POST
H3
204
/
vtrk.dv.tech/
0
162 B
34ms
33ms
Ping
text/plain
104.18.3.135
Cloudflare
General
Full URL
https://vtrk.dv.tech/?ec=dvtag&ea=ad-format-detection&ctx=dvtag&cmp=DV424940&cm106=2&cm107=0&cm108=3&cm109=1&cm110=4&cm111=1&cm112=2&cm113=16&cd111=https%3A%2F%2Fdarkreading.com%2Fcyberattacks-data-breaches%2Fattackers-multi-hop-google-redirects-phishing-campaign&cd112=9bd90912-941c-4372-aed8-f37dc1c8c47e&cd113=7f2ad076-2ad1-4480-b0f0-1f764ac919da&cd114=resource_v&cd115=104&cd116=5857754385&cd117=3886181507&cd118=7129991679&cd119=138568043700&cd120=%2F3618%2Fdarkreading.home%2Farticle%2Fcyberattacks-data-breaches&cd121=5x5&cd102=b30b55d&cd103=&cd107=9bd90912-941c-4372-aed8-f37dc1c8c47e&cd109=modern&cd200=com&cd108=&cd105=19913272&cd106=DV424940&cd104=www.darkreading.com&cd199=https%3A%2F%2Fdarkreading.com%2Fcyberattacks-data-breaches%2Fattackers-multi-hop-google-redirects-phishing-campaign&cd101=ad-format-detection&cm101=1&cid=08269d9a-08de-42e5-94a8-ca1ab81ce870&t=event&v=1&z=08269d9a-08de-42e5-94a8-ca1ab81ce870&cd160=08269d9a-08de-42e5-94a8-ca1ab81ce870
Requested by
Host: transcend-cdn.com
URL: https://transcend-cdn.com/cm/ef49a3f1-d8c1-47d6-88fc-50e41130631f/airgap.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.18.3.135 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

cache-control
no-cache
access-control-allow-credentials
true
access-control-allow-methods
GET, POST, OPTIONS
cf-ray
a38226ae1e5f3704-YYZ
access-control-allow-origin
https://www.darkreading.com
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Wed, 09 Sep 2026 00:42:06 GMT
server
cloudflare
priority
u=4,i
GET
H3
200
view
securepubads.g.doubleclick.net/pcs/ Frame 370B
0
0
65ms
64ms
Fetch
image/gif
142.251.211.130
Google LLC
General
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsuHOJItjX8etENsWQtm2C1UBTtNDqSNTt1A5QhUK6_tjrtArPkYJLxV4Yo9IF3IYYEWqXWHnOoIDSudm7m8H868HagFvRLFwgyoJM77olDk5eHkPE5hBRrBxnWPON2FssVG-oZYJZJdfD75ekjtW5VF2kwrFb5YYK7f-WvWCSBDsglkSzVriSFMUcNz7Ub25NId9hHE1SPlPV5bUlM4i4JXJgeIdtovmqXLn-HiYMCThinGi8R7qgNVbGbRYZSFR2Le1QtCtKZrNdsGH18ok-gimQf_IOSaQ0lur3cgZuDcqwjn9Yb2EDCbtIqhQLFIdNUWqK83hP5sHZnJW80U4Mwh0qXqyNPSctvRikI_JRYpM9HnUsqQIjj8XPvEss5UAs5WxSp0FFWPyTr7K7oaNmWUAQViPPyeeYd027VEYWuvi2fOU0OsBYUydgiVUtwJ3goJt_LJS4ZpZwgGf7Kc&sai=AMfl-YSPaJl7oHdyI-GUwNZaHOZWr9cTLOLwFXHIFH6Ym85LtB62UcwUGv9HJ0-ecaE2Jqt_4N-aywAdzuaOnbzAxcI1-GAPrXCGlwE634SqpkLME6rscFymShAmGJVEgVWgUsUAiIr63-w2p9bsr5qfr4fiv3ndJizh30Phu-pdUNtLh5zGGM1y0bGkB_KyE4F1A0mbjPW2UpnWUskoz2NLc2yKyOYXDoisII8rdIJVvS8Ek5cw7Lw_2YVkLE06YaIt7TctPx2cDYaBXOUHk9z8M8Q7QDSe0wVcf-71kGa0EwvSDoyIDnM6B2ZBXAY6JJhO86Gr7RuXc860HtEonPUhKGyVTxR1bAdbx3R4BTr25xPzrEwUL920vks&sig=Cg0ArKJSzM3FFq9wui6DEAE&uach_m=%5BUACH%5D&adurl=
Requested by
Host: transcend-cdn.com
URL: https://transcend-cdn.com/cm/ef49a3f1-d8c1-47d6-88fc-50e41130631f/airgap.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.211.130 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
lclgaa-au-in-f2.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

cache-control
private
timing-allow-origin
*
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
cross-origin-resource-policy
cross-origin
x-content-type-options
nosniff
access-control-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length
0
date
Wed, 09 Sep 2026 00:42:06 GMT
x-xss-protection
0
content-type
image/gif
server
cafe
GET
H2
200
window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20260904/r20110914/client/ Frame 370B
3 KB
0
0ms
0ms
Script
text/javascript
142.250.31.132
Google LLC
General
Full URL
https://tpc.googlesyndication.com/pagead/js/r20260904/r20110914/client/window_focus_fy2021.js
Requested by
Host: transcend-cdn.com
URL: https://transcend-cdn.com/cm/ef49a3f1-d8c1-47d6-88fc-50e41130631f/airgap.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.31.132 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
bj-in-f132.1e100.net
Software
cafe /
Resource Hash
6866f5af8889d6c11bd994ef35abef4e520ad362671ede3485b9005baeef9a53
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
br
etag
8676712673563253577
age
52038
x-content-type-options
nosniff
expires
Tue, 22 Sep 2026 10:14:48 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date
Tue, 08 Sep 2026 10:14:48 GMT
content-disposition
attachment; filename="f.txt"
content-type
text/javascript; charset=UTF-8
vary
Accept-Encoding
cache-control
public, max-age=1209600
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
access-control-allow-origin
*
content-length
1227
x-xss-protection
0
server
cafe
GET
H3
200
ufs_web_display.js Show response
pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ Frame 370B
239 KB
0
220ms
40ms
Script
text/javascript
64.233.180.155
Google LLC
General
Full URL
https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js
Requested by
Host: transcend-cdn.com
URL: https://transcend-cdn.com/cm/ef49a3f1-d8c1-47d6-88fc-50e41130631f/airgap.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
64.233.180.155 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
on-in-f155.1e100.net
Software
cafe /
Resource Hash
5b0d6fda9d4c1601d352e39f939162c2e95e547915536847e3782a0a10dfd92d
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.darkreading.com/

Response headers

content-encoding
br
etag
2640385400941753791
age
1021
x-content-type-options
nosniff
expires
Wed, 09 Sep 2026 01:25:04 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date
Wed, 09 Sep 2026 00:25:04 GMT
content-disposition
attachment; filename="f.txt"
content-type
text/javascript; charset=UTF-8
vary
Accept-Encoding
cache-control
public, max-age=3600, stale-while-revalidate=3600
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
content-length
75325
x-xss-protection
0
server
cafe
GET
H3
204
gen_204
pagead2.googlesyndication.com/pagead/ Frame 370B
0
0
52ms
51ms
Fetch
image/gif
64.233.180.155
Google LLC
General
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=fle-fetch-start2
Requested by
Host: transcend-cdn.com
URL: https://transcend-cdn.com/cm/ef49a3f1-d8c1-47d6-88fc-50e41130631f/airgap.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
64.233.180.155 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
on-in-f155.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

cache-control
no-cache, must-revalidate
timing-allow-origin
*
pragma
no-cache
cross-origin-resource-policy
cross-origin
x-content-type-options
nosniff
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length
0
date
Wed, 09 Sep 2026 00:42:06 GMT
x-xss-protection
0
content-type
image/gif
server
cafe
GET
H3
204
gen_204
pagead2.googlesyndication.com/pagead/ Frame 370B
0
0
52ms
51ms
Fetch
image/gif
64.233.180.155
Google LLC
General
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=colleague-executed&name=4
Requested by
Host: transcend-cdn.com
URL: https://transcend-cdn.com/cm/ef49a3f1-d8c1-47d6-88fc-50e41130631f/airgap.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
64.233.180.155 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
on-in-f155.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

cache-control
no-cache, must-revalidate
timing-allow-origin
*
pragma
no-cache
cross-origin-resource-policy
cross-origin
x-content-type-options
nosniff
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length
0
date
Wed, 09 Sep 2026 00:42:06 GMT
x-xss-protection
0
content-type
image/gif
server
cafe
HEAD
H2
200
/ Show response
ping.channel99.io/ Frame 370B
0
139 B
114ms
113ms
Fetch
image/png
172.67.163.34
Cloudflare
General
Full URL
https://ping.channel99.io/?C99=CT-W58QMB4&c00_s=am&c99_c=4142175498&c99_i=darkreading.com&c99_p=23311018763&c99_d=7384623559&c99_v=5856710547&c99_r=138572238837&rnd=926121173
Requested by
Host: transcend-cdn.com
URL: https://transcend-cdn.com/cm/ef49a3f1-d8c1-47d6-88fc-50e41130631f/airgap.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.67.163.34 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

cf-cache-status
MISS
etag
"71a50dbba44c78128b221b7df7bb51f1"
x-cache
Hit from cloudfront
x-amz-cf-id
TdgN-c4be5va2HFNbv5MvPlf3_YkUfmUPNgDCvXQQdc6P4C2I5C3bw==
date
Wed, 09 Sep 2026 00:42:06 GMT
content-type
image/png
vary
Accept-Encoding
last-modified
Mon, 31 Aug 2026 21:20:41 GMT
cache-control
no-store
via
1.1 70bb7fd797792ff677b4ec2e2a0ad742.cloudfront.net (CloudFront)
cf-ray
a38226ae6b7c0c26-YYZ
accept-ranges
bytes
access-control-allow-origin
*
content-length
95
x-amz-cf-pop
IAD61-P13
server
cloudflare
x-amz-server-side-encryption
AES256
GET
H3
200
view
securepubads.g.doubleclick.net/pcs/ Frame 370B
0
0
61ms
61ms
Fetch
image/gif
142.251.211.130
Google LLC
General
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstFtCUVO94KGZh_l_unA46_GYCDRfEzYh-Z-BB_YwKEfdpR6S3F2CT1kvErczmWFTY2FrQ506YH-NUQ3bIVA4xxCF2aizLqfMAaMpRFTiSJXCThD-1-gfT5PRLWRoPoGBvs1exPN4C9UuhCq_x2-fvUlP_h8B0wDDvU4BEn-Qdjpis7jq0phVNpqWWXYm0Jw7kYAcBO9m7fY3kMWj886q4g_FO_8yTCuhWPBOakifScf7IXwc9W2lFltUSldF2Y0v2KUHWYe459nTsDUOM3t5F2dEFg8Pj5k_Uuh37Jen4FdhK4pPjKh4nBfrE1dQhTYNBvSiLJ-uGySSuXhvG0hE-M6IIzCjNXBoQP5St_-IVIJOkab3_3JuHdmR8Wjklci4hb0otpTJA8-TVbjcKfhpTxDsPz0eBKUmvq5FLiCltYk6VEqly6XMRJi89Vh-RkETzBU3IRs3Y5oLoZEx79Akw&sai=AMfl-YR6dRmHq1WhnkLdCdALrehU9xvTH7rGoezG80qMoFcvVedT0asMldyyqR0dOt31CW2M18_KftYKNPtJF_HqKsQiuhO3EkfBV3QOfiQQGR8lrXW2xVIr-DmlsvlEd3sfTn3izlNfG7CSlNtXfS_TWjBMKNscJ8iyyXMHd-jzCR30xhgji5oi4zd_0xbi5p3x9eDcbaKS4whQWL2GOygKwDQb_9KnVTXQ2CSh7JDSaVUY9SSzzXEv42H5xRDgqn37Erpn_Lp-eIYRZHW9Zsq-_iTAN1WV3icLcD0cme1u9jWONnjqJekpO4242arWRWmeexFgxSkR_P7HrvdN6uwLJXKwlG-QbHVPUx449otTv8yCG5I4wskMX9c&sig=Cg0ArKJSzN5wkDMasQ_TEAE&uach_m=%5BUACH%5D&vt=11&igpp=1&dett=5&adurl=
Requested by
Host: transcend-cdn.com
URL: https://transcend-cdn.com/cm/ef49a3f1-d8c1-47d6-88fc-50e41130631f/airgap.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.211.130 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
lclgaa-au-in-f2.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

cache-control
private
timing-allow-origin
*
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
cross-origin-resource-policy
cross-origin
x-content-type-options
nosniff
access-control-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length
0
date
Wed, 09 Sep 2026 00:42:06 GMT
x-xss-protection
0
content-type
image/gif
server
cafe
GET
H3
200
6707262467748366739
tpc.googlesyndication.com/simgad/ Frame 370B
104 KB
104 KB
66ms
66ms
Image
image/png
142.250.31.132
Google LLC
General
Full URL
https://tpc.googlesyndication.com/simgad/6707262467748366739
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/cyberattacks-data-breaches/attackers-multi-hop-google-redirects-phishing-campaign
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.31.132 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
bj-in-f132.1e100.net
Software
sffe /
Resource Hash
859d6cd9509124bd7ede5fc254ed294e1ce79049f9e04f61f8ac6d8c3d8ed920
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

report-to
{"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
x-content-type-options
nosniff
expires
Thu, 09 Sep 2027 00:42:06 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
allow-fenced-frame-automatic-beacons
true
date
Wed, 09 Sep 2026 00:42:06 GMT
content-type
image/png
last-modified
Wed, 29 Jul 2026 15:47:55 GMT
cache-control
public, max-age=31536000
timing-allow-origin
*
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
access-control-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="content-ads-owners"
content-length
106294
x-xss-protection
0
server
sffe
GET

l
www.google.com/ads/measurement/ Frame 370B
0
0


GET
H/1.1
200
OK
dvtp_src.js Show response
cdn.doubleverify.com/ Frame 3B24
9 KB
0
198ms
198ms
Script
text/javascript
23.210.73.49
AKAMAI-ASN1 Akama...
General
Full URL
https://cdn.doubleverify.com/dvtp_src.js
Requested by
Host: transcend-cdn.com
URL: https://transcend-cdn.com/cm/ef49a3f1-d8c1-47d6-88fc-50e41130631f/airgap.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
23.210.73.49 Secaucus, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),
Reverse DNS
a23-210-73-49.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
f78fa5032699676674f8888c09692d2c3fd210abde09e964fed1a97c2ed94549

Request headers

Referer

Response headers

Access-Control-Expose-Headers
*
Cache-Control
max-age=3600
Content-Encoding
br
ETag
"9262973c7265bf021a0eb34db8628a8c"
Expires
Wed, 09 Sep 2026 01:42:05 GMT
Accept-Ranges
bytes
Access-Control-Allow-Origin
*
Content-Length
3510
Date
Wed, 09 Sep 2026 00:42:05 GMT
Content-Type
text/javascript
Last-Modified
Tue, 08 Sep 2026 10:12:43 GMT
GET
DATA
200
OK
truncated
/ Frame 2A36
214 B
0
Image
image/png

General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
779147f1b3663f83309aa693659023696c7814e0ef58f552bbbe19de8046c7b6

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
Referer

Response headers

Content-Type
image/png
GET
DATA
200
OK
truncated
/ Frame 370B
218 B
0
Image
image/png

General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
a0e2aef07d82dcad791c656319916649ad83bef1c25224c7d9f47a651401a50a

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
Referer

Response headers

Content-Type
image/png
GET
H/1.1
200
OK
visit.js Show response
tps.doubleverify.com/ Frame F9C5
578 B
705 B
143ms
58ms
Script
text/javascript
34.117.228.201
Google LLC
General
Full URL
https://tps.doubleverify.com/visit.js?gdpr_consent=&flvr=0&ttmms=480&ttfrms=47&brid=3&brver=152.0.0.0&bridua=3&bds=1&tstype=2&eparams=DC4FC%3Dl9EEADTbpTauTauHHH%5D52C%3CC625%3A%3F8%5D4%40%3ETau4J36C2EE24%3CD%5C52E2%5C3C62496DTau2EE24%3C6CD%5C%3EF%3DE%3A%5C9%40A%5C8%40%408%3D6%5CC65%3AC64ED%5CA9%3AD9%3A%3F8%5C42%3EA2%3A8%3FU2%3F4r92%3A%3Fl9EEADTbpTauTauHHH%5D52C%3CC625%3A%3F8%5D4%40%3ETar23%40FETbpTauTauU42%3FFC%3Dl9EEADTbpTauTauHHH%5D52C%3CC625%3A%3F8%5D4%40%3ETau4J36C2EE24%3CD%5C52E2%5C3C62496DTau2EE24%3C6CD%5C%3EF%3DE%3A%5C9%40A%5C8%40%408%3D6%5CC65%3AC64ED%5CA9%3AD9%3A%3F8%5C42%3EA2%3A8%3F&srcurlD=0&aUrlD=0&ssl=https:&dfs=7&ddur=276&uid=1788914526506226&jsCallback=dvCallback_1788914526506273&dvtagver=6.1.src&navUa=Mozilla%2F5.0%20(X11%3B%20Linux%20x86_64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F152.0.0.0%20Safari%2F537.36&htmlmsging=1&chro=1&hist=2&winh=1200&winw=1600&wouh=1200&wouw=1600&scah=1200&scaw=1600&tgjsver=10456&lvvn=28&m1=96&refD=1&referrer=about%3Ablank&fwc=1&fcl=1550&flt=4&fec=990&fcifrms=18&brh=2&dvp_epl=465&noc=16&nav_pltfrm=Linux%20x86_64&ctx=19913272&cmp=DV424940&adsrv=104&jsver=10456&unit=1x1&seltag=1&sadv=5856710547&ord=4142175498&litm=7384623559&scrt=138569962399&splc=%2F3618%2Fdarkreading.home%2Farticle%2Fcyberattacks-data-breaches&spos=wallpaper_v&c4=0&gdpr=0&errorURL=https://tps.doubleverify.com/visit.jpg&mib=0&t2te=0&dvp_pubaap=2&dich=1&dvp_uptbts=1788912138907&dvp_uptbcid=b30b55d&dvp_gptmasid=16&dvp_uptsid=165f6667-9ff4-426e-9726-4446118e879e&dvp_uptseid=wallpaper_v&dvp_uptpid=9bd90912-941c-4372-aed8-f37dc1c8c47e&dvp_qtpid=9bd90912-941c-4372-aed8-f37dc1c8c47e&dvp_qtsid=165f6667-9ff4-426e-9726-4446118e879e&dvp_uptsacnt=1&dvp_gptmle=1&alm=manual&dvp_pubaft=1&ee_dp_pubaft=1&dvp_gptmit=0&dvp_pubuaf=0&dvp_rcp=2&dvp_htec=1&dvp_seem=2&dvp_tuk=1&dvp_sukv=8532593.618607784&ee_dp_sukv=8532593.618607784&dvp_tukv=283174272.08277357&ee_dp_tukv=283174272.08277357&dvp_tuid=105598796811&ee_dp_vjeg=0
Requested by
Host: transcend-cdn.com
URL: https://transcend-cdn.com/cm/ef49a3f1-d8c1-47d6-88fc-50e41130631f/airgap.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
34.117.228.201 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM - Google LLC, US),
Reverse DNS
201.228.117.34.bc.googleusercontent.com
Software
/
Resource Hash
96259b58c39a79e9261b651cff06b8a3db1228c534e47e3ba31a83beef5d0dee

Request headers

sec-ch-ua-platform
"Linux"
Referer
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

Transfer-Encoding
chunked
Cache-Control
max-age=0
Timing-Allow-Origin
*
Content-Encoding
br
Pragma
no-cache
Connection
keep-alive
Expires
09/08/2026 00:42:06
Date
Wed, 09 Sep 2026 00:42:06 GMT
Content-Type
text/javascript
Vary
Accept-Encoding
GET
H/1.1
200
OK
visit.js Show response
tps.doubleverify.com/ Frame C119
578 B
700 B
125ms
62ms
Script
text/javascript
34.117.228.201
Google LLC
General
Full URL
https://tps.doubleverify.com/visit.js?gdpr_consent=&flvr=0&ttmms=512&ttfrms=7&brid=3&brver=152.0.0.0&bridua=3&bds=1&tstype=2&eparams=DC4FC%3Dl9EEADTbpTauTauHHH%5D52C%3CC625%3A%3F8%5D4%40%3ETau4J36C2EE24%3CD%5C52E2%5C3C62496DTau2EE24%3C6CD%5C%3EF%3DE%3A%5C9%40A%5C8%40%408%3D6%5CC65%3AC64ED%5CA9%3AD9%3A%3F8%5C42%3EA2%3A8%3FU2%3F4r92%3A%3Fl9EEADTbpTauTauHHH%5D52C%3CC625%3A%3F8%5D4%40%3ETar23%40FETbpTauTauU42%3FFC%3Dl9EEADTbpTauTauHHH%5D52C%3CC625%3A%3F8%5D4%40%3ETau4J36C2EE24%3CD%5C52E2%5C3C62496DTau2EE24%3C6CD%5C%3EF%3DE%3A%5C9%40A%5C8%40%408%3D6%5CC65%3AC64ED%5CA9%3AD9%3A%3F8%5C42%3EA2%3A8%3F&srcurlD=0&aUrlD=0&ssl=https:&dfs=17&ddur=202&uid=1788914526540813&jsCallback=dvCallback_1788914526540755&dvtagver=6.1.src&navUa=Mozilla%2F5.0%20(X11%3B%20Linux%20x86_64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F152.0.0.0%20Safari%2F537.36&htmlmsging=1&chro=1&hist=2&winh=1200&winw=1600&wouh=1200&wouw=1600&scah=1200&scaw=1600&tgjsver=10456&lvvn=28&m1=96&refD=1&referrer=about%3Ablank&fwc=1&fcl=1550&flt=4&fec=990&fcifrms=18&brh=2&dvp_epl=465&noc=16&nav_pltfrm=Linux%20x86_64&ctx=19913272&cmp=DV424940&adsrv=104&jsver=10456&unit=1x1&seltag=1&sadv=4467571816&ord=4080682313&litm=7321112809&scrt=138560099861&splc=%2F3618%2Fdarkreading.home%2Farticle%2Fcyberattacks-data-breaches&spos=welcome_v&c4=0&gdpr=0&errorURL=https://tps.doubleverify.com/visit.jpg&mib=0&t2te=0&dvp_pubaap=2&dich=1&dvp_uptbts=1788912138907&dvp_uptbcid=b30b55d&dvp_gptmasid=16&dvp_uptsid=010f9646-fb9a-4071-ab13-da8eccff5cd4&dvp_uptseid=welcome_v&dvp_uptpid=9bd90912-941c-4372-aed8-f37dc1c8c47e&dvp_qtpid=9bd90912-941c-4372-aed8-f37dc1c8c47e&dvp_qtsid=010f9646-fb9a-4071-ab13-da8eccff5cd4&dvp_uptsacnt=1&dvp_gptmle=1&alm=manual&dvp_pubaft=1&ee_dp_pubaft=1&dvp_gptmit=0&dvp_pubuaf=0&dvp_rcp=2&dvp_htec=1&dvp_seem=2&dvp_tuk=1&dvp_sukv=8210544603.207487&ee_dp_sukv=8210544603.207487&dvp_tukv=238396800277.57687&ee_dp_tukv=238396800277.57687&dvp_tuid=776211941583&ee_dp_vjeg=0
Requested by
Host: transcend-cdn.com
URL: https://transcend-cdn.com/cm/ef49a3f1-d8c1-47d6-88fc-50e41130631f/airgap.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
34.117.228.201 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM - Google LLC, US),
Reverse DNS
201.228.117.34.bc.googleusercontent.com
Software
/
Resource Hash
f49a91f490c11ee0edff2428a88e70b5fefb12578aa7d394f0c04169dcce0ae8

Request headers

sec-ch-ua-platform
"Linux"
Referer
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

Transfer-Encoding
chunked
Cache-Control
max-age=0
Timing-Allow-Origin
*
Content-Encoding
br
Pragma
no-cache
Connection
keep-alive
Expires
09/08/2026 00:42:06
Date
Wed, 09 Sep 2026 00:42:06 GMT
Content-Type
text/javascript
Vary
Accept-Encoding
GET
H/1.1
200
OK
visit.js Show response
tps.doubleverify.com/ Frame F50A
578 B
697 B
119ms
62ms
Script
text/javascript
34.117.228.201
Google LLC
General
Full URL
https://tps.doubleverify.com/visit.js?gdpr=&gdpr_consent=&flvr=0&ttmms=374&ttfrms=7&brid=3&brver=152.0.0.0&bridua=3&bds=1&tstype=2&eparams=DC4FC%3Dl9EEADTbpTauTauHHH%5D52C%3CC625%3A%3F8%5D4%40%3ETau4J36C2EE24%3CD%5C52E2%5C3C62496DTau2EE24%3C6CD%5C%3EF%3DE%3A%5C9%40A%5C8%40%408%3D6%5CC65%3AC64ED%5CA9%3AD9%3A%3F8%5C42%3EA2%3A8%3FU2%3F4r92%3A%3Fl9EEADTbpTauTauHHH%5D52C%3CC625%3A%3F8%5D4%40%3ETar9EEADTbpTauTauHHH%5D52C%3CC625%3A%3F8%5D4%40%3EU42%3FFC%3Dl9EEADTbpTauTauHHH%5D52C%3CC625%3A%3F8%5D4%40%3ETau4J36C2EE24%3CD%5C52E2%5C3C62496DTau2EE24%3C6CD%5C%3EF%3DE%3A%5C9%40A%5C8%40%408%3D6%5CC65%3AC64ED%5CA9%3AD9%3A%3F8%5C42%3EA2%3A8%3F&srcurlD=0&aUrlD=0&ssl=https:&dfs=490&ddur=0&uid=1788914526562473&jsCallback=dvCallback_1788914526562860&dvtagver=6.1.src&navUa=Mozilla%2F5.0%20(X11%3B%20Linux%20x86_64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F152.0.0.0%20Safari%2F537.36&htmlmsging=1&chro=1&hist=2&winh=1200&winw=1600&wouh=1200&wouw=1600&scah=1200&scaw=1600&tgjsver=10456&lvvn=28&m1=96&refD=1&referrer=https%3A%2F%2Fwww.darkreading.com%2Fcyberattacks-data-breaches%2Fattackers-multi-hop-google-redirects-phishing-campaign&fwc=1&fcl=1550&flt=4&fec=990&fcifrms=18&brh=2&dvp_epl=496&noc=16&nav_pltfrm=Linux%20x86_64&ctx=19913272&cmp=DV402603&btreg=7321112809138560099861&btadsrv=7321112809138560099861&adsrv=104&jsver=10456&unit=1x1&seltag=1&sadv=4467571816&ord=4080682313&litm=7321112809&scrt=138560099861&splc=/3618/darkreading.home/article/cyberattacks-data-breaches&adu=23311018763&spos=welcome_v&c4=0&errorURL=https://tps.doubleverify.com/visit.jpg&mib=0&t2te=0&cb=2023229933&dvp_pubaap=0&dvp_uptbcid=1.9.0&dvp_rcp=2&dvp_htec=2&dvp_seem=2&dvp_tuk=1&dvp_sukv=51196475.22190977&ee_dp_sukv=51196475.22190977&dvp_tukv=12768388028.762104&ee_dp_tukv=12768388028.762104&dvp_tuid=420767001597&ee_dp_vjeg=0
Requested by
Host: transcend-cdn.com
URL: https://transcend-cdn.com/cm/ef49a3f1-d8c1-47d6-88fc-50e41130631f/airgap.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
34.117.228.201 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM - Google LLC, US),
Reverse DNS
201.228.117.34.bc.googleusercontent.com
Software
/
Resource Hash
d3e57cdd620590c9ae7dd9c614299a0af7d7a378d1ca4ca2e04286bb4682beaf

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

Transfer-Encoding
chunked
Cache-Control
max-age=0
Timing-Allow-Origin
*
Content-Encoding
br
Pragma
no-cache
Connection
keep-alive
Expires
09/08/2026 00:42:06
Date
Wed, 09 Sep 2026 00:42:06 GMT
Content-Type
text/javascript
Vary
Accept-Encoding
GET
H2
200
5166112134831324558
s0.2mdn.net/simgad/ Frame CA48
140 KB
140 KB
127ms
40ms
Image
image/jpeg
142.250.68.198
Google LLC
General
Full URL
https://s0.2mdn.net/simgad/5166112134831324558
Requested by
Host: ad.doubleclick.net
URL: https://ad.doubleclick.net/ddm/adi/N520403.127711DARKREADING/B35832278.447559437;dc_ver=106.314;dc_eid=40004000;sz=640x480;u_sd=1;gdpr=0;dc_adk=2473714756;ord=nz29w6;click=https%3A%2F%2Fadclick.g.doubleclick.net%2Fpcs%2Fclick%3Fxai%3DAKAOjsu-r5iDaHcuPdbO75blbSNj10vv8HZuM0G-x-GopfMJoPQDiR4QZrtyhRzf8KycizHcd3aYMSQ6x8l5AkSj-mMjSpvqsMjHeyc2u3XoeapYIHvR06j-bNAWQH-BgGUpgioH4agm-rzvfJfROoUfFzpEjCcumBHsFGfOYBwdUUgR_4JvirmONr0A4ul4H5eYue80xgNVAgfmR4GGsBdN1lVy2_dVK0RMvK8t9QyFHOXZVf2d_3HcAs_IMsvtrGwhUD2cSYlvyfU27vLVcUPaBJJebidor5Q2pDfe_Fp6EPh2CPZQ6FKfiHClOHJqZU337mVDGg9R_6o0Yz8pYp9QIaT4-R5zpit01mkeBhMGLYV4WVjxxxFqPTZxf6Vd47kZCPftSPErpOLG1f9vSiLyazcPBzSMVTsz9XMPM-0gtBmfeiPY7kIl7SXlLPHJf-NdcSmMyj0%26sai%3DAMfl-YQqNeQ13sZJ-MA8hCfcA1W_3rEbLfDDHwWvRBcc8fDkaweii5sDV650asp4plTiRm4UeOBBC_4BXTQFx-6EL6roOz0ssNKnwScKeCdu9SrXwbHsLPGPruf9cBcQFzvMFGH7ygh3Lyar8ZBYCc6ObFrsemd9GIFnSDsQwNBFJopA-dr-qdaZMIrIVMWY4jjfH1eqPPIEXrn_wmwl8KC2wdEBFXJkzBdXgXwkLO7IAYAEaXR6CiL5305o9pXjpuQFSMccflOwmbACFuaBOeuNxTNyD5fJcl-5nOoWH6DHJbFDXgFiRC2jGFnbkc-lFXQ_uIRum02olGphNLEt3GwBFqfjTgQ9kYmkXRghbQj7eexd663KHQDnEFUc0AIqw02BKw_hcBKhXo5kZAVB%26sig%3DCg0ArKJSzGM8Rb0FbSVIEAE%26fbs_aeid%3D%255Bgw_fbsaeid%255D%26urlfix%3D1%26adurl%3D;uach=WyJMaW51eCIsIiIsIng4NiIsIiIsIjE1Mi4wLjc5NzcuODIiLG51bGwsMCxudWxsLCI2NCIsW1siQ2hyb21pdW0iLCIxNTIuMC43OTc3LjgyIl0sWyJHb29nbGUgQ2hyb21lIiwiMTUyLjAuNzk3Ny44MiJdLFsiTm90P0FfQnJhbmQiLCIyNC4wLjAuMCJdXSwwXQ..;dc_rfl=1,https%3A%2F%2Fwww.darkreading.com%2Fcyberattacks-data-breaches%2Fattackers-multi-hop-google-redirects-phishing-campaign$0;xdt=0;crlt=gwRwuG70(h;cmpl=8;gcsr=m;stc=1;chaa=1;sttr=87;prcl=s
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.68.198 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
pnlgaa-ax-in-f6.1e100.net
Software
sffe /
Resource Hash
237036b82d42036125776b95fad1d4f1ab58d98a77fd848f64849b93228731b7
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://ad.doubleclick.net/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

age
297385
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
x-content-type-options
nosniff
expires
Sun, 05 Sep 2027 14:05:41 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
allow-fenced-frame-automatic-beacons
true
date
Sat, 05 Sep 2026 14:05:41 GMT
last-modified
Fri, 15 May 2026 11:12:52 GMT
content-type
image/jpeg
cache-control
public, max-age=31536000
timing-allow-origin
*
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
access-control-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
content-length
143157
x-xss-protection
0
server
sffe
GET
H3
200
sodar_loader.js Show response
pagead2.googlesyndication.com/pagead/js/r20260904/r20110914/xfa/ Frame CA48
13 KB
5 KB
88ms
41ms
Script
text/javascript
64.233.180.154
Google LLC
General
Full URL
https://pagead2.googlesyndication.com/pagead/js/r20260904/r20110914/xfa/sodar_loader.js
Requested by
Host: ad.doubleclick.net
URL: https://ad.doubleclick.net/ddm/adi/N520403.127711DARKREADING/B35832278.447559437;dc_ver=106.314;dc_eid=40004000;sz=640x480;u_sd=1;gdpr=0;dc_adk=2473714756;ord=nz29w6;click=https%3A%2F%2Fadclick.g.doubleclick.net%2Fpcs%2Fclick%3Fxai%3DAKAOjsu-r5iDaHcuPdbO75blbSNj10vv8HZuM0G-x-GopfMJoPQDiR4QZrtyhRzf8KycizHcd3aYMSQ6x8l5AkSj-mMjSpvqsMjHeyc2u3XoeapYIHvR06j-bNAWQH-BgGUpgioH4agm-rzvfJfROoUfFzpEjCcumBHsFGfOYBwdUUgR_4JvirmONr0A4ul4H5eYue80xgNVAgfmR4GGsBdN1lVy2_dVK0RMvK8t9QyFHOXZVf2d_3HcAs_IMsvtrGwhUD2cSYlvyfU27vLVcUPaBJJebidor5Q2pDfe_Fp6EPh2CPZQ6FKfiHClOHJqZU337mVDGg9R_6o0Yz8pYp9QIaT4-R5zpit01mkeBhMGLYV4WVjxxxFqPTZxf6Vd47kZCPftSPErpOLG1f9vSiLyazcPBzSMVTsz9XMPM-0gtBmfeiPY7kIl7SXlLPHJf-NdcSmMyj0%26sai%3DAMfl-YQqNeQ13sZJ-MA8hCfcA1W_3rEbLfDDHwWvRBcc8fDkaweii5sDV650asp4plTiRm4UeOBBC_4BXTQFx-6EL6roOz0ssNKnwScKeCdu9SrXwbHsLPGPruf9cBcQFzvMFGH7ygh3Lyar8ZBYCc6ObFrsemd9GIFnSDsQwNBFJopA-dr-qdaZMIrIVMWY4jjfH1eqPPIEXrn_wmwl8KC2wdEBFXJkzBdXgXwkLO7IAYAEaXR6CiL5305o9pXjpuQFSMccflOwmbACFuaBOeuNxTNyD5fJcl-5nOoWH6DHJbFDXgFiRC2jGFnbkc-lFXQ_uIRum02olGphNLEt3GwBFqfjTgQ9kYmkXRghbQj7eexd663KHQDnEFUc0AIqw02BKw_hcBKhXo5kZAVB%26sig%3DCg0ArKJSzGM8Rb0FbSVIEAE%26fbs_aeid%3D%255Bgw_fbsaeid%255D%26urlfix%3D1%26adurl%3D;uach=WyJMaW51eCIsIiIsIng4NiIsIiIsIjE1Mi4wLjc5NzcuODIiLG51bGwsMCxudWxsLCI2NCIsW1siQ2hyb21pdW0iLCIxNTIuMC43OTc3LjgyIl0sWyJHb29nbGUgQ2hyb21lIiwiMTUyLjAuNzk3Ny44MiJdLFsiTm90P0FfQnJhbmQiLCIyNC4wLjAuMCJdXSwwXQ..;dc_rfl=1,https%3A%2F%2Fwww.darkreading.com%2Fcyberattacks-data-breaches%2Fattackers-multi-hop-google-redirects-phishing-campaign$0;xdt=0;crlt=gwRwuG70(h;cmpl=8;gcsr=m;stc=1;chaa=1;sttr=87;prcl=s
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
64.233.180.154 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
pe-in-f154.1e100.net
Software
cafe /
Resource Hash
5caad9c12e3f2f62e4f992381cfeb4ebc73cd92709a9ce311098873811f688a1
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://ad.doubleclick.net/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
br
etag
864530976519635400
age
52023
x-content-type-options
nosniff
expires
Tue, 22 Sep 2026 10:15:03 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date
Tue, 08 Sep 2026 10:15:03 GMT
content-disposition
attachment; filename="f.txt"
content-type
text/javascript; charset=UTF-8
vary
Accept-Encoding
cache-control
public, max-age=1209600
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
access-control-allow-origin
*
content-length
4858
x-xss-protection
0
server
cafe
GET
H3
200
omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20260904/r20110914/elements/html/ Frame CA48
13 KB
5 KB
41ms
40ms
Script
text/javascript
64.233.180.154
Google LLC
General
Full URL
https://pagead2.googlesyndication.com/pagead/js/r20260904/r20110914/elements/html/omrhp.js
Requested by
Host: ad.doubleclick.net
URL: https://ad.doubleclick.net/ddm/adi/N520403.127711DARKREADING/B35832278.447559437;dc_ver=106.314;dc_eid=40004000;sz=640x480;u_sd=1;gdpr=0;dc_adk=2473714756;ord=nz29w6;click=https%3A%2F%2Fadclick.g.doubleclick.net%2Fpcs%2Fclick%3Fxai%3DAKAOjsu-r5iDaHcuPdbO75blbSNj10vv8HZuM0G-x-GopfMJoPQDiR4QZrtyhRzf8KycizHcd3aYMSQ6x8l5AkSj-mMjSpvqsMjHeyc2u3XoeapYIHvR06j-bNAWQH-BgGUpgioH4agm-rzvfJfROoUfFzpEjCcumBHsFGfOYBwdUUgR_4JvirmONr0A4ul4H5eYue80xgNVAgfmR4GGsBdN1lVy2_dVK0RMvK8t9QyFHOXZVf2d_3HcAs_IMsvtrGwhUD2cSYlvyfU27vLVcUPaBJJebidor5Q2pDfe_Fp6EPh2CPZQ6FKfiHClOHJqZU337mVDGg9R_6o0Yz8pYp9QIaT4-R5zpit01mkeBhMGLYV4WVjxxxFqPTZxf6Vd47kZCPftSPErpOLG1f9vSiLyazcPBzSMVTsz9XMPM-0gtBmfeiPY7kIl7SXlLPHJf-NdcSmMyj0%26sai%3DAMfl-YQqNeQ13sZJ-MA8hCfcA1W_3rEbLfDDHwWvRBcc8fDkaweii5sDV650asp4plTiRm4UeOBBC_4BXTQFx-6EL6roOz0ssNKnwScKeCdu9SrXwbHsLPGPruf9cBcQFzvMFGH7ygh3Lyar8ZBYCc6ObFrsemd9GIFnSDsQwNBFJopA-dr-qdaZMIrIVMWY4jjfH1eqPPIEXrn_wmwl8KC2wdEBFXJkzBdXgXwkLO7IAYAEaXR6CiL5305o9pXjpuQFSMccflOwmbACFuaBOeuNxTNyD5fJcl-5nOoWH6DHJbFDXgFiRC2jGFnbkc-lFXQ_uIRum02olGphNLEt3GwBFqfjTgQ9kYmkXRghbQj7eexd663KHQDnEFUc0AIqw02BKw_hcBKhXo5kZAVB%26sig%3DCg0ArKJSzGM8Rb0FbSVIEAE%26fbs_aeid%3D%255Bgw_fbsaeid%255D%26urlfix%3D1%26adurl%3D;uach=WyJMaW51eCIsIiIsIng4NiIsIiIsIjE1Mi4wLjc5NzcuODIiLG51bGwsMCxudWxsLCI2NCIsW1siQ2hyb21pdW0iLCIxNTIuMC43OTc3LjgyIl0sWyJHb29nbGUgQ2hyb21lIiwiMTUyLjAuNzk3Ny44MiJdLFsiTm90P0FfQnJhbmQiLCIyNC4wLjAuMCJdXSwwXQ..;dc_rfl=1,https%3A%2F%2Fwww.darkreading.com%2Fcyberattacks-data-breaches%2Fattackers-multi-hop-google-redirects-phishing-campaign$0;xdt=0;crlt=gwRwuG70(h;cmpl=8;gcsr=m;stc=1;chaa=1;sttr=87;prcl=s
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
64.233.180.154 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
pe-in-f154.1e100.net
Software
cafe /
Resource Hash
b615533eb7c29c8287b993f8162285592ef9e1dc3b0b033deeb0133ca54db8ab
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://ad.doubleclick.net/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
br
etag
11996168583361498667
age
60765
x-content-type-options
nosniff
expires
Tue, 22 Sep 2026 07:49:21 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date
Tue, 08 Sep 2026 07:49:21 GMT
content-disposition
attachment; filename="f.txt"
content-type
text/javascript; charset=UTF-8
vary
Accept-Encoding
cache-control
public, max-age=1209600
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
access-control-allow-origin
*
content-length
4834
x-xss-protection
0
server
cafe
GET
H3
200
reach_worklet.html Show response
www.googleadservices.com/pagead/managed/js/activeview/current/ Frame 2C80
93 B
0
0ms
0ms
Document
text/html
142.251.167.157
Google LLC
General
Full URL
https://www.googleadservices.com/pagead/managed/js/activeview/current/reach_worklet.html
Requested by
Host: transcend-cdn.com
URL: https://transcend-cdn.com/cm/ef49a3f1-d8c1-47d6-88fc-50e41130631f/airgap.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.167.157 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
ww-in-f157.1e100.net
Software
cafe /
Resource Hash
136b3dfa7c254f92a9a3513c191c87c05f7c7ff7f82c6d648a33496c3c380593
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.darkreading.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0
sec-ch-ua-platform
"Linux"

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
private, max-age=3600, stale-while-revalidate=3600
content-encoding
br
content-length
69
content-type
text/html; charset=UTF-8
cross-origin-resource-policy
cross-origin
date
Wed, 09 Sep 2026 00:42:06 GMT
etag
9658810392779322030
expires
Wed, 09 Sep 2026 00:42:06 GMT
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server
cafe
timing-allow-origin
*
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
0
GET
H3
200
reach_worklet.js Show response
www.googleadservices.com/pagead/managed/js/activeview/current/ Frame 140A
196 KB
62 KB
84ms
81ms
Script
text/javascript
142.251.167.157
Google LLC
General
Full URL
https://www.googleadservices.com/pagead/managed/js/activeview/current/reach_worklet.js
Requested by
Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/managed/js/activeview/current/reach_worklet.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.167.157 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
ww-in-f157.1e100.net
Software
cafe /
Resource Hash
f553d47197d2f0110392859534f34cbcefb7b47319d99151e43708c5ab3f87c1
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.googleadservices.com/pagead/managed/js/activeview/current/reach_worklet.html
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
br
etag
9622583581042959437
x-content-type-options
nosniff
expires
Wed, 09 Sep 2026 00:42:06 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date
Wed, 09 Sep 2026 00:42:06 GMT
content-type
text/javascript; charset=UTF-8
vary
Accept-Encoding
content-disposition
attachment; filename="f.txt"
cache-control
private, max-age=3600, stale-while-revalidate=3600
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
content-length
63634
x-xss-protection
0
server
cafe
GET
H/1.1
200
OK
dv-measurements10456.js Show response
cdn.doubleverify.com/ Frame 7EC0
482 KB
0
52ms
52ms
Script
text/javascript
23.210.73.49
AKAMAI-ASN1 Akama...
General
Full URL
https://cdn.doubleverify.com/dv-measurements10456.js
Requested by
Host: transcend-cdn.com
URL: https://transcend-cdn.com/cm/ef49a3f1-d8c1-47d6-88fc-50e41130631f/airgap.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
23.210.73.49 Secaucus, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),
Reverse DNS
a23-210-73-49.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
2f7d151682e4657b099b86a53e3314931c9a560fb9f889d7b1a63db730fa705d

Request headers

Referer

Response headers

Access-Control-Expose-Headers
*
Cache-Control
max-age=31536000
Content-Encoding
br
ETag
"5f0ff395d23840dfbdfa6555d7dc5b94"
Expires
Thu, 09 Sep 2027 00:42:06 GMT
Accept-Ranges
bytes
Access-Control-Allow-Origin
*
Content-Length
97551
Date
Wed, 09 Sep 2026 00:42:06 GMT
Last-Modified
Tue, 08 Sep 2026 05:45:35 GMT
Content-Type
text/javascript
GET
H3
200
reach_worklet.html Show response
www.googleadservices.com/pagead/managed/js/activeview/current/ Frame 9EBD
93 B
0
1ms
1ms
Document
text/html
142.251.167.157
Google LLC
General
Full URL
https://www.googleadservices.com/pagead/managed/js/activeview/current/reach_worklet.html
Requested by
Host: transcend-cdn.com
URL: https://transcend-cdn.com/cm/ef49a3f1-d8c1-47d6-88fc-50e41130631f/airgap.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.167.157 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
ww-in-f157.1e100.net
Software
cafe /
Resource Hash
136b3dfa7c254f92a9a3513c191c87c05f7c7ff7f82c6d648a33496c3c380593
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.darkreading.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0
sec-ch-ua-platform
"Linux"

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
private, max-age=3600, stale-while-revalidate=3600
content-encoding
br
content-length
69
content-type
text/html; charset=UTF-8
cross-origin-resource-policy
cross-origin
date
Wed, 09 Sep 2026 00:42:06 GMT
etag
9658810392779322030
expires
Wed, 09 Sep 2026 00:42:06 GMT
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server
cafe
timing-allow-origin
*
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
0
GET
H2
200
web.js Show response
cdn.celtra.com/ads/42f65aba/ Frame 2A36
15 KB
5 KB
177ms
66ms
Script
application/javascript
13.32.241.19
Amazon.com
General
Full URL
https://cdn.celtra.com/ads/42f65aba/web.js?&accountId=382ce2c3&clickUrl=https%3A%2F%2Fadclick.g.doubleclick.net%2Fpcs%2Fclick%3Fxai%3DAKAOjsv55flgjGLKKWKF-Ir7_N3UPQ9Lq163SPijKRtBwD73_UlDPfZD1rWLrjx8Juot9vd7d0EfwTNSLVY0Xdj2G1Xkkq4Ipt_atTMQY73DrB93Rf-UOlPmVmLA_cZKczuMTwLbrgpDLmHAnKcx38WhEV4MNjIKDucqH9sZGqq2GUwTvlziz6JvvnQFo6JMfCBh5pPuSlwjdrXaAmufaRoGIOu7tRIC0mHuta_4oa_zltbkMp4rTnPWbq_-oYhB0ILtdAkWIdhNtiS2tFTmV0yPm8GFceuWifzIctfO7JsAZfhy4o3vYj8MNDNnGAZAKsdDejgcqWhJRZnpHNGnGtU1jewweBnlOsk3CW0dbFEtfCxnZ_C5RXbaQzwUSyOlDkpis0L-ZIdtXE6I2kW6B6Is4XfRRzuxU-K5kDiE4kuENEzgTKeHfDMKIvwEIYheD6Ywpkbea08%26sai%3DAMfl-YT5BxJqplnq443i_J1N7X3d28nwpY0gIKpZukT6t6mkkQVBSgkc6EFBiYzCl--gfd2ElZZLVjaUDbSb41OibN0ira1hoyESodgRW6WAngBQnPPww3Bbv6nXFihEy87CatLn_OPHVshwArEW1iDMDsrvCdVPbHTg1cm6C-N5axSFoaT07h-yFML8U3L-5m0j_LjzyxQw_Wib7wYRc0UgbvCia7o5sCBraV25JVIHlWWOS9y9c642XgAG2j_Zca6BpFhm8xZXjbKDzRJKinkZ9ykF6BKvausoj7Iwg610C3xdZAmzgys9VwpUIM4945caOjXk_8zJFHVak_AbD7J6GiKpeTG6DFCkYj7tKDPGq6C_BZfEVV1hvGA%26sig%3DCg0ArKJSzFQNTxLvmbrHEAE%26fbs_aeid%3D%255Bgw_fbsaeid%255D%26urlfix%3D1%26adurl%3D&expandDirection=undefined&clickEvent=advertiser&iosAdvId=&androidAdvId=&externalAdServer=GoogleAdManager&tagVersion=html-standard-10&eas.JWVjaWQh=138568043700&externalCreativeId=138568043700&externalPlacementId=23311018763&externalSiteId=23309879500&externalSiteName=darkreading.com&externalLineItemId=7129991679&externalCampaignId=3886181507&externalAdvertiserId=5857754385&coppa=0&externalCreativeSize=5x5&scriptId=celtra-script-1&clientTimestamp=1788914526.675&clientTimeZoneOffsetInMinutes=420&hostPageLoadId=1300070680644625
Requested by
Host: transcend-cdn.com
URL: https://transcend-cdn.com/cm/ef49a3f1-d8c1-47d6-88fc-50e41130631f/airgap.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.32.241.19 New York, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-13-32-241-19.jfk50.r.cloudfront.net
Software
/
Resource Hash
e6c3f4827dd29360a1909587200ff206e002594276a41d78be1f25d61ad2728f

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

cache-control
no-store
content-encoding
gzip
via
1.1 68f8ff7a6e326bbdf97019cfeb60c628.cloudfront.net (CloudFront)
alt-svc
h3=":443"; ma=86400
x-cache
Miss from cloudfront
content-length
5208
x-amz-cf-id
UAofCJ79YiSbE3wNEmifznpiSmDTesdQFAvSg_h6ch2V30S5bCZ5lg==
date
Wed, 09 Sep 2026 00:42:06 GMT
content-type
application/javascript; charset=utf-8
x-amz-cf-pop
JFK50-P13
GET
H3
200
reach_worklet.html Show response
www.googleadservices.com/pagead/managed/js/activeview/current/ Frame 62F2
93 B
0
0ms
0ms
Document
text/html
142.251.167.157
Google LLC
General
Full URL
https://www.googleadservices.com/pagead/managed/js/activeview/current/reach_worklet.html
Requested by
Host: transcend-cdn.com
URL: https://transcend-cdn.com/cm/ef49a3f1-d8c1-47d6-88fc-50e41130631f/airgap.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.167.157 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
ww-in-f157.1e100.net
Software
cafe /
Resource Hash
136b3dfa7c254f92a9a3513c191c87c05f7c7ff7f82c6d648a33496c3c380593
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.darkreading.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0
sec-ch-ua-platform
"Linux"

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
private, max-age=3600, stale-while-revalidate=3600
content-encoding
br
content-length
69
content-type
text/html; charset=UTF-8
cross-origin-resource-policy
cross-origin
date
Wed, 09 Sep 2026 00:42:06 GMT
etag
9658810392779322030
expires
Wed, 09 Sep 2026 00:42:06 GMT
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server
cafe
timing-allow-origin
*
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
0
GET
H/1.1
200
OK
dv-measurements10456.js Show response
cdn.doubleverify.com/ Frame AD38
482 KB
0
52ms
52ms
Script
text/javascript
23.210.73.49
AKAMAI-ASN1 Akama...
General
Full URL
https://cdn.doubleverify.com/dv-measurements10456.js
Requested by
Host: transcend-cdn.com
URL: https://transcend-cdn.com/cm/ef49a3f1-d8c1-47d6-88fc-50e41130631f/airgap.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
23.210.73.49 Secaucus, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),
Reverse DNS
a23-210-73-49.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
2f7d151682e4657b099b86a53e3314931c9a560fb9f889d7b1a63db730fa705d

Request headers

Referer

Response headers

Access-Control-Expose-Headers
*
Cache-Control
max-age=31536000
Content-Encoding
br
ETag
"5f0ff395d23840dfbdfa6555d7dc5b94"
Expires
Thu, 09 Sep 2027 00:42:06 GMT
Accept-Ranges
bytes
Access-Control-Allow-Origin
*
Content-Length
97551
Date
Wed, 09 Sep 2026 00:42:06 GMT
Last-Modified
Tue, 08 Sep 2026 05:45:35 GMT
Content-Type
text/javascript
GET
H3
200
ufs_web_display.js Show response
pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ Frame CA48
239 KB
74 KB
41ms
41ms
Script
text/javascript
64.233.180.154
Google LLC
General
Full URL
https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js?cache=r20110914
Requested by
Host: ad.doubleclick.net
URL: https://ad.doubleclick.net/ddm/adi/N520403.127711DARKREADING/B35832278.447559437;dc_ver=106.314;dc_eid=40004000;sz=640x480;u_sd=1;gdpr=0;dc_adk=2473714756;ord=nz29w6;click=https%3A%2F%2Fadclick.g.doubleclick.net%2Fpcs%2Fclick%3Fxai%3DAKAOjsu-r5iDaHcuPdbO75blbSNj10vv8HZuM0G-x-GopfMJoPQDiR4QZrtyhRzf8KycizHcd3aYMSQ6x8l5AkSj-mMjSpvqsMjHeyc2u3XoeapYIHvR06j-bNAWQH-BgGUpgioH4agm-rzvfJfROoUfFzpEjCcumBHsFGfOYBwdUUgR_4JvirmONr0A4ul4H5eYue80xgNVAgfmR4GGsBdN1lVy2_dVK0RMvK8t9QyFHOXZVf2d_3HcAs_IMsvtrGwhUD2cSYlvyfU27vLVcUPaBJJebidor5Q2pDfe_Fp6EPh2CPZQ6FKfiHClOHJqZU337mVDGg9R_6o0Yz8pYp9QIaT4-R5zpit01mkeBhMGLYV4WVjxxxFqPTZxf6Vd47kZCPftSPErpOLG1f9vSiLyazcPBzSMVTsz9XMPM-0gtBmfeiPY7kIl7SXlLPHJf-NdcSmMyj0%26sai%3DAMfl-YQqNeQ13sZJ-MA8hCfcA1W_3rEbLfDDHwWvRBcc8fDkaweii5sDV650asp4plTiRm4UeOBBC_4BXTQFx-6EL6roOz0ssNKnwScKeCdu9SrXwbHsLPGPruf9cBcQFzvMFGH7ygh3Lyar8ZBYCc6ObFrsemd9GIFnSDsQwNBFJopA-dr-qdaZMIrIVMWY4jjfH1eqPPIEXrn_wmwl8KC2wdEBFXJkzBdXgXwkLO7IAYAEaXR6CiL5305o9pXjpuQFSMccflOwmbACFuaBOeuNxTNyD5fJcl-5nOoWH6DHJbFDXgFiRC2jGFnbkc-lFXQ_uIRum02olGphNLEt3GwBFqfjTgQ9kYmkXRghbQj7eexd663KHQDnEFUc0AIqw02BKw_hcBKhXo5kZAVB%26sig%3DCg0ArKJSzGM8Rb0FbSVIEAE%26fbs_aeid%3D%255Bgw_fbsaeid%255D%26urlfix%3D1%26adurl%3D;uach=WyJMaW51eCIsIiIsIng4NiIsIiIsIjE1Mi4wLjc5NzcuODIiLG51bGwsMCxudWxsLCI2NCIsW1siQ2hyb21pdW0iLCIxNTIuMC43OTc3LjgyIl0sWyJHb29nbGUgQ2hyb21lIiwiMTUyLjAuNzk3Ny44MiJdLFsiTm90P0FfQnJhbmQiLCIyNC4wLjAuMCJdXSwwXQ..;dc_rfl=1,https%3A%2F%2Fwww.darkreading.com%2Fcyberattacks-data-breaches%2Fattackers-multi-hop-google-redirects-phishing-campaign$0;xdt=0;crlt=gwRwuG70(h;cmpl=8;gcsr=m;stc=1;chaa=1;sttr=87;prcl=s
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
64.233.180.154 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
pe-in-f154.1e100.net
Software
cafe /
Resource Hash
5b0d6fda9d4c1601d352e39f939162c2e95e547915536847e3782a0a10dfd92d
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://ad.doubleclick.net/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
br
etag
2640385400941753791
age
1744
x-content-type-options
nosniff
expires
Wed, 09 Sep 2026 01:13:02 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date
Wed, 09 Sep 2026 00:13:02 GMT
content-disposition
attachment; filename="f.txt"
content-type
text/javascript; charset=UTF-8
vary
Accept-Encoding
cache-control
public, max-age=3600, stale-while-revalidate=3600
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
content-length
75325
x-xss-protection
0
server
cafe
GET
H2
200
view
googleads4.g.doubleclick.net/pcs/ Frame CA48
0
0
226ms
65ms
Fetch
image/gif
172.253.62.157
Google LLC
General
Full URL
https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjssKYpPJOmFlBdgBde6LD-erhFeJQ5N4JNSqRI3_IuYfFCFMHL1CcTZE-icbcpbnYYB7eQe9pn1KZyuX94_uoduhDWlzMqaXRSrP9a2msYJmRUxNUj9rKkoKDfx0yHT6LLU9OV8Iy5eKZe6tr7MO3XXgD_s5_CxL06uj3EaSZL1SD1enlkd9TCSMOI7xdvZz2nNqyV5GLxTF8_0qlOc8UxaUoQ&sai=AMfl-YQ3BEQN6afZh4flElKQxbhM5pSBwVJjt8iErpz1V0p_YlA-g6USS0z49HMtAlTM_xqJtdUif1s9USHcuOUBO9bAX81dPDR1FpfCQo2lBNktM3VXPmwfOs1ZM-yRX7l1pcQ8TAhb-eatn6msTU1AirNrr6mRZpVFfaPgBhL9sIM7sHIoBlGyCmaaqCtH0eWg9o0UieJCHNmcE5lvO1iugYkO3jxe4zkc7Y_PjJQieluoGf2UdF8iepHhZGCwihecLmjYIAJDmMq2pIH6msAIgggyMMcXegHsRQxx41JbeCvEx5nC_L_p5aHFCK6aZL9A9VmWuz_D527rA_jykHNBK3rl_SsB0g&sig=Cg0ArKJSzHFCzguHpwwBEAE&uach_m=%5BUACH%5D&cry=1&fbs_aeid=%5Bgw_fbsaeid%5D&urlfix=1&omid=0&rm=1&ctpt=2&cbvp=2&dett=2&cstd=0&cisv=r20260904.15438&arae=0&ftch=1&adurl=
Requested by
Host: ad.doubleclick.net
URL: https://ad.doubleclick.net/ddm/adi/N520403.127711DARKREADING/B35832278.447559437;dc_ver=106.314;dc_eid=40004000;sz=640x480;u_sd=1;gdpr=0;dc_adk=2473714756;ord=nz29w6;click=https%3A%2F%2Fadclick.g.doubleclick.net%2Fpcs%2Fclick%3Fxai%3DAKAOjsu-r5iDaHcuPdbO75blbSNj10vv8HZuM0G-x-GopfMJoPQDiR4QZrtyhRzf8KycizHcd3aYMSQ6x8l5AkSj-mMjSpvqsMjHeyc2u3XoeapYIHvR06j-bNAWQH-BgGUpgioH4agm-rzvfJfROoUfFzpEjCcumBHsFGfOYBwdUUgR_4JvirmONr0A4ul4H5eYue80xgNVAgfmR4GGsBdN1lVy2_dVK0RMvK8t9QyFHOXZVf2d_3HcAs_IMsvtrGwhUD2cSYlvyfU27vLVcUPaBJJebidor5Q2pDfe_Fp6EPh2CPZQ6FKfiHClOHJqZU337mVDGg9R_6o0Yz8pYp9QIaT4-R5zpit01mkeBhMGLYV4WVjxxxFqPTZxf6Vd47kZCPftSPErpOLG1f9vSiLyazcPBzSMVTsz9XMPM-0gtBmfeiPY7kIl7SXlLPHJf-NdcSmMyj0%26sai%3DAMfl-YQqNeQ13sZJ-MA8hCfcA1W_3rEbLfDDHwWvRBcc8fDkaweii5sDV650asp4plTiRm4UeOBBC_4BXTQFx-6EL6roOz0ssNKnwScKeCdu9SrXwbHsLPGPruf9cBcQFzvMFGH7ygh3Lyar8ZBYCc6ObFrsemd9GIFnSDsQwNBFJopA-dr-qdaZMIrIVMWY4jjfH1eqPPIEXrn_wmwl8KC2wdEBFXJkzBdXgXwkLO7IAYAEaXR6CiL5305o9pXjpuQFSMccflOwmbACFuaBOeuNxTNyD5fJcl-5nOoWH6DHJbFDXgFiRC2jGFnbkc-lFXQ_uIRum02olGphNLEt3GwBFqfjTgQ9kYmkXRghbQj7eexd663KHQDnEFUc0AIqw02BKw_hcBKhXo5kZAVB%26sig%3DCg0ArKJSzGM8Rb0FbSVIEAE%26fbs_aeid%3D%255Bgw_fbsaeid%255D%26urlfix%3D1%26adurl%3D;uach=WyJMaW51eCIsIiIsIng4NiIsIiIsIjE1Mi4wLjc5NzcuODIiLG51bGwsMCxudWxsLCI2NCIsW1siQ2hyb21pdW0iLCIxNTIuMC43OTc3LjgyIl0sWyJHb29nbGUgQ2hyb21lIiwiMTUyLjAuNzk3Ny44MiJdLFsiTm90P0FfQnJhbmQiLCIyNC4wLjAuMCJdXSwwXQ..;dc_rfl=1,https%3A%2F%2Fwww.darkreading.com%2Fcyberattacks-data-breaches%2Fattackers-multi-hop-google-redirects-phishing-campaign$0;xdt=0;crlt=gwRwuG70(h;cmpl=8;gcsr=m;stc=1;chaa=1;sttr=87;prcl=s
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.253.62.157 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
bc-in-f157.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://ad.doubleclick.net/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

cache-control
private
timing-allow-origin
*
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
cross-origin-resource-policy
cross-origin
x-content-type-options
nosniff
access-control-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length
0
date
Wed, 09 Sep 2026 00:42:06 GMT
x-xss-protection
0
content-type
image/gif
server
cafe
GET
H3
200
reach_worklet.js Show response
www.googleadservices.com/pagead/managed/js/activeview/current/ Frame 2C80
196 KB
0
0ms
0ms
Script
text/javascript
142.251.167.157
Google LLC
General
Full URL
https://www.googleadservices.com/pagead/managed/js/activeview/current/reach_worklet.js
Requested by
Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/managed/js/activeview/current/reach_worklet.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.167.157 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
ww-in-f157.1e100.net
Software
cafe /
Resource Hash
f553d47197d2f0110392859534f34cbcefb7b47319d99151e43708c5ab3f87c1
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.googleadservices.com/pagead/managed/js/activeview/current/reach_worklet.html
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
br
etag
9622583581042959437
x-content-type-options
nosniff
expires
Wed, 09 Sep 2026 00:42:06 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date
Wed, 09 Sep 2026 00:42:06 GMT
content-type
text/javascript; charset=UTF-8
vary
Accept-Encoding
content-disposition
attachment; filename="f.txt"
cache-control
private, max-age=3600, stale-while-revalidate=3600
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
content-length
63634
x-xss-protection
0
server
cafe
GET
H/1.1
200
OK
visit.js Show response
tps.doubleverify.com/ Frame 7EC0
578 B
706 B
61ms
60ms
Script
text/javascript
34.117.228.201
Google LLC
General
Full URL
https://tps.doubleverify.com/visit.js?gdpr_consent=&flvr=0&ttmms=150&ttfrms=17&brid=3&brver=152.0.0.0&bridua=3&bds=1&tstype=2&eparams=DC4FC%3Dl9EEADTbpTauTauHHH%5D52C%3CC625%3A%3F8%5D4%40%3ETau4J36C2EE24%3CD%5C52E2%5C3C62496DTau2EE24%3C6CD%5C%3EF%3DE%3A%5C9%40A%5C8%40%408%3D6%5CC65%3AC64ED%5CA9%3AD9%3A%3F8%5C42%3EA2%3A8%3FU2%3F4r92%3A%3Fl9EEADTbpTauTauHHH%5D52C%3CC625%3A%3F8%5D4%40%3ETar23%40FETbpTauTauU42%3FFC%3Dl9EEADTbpTauTauHHH%5D52C%3CC625%3A%3F8%5D4%40%3ETau4J36C2EE24%3CD%5C52E2%5C3C62496DTau2EE24%3C6CD%5C%3EF%3DE%3A%5C9%40A%5C8%40%408%3D6%5CC65%3AC64ED%5CA9%3AD9%3A%3F8%5C42%3EA2%3A8%3F&srcurlD=0&aUrlD=0&ssl=https:&dfs=13&ddur=0&uid=1788914526796367&jsCallback=dvCallback_1788914526796826&dvtagver=6.1.src&navUa=Mozilla%2F5.0%20(X11%3B%20Linux%20x86_64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F152.0.0.0%20Safari%2F537.36&htmlmsging=1&chro=1&hist=2&winh=1200&winw=1600&wouh=1200&wouw=1600&scah=1200&scaw=1600&tgjsver=10456&lvvn=28&m1=96&refD=1&referrer=about%3Ablank&fwc=1&fcl=1613&flt=4&fec=990&fcifrms=18&brh=2&dvp_epl=465&noc=16&nav_pltfrm=Linux%20x86_64&ctx=19913272&cmp=DV424940&adsrv=104&jsver=10456&unit=728x90&seltag=1&sadv=5856710547&ord=4142175498&litm=7384623559&scrt=138568952004&splc=%2F3618%2Fdarkreading.home%2Farticle%2Fcyberattacks-data-breaches&spos=728_1v&c4=0&gdpr=0&errorURL=https://tps.doubleverify.com/visit.jpg&mib=0&t2te=0&dvp_pubaap=2&dich=1&dvp_uptbts=1788912138907&dvp_uptbcid=b30b55d&dvp_gptmasid=16&dvp_uptsid=e3da704f-167f-431e-a509-02085079738b&dvp_uptseid=728_1v&mpt_pub_qtbscpl=1&mpt_pub_qtids=0&dvp_uptpid=9bd90912-941c-4372-aed8-f37dc1c8c47e&dvp_qtpid=9bd90912-941c-4372-aed8-f37dc1c8c47e&dvp_qtsid=e3da704f-167f-431e-a509-02085079738b&mpt_pub_dvr=srti_00434591-a1aa-4ce3-89b6-5bbcc82a4d97%2Csrtb_2cda02ad-0d6e-47b5-9888-7f2f25097118&dvp_uptsacnt=1&dvp_gptmle=1&alm=manual&dvp_pubaft=1&ee_dp_pubaft=1&dvp_gptmit=0&dvp_pubuaf=0&dvp_rcp=2&dvp_htec=1&dvp_seem=2&dvp_tuk=1&dvp_sukv=576560716.7930255&ee_dp_sukv=576560716.7930255&dvp_tukv=85167129528.04784&ee_dp_tukv=85167129528.04784&dvp_tuid=744401682135&ee_dp_vjeg=0
Requested by
Host: transcend-cdn.com
URL: https://transcend-cdn.com/cm/ef49a3f1-d8c1-47d6-88fc-50e41130631f/airgap.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
34.117.228.201 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM - Google LLC, US),
Reverse DNS
201.228.117.34.bc.googleusercontent.com
Software
/
Resource Hash
68c518045723303165c852609d256e8e9f1444a7075687d43decd7f1831ff585

Request headers

sec-ch-ua-platform
"Linux"
Referer
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

Transfer-Encoding
chunked
Cache-Control
max-age=0
Timing-Allow-Origin
*
Content-Encoding
br
Pragma
no-cache
Connection
keep-alive
Expires
09/08/2026 00:42:06
Date
Wed, 09 Sep 2026 00:42:06 GMT
Content-Type
text/javascript
Vary
Accept-Encoding
GET
H3
200
reach_worklet.js Show response
www.googleadservices.com/pagead/managed/js/activeview/current/ Frame 9EBD
196 KB
0
0ms
0ms
Script
text/javascript
142.251.167.157
Google LLC
General
Full URL
https://www.googleadservices.com/pagead/managed/js/activeview/current/reach_worklet.js
Requested by
Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/managed/js/activeview/current/reach_worklet.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.167.157 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
ww-in-f157.1e100.net
Software
cafe /
Resource Hash
f553d47197d2f0110392859534f34cbcefb7b47319d99151e43708c5ab3f87c1
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.googleadservices.com/pagead/managed/js/activeview/current/reach_worklet.html
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
br
etag
9622583581042959437
x-content-type-options
nosniff
expires
Wed, 09 Sep 2026 00:42:06 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date
Wed, 09 Sep 2026 00:42:06 GMT
content-type
text/javascript; charset=UTF-8
vary
Accept-Encoding
content-disposition
attachment; filename="f.txt"
cache-control
private, max-age=3600, stale-while-revalidate=3600
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
content-length
63634
x-xss-protection
0
server
cafe
GET
H3
200
reach_worklet.js Show response
www.googleadservices.com/pagead/managed/js/activeview/current/ Frame 62F2
196 KB
0
1ms
1ms
Script
text/javascript
142.251.167.157
Google LLC
General
Full URL
https://www.googleadservices.com/pagead/managed/js/activeview/current/reach_worklet.js
Requested by
Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/managed/js/activeview/current/reach_worklet.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.167.157 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
ww-in-f157.1e100.net
Software
cafe /
Resource Hash
f553d47197d2f0110392859534f34cbcefb7b47319d99151e43708c5ab3f87c1
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.googleadservices.com/pagead/managed/js/activeview/current/reach_worklet.html
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
br
etag
9622583581042959437
x-content-type-options
nosniff
expires
Wed, 09 Sep 2026 00:42:06 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date
Wed, 09 Sep 2026 00:42:06 GMT
content-type
text/javascript; charset=UTF-8
vary
Accept-Encoding
content-disposition
attachment; filename="f.txt"
cache-control
private, max-age=3600, stale-while-revalidate=3600
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
content-length
63634
x-xss-protection
0
server
cafe
GET
H/1.1
200
OK
visit.js Show response
tps.doubleverify.com/ Frame AD38
750 B
789 B
62ms
61ms
Script
text/javascript
34.117.228.201
Google LLC
General
Full URL
https://tps.doubleverify.com/visit.js?gdpr_consent=&flvr=0&ttmms=176&ttfrms=20&brid=3&brver=152.0.0.0&bridua=3&bds=1&tstype=2&eparams=DC4FC%3Dl9EEADTbpTauTauHHH%5D52C%3CC625%3A%3F8%5D4%40%3ETau4J36C2EE24%3CD%5C52E2%5C3C62496DTau2EE24%3C6CD%5C%3EF%3DE%3A%5C9%40A%5C8%40%408%3D6%5CC65%3AC64ED%5CA9%3AD9%3A%3F8%5C42%3EA2%3A8%3FU2%3F4r92%3A%3Fl9EEADTbpTauTauHHH%5D52C%3CC625%3A%3F8%5D4%40%3ETar23%40FETbpTauTauU42%3FFC%3Dl9EEADTbpTauTauHHH%5D52C%3CC625%3A%3F8%5D4%40%3ETau4J36C2EE24%3CD%5C52E2%5C3C62496DTau2EE24%3C6CD%5C%3EF%3DE%3A%5C9%40A%5C8%40%408%3D6%5CC65%3AC64ED%5CA9%3AD9%3A%3F8%5C42%3EA2%3A8%3F&srcurlD=0&aUrlD=0&ssl=https:&dfs=9&ddur=0&uid=1788914526905540&jsCallback=dvCallback_1788914526905837&dvtagver=6.1.src&navUa=Mozilla%2F5.0%20(X11%3B%20Linux%20x86_64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F152.0.0.0%20Safari%2F537.36&htmlmsging=1&chro=1&hist=2&winh=1200&winw=1600&wouh=1200&wouw=1600&scah=1200&scaw=1600&tgjsver=10456&lvvn=28&m1=96&refD=1&referrer=about%3Ablank&fwc=1&fcl=1613&flt=4&fec=990&fcifrms=18&brh=2&dvp_epl=465&noc=16&nav_pltfrm=Linux%20x86_64&ctx=19913272&cmp=DV424940&adsrv=104&jsver=10456&unit=300x250&seltag=1&sadv=5856710547&ord=4142175498&litm=7384623559&scrt=138572238837&splc=%2F3618%2Fdarkreading.home%2Farticle%2Fcyberattacks-data-breaches&spos=300_1v&c4=0&gdpr=0&errorURL=https://tps.doubleverify.com/visit.jpg&mib=0&t2te=0&dvp_pubaap=2&dich=1&dvp_uptbts=1788912138907&dvp_uptbcid=b30b55d&dvp_gptmasid=16&dvp_uptsid=9f4f7ecd-62d4-4eec-8905-b0868f668e99&dvp_uptseid=300_1v&mpt_pub_qtbscpl=1&mpt_pub_qtids=0&dvp_uptpid=9bd90912-941c-4372-aed8-f37dc1c8c47e&dvp_qtpid=9bd90912-941c-4372-aed8-f37dc1c8c47e&dvp_qtsid=9f4f7ecd-62d4-4eec-8905-b0868f668e99&mpt_pub_dvr=srti_00434591-a1aa-4ce3-89b6-5bbcc82a4d97%2Csrtb_2cda02ad-0d6e-47b5-9888-7f2f25097118&dvp_uptsacnt=1&dvp_gptmle=1&alm=manual&dvp_pubaft=1&ee_dp_pubaft=1&dvp_gptmit=0&dvp_pubuaf=0&dvp_rcp=2&dvp_htec=1&dvp_seem=2&dvp_tuk=1&dvp_sukv=524631741828.4598&ee_dp_sukv=524631741828.4598&dvp_tukv=1459902995532.631&ee_dp_tukv=1459902995532.631&dvp_tuid=264122579944&ee_dp_vjeg=0
Requested by
Host: transcend-cdn.com
URL: https://transcend-cdn.com/cm/ef49a3f1-d8c1-47d6-88fc-50e41130631f/airgap.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
34.117.228.201 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM - Google LLC, US),
Reverse DNS
201.228.117.34.bc.googleusercontent.com
Software
/
Resource Hash
13ed9c616548f7bb869d7a5260e2e5542ce9707af623d6ae7499b0d80930aa4d

Request headers

sec-ch-ua-platform
"Linux"
Referer
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

Transfer-Encoding
chunked
Cache-Control
max-age=0
Timing-Allow-Origin
*
Content-Encoding
br
Pragma
no-cache
Connection
keep-alive
Expires
09/08/2026 00:42:06
Date
Wed, 09 Sep 2026 00:42:06 GMT
Content-Type
text/javascript
Vary
Accept-Encoding
GET
H2
200
VFc2VJAc.js Show response
ep2.adtrafficquality.google/sodar/ Frame CA48
43 KB
14 KB
148ms
43ms
Script
text/javascript
142.251.211.65
Google LLC
General
Full URL
https://ep2.adtrafficquality.google/sodar/VFc2VJAc.js
Requested by
Host: ad.doubleclick.net
URL: https://ad.doubleclick.net/ddm/adi/N520403.127711DARKREADING/B35832278.447559437;dc_ver=106.314;dc_eid=40004000;sz=640x480;u_sd=1;gdpr=0;dc_adk=2473714756;ord=nz29w6;click=https%3A%2F%2Fadclick.g.doubleclick.net%2Fpcs%2Fclick%3Fxai%3DAKAOjsu-r5iDaHcuPdbO75blbSNj10vv8HZuM0G-x-GopfMJoPQDiR4QZrtyhRzf8KycizHcd3aYMSQ6x8l5AkSj-mMjSpvqsMjHeyc2u3XoeapYIHvR06j-bNAWQH-BgGUpgioH4agm-rzvfJfROoUfFzpEjCcumBHsFGfOYBwdUUgR_4JvirmONr0A4ul4H5eYue80xgNVAgfmR4GGsBdN1lVy2_dVK0RMvK8t9QyFHOXZVf2d_3HcAs_IMsvtrGwhUD2cSYlvyfU27vLVcUPaBJJebidor5Q2pDfe_Fp6EPh2CPZQ6FKfiHClOHJqZU337mVDGg9R_6o0Yz8pYp9QIaT4-R5zpit01mkeBhMGLYV4WVjxxxFqPTZxf6Vd47kZCPftSPErpOLG1f9vSiLyazcPBzSMVTsz9XMPM-0gtBmfeiPY7kIl7SXlLPHJf-NdcSmMyj0%26sai%3DAMfl-YQqNeQ13sZJ-MA8hCfcA1W_3rEbLfDDHwWvRBcc8fDkaweii5sDV650asp4plTiRm4UeOBBC_4BXTQFx-6EL6roOz0ssNKnwScKeCdu9SrXwbHsLPGPruf9cBcQFzvMFGH7ygh3Lyar8ZBYCc6ObFrsemd9GIFnSDsQwNBFJopA-dr-qdaZMIrIVMWY4jjfH1eqPPIEXrn_wmwl8KC2wdEBFXJkzBdXgXwkLO7IAYAEaXR6CiL5305o9pXjpuQFSMccflOwmbACFuaBOeuNxTNyD5fJcl-5nOoWH6DHJbFDXgFiRC2jGFnbkc-lFXQ_uIRum02olGphNLEt3GwBFqfjTgQ9kYmkXRghbQj7eexd663KHQDnEFUc0AIqw02BKw_hcBKhXo5kZAVB%26sig%3DCg0ArKJSzGM8Rb0FbSVIEAE%26fbs_aeid%3D%255Bgw_fbsaeid%255D%26urlfix%3D1%26adurl%3D;uach=WyJMaW51eCIsIiIsIng4NiIsIiIsIjE1Mi4wLjc5NzcuODIiLG51bGwsMCxudWxsLCI2NCIsW1siQ2hyb21pdW0iLCIxNTIuMC43OTc3LjgyIl0sWyJHb29nbGUgQ2hyb21lIiwiMTUyLjAuNzk3Ny44MiJdLFsiTm90P0FfQnJhbmQiLCIyNC4wLjAuMCJdXSwwXQ..;dc_rfl=1,https%3A%2F%2Fwww.darkreading.com%2Fcyberattacks-data-breaches%2Fattackers-multi-hop-google-redirects-phishing-campaign$0;xdt=0;crlt=gwRwuG70(h;cmpl=8;gcsr=m;stc=1;chaa=1;sttr=87;prcl=s
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.251.211.65 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
pnlgaa-av-in-f1.1e100.net
Software
sffe /
Resource Hash
54573654901c495ecf67cc8ffd30108dd6f3a3c7332fd4dba41ab13877b75b8d
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://ad.doubleclick.net/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
br
age
2221
report-to
{"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
x-content-type-options
nosniff
expires
Wed, 09 Sep 2026 00:55:06 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Wed, 09 Sep 2026 00:05:06 GMT
last-modified
Thu, 13 Mar 2025 04:28:00 GMT
content-type
text/javascript
vary
Accept-Encoding
cache-control
public, max-age=3000
timing-allow-origin
*
cross-origin-opener-policy
same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
content-length
14328
x-xss-protection
0
server
sffe
GET
H3
204
gen_204
pagead2.googlesyndication.com/pagead/ Frame 336B
0
0
54ms
53ms
Fetch
image/gif
64.233.180.155
Google LLC
General
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=colleague-executed&name=1
Requested by
Host: transcend-cdn.com
URL: https://transcend-cdn.com/cm/ef49a3f1-d8c1-47d6-88fc-50e41130631f/airgap.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
64.233.180.155 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
on-in-f155.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

cache-control
no-cache, must-revalidate
timing-allow-origin
*
pragma
no-cache
cross-origin-resource-policy
cross-origin
x-content-type-options
nosniff
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length
0
date
Wed, 09 Sep 2026 00:42:07 GMT
x-xss-protection
0
content-type
image/gif
server
cafe
GET
H3
204
gen_204
pagead2.googlesyndication.com/pagead/ Frame 336B
0
0
54ms
53ms
Fetch
image/gif
64.233.180.155
Google LLC
General
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=reach&proto=CAlgAWACYANgBGgD
Requested by
Host: transcend-cdn.com
URL: https://transcend-cdn.com/cm/ef49a3f1-d8c1-47d6-88fc-50e41130631f/airgap.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
64.233.180.155 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
on-in-f155.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

cache-control
no-cache, must-revalidate
timing-allow-origin
*
pragma
no-cache
cross-origin-resource-policy
cross-origin
x-content-type-options
nosniff
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length
0
date
Wed, 09 Sep 2026 00:42:07 GMT
x-xss-protection
0
content-type
image/gif
server
cafe
GET
H3
200
sodar Show response
pagead2.googlesyndication.com/getconfig/ Frame CA48
9 KB
6 KB
123ms
121ms
XHR
application/json
64.233.180.154
Google LLC
General
Full URL
https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=xfad&tv=r20100101&st=int
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/r20260904/r20110914/xfa/sodar_loader.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
64.233.180.154 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
pe-in-f154.1e100.net
Software
cafe /
Resource Hash
e2e59c1050564c04a168d3dfffc3978e3cc960d975338cb6b322dc7f3a096ce1
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://ad.doubleclick.net/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

timing-allow-origin
*
content-encoding
br
cross-origin-resource-policy
cross-origin
x-content-type-options
nosniff
access-control-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length
6617
date
Wed, 09 Sep 2026 00:42:07 GMT
x-xss-protection
0
content-type
application/json; charset=UTF-8
content-disposition
attachment; filename="f.txt"
server
cafe
GET
H2
200
model_person_country_code_CA_person_region_code_4f6e746172696f5f47726561746572546f726f6e746f.json Show response
www.googletagservices.com/agrp/prod/ Frame 140A
668 KB
92 KB
135ms
44ms
Fetch
application/json
142.251.163.154
Google LLC
General
Full URL
https://www.googletagservices.com/agrp/prod/model_person_country_code_CA_person_region_code_4f6e746172696f5f47726561746572546f726f6e746f.json
Requested by
Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/managed/js/activeview/current/reach_worklet.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.251.163.154 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
wv-in-f154.1e100.net
Software
sffe /
Resource Hash
532e8c03dd434c5416e7705a6d9f1f96b319d9d98737c479dec19d0ca3682e84
Security Headers
Name Value
Content-Security-Policy require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-people-metrics-releaser
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.googleadservices.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
gzip
age
13965
report-to
{"group":"ads-people-metrics-releaser","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-people-metrics-releaser"}]}
x-content-type-options
nosniff
expires
Wed, 09 Sep 2026 20:49:22 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Tue, 08 Sep 2026 20:49:22 GMT
last-modified
Tue, 30 Jul 2024 19:25:57 GMT
content-type
application/json
vary
Accept-Encoding
content-security-policy
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-people-metrics-releaser
cache-control
public, max-age=86400
cross-origin-opener-policy
same-origin; report-to="ads-people-metrics-releaser"
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
access-control-allow-origin
*
content-length
93730
x-xss-protection
0
server
sffe
POST
H3
200
report-shared-storage
www.googleadservices.com/.well-known/private-aggregation/ Frame 140A
0
0
66ms
64ms
Fetch
text/html
142.251.167.157
Google LLC
General
Full URL
https://www.googleadservices.com/.well-known/private-aggregation/report-shared-storage
Requested by
Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/managed/js/activeview/current/reach_worklet.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.167.157 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
ww-in-f157.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.googleadservices.com/pagead/managed/js/activeview/current/reach_worklet.html
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
Content-Type
text/plain;charset=UTF-8
sec-ch-ua-mobile
?0

Response headers

timing-allow-origin
*
cross-origin-resource-policy
cross-origin
x-content-type-options
nosniff
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length
0
date
Wed, 09 Sep 2026 00:42:07 GMT
x-xss-protection
0
content-type
text/html; charset=UTF-8
server
cafe
POST
H3
200
report-shared-storage
www.googleadservices.com/.well-known/private-aggregation/ Frame 140A
0
0
70ms
68ms
Fetch
text/html
142.251.167.157
Google LLC
General
Full URL
https://www.googleadservices.com/.well-known/private-aggregation/report-shared-storage
Requested by
Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/managed/js/activeview/current/reach_worklet.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.167.157 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
ww-in-f157.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.googleadservices.com/pagead/managed/js/activeview/current/reach_worklet.html
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
Content-Type
text/plain;charset=UTF-8
sec-ch-ua-mobile
?0

Response headers

timing-allow-origin
*
cross-origin-resource-policy
cross-origin
x-content-type-options
nosniff
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length
0
date
Wed, 09 Sep 2026 00:42:07 GMT
x-xss-protection
0
content-type
text/html; charset=UTF-8
server
cafe
POST
H3
200
report-shared-storage
www.googleadservices.com/.well-known/private-aggregation/ Frame 140A
0
0
68ms
67ms
Fetch
text/html
142.251.167.157
Google LLC
General
Full URL
https://www.googleadservices.com/.well-known/private-aggregation/report-shared-storage
Requested by
Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/managed/js/activeview/current/reach_worklet.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.167.157 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
ww-in-f157.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.googleadservices.com/pagead/managed/js/activeview/current/reach_worklet.html
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
Content-Type
text/plain;charset=UTF-8
sec-ch-ua-mobile
?0

Response headers

timing-allow-origin
*
cross-origin-resource-policy
cross-origin
x-content-type-options
nosniff
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length
0
date
Wed, 09 Sep 2026 00:42:07 GMT
x-xss-protection
0
content-type
text/html; charset=UTF-8
server
cafe
GET
H3
204
gen_204
pagead2.googlesyndication.com/pagead/ Frame 140A
0
0
49ms
49ms
Fetch
image/gif
64.233.180.154
Google LLC
General
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=reach&proto=CAESDk9wZXJhdGlvbkVycm9yGlRGYWlsZWQgdG8gZXhlY3V0ZSAnYWRkTW9kdWxlJyBvbiAnU2hhcmVkU3RvcmFnZVdvcmtsZXQnOiBTaGFyZWQgU3RvcmFnZSBpcyBkaXNhYmxlZC4%3D
Requested by
Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/managed/js/activeview/current/reach_worklet.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
64.233.180.154 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
pe-in-f154.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.googleadservices.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

cache-control
no-cache, must-revalidate
timing-allow-origin
*
pragma
no-cache
cross-origin-resource-policy
cross-origin
x-content-type-options
nosniff
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length
0
date
Wed, 09 Sep 2026 00:42:07 GMT
x-xss-protection
0
content-type
image/gif
server
cafe
GET
H2
200
web.js Show response
cache-ssl.celtra.com/api/creatives/f0f353de/compiled/ Frame 2A36
625 KB
147 KB
68ms
51ms
Script
application/javascript
13.32.241.19
Amazon.com
General
Full URL
https://cache-ssl.celtra.com/api/creatives/f0f353de/compiled/web.js?v=270-58-7a8cef22&secure=1&cachedVariantChoices=W10-&isPurposePreview=0&runnerModernization=1
Requested by
Host: transcend-cdn.com
URL: https://transcend-cdn.com/cm/ef49a3f1-d8c1-47d6-88fc-50e41130631f/airgap.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.32.241.19 New York, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-13-32-241-19.jfk50.r.cloudfront.net
Software
Apache /
Resource Hash
4918a01cc32ea5bb6a5462f167789e5b8d027f0231857f68d8b3741f3fe1eb20

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

access-control-expose-headers
Accept-Ranges, Content-Encoding, Content-Length, Content-Range, Content-Disposition
content-encoding
gzip
etag
"51a164cce8114dfacd0bc4e50b6f6603498f379733ba86465af5b369eb7f33e2"
age
62142
alt-svc
h3=":443"; ma=86400
x-cache
Hit from cloudfront
x-amz-cf-id
R3Bx4GV3dgOBysGMeXzze5Wu9Jp5CBy6S0fyzMMPzLJBH4aS2zNlVg==
date
Tue, 08 Sep 2026 07:26:25 GMT
content-type
application/javascript
vary
Accept-Encoding
cache-control
max-age=31556926
access-control-allow-credentials
false
via
1.1 68f8ff7a6e326bbdf97019cfeb60c628.cloudfront.net (CloudFront)
accept-ranges
bytes
access-control-allow-origin
*
content-length
149886
x-amz-cf-pop
JFK50-P13
server
Apache
GET
DATA
200
OK
truncated
/ Frame 2A36
167 B
0
Image
image/png

General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
d26432e661658ef9d3d538b1f71b1478193f6c141f1cd7dfed03e5b677d178c2

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
Referer

Response headers

Content-Type
image/png
GET
BLOB
200
OK
b9518434-889a-4453-aa6f-edce68b355e9
https://www.darkreading.com/ Frame 2A36
167 B
0
Image
image/png

General
Full URL
blob:https://www.darkreading.com/b9518434-889a-4453-aa6f-edce68b355e9
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/cyberattacks-data-breaches/attackers-multi-hop-google-redirects-phishing-campaign
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
d26432e661658ef9d3d538b1f71b1478193f6c141f1cd7dfed03e5b677d178c2

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
Referer

Response headers

Content-Type
image/png
Content-Length
167
GET
H3
204
gen_204
pagead2.googlesyndication.com/pagead/ Frame CA48
0
0
55ms
53ms
Fetch
image/gif
64.233.180.154
Google LLC
General
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=fle-fetch-start2
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js?cache=r20110914
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
64.233.180.154 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
pe-in-f154.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://ad.doubleclick.net/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

cache-control
no-cache, must-revalidate
timing-allow-origin
*
pragma
no-cache
cross-origin-resource-policy
cross-origin
x-content-type-options
nosniff
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length
0
date
Wed, 09 Sep 2026 00:42:07 GMT
x-xss-protection
0
content-type
image/gif
server
cafe
GET
H3
204
gen_204
pagead2.googlesyndication.com/pagead/ Frame CA48
0
0
51ms
50ms
Fetch
image/gif
64.233.180.154
Google LLC
General
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=colleague-executed&name=4
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js?cache=r20110914
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
64.233.180.154 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
pe-in-f154.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://ad.doubleclick.net/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

cache-control
no-cache, must-revalidate
timing-allow-origin
*
pragma
no-cache
cross-origin-resource-policy
cross-origin
x-content-type-options
nosniff
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length
0
date
Wed, 09 Sep 2026 00:42:07 GMT
x-xss-protection
0
content-type
image/gif
server
cafe
GET
H3
200
reach_worklet.html Show response
www.googleadservices.com/pagead/managed/js/activeview/current/ Frame 3C33
93 B
0
0ms
0ms
Document
text/html
142.251.167.157
Google LLC
General
Full URL
https://www.googleadservices.com/pagead/managed/js/activeview/current/reach_worklet.html
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js?cache=r20110914
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.167.157 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
ww-in-f157.1e100.net
Software
cafe /
Resource Hash
136b3dfa7c254f92a9a3513c191c87c05f7c7ff7f82c6d648a33496c3c380593
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://ad.doubleclick.net/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0
sec-ch-ua-platform
"Linux"

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
private, max-age=3600, stale-while-revalidate=3600
content-encoding
br
content-length
69
content-type
text/html; charset=UTF-8
cross-origin-resource-policy
cross-origin
date
Wed, 09 Sep 2026 00:42:06 GMT
etag
9658810392779322030
expires
Wed, 09 Sep 2026 00:42:06 GMT
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server
cafe
timing-allow-origin
*
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
0
GET
H/1.1
204
No Content
event.jpg
tps-dn-ue1.doubleverify.com/ Frame AD38
0
0
205ms
63ms
Fetch
35.211.246.180
YOUTUBE Google Ir...
General
Full URL
https://tps-dn-ue1.doubleverify.com/event.jpg?impid=ada081f0361b4969bb50ea688a57685e&consid=&api=1&rc=true
Requested by
Host: transcend-cdn.com
URL: https://transcend-cdn.com/cm/ef49a3f1-d8c1-47d6-88fc-50e41130631f/airgap.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
35.211.246.180 North Charleston, United States, ASN43515 (YOUTUBE Google Ireland Limited, IE),
Reverse DNS
180.246.211.35.bc.googleusercontent.com
Software
openresty/1.25.3.1 /
Resource Hash

Request headers

sec-ch-ua-platform
"Linux"
Referer
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

Expires
2026-09-08T00:42:07
Cache-Control
max-age=0
Date
Wed, 09 Sep 2026 00:42:07 GMT
Pragma
no-cache
Server
openresty/1.25.3.1
Connection
keep-alive
GET
H3
204
gen_204
pagead2.googlesyndication.com/pagead/ Frame ED37
0
0
54ms
53ms
Fetch
image/gif
64.233.180.155
Google LLC
General
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=colleague-executed&name=1
Requested by
Host: transcend-cdn.com
URL: https://transcend-cdn.com/cm/ef49a3f1-d8c1-47d6-88fc-50e41130631f/airgap.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
64.233.180.155 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
on-in-f155.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

cache-control
no-cache, must-revalidate
timing-allow-origin
*
pragma
no-cache
cross-origin-resource-policy
cross-origin
x-content-type-options
nosniff
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length
0
date
Wed, 09 Sep 2026 00:42:07 GMT
x-xss-protection
0
content-type
image/gif
server
cafe
GET
H3
204
gen_204
pagead2.googlesyndication.com/pagead/ Frame ED37
0
0
61ms
55ms
Fetch
image/gif
64.233.180.155
Google LLC
General
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=reach&proto=CAlgAWACYANgBGgD
Requested by
Host: transcend-cdn.com
URL: https://transcend-cdn.com/cm/ef49a3f1-d8c1-47d6-88fc-50e41130631f/airgap.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
64.233.180.155 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
on-in-f155.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

cache-control
no-cache, must-revalidate
timing-allow-origin
*
pragma
no-cache
cross-origin-resource-policy
cross-origin
x-content-type-options
nosniff
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length
0
date
Wed, 09 Sep 2026 00:42:07 GMT
x-xss-protection
0
content-type
image/gif
server
cafe
GET
H3
204
gen_204
pagead2.googlesyndication.com/pagead/ Frame 140A
0
0
60ms
55ms
Fetch
image/gif
64.233.180.154
Google LLC
General
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=reach&proto=CAIgATphbW9kZWxfcGVyc29uX2NvdW50cnlfY29kZV9DQV9wZXJzb25fcmVnaW9uX2NvZGVfNGY2ZTc0NjE3MjY5NmY1ZjQ3NzI2NTYxNzQ2NTcyNTQ2ZjcyNmY2ZTc0NmYuanNvbkjIAVIaQ0l2TWtmYWg0SllERlZaNXdBWWQ5MVlhbUFaLwjMEBCZnQEY05c9IJGFqQQoAjACOAFdzcxMPeoBBggtGB4gCoICCAgDEAMYAyAE
Requested by
Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/managed/js/activeview/current/reach_worklet.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
64.233.180.154 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
pe-in-f154.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.googleadservices.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

cache-control
no-cache, must-revalidate
timing-allow-origin
*
pragma
no-cache
cross-origin-resource-policy
cross-origin
x-content-type-options
nosniff
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length
0
date
Wed, 09 Sep 2026 00:42:07 GMT
x-xss-protection
0
content-type
image/gif
server
cafe
GET
H3
200
activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 336B
42 B
65 B
66ms
65ms
Fetch
image/gif
64.233.180.155
Google LLC
General
Full URL
https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjssB-DZqMtlIPnAh74PWjepQDsP5Z6NgJ8ZAPslurweHEbdqnz--tFnGymNkNB5ZSUqEbaUgtkPtU3Ck2euEEqOySJdBi_VXrs35KuZkIyj0Hva-4vmp0CpCJKKzEFtZePP4OlYAcF0nTJl3cyNToULZYVIIiYL7-qhH-3cVAluq9trDYU6yAKKUSFuCcp_H&sig=Cg0ArKJSzBsLH_bMJd16EAE&id=lidar2&mcvt=1107&p=0,0,1200,1600&tm=1128.900001525879&tu=22.099998474121094&mtos=1107,1107,1107,1107,1107&tos=1107,0,0,0,0&v=20260831&bin=7&avms=nio&bs=1600,1200&mc=1&vu=1&app=0&itpl=0&adk=2932576195&rs=4&la=1&cr=0&uach=WyJMaW51eCIsIiIsIng4NiIsIiIsIjE1Mi4wLjc5NzcuODIiLG51bGwsMCxudWxsLCI2NCIsW1siQ2hyb21pdW0iLCIxNTIuMC43OTc3LjgyIl0sWyJHb29nbGUgQ2hyb21lIiwiMTUyLjAuNzk3Ny44MiJdLFsiTm90P0FfQnJhbmQiLCIyNC4wLjAuMCJdXSwwXQ%3D%3D&vs=4&r=v&co=8484732600&rst=1788914525674&rpt=474&isd=0&lsd=0&met=ce&wmsd=0&pbe=0&fle=0&vae=0&spb=0&sfl=0&ffslot=0&reach=8&io2=14
Requested by
Host: transcend-cdn.com
URL: https://transcend-cdn.com/cm/ef49a3f1-d8c1-47d6-88fc-50e41130631f/airgap.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
64.233.180.155 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
on-in-f155.1e100.net
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

cache-control
no-cache, must-revalidate
timing-allow-origin
*
pragma
no-cache
cross-origin-resource-policy
cross-origin
access-control-allow-credentials
true
x-content-type-options
nosniff
expires
Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length
42
date
Wed, 09 Sep 2026 00:42:07 GMT
x-xss-protection
0
content-type
image/gif
server
cafe
GET
H3
204
gen_204
pagead2.googlesyndication.com/pagead/ Frame 2A36
0
0
80ms
51ms
Fetch
image/gif
64.233.180.155
Google LLC
General
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=colleague-executed&name=1
Requested by
Host: transcend-cdn.com
URL: https://transcend-cdn.com/cm/ef49a3f1-d8c1-47d6-88fc-50e41130631f/airgap.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
64.233.180.155 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
on-in-f155.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

cache-control
no-cache, must-revalidate
timing-allow-origin
*
pragma
no-cache
cross-origin-resource-policy
cross-origin
x-content-type-options
nosniff
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length
0
date
Wed, 09 Sep 2026 00:42:07 GMT
x-xss-protection
0
content-type
image/gif
server
cafe
GET
H3
204
gen_204
pagead2.googlesyndication.com/pagead/ Frame 2A36
0
0
89ms
57ms
Fetch
image/gif
64.233.180.155
Google LLC
General
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=reach&proto=CAlgAWACYANgBGgD
Requested by
Host: transcend-cdn.com
URL: https://transcend-cdn.com/cm/ef49a3f1-d8c1-47d6-88fc-50e41130631f/airgap.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
64.233.180.155 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
on-in-f155.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

cache-control
no-cache, must-revalidate
timing-allow-origin
*
pragma
no-cache
cross-origin-resource-policy
cross-origin
x-content-type-options
nosniff
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length
0
date
Wed, 09 Sep 2026 00:42:07 GMT
x-xss-protection
0
content-type
image/gif
server
cafe
GET
H3
204
gen_204
pagead2.googlesyndication.com/pagead/ Frame 370B
0
0
131ms
50ms
Fetch
image/gif
64.233.180.155
Google LLC
General
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=colleague-executed&name=1
Requested by
Host: transcend-cdn.com
URL: https://transcend-cdn.com/cm/ef49a3f1-d8c1-47d6-88fc-50e41130631f/airgap.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
64.233.180.155 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
on-in-f155.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

cache-control
no-cache, must-revalidate
timing-allow-origin
*
pragma
no-cache
cross-origin-resource-policy
cross-origin
x-content-type-options
nosniff
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length
0
date
Wed, 09 Sep 2026 00:42:07 GMT
x-xss-protection
0
content-type
image/gif
server
cafe
GET
H3
204
gen_204
pagead2.googlesyndication.com/pagead/ Frame 370B
0
0
130ms
50ms
Fetch
image/gif
64.233.180.155
Google LLC
General
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=reach&proto=CAlgAWACYANgBGgD
Requested by
Host: transcend-cdn.com
URL: https://transcend-cdn.com/cm/ef49a3f1-d8c1-47d6-88fc-50e41130631f/airgap.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
64.233.180.155 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
on-in-f155.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

cache-control
no-cache, must-revalidate
timing-allow-origin
*
pragma
no-cache
cross-origin-resource-policy
cross-origin
x-content-type-options
nosniff
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length
0
date
Wed, 09 Sep 2026 00:42:07 GMT
x-xss-protection
0
content-type
image/gif
server
cafe
GET
H3
200
reach_worklet.js Show response
www.googleadservices.com/pagead/managed/js/activeview/current/ Frame 3C33
196 KB
0
1ms
1ms
Script
text/javascript
142.251.167.157
Google LLC
General
Full URL
https://www.googleadservices.com/pagead/managed/js/activeview/current/reach_worklet.js
Requested by
Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/managed/js/activeview/current/reach_worklet.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.167.157 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
ww-in-f157.1e100.net
Software
cafe /
Resource Hash
f553d47197d2f0110392859534f34cbcefb7b47319d99151e43708c5ab3f87c1
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.googleadservices.com/pagead/managed/js/activeview/current/reach_worklet.html

Response headers

content-encoding
br
etag
9622583581042959437
x-content-type-options
nosniff
expires
Wed, 09 Sep 2026 00:42:06 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date
Wed, 09 Sep 2026 00:42:06 GMT
content-type
text/javascript; charset=UTF-8
vary
Accept-Encoding
content-disposition
attachment; filename="f.txt"
cache-control
private, max-age=3600, stale-while-revalidate=3600
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
content-length
63634
x-xss-protection
0
server
cafe
GET
H2
200
model_person_country_code_CA_person_region_code_4f6e746172696f5f47726561746572546f726f6e746f.json Show response
www.googletagservices.com/agrp/prod/ Frame 2C80
668 KB
0
1ms
1ms
Fetch
application/json
142.251.163.154
Google LLC
General
Full URL
https://www.googletagservices.com/agrp/prod/model_person_country_code_CA_person_region_code_4f6e746172696f5f47726561746572546f726f6e746f.json
Requested by
Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/managed/js/activeview/current/reach_worklet.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.251.163.154 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
wv-in-f154.1e100.net
Software
sffe /
Resource Hash
532e8c03dd434c5416e7705a6d9f1f96b319d9d98737c479dec19d0ca3682e84
Security Headers
Name Value
Content-Security-Policy require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-people-metrics-releaser
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.googleadservices.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
gzip
age
13965
report-to
{"group":"ads-people-metrics-releaser","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-people-metrics-releaser"}]}
x-content-type-options
nosniff
expires
Wed, 09 Sep 2026 20:49:22 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Tue, 08 Sep 2026 20:49:22 GMT
last-modified
Tue, 30 Jul 2024 19:25:57 GMT
content-type
application/json
vary
Accept-Encoding
content-security-policy
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-people-metrics-releaser
cache-control
public, max-age=86400
cross-origin-opener-policy
same-origin; report-to="ads-people-metrics-releaser"
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
access-control-allow-origin
*
content-length
93730
x-xss-protection
0
server
sffe
POST
H3
200
report-shared-storage
www.googleadservices.com/.well-known/private-aggregation/ Frame 2C80
0
0
65ms
61ms
Fetch
text/html
142.251.167.157
Google LLC
General
Full URL
https://www.googleadservices.com/.well-known/private-aggregation/report-shared-storage
Requested by
Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/managed/js/activeview/current/reach_worklet.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.167.157 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
ww-in-f157.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.googleadservices.com/pagead/managed/js/activeview/current/reach_worklet.html
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
Content-Type
text/plain;charset=UTF-8
sec-ch-ua-mobile
?0

Response headers

timing-allow-origin
*
cross-origin-resource-policy
cross-origin
x-content-type-options
nosniff
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length
0
date
Wed, 09 Sep 2026 00:42:07 GMT
x-xss-protection
0
content-type
text/html; charset=UTF-8
server
cafe
POST
H3
200
report-shared-storage
www.googleadservices.com/.well-known/private-aggregation/ Frame 2C80
0
0
73ms
61ms
Fetch
text/html
142.251.167.157
Google LLC
General
Full URL
https://www.googleadservices.com/.well-known/private-aggregation/report-shared-storage
Requested by
Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/managed/js/activeview/current/reach_worklet.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.167.157 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
ww-in-f157.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.googleadservices.com/pagead/managed/js/activeview/current/reach_worklet.html
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
Content-Type
text/plain;charset=UTF-8
sec-ch-ua-mobile
?0

Response headers

timing-allow-origin
*
cross-origin-resource-policy
cross-origin
x-content-type-options
nosniff
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length
0
date
Wed, 09 Sep 2026 00:42:07 GMT
x-xss-protection
0
content-type
text/html; charset=UTF-8
server
cafe
POST
H3
200
report-shared-storage
www.googleadservices.com/.well-known/private-aggregation/ Frame 2C80
0
0
73ms
62ms
Fetch
text/html
142.251.167.157
Google LLC
General
Full URL
https://www.googleadservices.com/.well-known/private-aggregation/report-shared-storage
Requested by
Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/managed/js/activeview/current/reach_worklet.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.167.157 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
ww-in-f157.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.googleadservices.com/pagead/managed/js/activeview/current/reach_worklet.html
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
Content-Type
text/plain;charset=UTF-8
sec-ch-ua-mobile
?0

Response headers

timing-allow-origin
*
cross-origin-resource-policy
cross-origin
x-content-type-options
nosniff
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length
0
date
Wed, 09 Sep 2026 00:42:07 GMT
x-xss-protection
0
content-type
text/html; charset=UTF-8
server
cafe
GET
H3
204
gen_204
pagead2.googlesyndication.com/pagead/ Frame 2C80
0
0
58ms
51ms
Fetch
image/gif
64.233.180.154
Google LLC
General
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=reach&proto=CAESDk9wZXJhdGlvbkVycm9yGlRGYWlsZWQgdG8gZXhlY3V0ZSAnYWRkTW9kdWxlJyBvbiAnU2hhcmVkU3RvcmFnZVdvcmtsZXQnOiBTaGFyZWQgU3RvcmFnZSBpcyBkaXNhYmxlZC4%3D
Requested by
Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/managed/js/activeview/current/reach_worklet.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
64.233.180.154 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
pe-in-f154.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.googleadservices.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

cache-control
no-cache, must-revalidate
timing-allow-origin
*
pragma
no-cache
cross-origin-resource-policy
cross-origin
x-content-type-options
nosniff
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length
0
date
Wed, 09 Sep 2026 00:42:07 GMT
x-xss-protection
0
content-type
image/gif
server
cafe
GET
H2
200
Klz6NWr5.html Show response
ep2.adtrafficquality.google/sodar/ Frame 6B8A
35 KB
12 KB
46ms
40ms
Document
text/html
142.251.211.65
Google LLC
General
Full URL
https://ep2.adtrafficquality.google/sodar/Klz6NWr5.html
Requested by
Host: ep2.adtrafficquality.google
URL: https://ep2.adtrafficquality.google/sodar/VFc2VJAc.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.251.211.65 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
pnlgaa-av-in-f1.1e100.net
Software
sffe /
Resource Hash
2a5cfa356af90e4dc14d89477463deb2c098c826ebc6d74c1577eb3d5973cac9
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://ad.doubleclick.net/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0
sec-ch-ua-platform
"Linux"

Response headers

accept-ranges
bytes
age
827
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
public, max-age=3000
content-encoding
br
content-length
12007
content-type
text/html
cross-origin-opener-policy
same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy
cross-origin
date
Wed, 09 Sep 2026 00:28:20 GMT
expires
Wed, 09 Sep 2026 01:18:20 GMT
last-modified
Thu, 13 Mar 2025 04:28:00 GMT
report-to
{"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server
sffe
timing-allow-origin
*
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
0
GET
H2
200
model_person_country_code_CA_person_region_code_4f6e746172696f5f47726561746572546f726f6e746f.json Show response
www.googletagservices.com/agrp/prod/ Frame 9EBD
668 KB
0
1ms
1ms
Fetch
application/json
142.251.163.154
Google LLC
General
Full URL
https://www.googletagservices.com/agrp/prod/model_person_country_code_CA_person_region_code_4f6e746172696f5f47726561746572546f726f6e746f.json
Requested by
Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/managed/js/activeview/current/reach_worklet.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.251.163.154 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
wv-in-f154.1e100.net
Software
sffe /
Resource Hash
532e8c03dd434c5416e7705a6d9f1f96b319d9d98737c479dec19d0ca3682e84
Security Headers
Name Value
Content-Security-Policy require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-people-metrics-releaser
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.googleadservices.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
gzip
age
13965
report-to
{"group":"ads-people-metrics-releaser","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-people-metrics-releaser"}]}
x-content-type-options
nosniff
expires
Wed, 09 Sep 2026 20:49:22 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Tue, 08 Sep 2026 20:49:22 GMT
last-modified
Tue, 30 Jul 2024 19:25:57 GMT
content-type
application/json
vary
Accept-Encoding
content-security-policy
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-people-metrics-releaser
cache-control
public, max-age=86400
cross-origin-opener-policy
same-origin; report-to="ads-people-metrics-releaser"
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
access-control-allow-origin
*
content-length
93730
x-xss-protection
0
server
sffe
POST
H3
200
report-shared-storage
www.googleadservices.com/.well-known/private-aggregation/ Frame 9EBD
0
0
62ms
56ms
Fetch
text/html
142.251.167.157
Google LLC
General
Full URL
https://www.googleadservices.com/.well-known/private-aggregation/report-shared-storage
Requested by
Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/managed/js/activeview/current/reach_worklet.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.167.157 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
ww-in-f157.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.googleadservices.com/pagead/managed/js/activeview/current/reach_worklet.html
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
Content-Type
text/plain;charset=UTF-8
sec-ch-ua-mobile
?0

Response headers

timing-allow-origin
*
cross-origin-resource-policy
cross-origin
x-content-type-options
nosniff
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length
0
date
Wed, 09 Sep 2026 00:42:07 GMT
x-xss-protection
0
content-type
text/html; charset=UTF-8
server
cafe
POST
H3
200
report-shared-storage
www.googleadservices.com/.well-known/private-aggregation/ Frame 9EBD
0
0
66ms
63ms
Fetch
text/html
142.251.167.157
Google LLC
General
Full URL
https://www.googleadservices.com/.well-known/private-aggregation/report-shared-storage
Requested by
Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/managed/js/activeview/current/reach_worklet.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.167.157 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
ww-in-f157.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.googleadservices.com/pagead/managed/js/activeview/current/reach_worklet.html
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
Content-Type
text/plain;charset=UTF-8
sec-ch-ua-mobile
?0

Response headers

timing-allow-origin
*
cross-origin-resource-policy
cross-origin
x-content-type-options
nosniff
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length
0
date
Wed, 09 Sep 2026 00:42:07 GMT
x-xss-protection
0
content-type
text/html; charset=UTF-8
server
cafe
POST
H3
200
report-shared-storage
www.googleadservices.com/.well-known/private-aggregation/ Frame 9EBD
0
0
68ms
64ms
Fetch
text/html
142.251.167.157
Google LLC
General
Full URL
https://www.googleadservices.com/.well-known/private-aggregation/report-shared-storage
Requested by
Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/managed/js/activeview/current/reach_worklet.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.167.157 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
ww-in-f157.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.googleadservices.com/pagead/managed/js/activeview/current/reach_worklet.html
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
Content-Type
text/plain;charset=UTF-8
sec-ch-ua-mobile
?0

Response headers

timing-allow-origin
*
cross-origin-resource-policy
cross-origin
x-content-type-options
nosniff
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length
0
date
Wed, 09 Sep 2026 00:42:07 GMT
x-xss-protection
0
content-type
text/html; charset=UTF-8
server
cafe
GET
H3
204
gen_204
pagead2.googlesyndication.com/pagead/ Frame 9EBD
0
0
93ms
50ms
Fetch
image/gif
64.233.180.154
Google LLC
General
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=reach&proto=CAESDk9wZXJhdGlvbkVycm9yGlRGYWlsZWQgdG8gZXhlY3V0ZSAnYWRkTW9kdWxlJyBvbiAnU2hhcmVkU3RvcmFnZVdvcmtsZXQnOiBTaGFyZWQgU3RvcmFnZSBpcyBkaXNhYmxlZC4%3D
Requested by
Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/managed/js/activeview/current/reach_worklet.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
64.233.180.154 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
pe-in-f154.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.googleadservices.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

cache-control
no-cache, must-revalidate
timing-allow-origin
*
pragma
no-cache
cross-origin-resource-policy
cross-origin
x-content-type-options
nosniff
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length
0
date
Wed, 09 Sep 2026 00:42:07 GMT
x-xss-protection
0
content-type
image/gif
server
cafe
GET
H2
200
model_person_country_code_CA_person_region_code_4f6e746172696f5f47726561746572546f726f6e746f.json Show response
www.googletagservices.com/agrp/prod/ Frame 62F2
668 KB
0
4ms
4ms
Fetch
application/json
142.251.163.154
Google LLC
General
Full URL
https://www.googletagservices.com/agrp/prod/model_person_country_code_CA_person_region_code_4f6e746172696f5f47726561746572546f726f6e746f.json
Requested by
Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/managed/js/activeview/current/reach_worklet.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.251.163.154 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
wv-in-f154.1e100.net
Software
sffe /
Resource Hash
532e8c03dd434c5416e7705a6d9f1f96b319d9d98737c479dec19d0ca3682e84
Security Headers
Name Value
Content-Security-Policy require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-people-metrics-releaser
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.googleadservices.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
gzip
age
13965
report-to
{"group":"ads-people-metrics-releaser","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-people-metrics-releaser"}]}
x-content-type-options
nosniff
expires
Wed, 09 Sep 2026 20:49:22 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Tue, 08 Sep 2026 20:49:22 GMT
last-modified
Tue, 30 Jul 2024 19:25:57 GMT
content-type
application/json
vary
Accept-Encoding
content-security-policy
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-people-metrics-releaser
cache-control
public, max-age=86400
cross-origin-opener-policy
same-origin; report-to="ads-people-metrics-releaser"
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
access-control-allow-origin
*
content-length
93730
x-xss-protection
0
server
sffe
POST
H3
200
report-shared-storage
www.googleadservices.com/.well-known/private-aggregation/ Frame 62F2
0
0
66ms
61ms
Fetch
text/html
142.251.167.157
Google LLC
General
Full URL
https://www.googleadservices.com/.well-known/private-aggregation/report-shared-storage
Requested by
Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/managed/js/activeview/current/reach_worklet.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.167.157 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
ww-in-f157.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.googleadservices.com/pagead/managed/js/activeview/current/reach_worklet.html
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
Content-Type
text/plain;charset=UTF-8
sec-ch-ua-mobile
?0

Response headers

timing-allow-origin
*
cross-origin-resource-policy
cross-origin
x-content-type-options
nosniff
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length
0
date
Wed, 09 Sep 2026 00:42:07 GMT
x-xss-protection
0
content-type
text/html; charset=UTF-8
server
cafe
POST
H3
200
report-shared-storage
www.googleadservices.com/.well-known/private-aggregation/ Frame 62F2
0
0
70ms
66ms
Fetch
text/html
142.251.167.157
Google LLC
General
Full URL
https://www.googleadservices.com/.well-known/private-aggregation/report-shared-storage
Requested by
Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/managed/js/activeview/current/reach_worklet.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.167.157 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
ww-in-f157.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.googleadservices.com/pagead/managed/js/activeview/current/reach_worklet.html
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
Content-Type
text/plain;charset=UTF-8
sec-ch-ua-mobile
?0

Response headers

timing-allow-origin
*
cross-origin-resource-policy
cross-origin
x-content-type-options
nosniff
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length
0
date
Wed, 09 Sep 2026 00:42:07 GMT
x-xss-protection
0
content-type
text/html; charset=UTF-8
server
cafe
POST
H3
200
report-shared-storage
www.googleadservices.com/.well-known/private-aggregation/ Frame 62F2
0
0
73ms
69ms
Fetch
text/html
142.251.167.157
Google LLC
General
Full URL
https://www.googleadservices.com/.well-known/private-aggregation/report-shared-storage
Requested by
Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/managed/js/activeview/current/reach_worklet.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.167.157 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
ww-in-f157.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.googleadservices.com/pagead/managed/js/activeview/current/reach_worklet.html
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
Content-Type
text/plain;charset=UTF-8
sec-ch-ua-mobile
?0

Response headers

timing-allow-origin
*
cross-origin-resource-policy
cross-origin
x-content-type-options
nosniff
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length
0
date
Wed, 09 Sep 2026 00:42:07 GMT
x-xss-protection
0
content-type
text/html; charset=UTF-8
server
cafe
GET
H3
204
gen_204
pagead2.googlesyndication.com/pagead/ Frame 62F2
0
0
142ms
50ms
Fetch
image/gif
64.233.180.154
Google LLC
General
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=reach&proto=CAESDk9wZXJhdGlvbkVycm9yGlRGYWlsZWQgdG8gZXhlY3V0ZSAnYWRkTW9kdWxlJyBvbiAnU2hhcmVkU3RvcmFnZVdvcmtsZXQnOiBTaGFyZWQgU3RvcmFnZSBpcyBkaXNhYmxlZC4%3D
Requested by
Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/managed/js/activeview/current/reach_worklet.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
64.233.180.154 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
pe-in-f154.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.googleadservices.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

cache-control
no-cache, must-revalidate
timing-allow-origin
*
pragma
no-cache
cross-origin-resource-policy
cross-origin
x-content-type-options
nosniff
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length
0
date
Wed, 09 Sep 2026 00:42:07 GMT
x-xss-protection
0
content-type
image/gif
server
cafe
GET
H3
204
gen_204
pagead2.googlesyndication.com/pagead/ Frame 2C80
0
0
51ms
50ms
Fetch
image/gif
64.233.180.154
Google LLC
General
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=reach&proto=CAIgATphbW9kZWxfcGVyc29uX2NvdW50cnlfY29kZV9DQV9wZXJzb25fcmVnaW9uX2NvZGVfNGY2ZTc0NjE3MjY5NmY1ZjQ3NzI2NTYxNzQ2NTcyNTQ2ZjcyNmY2ZTc0NmYuanNvbkjIAVIaQ1BQUzdmYWg0SllERmQwSEVnQWR0RXNSNFFaLwjMEBCZnQEY05c9IJGFqQQoAjACOAFdzcxMPeoBBggtGB4gCoICCAgDEAMYAyAE
Requested by
Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/managed/js/activeview/current/reach_worklet.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
64.233.180.154 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
pe-in-f154.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.googleadservices.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

cache-control
no-cache, must-revalidate
timing-allow-origin
*
pragma
no-cache
cross-origin-resource-policy
cross-origin
x-content-type-options
nosniff
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length
0
date
Wed, 09 Sep 2026 00:42:07 GMT
x-xss-protection
0
content-type
image/gif
server
cafe
POST
H3
200
report-shared-storage
www.googleadservices.com/.well-known/private-aggregation/ Frame 140A
0
0
65ms
60ms
Fetch
text/html
142.251.167.157
Google LLC
General
Full URL
https://www.googleadservices.com/.well-known/private-aggregation/report-shared-storage
Requested by
Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/managed/js/activeview/current/reach_worklet.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.167.157 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
ww-in-f157.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.googleadservices.com/pagead/managed/js/activeview/current/reach_worklet.html
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
Content-Type
text/plain;charset=UTF-8
sec-ch-ua-mobile
?0

Response headers

timing-allow-origin
*
cross-origin-resource-policy
cross-origin
x-content-type-options
nosniff
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length
0
date
Wed, 09 Sep 2026 00:42:07 GMT
x-xss-protection
0
content-type
text/html; charset=UTF-8
server
cafe
GET
H3
204
gen_204
pagead2.googlesyndication.com/pagead/ Frame 140A
0
0
50ms
49ms
Fetch
image/gif
64.233.180.154
Google LLC
General
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=reach&proto=CAMSDk9wZXJhdGlvbkVycm9yGkdGYWlsZWQgdG8gZXhlY3V0ZSAncnVuJyBvbiAnU2hhcmVkU3RvcmFnZSc6IFNoYXJlZCBTdG9yYWdlIGlzIGRpc2FibGVkLg%3D%3D
Requested by
Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/managed/js/activeview/current/reach_worklet.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
64.233.180.154 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
pe-in-f154.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.googleadservices.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

cache-control
no-cache, must-revalidate
timing-allow-origin
*
pragma
no-cache
cross-origin-resource-policy
cross-origin
x-content-type-options
nosniff
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length
0
date
Wed, 09 Sep 2026 00:42:07 GMT
x-xss-protection
0
content-type
image/gif
server
cafe
GET
H3
204
gen_204
pagead2.googlesyndication.com/pagead/ Frame 140A
0
0
55ms
53ms
Fetch
image/gif
64.233.180.154
Google LLC
General
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=reach&proto=CAUoAjAC
Requested by
Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/managed/js/activeview/current/reach_worklet.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
64.233.180.154 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
pe-in-f154.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.googleadservices.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

cache-control
no-cache, must-revalidate
timing-allow-origin
*
pragma
no-cache
cross-origin-resource-policy
cross-origin
x-content-type-options
nosniff
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length
0
date
Wed, 09 Sep 2026 00:42:07 GMT
x-xss-protection
0
content-type
image/gif
server
cafe
POST
H3
200
report-shared-storage
www.googleadservices.com/.well-known/private-aggregation/ Frame 140A
0
0
66ms
62ms
Fetch
text/html
142.251.167.157
Google LLC
General
Full URL
https://www.googleadservices.com/.well-known/private-aggregation/report-shared-storage
Requested by
Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/managed/js/activeview/current/reach_worklet.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.167.157 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
ww-in-f157.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.googleadservices.com/pagead/managed/js/activeview/current/reach_worklet.html
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
Content-Type
text/plain;charset=UTF-8
sec-ch-ua-mobile
?0

Response headers

timing-allow-origin
*
cross-origin-resource-policy
cross-origin
x-content-type-options
nosniff
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length
0
date
Wed, 09 Sep 2026 00:42:07 GMT
x-xss-protection
0
content-type
text/html; charset=UTF-8
server
cafe
GET
H3
204
gen_204
pagead2.googlesyndication.com/pagead/ Frame 140A
0
0
108ms
51ms
Fetch
image/gif
64.233.180.154
Google LLC
General
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=reach&proto=CAMSDk9wZXJhdGlvbkVycm9yGkdGYWlsZWQgdG8gZXhlY3V0ZSAncnVuJyBvbiAnU2hhcmVkU3RvcmFnZSc6IFNoYXJlZCBTdG9yYWdlIGlzIGRpc2FibGVkLg%3D%3D
Requested by
Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/managed/js/activeview/current/reach_worklet.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
64.233.180.154 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
pe-in-f154.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.googleadservices.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

cache-control
no-cache, must-revalidate
timing-allow-origin
*
pragma
no-cache
cross-origin-resource-policy
cross-origin
x-content-type-options
nosniff
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length
0
date
Wed, 09 Sep 2026 00:42:07 GMT
x-xss-protection
0
content-type
image/gif
server
cafe
GET
H3
204
gen_204
pagead2.googlesyndication.com/pagead/ Frame 140A
0
0
57ms
56ms
Fetch
image/gif
64.233.180.154
Google LLC
General
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=reach&proto=CAUoAjAB
Requested by
Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/managed/js/activeview/current/reach_worklet.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
64.233.180.154 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
pe-in-f154.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.googleadservices.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

cache-control
no-cache, must-revalidate
timing-allow-origin
*
pragma
no-cache
cross-origin-resource-policy
cross-origin
x-content-type-options
nosniff
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length
0
date
Wed, 09 Sep 2026 00:42:07 GMT
x-xss-protection
0
content-type
image/gif
server
cafe
POST
H3
200
report-shared-storage
www.googleadservices.com/.well-known/private-aggregation/ Frame 140A
0
0
68ms
66ms
Fetch
text/html
142.251.167.157
Google LLC
General
Full URL
https://www.googleadservices.com/.well-known/private-aggregation/report-shared-storage
Requested by
Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/managed/js/activeview/current/reach_worklet.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.167.157 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
ww-in-f157.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.googleadservices.com/pagead/managed/js/activeview/current/reach_worklet.html
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
Content-Type
text/plain;charset=UTF-8
sec-ch-ua-mobile
?0

Response headers

timing-allow-origin
*
cross-origin-resource-policy
cross-origin
x-content-type-options
nosniff
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length
0
date
Wed, 09 Sep 2026 00:42:07 GMT
x-xss-protection
0
content-type
text/html; charset=UTF-8
server
cafe
GET
H3
204
gen_204
pagead2.googlesyndication.com/pagead/ Frame 140A
0
0
158ms
52ms
Fetch
image/gif
64.233.180.154
Google LLC
General
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=reach&proto=CAMSDk9wZXJhdGlvbkVycm9yGkdGYWlsZWQgdG8gZXhlY3V0ZSAncnVuJyBvbiAnU2hhcmVkU3RvcmFnZSc6IFNoYXJlZCBTdG9yYWdlIGlzIGRpc2FibGVkLg%3D%3D
Requested by
Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/managed/js/activeview/current/reach_worklet.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
64.233.180.154 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
pe-in-f154.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.googleadservices.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

cache-control
no-cache, must-revalidate
timing-allow-origin
*
pragma
no-cache
cross-origin-resource-policy
cross-origin
x-content-type-options
nosniff
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length
0
date
Wed, 09 Sep 2026 00:42:07 GMT
x-xss-protection
0
content-type
image/gif
server
cafe
GET
H3
204
gen_204
pagead2.googlesyndication.com/pagead/ Frame 140A
0
0
104ms
50ms
Fetch
image/gif
64.233.180.154
Google LLC
General
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=reach&proto=CAUoAjAC
Requested by
Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/managed/js/activeview/current/reach_worklet.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
64.233.180.154 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
pe-in-f154.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.googleadservices.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

cache-control
no-cache, must-revalidate
timing-allow-origin
*
pragma
no-cache
cross-origin-resource-policy
cross-origin
x-content-type-options
nosniff
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length
0
date
Wed, 09 Sep 2026 00:42:07 GMT
x-xss-protection
0
content-type
image/gif
server
cafe
GET
H3
204
gen_204
pagead2.googlesyndication.com/pagead/ Frame 140A
0
0
53ms
53ms
Fetch
image/gif
64.233.180.154
Google LLC
General
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=reach&proto=CAlgBWAGYAdgCGAJaAM%3D
Requested by
Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/managed/js/activeview/current/reach_worklet.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
64.233.180.154 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
pe-in-f154.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.googleadservices.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

cache-control
no-cache, must-revalidate
timing-allow-origin
*
pragma
no-cache
cross-origin-resource-policy
cross-origin
x-content-type-options
nosniff
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length
0
date
Wed, 09 Sep 2026 00:42:07 GMT
x-xss-protection
0
content-type
image/gif
server
cafe
GET
H3
204
gen_204
pagead2.googlesyndication.com/pagead/ Frame 9EBD
0
0
51ms
51ms
Fetch
image/gif
64.233.180.154
Google LLC
General
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=reach&proto=CAIgATphbW9kZWxfcGVyc29uX2NvdW50cnlfY29kZV9DQV9wZXJzb25fcmVnaW9uX2NvZGVfNGY2ZTc0NjE3MjY5NmY1ZjQ3NzI2NTYxNzQ2NTcyNTQ2ZjcyNmY2ZTc0NmYuanNvbkjIAVIaQ1A3VzdmYWg0SllERlVaLXdBWWR1cTR3a3daLwjMEBCZnQEY05c9IJGFqQQoAjACOAFdzcxMPeoBBggtGB4gCoICCAgDEAMYAyAE
Requested by
Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/managed/js/activeview/current/reach_worklet.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
64.233.180.154 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
pe-in-f154.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.googleadservices.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

cache-control
no-cache, must-revalidate
timing-allow-origin
*
pragma
no-cache
cross-origin-resource-policy
cross-origin
x-content-type-options
nosniff
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length
0
date
Wed, 09 Sep 2026 00:42:07 GMT
x-xss-protection
0
content-type
image/gif
server
cafe
GET
H3
200
adsense.-728x90-_bottom_ads. Show response
fundingchoicesmessages.google.com/f/AGSKWxVJIqm7vYE0Spbl7gtFpoCox7SPqqdc6yiOP8cOGiRcN4dWdIvqxz-UBMI9akTSVgpWgPlaD9TOdvEvpvbGm_onQeVjfJwS1-dB9sebGGAAPaLpElUAcoYdExS4wdTB5-dsSgEf_qg_TXKsP_2HJvGjBorE8...
54 B
109 B
60ms
60ms
Script
application/javascript
142.250.217.238
Google LLC
General
Full URL
https://fundingchoicesmessages.google.com/f/AGSKWxVJIqm7vYE0Spbl7gtFpoCox7SPqqdc6yiOP8cOGiRcN4dWdIvqxz-UBMI9akTSVgpWgPlaD9TOdvEvpvbGm_onQeVjfJwS1-dB9sebGGAAPaLpElUAcoYdExS4wdTB5-dsSgEf_qg_TXKsP_2HJvGjBorE8ZcD_ODD8T3H96b03TgxAl4oA2exYpBD/_/customadmode./ui/adv_/adsense.-728x90-_bottom_ads.
Requested by
Host: transcend-cdn.com
URL: https://transcend-cdn.com/cm/ef49a3f1-d8c1-47d6-88fc-50e41130631f/airgap.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.217.238 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
pnlgaa-ay-in-f14.1e100.net
Software
ESF /
Resource Hash
8e7ca48dc4aad37780c1fe8365101d84b98ca7a301ca152bc03c1c868734c42c
Security Headers
Name Value
Content-Security-Policy script-src 'report-sample' 'nonce-j8ZZLKSlgxREVnTy-ogC6Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
gzip
x-content-type-options
nosniff
expires
Mon, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Wed, 09 Sep 2026 00:42:07 GMT
content-type
application/javascript; charset=utf-8
x-frame-options
SAMEORIGIN
reporting-endpoints
default="/_/ContributorServingWebSwitchboardHttp/web-reports?context=eJzjStHikmLw0JBiaL15jnU6EJcsOs_aBsRdQDwHiA0VLrE6A_GH-susP4C4SOIKawsQf6q6wSpSfYP1W7EvG0eJLxvLW3-2hdMC2VYCsYhBEJsMEKcdDGfLA2IhHo7715qusgm8mHryHaOSRlJ-YXxyfl5JUWZSaUl-UVpyWmpxalFZalG8kYGRmYGlgbmegXl8gQEA_V47WA"
content-security-policy
script-src 'report-sample' 'nonce-j8ZZLKSlgxREVnTy-ogC6Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport
cache-control
no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy
same-origin
pragma
no-cache
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy
cross-origin
permissions-policy
ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
x-xss-protection
0
server
ESF
GET
H3
200
lidar.js Show response
pagead2.googlesyndication.com/pagead/js/
267 KB
84 KB
43ms
42ms
Script
text/javascript
64.233.180.155
Google LLC
General
Full URL
https://pagead2.googlesyndication.com/pagead/js/lidar.js?fcd=true
Requested by
Host: transcend-cdn.com
URL: https://transcend-cdn.com/cm/ef49a3f1-d8c1-47d6-88fc-50e41130631f/airgap.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
64.233.180.155 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
on-in-f155.1e100.net
Software
cafe /
Resource Hash
94bc3430523d0604e00003897d9545a6df44bba6ee29262b35aa0f426eed479d
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
br
etag
7884332137555946992
age
846
x-content-type-options
nosniff
expires
Wed, 09 Sep 2026 01:28:01 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date
Wed, 09 Sep 2026 00:28:01 GMT
content-disposition
attachment; filename="f.txt"
content-type
text/javascript; charset=UTF-8
vary
Accept-Encoding
cache-control
public, max-age=3600
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
content-length
85802
x-xss-protection
0
server
cafe
POST
H3
204
AGSKWxVq3qiJFcpbE9g2txPOXTt5x1Pe-8X71tTe7ZRTxHJuLE3A7KdGPFWIjn2QIkPJIykWnKn1S8Hy-V5fxcCKaWGiu5hrB6NcB-zzoFn0NK7l9-zgfe5aHviWROx9qXQjOg1DMrM-3g== Show response
fundingchoicesmessages.google.com/el/
0
28 B
68ms
66ms
XHR
text/html
142.250.217.238
Google LLC
General
Full URL
https://fundingchoicesmessages.google.com/el/AGSKWxVq3qiJFcpbE9g2txPOXTt5x1Pe-8X71tTe7ZRTxHJuLE3A7KdGPFWIjn2QIkPJIykWnKn1S8Hy-V5fxcCKaWGiu5hrB6NcB-zzoFn0NK7l9-zgfe5aHviWROx9qXQjOg1DMrM-3g==
Requested by
Host: transcend-cdn.com
URL: https://transcend-cdn.com/cm/ef49a3f1-d8c1-47d6-88fc-50e41130631f/airgap.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.217.238 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
pnlgaa-ay-in-f14.1e100.net
Software
ESF /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Content-Security-Policy require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-mQBgN6X1Vifa-OL0QYFbug' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
Content-Type
text/plain
sec-ch-ua-mobile
?0

Response headers

access-control-max-age
86400
access-control-allow-methods
POST, GET, OPTIONS
x-content-type-options
nosniff
expires
Mon, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Wed, 09 Sep 2026 00:42:07 GMT
content-type
text/html; charset=utf-8
x-frame-options
SAMEORIGIN
reporting-endpoints
default="/_/ContributorLoggingHttp/web-reports?context=eJzjMtDikmLw15BiOHnrNtNFIP5Qf5n1BxAvnBbIthKIRQyC2GSAOO1gOFseEAvxcNy_1nSVTeDA8wPvGJVckvIL45Pz80pS80p0E1OKdUHsosyk0pL8IhR2ahlIRU5-enpmXnq8kYGRmYGlgbmegVl8gQEAdbkx8A"
content-security-policy
require-trusted-types-for 'script';report-uri /_/ContributorLoggingHttp/cspreport, script-src 'report-sample' 'nonce-mQBgN6X1Vifa-OL0QYFbug' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorLoggingHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorLoggingHttp/cspreport/allowlist
cache-control
no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy
same-origin
pragma
no-cache
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
access-control-allow-credentials
true
permissions-policy
ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
access-control-allow-origin
https://www.darkreading.com
content-length
0
x-xss-protection
0
server
ESF
GET
H3
204
gen_204
pagead2.googlesyndication.com/pagead/ Frame 62F2
0
0
54ms
50ms
Fetch
image/gif
64.233.180.154
Google LLC
General
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=reach&proto=CAIgATphbW9kZWxfcGVyc29uX2NvdW50cnlfY29kZV9DQV9wZXJzb25fcmVnaW9uX2NvZGVfNGY2ZTc0NjE3MjY5NmY1ZjQ3NzI2NTYxNzQ2NTcyNTQ2ZjcyNmY2ZTc0NmYuanNvbkjIAVIaQ0ozdTdmYWg0SllERlZodndBWWRwVGM3R0FaLwjMEBCZnQEY05c9IJGFqQQoAjACOAFdzcxMPeoBBggtGB4gCoICCAgDEAMYAyAE
Requested by
Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/managed/js/activeview/current/reach_worklet.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
64.233.180.154 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
pe-in-f154.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.googleadservices.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

cache-control
no-cache, must-revalidate
timing-allow-origin
*
pragma
no-cache
cross-origin-resource-policy
cross-origin
x-content-type-options
nosniff
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length
0
date
Wed, 09 Sep 2026 00:42:07 GMT
x-xss-protection
0
content-type
image/gif
server
cafe
GET
H3
204
gen_204
pagead2.googlesyndication.com/pagead/ Frame CA48
0
0
52ms
51ms
Fetch
image/gif
64.233.180.154
Google LLC
General
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=colleague-executed&name=1
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js?cache=r20110914
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
64.233.180.154 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
pe-in-f154.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://ad.doubleclick.net/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

cache-control
no-cache, must-revalidate
timing-allow-origin
*
pragma
no-cache
cross-origin-resource-policy
cross-origin
x-content-type-options
nosniff
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length
0
date
Wed, 09 Sep 2026 00:42:07 GMT
x-xss-protection
0
content-type
image/gif
server
cafe
GET
H3
204
gen_204
pagead2.googlesyndication.com/pagead/ Frame CA48
0
0
53ms
52ms
Fetch
image/gif
64.233.180.154
Google LLC
General
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=reach&proto=CAlgAWACYANgBGgD
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js?cache=r20110914
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
64.233.180.154 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
pe-in-f154.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://ad.doubleclick.net/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

cache-control
no-cache, must-revalidate
timing-allow-origin
*
pragma
no-cache
cross-origin-resource-policy
cross-origin
x-content-type-options
nosniff
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length
0
date
Wed, 09 Sep 2026 00:42:07 GMT
x-xss-protection
0
content-type
image/gif
server
cafe
GET
H2
200
/ Show response
agent-card.bridged.media/ Frame FB4D
701 B
1 KB
153ms
41ms
Document
text/html
99.84.160.3
Amazon.com
General
Full URL
https://agent-card.bridged.media/?trackerId=632f45dc-cdfb-45f9-b0c5-d01316c801ef&pageURL=https://www.darkreading.com/cyberattacks-data-breaches/attackers-multi-hop-google-redirects-phishing-campaign
Requested by
Host: transcend-cdn.com
URL: https://transcend-cdn.com/cm/ef49a3f1-d8c1-47d6-88fc-50e41130631f/airgap.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
99.84.160.3 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-99-84-160-3.jfk50.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
83d123eaca7be680e6615b179a4dfed777f32dfb7e064e769bfa8a7cbf042bc4

Request headers

Referer
https://www.darkreading.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0
sec-ch-ua-platform
"Linux"

Response headers

accept-ranges
bytes
age
217
cache-control
public, max-age=300, s-maxage=300
content-length
701
content-type
text/html
date
Wed, 09 Sep 2026 00:38:31 GMT
etag
"e0a67a3c32a78a236544ecde31dbb5c4"
last-modified
Mon, 07 Sep 2026 13:56:20 GMT
server
AmazonS3
via
1.1 26512aa427c30d93015b4bde75974708.cloudfront.net (CloudFront)
x-amz-cf-id
H1BqFPnA6eBxbgozwy0Izjpd5UUP7ThxcriUK8lGZmDfB_iR9WokcA==
x-amz-cf-pop
JFK50-P15
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
GET
H2
200
model_person_country_code_CA_person_region_code_4f6e746172696f5f47726561746572546f726f6e746f.json Show response
www.googletagservices.com/agrp/prod/ Frame 3C33
668 KB
0
0ms
0ms
Fetch
application/json
142.251.163.154
Google LLC
General
Full URL
https://www.googletagservices.com/agrp/prod/model_person_country_code_CA_person_region_code_4f6e746172696f5f47726561746572546f726f6e746f.json
Requested by
Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/managed/js/activeview/current/reach_worklet.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.251.163.154 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
wv-in-f154.1e100.net
Software
sffe /
Resource Hash
532e8c03dd434c5416e7705a6d9f1f96b319d9d98737c479dec19d0ca3682e84
Security Headers
Name Value
Content-Security-Policy require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-people-metrics-releaser
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.googleadservices.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

content-encoding
gzip
age
13965
report-to
{"group":"ads-people-metrics-releaser","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-people-metrics-releaser"}]}
x-content-type-options
nosniff
expires
Wed, 09 Sep 2026 20:49:22 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Tue, 08 Sep 2026 20:49:22 GMT
last-modified
Tue, 30 Jul 2024 19:25:57 GMT
content-type
application/json
vary
Accept-Encoding
content-security-policy
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-people-metrics-releaser
cache-control
public, max-age=86400
cross-origin-opener-policy
same-origin; report-to="ads-people-metrics-releaser"
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
access-control-allow-origin
*
content-length
93730
x-xss-protection
0
server
sffe
POST
H3
200
report-shared-storage
www.googleadservices.com/.well-known/private-aggregation/ Frame 3C33
0
0
61ms
59ms
Fetch
text/html
142.251.167.157
Google LLC
General
Full URL
https://www.googleadservices.com/.well-known/private-aggregation/report-shared-storage
Requested by
Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/managed/js/activeview/current/reach_worklet.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.167.157 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
ww-in-f157.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.googleadservices.com/pagead/managed/js/activeview/current/reach_worklet.html
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
Content-Type
text/plain;charset=UTF-8
sec-ch-ua-mobile
?0

Response headers

timing-allow-origin
*
cross-origin-resource-policy
cross-origin
x-content-type-options
nosniff
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length
0
date
Wed, 09 Sep 2026 00:42:07 GMT
x-xss-protection
0
content-type
text/html; charset=UTF-8
server
cafe
POST
H3
200
report-shared-storage
www.googleadservices.com/.well-known/private-aggregation/ Frame 3C33
0
0
78ms
76ms
Fetch
text/html
142.251.167.157
Google LLC
General
Full URL
https://www.googleadservices.com/.well-known/private-aggregation/report-shared-storage
Requested by
Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/managed/js/activeview/current/reach_worklet.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.167.157 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
ww-in-f157.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.googleadservices.com/pagead/managed/js/activeview/current/reach_worklet.html
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
Content-Type
text/plain;charset=UTF-8
sec-ch-ua-mobile
?0

Response headers

timing-allow-origin
*
cross-origin-resource-policy
cross-origin
x-content-type-options
nosniff
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length
0
date
Wed, 09 Sep 2026 00:42:07 GMT
x-xss-protection
0
content-type
text/html; charset=UTF-8
server
cafe
POST
H3
200
report-shared-storage
www.googleadservices.com/.well-known/private-aggregation/ Frame 3C33
0
0
76ms
74ms
Fetch
text/html
142.251.167.157
Google LLC
General
Full URL
https://www.googleadservices.com/.well-known/private-aggregation/report-shared-storage
Requested by
Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/managed/js/activeview/current/reach_worklet.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.167.157 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
ww-in-f157.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.googleadservices.com/pagead/managed/js/activeview/current/reach_worklet.html
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
Content-Type
text/plain;charset=UTF-8
sec-ch-ua-mobile
?0

Response headers

timing-allow-origin
*
cross-origin-resource-policy
cross-origin
x-content-type-options
nosniff
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length
0
date
Wed, 09 Sep 2026 00:42:07 GMT
x-xss-protection
0
content-type
text/html; charset=UTF-8
server
cafe
GET
H3
204
gen_204
pagead2.googlesyndication.com/pagead/ Frame 3C33
0
0
50ms
49ms
Fetch
image/gif
64.233.180.154
Google LLC
General
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=reach&proto=CAESDk9wZXJhdGlvbkVycm9yGlRGYWlsZWQgdG8gZXhlY3V0ZSAnYWRkTW9kdWxlJyBvbiAnU2hhcmVkU3RvcmFnZVdvcmtsZXQnOiBTaGFyZWQgU3RvcmFnZSBpcyBkaXNhYmxlZC4%3D
Requested by
Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/managed/js/activeview/current/reach_worklet.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
64.233.180.154 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
pe-in-f154.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.googleadservices.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

cache-control
no-cache, must-revalidate
timing-allow-origin
*
pragma
no-cache
cross-origin-resource-policy
cross-origin
x-content-type-options
nosniff
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length
0
date
Wed, 09 Sep 2026 00:42:07 GMT
x-xss-protection
0
content-type
image/gif
server
cafe
POST
H3
200
report-shared-storage
www.googleadservices.com/.well-known/private-aggregation/ Frame 2C80
0
0
69ms
66ms
Fetch
text/html
142.251.167.157
Google LLC
General
Full URL
https://www.googleadservices.com/.well-known/private-aggregation/report-shared-storage
Requested by
Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/managed/js/activeview/current/reach_worklet.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.167.157 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
ww-in-f157.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.googleadservices.com/pagead/managed/js/activeview/current/reach_worklet.html
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
Content-Type
text/plain;charset=UTF-8
sec-ch-ua-mobile
?0

Response headers

timing-allow-origin
*
cross-origin-resource-policy
cross-origin
x-content-type-options
nosniff
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length
0
date
Wed, 09 Sep 2026 00:42:07 GMT
x-xss-protection
0
content-type
text/html; charset=UTF-8
server
cafe
GET
H3
204
gen_204
pagead2.googlesyndication.com/pagead/ Frame 2C80
0
0
50ms
48ms
Fetch
image/gif
64.233.180.154
Google LLC
General
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=reach&proto=CAMSDk9wZXJhdGlvbkVycm9yGkdGYWlsZWQgdG8gZXhlY3V0ZSAncnVuJyBvbiAnU2hhcmVkU3RvcmFnZSc6IFNoYXJlZCBTdG9yYWdlIGlzIGRpc2FibGVkLg%3D%3D
Requested by
Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/managed/js/activeview/current/reach_worklet.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
64.233.180.154 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
pe-in-f154.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.googleadservices.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

cache-control
no-cache, must-revalidate
timing-allow-origin
*
pragma
no-cache
cross-origin-resource-policy
cross-origin
x-content-type-options
nosniff
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length
0
date
Wed, 09 Sep 2026 00:42:07 GMT
x-xss-protection
0
content-type
image/gif
server
cafe
GET
H3
204
gen_204
pagead2.googlesyndication.com/pagead/ Frame 2C80
0
0
51ms
49ms
Fetch
image/gif
64.233.180.154
Google LLC
General
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=reach&proto=CAUoAjAC
Requested by
Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/managed/js/activeview/current/reach_worklet.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
64.233.180.154 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
pe-in-f154.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.googleadservices.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

cache-control
no-cache, must-revalidate
timing-allow-origin
*
pragma
no-cache
cross-origin-resource-policy
cross-origin
x-content-type-options
nosniff
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length
0
date
Wed, 09 Sep 2026 00:42:07 GMT
x-xss-protection
0
content-type
image/gif
server
cafe
POST
H3
200
report-shared-storage
www.googleadservices.com/.well-known/private-aggregation/ Frame 2C80
0
0
78ms
77ms
Fetch
text/html
142.251.167.157
Google LLC
General
Full URL
https://www.googleadservices.com/.well-known/private-aggregation/report-shared-storage
Requested by
Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/managed/js/activeview/current/reach_worklet.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.167.157 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
ww-in-f157.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.googleadservices.com/pagead/managed/js/activeview/current/reach_worklet.html
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
Content-Type
text/plain;charset=UTF-8
sec-ch-ua-mobile
?0

Response headers

timing-allow-origin
*
cross-origin-resource-policy
cross-origin
x-content-type-options
nosniff
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length
0
date
Wed, 09 Sep 2026 00:42:07 GMT
x-xss-protection
0
content-type
text/html; charset=UTF-8
server
cafe
GET
H3
204
gen_204
pagead2.googlesyndication.com/pagead/ Frame 2C80
0
0
92ms
49ms
Fetch
image/gif
64.233.180.154
Google LLC
General
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=reach&proto=CAMSDk9wZXJhdGlvbkVycm9yGkdGYWlsZWQgdG8gZXhlY3V0ZSAncnVuJyBvbiAnU2hhcmVkU3RvcmFnZSc6IFNoYXJlZCBTdG9yYWdlIGlzIGRpc2FibGVkLg%3D%3D
Requested by
Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/managed/js/activeview/current/reach_worklet.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
64.233.180.154 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
pe-in-f154.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.googleadservices.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

cache-control
no-cache, must-revalidate
timing-allow-origin
*
pragma
no-cache
cross-origin-resource-policy
cross-origin
x-content-type-options
nosniff
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length
0
date
Wed, 09 Sep 2026 00:42:07 GMT
x-xss-protection
0
content-type
image/gif
server
cafe
GET
H3
204
gen_204
pagead2.googlesyndication.com/pagead/ Frame 2C80
0
0
51ms
49ms
Fetch
image/gif
64.233.180.154
Google LLC
General
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=reach&proto=CAUoAjAB
Requested by
Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/managed/js/activeview/current/reach_worklet.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
64.233.180.154 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
pe-in-f154.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.googleadservices.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

cache-control
no-cache, must-revalidate
timing-allow-origin
*
pragma
no-cache
cross-origin-resource-policy
cross-origin
x-content-type-options
nosniff
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length
0
date
Wed, 09 Sep 2026 00:42:07 GMT
x-xss-protection
0
content-type
image/gif
server
cafe
POST
H3
200
report-shared-storage
www.googleadservices.com/.well-known/private-aggregation/ Frame 2C80
0
0
79ms
77ms
Fetch
text/html
142.251.167.157
Google LLC
General
Full URL
https://www.googleadservices.com/.well-known/private-aggregation/report-shared-storage
Requested by
Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/managed/js/activeview/current/reach_worklet.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.167.157 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
ww-in-f157.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.googleadservices.com/pagead/managed/js/activeview/current/reach_worklet.html
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
Content-Type
text/plain;charset=UTF-8
sec-ch-ua-mobile
?0

Response headers

timing-allow-origin
*
cross-origin-resource-policy
cross-origin
x-content-type-options
nosniff
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length
0
date
Wed, 09 Sep 2026 00:42:07 GMT
x-xss-protection
0
content-type
text/html; charset=UTF-8
server
cafe
GET
H3
204
gen_204
pagead2.googlesyndication.com/pagead/ Frame 2C80
0
0
146ms
53ms
Fetch
image/gif
64.233.180.154
Google LLC
General
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=reach&proto=CAMSDk9wZXJhdGlvbkVycm9yGkdGYWlsZWQgdG8gZXhlY3V0ZSAncnVuJyBvbiAnU2hhcmVkU3RvcmFnZSc6IFNoYXJlZCBTdG9yYWdlIGlzIGRpc2FibGVkLg%3D%3D
Requested by
Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/managed/js/activeview/current/reach_worklet.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
64.233.180.154 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
pe-in-f154.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.googleadservices.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

cache-control
no-cache, must-revalidate
timing-allow-origin
*
pragma
no-cache
cross-origin-resource-policy
cross-origin
x-content-type-options
nosniff
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length
0
date
Wed, 09 Sep 2026 00:42:07 GMT
x-xss-protection
0
content-type
image/gif
server
cafe
GET
H3
204
gen_204
pagead2.googlesyndication.com/pagead/ Frame 2C80
0
0
92ms
50ms
Fetch
image/gif
64.233.180.154
Google LLC
General
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=reach&proto=CAUoAjAC
Requested by
Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/managed/js/activeview/current/reach_worklet.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
64.233.180.154 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
pe-in-f154.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.googleadservices.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

cache-control
no-cache, must-revalidate
timing-allow-origin
*
pragma
no-cache
cross-origin-resource-policy
cross-origin
x-content-type-options
nosniff
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length
0
date
Wed, 09 Sep 2026 00:42:07 GMT
x-xss-protection
0
content-type
image/gif
server
cafe
GET
H3
204
gen_204
pagead2.googlesyndication.com/pagead/ Frame 2C80
0
0
51ms
50ms
Fetch
image/gif
64.233.180.154
Google LLC
General
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=reach&proto=CAlgBWAGYAdgCGAJaAM%3D
Requested by
Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/managed/js/activeview/current/reach_worklet.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
64.233.180.154 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
pe-in-f154.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.googleadservices.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

cache-control
no-cache, must-revalidate
timing-allow-origin
*
pragma
no-cache
cross-origin-resource-policy
cross-origin
x-content-type-options
nosniff
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length
0
date
Wed, 09 Sep 2026 00:42:07 GMT
x-xss-protection
0
content-type
image/gif
server
cafe
POST
H3
200
report-shared-storage
www.googleadservices.com/.well-known/private-aggregation/ Frame 9EBD
0
0
59ms
58ms
Fetch
text/html
142.251.167.157
Google LLC
General
Full URL
https://www.googleadservices.com/.well-known/private-aggregation/report-shared-storage
Requested by
Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/managed/js/activeview/current/reach_worklet.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.167.157 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
ww-in-f157.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.googleadservices.com/pagead/managed/js/activeview/current/reach_worklet.html
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
Content-Type
text/plain;charset=UTF-8
sec-ch-ua-mobile
?0

Response headers

timing-allow-origin
*
cross-origin-resource-policy
cross-origin
x-content-type-options
nosniff
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length
0
date
Wed, 09 Sep 2026 00:42:07 GMT
x-xss-protection
0
content-type
text/html; charset=UTF-8
server
cafe
GET
H3
204
gen_204
pagead2.googlesyndication.com/pagead/ Frame 9EBD
0
0
84ms
52ms
Fetch
image/gif
64.233.180.154
Google LLC
General
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=reach&proto=CAMSDk9wZXJhdGlvbkVycm9yGkdGYWlsZWQgdG8gZXhlY3V0ZSAncnVuJyBvbiAnU2hhcmVkU3RvcmFnZSc6IFNoYXJlZCBTdG9yYWdlIGlzIGRpc2FibGVkLg%3D%3D
Requested by
Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/managed/js/activeview/current/reach_worklet.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
64.233.180.154 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
pe-in-f154.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.googleadservices.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

cache-control
no-cache, must-revalidate
timing-allow-origin
*
pragma
no-cache
cross-origin-resource-policy
cross-origin
x-content-type-options
nosniff
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length
0
date
Wed, 09 Sep 2026 00:42:07 GMT
x-xss-protection
0
content-type
image/gif
server
cafe
GET
H3
204
gen_204
pagead2.googlesyndication.com/pagead/ Frame 9EBD
0
0
53ms
49ms
Fetch
image/gif
64.233.180.154
Google LLC
General
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=reach&proto=CAUoAjAC
Requested by
Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/managed/js/activeview/current/reach_worklet.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
64.233.180.154 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
pe-in-f154.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.googleadservices.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

cache-control
no-cache, must-revalidate
timing-allow-origin
*
pragma
no-cache
cross-origin-resource-policy
cross-origin
x-content-type-options
nosniff
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length
0
date
Wed, 09 Sep 2026 00:42:07 GMT
x-xss-protection
0
content-type
image/gif
server
cafe
POST
H3
200
report-shared-storage
www.googleadservices.com/.well-known/private-aggregation/ Frame 9EBD
0
0
62ms
58ms
Fetch
text/html
142.251.167.157
Google LLC
General
Full URL
https://www.googleadservices.com/.well-known/private-aggregation/report-shared-storage
Requested by
Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/managed/js/activeview/current/reach_worklet.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.167.157 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
ww-in-f157.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.googleadservices.com/pagead/managed/js/activeview/current/reach_worklet.html
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
Content-Type
text/plain;charset=UTF-8
sec-ch-ua-mobile
?0

Response headers

timing-allow-origin
*
cross-origin-resource-policy
cross-origin
x-content-type-options
nosniff
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length
0
date
Wed, 09 Sep 2026 00:42:07 GMT
x-xss-protection
0
content-type
text/html; charset=UTF-8
server
cafe
GET
H3
204
gen_204
pagead2.googlesyndication.com/pagead/ Frame 9EBD
0
0
134ms
50ms
Fetch
image/gif
64.233.180.154
Google LLC
General
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=reach&proto=CAMSDk9wZXJhdGlvbkVycm9yGkdGYWlsZWQgdG8gZXhlY3V0ZSAncnVuJyBvbiAnU2hhcmVkU3RvcmFnZSc6IFNoYXJlZCBTdG9yYWdlIGlzIGRpc2FibGVkLg%3D%3D
Requested by
Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/managed/js/activeview/current/reach_worklet.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
64.233.180.154 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
pe-in-f154.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua-platform
"Linux"
Referer
https://www.googleadservices.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
sec-ch-ua
"Chromium";v="152", "Google Chrome";v="152", "Not?A_Brand";v="24"
sec-ch-ua-mobile
?0

Response headers

cache-control
no-cache, must-revalidate
timing-allow-origin
*
pragma
no-cache
cross-origin-resource-policy
cross-origin
x-content-type-options
nosniff
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length
0
date
Wed, 09 Sep 2026 00:42:07 GMT
x-xss-protection
0
content-type
image/gif
server
cafe
GET
H3
204
gen_204
pagead2.googlesyndication.com/pagead/ Frame 9EBD
0
0
54ms
52ms
Fetch
image/gif
64.233.180.154
Google LLC
General
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=av-js&type=reach&proto=CAUoAjAB
Requested by
Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/managed/js/activeview/current/reach_worklet.js