cloud.google.com Open in urlscan Pro
2a00:1450:4001:80e::200e Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://www.mandiant.com/resources/evolution-of-fin7
Effective URL:
https://cloud.google.com/blog/topics/threat-intelligence/evolution-of-fin7/?hl=en
Submission: On October 20 via api (October 20th 2024, 12:24:19 am UTC) from BY — Scanned from DE

Summary HTTP 34 Redirects Links 22 Behaviour Indicators

Summary

This website contacted 13 IPs in 2 countries across 6 domains to perform 34 HTTP transactions. The main IP is 2a00:1450:4001:80e::200e, located in Frankfurt am Main, Germany and belongs to GOOGLE, US. The main domain is cloud.google.com. The Cisco Umbrella rank of the primary domain is 15779.
TLS certificate: Issued by WR2 on September 30th 2024. Valid for: 3 months.

This is the only time cloud.google.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
2 2	2606:4700:300... 2606:4700:300b::a29f:f17d	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 2	2a00:1450:400... 2a00:1450:4001:80e::200e	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:81d::200a	15169 (GOOGLE) (GOOGLE)
10	216.58.206.67 216.58.206.67	15169 (GOOGLE) (GOOGLE)
6	172.217.18.3 172.217.18.3	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:812::201b	15169 (GOOGLE) (GOOGLE)
4	142.250.185.78 142.250.185.78	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:806::200e	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:82f::2008	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:806::200a	15169 (GOOGLE) (GOOGLE)
1	142.250.181.232 142.250.181.232	15169 (GOOGLE) (GOOGLE)
2	142.250.186.110 142.250.186.110	15169 (GOOGLE) (GOOGLE)
2	2001:4860:480... 2001:4860:4802:32::36	15169 (GOOGLE) (GOOGLE)
34	13

2 2606:4700:300b::a29f:f17d (United States) 2 redirects

ASN13335 (CLOUDFLARENET, US)

www.mandiant.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:80e::200e (Frankfurt am Main, Germany) 1 redirects

ASN15169 (GOOGLE, US)

cloud.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:81d::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 216.58.206.67 (United States)

ASN15169 (GOOGLE, US)
PTR: lhr35s11-in-f3.1e100.net

www.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 172.217.18.3 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s22-in-f3.1e100.net

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:812::201b (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

storage.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 142.250.185.78 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s48-in-f14.1e100.net

cloud.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:806::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

apis.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:82f::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:806::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

scone-pa.clients6.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.181.232 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s56-in-f8.1e100.net

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 142.250.186.110 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s06-in-f14.1e100.net

apis.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2001:4860:4802:32::36 (United States)

ASN15169 (GOOGLE, US)

region1.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
16	gstatic.com www.gstatic.com fonts.gstatic.com	588 KB
12	google.com 1 redirects cloud.google.com — Cisco Umbrella Rank: 15779 apis.google.com — Cisco Umbrella Rank: 123 scone-pa.clients6.google.com — Cisco Umbrella Rank: 2575	217 KB
3	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 39	246 KB
2	google-analytics.com region1.google-analytics.com — Cisco Umbrella Rank: 3643
2	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 30 storage.googleapis.com — Cisco Umbrella Rank: 356	458 KB
2	mandiant.com 2 redirects www.mandiant.com — Cisco Umbrella Rank: 619779	2 KB
34	6

	Domain	Requested by
10	www.gstatic.com	cloud.google.com www.gstatic.com
6	fonts.gstatic.com	cloud.google.com fonts.googleapis.com
6	cloud.google.com	1 redirects www.gstatic.com
4	apis.google.com	www.gstatic.com apis.google.com scone-pa.clients6.google.com
3	www.googletagmanager.com	www.gstatic.com www.googletagmanager.com
2	region1.google-analytics.com	www.googletagmanager.com
2	scone-pa.clients6.google.com	apis.google.com
2	www.mandiant.com	2 redirects
1	storage.googleapis.com	cloud.google.com
1	fonts.googleapis.com	cloud.google.com
34	10

This site contains links to these domains. Also see Links.

Domain
policies.google.com
console.cloud.google.com
mapsplatform.google.com
workspace.google.com
x.com
www.linkedin.com
www.facebook.com
github.com
bi-zone.medium.com
docs.microsoft.com
excel-dna.net
www.justice.gov
www.x.com
www.youtube.com
www.instagram.com
myaccount.google.com
support.google.com

Subject Issuer	Validity	Valid
*.google.com WR2	`2024-09-30` - `2024-12-23`	3 months	crt.sh
upload.video.google.com WR2	`2024-09-30` - `2024-12-23`	3 months	crt.sh
*.gstatic.com WR2	`2024-09-30` - `2024-12-23`	3 months	crt.sh
storage.googleapis.com WR2	`2024-09-30` - `2024-12-23`	3 months	crt.sh
*.apis.google.com WR2	`2024-09-30` - `2024-12-23`	3 months	crt.sh
*.google-analytics.com WR2	`2024-09-30` - `2024-12-23`	3 months	crt.sh
*.googleapis.com WR2	`2024-09-30` - `2024-12-23`	3 months	crt.sh

This page contains 2 frames:

Primary Page: https://cloud.google.com/blog/topics/threat-intelligence/evolution-of-fin7/?hl=en
Frame ID: 886547A63A7CC8FEE003C9AA94948F11
Requests: 31 HTTP requests in this frame

Frame: https://scone-pa.clients6.google.com/static/proxy.html?usegapi=1&jsh=m%3B%2F_%2Fscs%2Fabc-static%2F_%2Fjs%2Fk%3Dgapi.lb.de.n5o4atTRbEk.O%2Fam%3DAACA%2Fd%3D1%2Frs%3DAHpOoo89LjB0PzAni2ztsziMpIuu6JMJSg%2Fm%3D__features__
Frame ID: A666BB6851913BD19578F88067BB397C
Requests: 4 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

FIN7 Power Hour: Adversary Archaeology and the Evolution of FIN7 | Mandiant | Google Cloud Blog

Page URL History Show full URLs

https://www.mandiant.com/resources/evolution-of-fin7 HTTP 301
https://www.mandiant.com/resources/blog/evolution-of-fin7 HTTP 301
https://cloud.google.com/blog/topics/threat-intelligence/evolution-of-fin7/ HTTP 302
https://cloud.google.com/blog/topics/threat-intelligence/evolution-of-fin7/?hl=en Page URL

Detected technologies

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

Google Plus (Widgets) Expand

Overall confidence: 100%
Detected patterns

apis\.google\.com/js/[a-z]*\.js

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtm\.js
googletagmanager\.com/gtag/js

Page Statistics

34
Requests

100 %
HTTPS

62 %
IPv6

6
Domains

10
Subdomains

13
IPs

2
Countries

1509 kB
Transfer

4881 kB
Size

7
Cookies

22 Outgoing links

These are links going to different origins than the main page.

URL: https://policies.google.com/technologies/cookies?hl=en
Title: Learn more

Search URL Search Domain Scan URL

URL: https://console.cloud.google.com/freetrial/
Title: Get started for free

Search URL Search Domain Scan URL

URL: https://mapsplatform.google.com/resources/blog/
Title: Google Maps Platform

Search URL Search Domain Scan URL

URL: https://workspace.google.com/blog
Title: Google Workspace

Search URL Search Domain Scan URL

URL: https://x.com/intent/tweet?text=FIN7%20Power%20Hour:%20Adversary%20Archaeology%20and%20the%20Evolution%20of%20FIN7%20@googlecloud&url=https://cloud.google.com/blog/topics/threat-intelligence/evolution-of-fin7

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/shareArticle?mini=true&url=https://cloud.google.com/blog/topics/threat-intelligence/evolution-of-fin7&title=FIN7%20Power%20Hour:%20Adversary%20Archaeology%20and%20the%20Evolution%20of%20FIN7

Search URL Search Domain Scan URL

URL: https://www.facebook.com/sharer/sharer.php?caption=FIN7%20Power%20Hour:%20Adversary%20Archaeology%20and%20the%20Evolution%20of%20FIN7&u=https://cloud.google.com/blog/topics/threat-intelligence/evolution-of-fin7

Search URL Search Domain Scan URL

URL: https://github.com/PowerShellMafia/PowerSploit/blob/master/CodeExecution/Invoke-Shellcode.ps1
Title: PowerSploit

Search URL Search Domain Scan URL

URL: https://bi-zone.medium.com/from-pentest-to-apt-attack-cybercriminal-group-fin7-disguises-its-malware-as-an-ethical-hackers-c23c9a75e319
Title: Lizar

Search URL Search Domain Scan URL

URL: https://docs.microsoft.com/en-us/windows/win32/api/amsi/nf-amsi-amsiscanbuffer
Title: amsi.dll!AmsiScanBuffer

Search URL Search Domain Scan URL

URL: https://github.com/monoxgas/sRDI
Title: publicly available

Search URL Search Domain Scan URL

URL: https://excel-dna.net/
Title: Excel-DNA

Search URL Search Domain Scan URL

URL: https://www.justice.gov/opa/pr/three-members-notorious-international-cybercrime-group-fin7-custody-role-attacking-over-100
Title: 2018

Search URL Search Domain Scan URL

URL: https://www.justice.gov/usao-wdwa/pr/high-level-organizer-notorious-hacking-group-fin7-sentenced-ten-years-prison-scheme
Title: 2021

Search URL Search Domain Scan URL

URL: https://www.x.com/googlecloud

Search URL Search Domain Scan URL

URL: https://www.youtube.com/googlecloud

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/showcase/google-cloud

Search URL Search Domain Scan URL

URL: https://www.instagram.com/googlecloud/

Search URL Search Domain Scan URL

URL: https://www.facebook.com/googlecloud/

Search URL Search Domain Scan URL

URL: https://myaccount.google.com/privacypolicy?hl=en
Title: Privacy

Search URL Search Domain Scan URL

URL: https://myaccount.google.com/termsofservice?hl=en
Title: Terms

Search URL Search Domain Scan URL

URL: https://support.google.com/
Title: Help

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://www.mandiant.com/resources/evolution-of-fin7 HTTP 301
https://www.mandiant.com/resources/blog/evolution-of-fin7 HTTP 301
https://cloud.google.com/blog/topics/threat-intelligence/evolution-of-fin7/ HTTP 302
https://cloud.google.com/blog/topics/threat-intelligence/evolution-of-fin7/?hl=en Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

34 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request / Show response
cloud.google.com/blog/topics/threat-intelligence/evolution-of-fin7/
Redirect Chain

https://www.mandiant.com/resources/evolution-of-fin7
https://www.mandiant.com/resources/blog/evolution-of-fin7
https://cloud.google.com/blog/topics/threat-intelligence/evolution-of-fin7/
https://cloud.google.com/blog/topics/threat-intelligence/evolution-of-fin7/?hl=en

340 KB
70 KB

52ms
50ms

Document
text/html

2a00:1450:4001:80e::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cloud.google.com/blog/topics/threat-intelligence/evolution-of-fin7/?hl=en

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

261d94022f74ec70efe933e3b0707a01d5b85c84f0900194965078f07ac7d653

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /blog/_/TransformBlogUi/cspreport script-src 'report-sample' 'nonce-SJOefFOGFWwVv5awAXwX8Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /blog/_/TransformBlogUi/cspreport;worker-src 'self' script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com https://ssl.google-analytics.com https://www.googleadservices.com/pagead/conversion_async.js https://www.youtube.com https://googleads.g.doubleclick.net https://www.googleadservices.com/pagead/ https://support.google.com/inapp/ https://www.google.com/tools/feedback/ https://www.gstatic.com/inproduct_help/ https://www.gstatic.com/support/content/;report-uri /blog/_/TransformBlogUi/cspreport/allowlist
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, no-store, max-age=0, must-revalidate
content-encoding: gzip
content-security-policy: require-trusted-types-for 'script';report-uri /blog/_/TransformBlogUi/cspreport script-src 'report-sample' 'nonce-SJOefFOGFWwVv5awAXwX8Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /blog/_/TransformBlogUi/cspreport;worker-src 'self' script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com https://ssl.google-analytics.com https://www.googleadservices.com/pagead/conversion_async.js https://www.youtube.com https://googleads.g.doubleclick.net https://www.googleadservices.com/pagead/ https://support.google.com/inapp/ https://www.google.com/tools/feedback/ https://www.gstatic.com/inproduct_help/ https://www.gstatic.com/support/content/;report-uri /blog/_/TransformBlogUi/cspreport/allowlist
content-type: text/html; charset=utf-8
cross-origin-opener-policy: same-origin
cross-origin-resource-policy: same-site
date: Sun, 20 Oct 2024 00:24:13 GMT
expires: Mon, 01 Jan 1990 00:00:00 GMT
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
pragma: no-cache
reporting-endpoints: default="/blog/_/TransformBlogUi/web-reports?context=eJzjStDikmII1pBiyHz6mIn90ROmUrGXTBJfXzJpAHGB7Cum3Z-msTqlz2ANAuLWm-dYpwJx0r_zrEVArOZ6gdVQ4RKrIxCr9lxiNQVikQeXWHU5LrMWSVxhbQJiIR6OtbMv7mAT2HH79VpmJe2k_ML45Jz80pQK3fLUJN2knPx03dLM4tSistSieCMDIxNDA0NzPQPz-AIDAOgMO5U"
server: ESF
strict-transport-security: max-age=31536000
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-ua-compatible: IE=edge
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, no-store, max-age=0, must-revalidate
content-length: 0
content-type: application/binary
date: Sun, 20 Oct 2024 00:24:13 GMT
expires: Mon, 01 Jan 1990 00:00:00 GMT
location: https://cloud.google.com/blog/topics/threat-intelligence/evolution-of-fin7/?hl=en
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
pragma: no-cache
server: ESF
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-xss-protection: 0

GET
H2 200 css
fonts.googleapis.com/ 11 KB
1 KB 58ms
22ms Stylesheet
text/css 2a00:1450:4001:81d::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Google+Sans+Text_old:400,500,700,400i,500i,700i

Requested by

Host: cloud.google.com
URL: https://cloud.google.com/blog/topics/threat-intelligence/evolution-of-fin7/?hl=en

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81d::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

80b96a151d114ccd04b03d571e7562622fd97d5cccb528e3caa68b2781e0c562

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://cloud.google.com/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Sun, 20 Oct 2024 00:24:13 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sun, 20 Oct 2024 00:24:13 GMT
content-type: text/css; charset=utf-8
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
last-modified: Sat, 19 Oct 2024 23:23:42 GMT
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
x-xss-protection: 0
server: ESF

GET
H3 200 m=articleview,_b,_tp
www.gstatic.com/_/mss/boq-cloudx-web-blog/_/ss/k=boq-cloudx-web-blog.TransformBlogUi.zcSOI-C_kx0.L.B1.O/am=MBgwCw/d=1/ed=1/rs=AHrnUqWpwTO7nhVaMZVx2nAqQnPKIacdGw/ 2 MB
185 KB 39ms
14ms Stylesheet
text/css 216.58.206.67
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/_/mss/boq-cloudx-web-blog/_/ss/k=boq-cloudx-web-blog.TransformBlogUi.zcSOI-C_kx0.L.B1.O/am=MBgwCw/d=1/ed=1/rs=AHrnUqWpwTO7nhVaMZVx2nAqQnPKIacdGw/m=articleview,_b,_tp

Requested by

Host: cloud.google.com
URL: https://cloud.google.com/blog/topics/threat-intelligence/evolution-of-fin7/?hl=en

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.206.67 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lhr35s11-in-f3.1e100.net

Software

sffe /

Resource Hash

14e50adfc4eaedc74c842c05913526a483d4bb07c23bb1b1c1fd7062e745fdb5

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/boq-infra/cloudx-web-blog-boq-js-css-signers
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://cloud.google.com/

Response headers

content-encoding: gzip
age: 107882
report-to: {"group":"boq-infra/cloudx-web-blog-boq-js-css-signers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/boq-infra/cloudx-web-blog-boq-js-css-signers"}]}
x-content-type-options: nosniff
expires: Sat, 18 Oct 2025 18:26:11 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 18 Oct 2024 18:26:11 GMT
last-modified: Fri, 18 Oct 2024 00:13:23 GMT
content-type: text/css; charset=UTF-8
vary: Accept-Encoding, Origin
content-security-policy: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/boq-infra/cloudx-web-blog-boq-js-css-signers
cache-control: public, immutable, max-age=31536000
cross-origin-opener-policy: same-origin; report-to="boq-infra/cloudx-web-blog-boq-js-css-signers"
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
content-length: 189301
x-xss-protection: 0
server: sffe

GET
H3 200 m=_b,_tp Show response
www.gstatic.com/_/mss/boq-cloudx-web-blog/_/js/k=boq-cloudx-web-blog.TransformBlogUi.en.GhBfww-avHA.es5.O/am=MBgwCw/d=1/excm=_b,_tp,articleview/ed=1/dg=0/wt=2/ujg=1/rs=AHrnUqVY5-UtOXSp97YHbeNbiPkJ6... 193 KB
68 KB 80ms
55ms Script
text/javascript 216.58.206.67
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/_/mss/boq-cloudx-web-blog/_/js/k=boq-cloudx-web-blog.TransformBlogUi.en.GhBfww-avHA.es5.O/am=MBgwCw/d=1/excm=_b,_tp,articleview/ed=1/dg=0/wt=2/ujg=1/rs=AHrnUqVY5-UtOXSp97YHbeNbiPkJ64mSOg/m=_b,_tp

Requested by

Host: cloud.google.com
URL: https://cloud.google.com/blog/topics/threat-intelligence/evolution-of-fin7/?hl=en

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.206.67 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lhr35s11-in-f3.1e100.net

Software

sffe /

Resource Hash

8071b149660b49d9b5738d7bcde92963fed9d7b451b8220efdf0623a77fb938b

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/boq-infra/cloudx-web-blog-boq-js-css-signers
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://cloud.google.com/

Response headers

content-encoding: gzip
age: 107882
report-to: {"group":"boq-infra/cloudx-web-blog-boq-js-css-signers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/boq-infra/cloudx-web-blog-boq-js-css-signers"}]}
x-content-type-options: nosniff
expires: Sat, 18 Oct 2025 18:26:11 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 18 Oct 2024 18:26:11 GMT
last-modified: Fri, 18 Oct 2024 00:13:23 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding, Origin
content-security-policy: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/boq-infra/cloudx-web-blog-boq-js-css-signers
cache-control: public, immutable, max-age=31536000
cross-origin-opener-policy: same-origin; report-to="boq-infra/cloudx-web-blog-boq-js-css-signers"
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
content-length: 69288
x-xss-protection: 0
server: sffe

GET
H3 200 4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RPjIUvQ.woff2
fonts.gstatic.com/s/googlesans/v58/ 33 KB
33 KB 54ms
15ms Font
font/woff2 172.217.18.3
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/googlesans/v58/4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RPjIUvQ.woff2

Requested by

Host: cloud.google.com
URL: https://cloud.google.com/blog/topics/threat-intelligence/evolution-of-fin7/?hl=en

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.18.3 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s22-in-f3.1e100.net

Software

sffe /

Resource Hash

65c99d3b9f1a1b905046e30d00a97f2d4d605e565c32917e7a89a35926e04b98

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin: https://cloud.google.com
Referer: https://cloud.google.com/

Response headers

age: 332970
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options: nosniff
expires: Thu, 16 Oct 2025 03:54:44 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 16 Oct 2024 03:54:44 GMT
last-modified: Tue, 23 May 2023 16:35:55 GMT
content-type: font/woff2
cache-control: public, max-age=31536000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="apps-themes"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges: bytes
access-control-allow-origin: *
content-length: 34108
x-xss-protection: 0
server: sffe

GET
H3 200 5aUp9-KzpRiLCAt4Unrc-xIKmCU5oLlVnmhjtg.woff2
fonts.gstatic.com/s/googlesanstext/v22/ 16 KB
16 KB 22ms
21ms Font
font/woff2 172.217.18.3
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/googlesanstext/v22/5aUp9-KzpRiLCAt4Unrc-xIKmCU5oLlVnmhjtg.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Google+Sans+Text_old:400,500,700,400i,500i,700i

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.18.3 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s22-in-f3.1e100.net

Software

sffe /

Resource Hash

ba191bf3b5c39a50676e4ecae47adff7f404f9481890530cdbf64252fbb1a57e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin: https://cloud.google.com
Referer: https://fonts.googleapis.com/

Response headers

age: 333899
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options: nosniff
expires: Thu, 16 Oct 2025 03:39:15 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 16 Oct 2024 03:39:15 GMT
last-modified: Wed, 31 Jul 2024 20:32:02 GMT
content-type: font/woff2
cache-control: public, max-age=31536000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="apps-themes"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges: bytes
access-control-allow-origin: *
content-length: 16396
x-xss-protection: 0
server: sffe

GET
H3 200 5aUu9-KzpRiLCAt4Unrc-xIKmCU5qEp2iw.woff2
fonts.gstatic.com/s/googlesanstext/v22/ 16 KB
16 KB 61ms
60ms Font
font/woff2 172.217.18.3
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/googlesanstext/v22/5aUu9-KzpRiLCAt4Unrc-xIKmCU5qEp2iw.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Google+Sans+Text_old:400,500,700,400i,500i,700i

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.18.3 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s22-in-f3.1e100.net

Software

sffe /

Resource Hash

97399a2914c593da2895d9729aa0170a1956e91ee54cf7550696691949558a37

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin: https://cloud.google.com
Referer: https://fonts.googleapis.com/

Response headers

age: 332917
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options: nosniff
expires: Thu, 16 Oct 2025 03:55:37 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 16 Oct 2024 03:55:37 GMT
last-modified: Wed, 31 Jul 2024 20:31:46 GMT
content-type: font/woff2
cache-control: public, max-age=31536000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="apps-themes"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges: bytes
access-control-allow-origin: *
content-length: 15996
x-xss-protection: 0
server: sffe

GET
H3 200 5aUp9-KzpRiLCAt4Unrc-xIKmCU5oPFTnmhjtg.woff2
fonts.gstatic.com/s/googlesanstext/v22/ 16 KB
16 KB 60ms
59ms Font
font/woff2 172.217.18.3
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/googlesanstext/v22/5aUp9-KzpRiLCAt4Unrc-xIKmCU5oPFTnmhjtg.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Google+Sans+Text_old:400,500,700,400i,500i,700i

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.18.3 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s22-in-f3.1e100.net

Software

sffe /

Resource Hash

06e60764f2f683ef1562780a928735ca90bd7ff7b7376d2818c8445be9c29669

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin: https://cloud.google.com
Referer: https://fonts.googleapis.com/

Response headers

age: 332717
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options: nosniff
expires: Thu, 16 Oct 2025 03:58:57 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 16 Oct 2024 03:58:57 GMT
last-modified: Wed, 31 Jul 2024 20:32:37 GMT
content-type: font/woff2
cache-control: public, max-age=31536000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="apps-themes"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges: bytes
access-control-allow-origin: *
content-length: 15988
x-xss-protection: 0
server: sffe

GET
H3 200 5aUo9-KzpRiLCAt4Unrc-xIKmCU5qE9GiU9G.woff2
fonts.gstatic.com/s/googlesanstext/v22/ 16 KB
16 KB 26ms
25ms Font
font/woff2 172.217.18.3
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/googlesanstext/v22/5aUo9-KzpRiLCAt4Unrc-xIKmCU5qE9GiU9G.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Google+Sans+Text_old:400,500,700,400i,500i,700i

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.18.3 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s22-in-f3.1e100.net

Software

sffe /

Resource Hash

0f0c9a6824743e74e287574ef92dc872cbd02f44b9285f0564381b3d9b9173cf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin: https://cloud.google.com
Referer: https://fonts.googleapis.com/

Response headers

age: 333105
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options: nosniff
expires: Thu, 16 Oct 2025 03:52:29 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 16 Oct 2024 03:52:29 GMT
last-modified: Wed, 31 Jul 2024 20:32:00 GMT
content-type: font/woff2
cache-control: public, max-age=31536000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="apps-themes"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges: bytes
access-control-allow-origin: *
content-length: 16716
x-xss-protection: 0
server: sffe

GET
H3 200 pxiDypQkot1TnFhsFMOfGShVF9eO.woff2
fonts.gstatic.com/s/productsans/v9/ 31 KB
31 KB 63ms
62ms Font
font/woff2 172.217.18.3
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/productsans/v9/pxiDypQkot1TnFhsFMOfGShVF9eO.woff2

Requested by

Host: cloud.google.com
URL: https://cloud.google.com/blog/topics/threat-intelligence/evolution-of-fin7/?hl=en

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.18.3 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s22-in-f3.1e100.net

Software

sffe /

Resource Hash

2e0bdc192134bb3950a1ba4c1148901e39ebd8d2d01f64ef23106e90a9f771b0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin: https://cloud.google.com
Referer: https://cloud.google.com/

Response headers

age: 428236
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options: nosniff
expires: Wed, 15 Oct 2025 01:26:58 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 15 Oct 2024 01:26:58 GMT
last-modified: Mon, 15 Aug 2016 20:30:17 GMT
content-type: font/woff2
cache-control: public, max-age=31536000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="apps-themes"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges: bytes
access-control-allow-origin: *
content-length: 31568
x-xss-protection: 0
server: sffe

GET
H2 200 fin7-evo1_pysh.max-1900x1900.png
storage.googleapis.com/gweb-cloudblog-publish/images/ 456 KB
457 KB 262ms
201ms Image
image/png 2a00:1450:4001:812::201b
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://storage.googleapis.com/gweb-cloudblog-publish/images/fin7-evo1_pysh.max-1900x1900.png
Requested by: Host: cloud.google.com
URL: https://cloud.google.com/blog/topics/threat-intelligence/evolution-of-fin7/?hl=en
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:812::201b Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: UploadServer /
Resource Hash: 0af670810630c5efe0961873077a5ad14c12ac6ae4c8dd9f5d8bbe9e69034f28

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://cloud.google.com/

Response headers

x-goog-metageneration: 1
x-goog-hash: crc32c=CJSNJw==, md5=BamOD2CvgrpUEq+DcnbxOQ==
etag: "05a98e0f60af82ba5412af837276f139"
x-goog-stored-content-encoding: identity
expires: Sun, 20 Oct 2024 01:24:14 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-goog-stored-content-length: 466908
date: Sun, 20 Oct 2024 00:24:14 GMT
last-modified: Tue, 27 Feb 2024 16:05:26 GMT
content-type: image/png
x-guploader-uploadid: AHmUCY3uUjXvGzBrrSJVz7sGs2rUQxjZUCqbiKHUuP5Hck7qjKqgRf_q-UKJk5QEPazZOExCAcdaSIMzmA
cache-control: public, max-age=3600
x-goog-storage-class: MULTI_REGIONAL
accept-ranges: bytes
x-goog-generation: 1709049926857952
content-length: 466908
server: UploadServer

GET
DATA 200
OK truncated
/ 140 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: c64d4e621adbcc54a58cad839ff4223818b1fd3f234d16e4ae0599bafb0a616e

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/svg+xml

GET
H3 200 m=ws9Tlc,n73qwf,GkRiKb,e5qFLc,IZT63,UUJqVe,O1Gjze,byfTOb,lsjVmc,xUdipf,OTA3Ae,A1yn5d,fKUV3e,aurFic,Ug7Xab,ZwDk9d,V3dDOb,Pkx8hb,mI3LFb,mzzZzc,CHCSlb,o60eef,kxO7ab,YSybTb,SCGBie,O6y8ed,PrPYRd,MpJwZc,... Show response
www.gstatic.com/_/mss/boq-cloudx-web-blog/_/js/k=boq-cloudx-web-blog.TransformBlogUi.en.GhBfww-avHA.es5.O/ck=boq-cloudx-web-blog.TransformBlogUi.zcSOI-C_kx0.L.B1.O/am=MBgwCw/d=1/exm=_b,_tp/excm=_b,... 499 KB
155 KB 17ms
17ms Script
text/javascript 216.58.206.67
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/_/mss/boq-cloudx-web-blog/_/js/k=boq-cloudx-web-blog.TransformBlogUi.en.GhBfww-avHA.es5.O/ck=boq-cloudx-web-blog.TransformBlogUi.zcSOI-C_kx0.L.B1.O/am=MBgwCw/d=1/exm=_b,_tp/excm=_b,_tp,articleview/ed=1/wt=2/ujg=1/rs=AHrnUqULJgN1VoWooeKGHI572lTeRkS7ww/ee=EVNhjf:pw70Gc;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:SdcwHb;Me32dd:MEeYgc;NPKaK:SdcwHb;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;Uvc8o:VDovNc;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:QIhFr;lOO0Vd:OTA3Ae;nAFL3:s39S4;oGtAuc:sOXFj;pXdRYb:MdUzUe;qafBPd:yDVVkb;qddgKe:xQtZb;wR5FRb:O1Gjze;xqZiqf:BBI74;yxTchf:KUM7Z;zxnPse:GkRiKb/m=ws9Tlc,n73qwf,GkRiKb,e5qFLc,IZT63,UUJqVe,O1Gjze,byfTOb,lsjVmc,xUdipf,OTA3Ae,A1yn5d,fKUV3e,aurFic,Ug7Xab,ZwDk9d,V3dDOb,Pkx8hb,mI3LFb,mzzZzc,CHCSlb,o60eef,kxO7ab,YSybTb,SCGBie,O6y8ed,PrPYRd,MpJwZc,LEikZe,NwH0H,OmgaI,lazG7b,XVMNvd,L1AAkb,KUM7Z,Mlhmy,s39S4,fmklff,lwddkf,gychg,w9hDv,EEDORb,RMhBfe,SdcwHb,aW3pY,pw70Gc,EFQ78c,Ulmmrd,ZfAoz,mdR7q,xQtZb,JNoxi,kWgXee,oTg6l,BVgquf,QIhFr,ovKuLd,yDVVkb,hc6Ubd,SpsfSb,ebZ3mb,Z5uLle,BBI74,ZDZcre,Z3rB,rJ9tU,MdUzUe,A7fCU,zbML3c,zr1jrb,Yq43cc,Uas9Hd,pjICDe

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/_/mss/boq-cloudx-web-blog/_/js/k=boq-cloudx-web-blog.TransformBlogUi.en.GhBfww-avHA.es5.O/am=MBgwCw/d=1/excm=_b,_tp,articleview/ed=1/dg=0/wt=2/ujg=1/rs=AHrnUqVY5-UtOXSp97YHbeNbiPkJ64mSOg/m=_b,_tp

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.206.67 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lhr35s11-in-f3.1e100.net

Software

sffe /

Resource Hash

128bfed9cdfc66eab2d09d82bc0c87b5784243d1a8c23aa992e5745314f4377b

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/boq-infra/cloudx-web-blog-boq-js-css-signers
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://cloud.google.com/

Response headers

content-encoding: gzip
age: 107632
report-to: {"group":"boq-infra/cloudx-web-blog-boq-js-css-signers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/boq-infra/cloudx-web-blog-boq-js-css-signers"}]}
x-content-type-options: nosniff
expires: Sat, 18 Oct 2025 18:30:22 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 18 Oct 2024 18:30:22 GMT
last-modified: Fri, 18 Oct 2024 00:13:23 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding, Origin
content-security-policy: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/boq-infra/cloudx-web-blog-boq-js-css-signers
cache-control: public, immutable, max-age=31536000
cross-origin-opener-policy: same-origin; report-to="boq-infra/cloudx-web-blog-boq-js-css-signers"
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
content-length: 158958
x-xss-protection: 0
server: sffe

GET
H3 200 m=NsSboe Show response
www.gstatic.com/_/mss/boq-cloudx-web-blog/_/js/k=boq-cloudx-web-blog.TransformBlogUi.en.GhBfww-avHA.es5.O/ck=boq-cloudx-web-blog.TransformBlogUi.zcSOI-C_kx0.L.B1.O/am=MBgwCw/d=1/exm=A1yn5d,A7fCU,BB... 10 KB
3 KB 15ms
15ms Script
text/javascript 216.58.206.67
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/_/mss/boq-cloudx-web-blog/_/js/k=boq-cloudx-web-blog.TransformBlogUi.en.GhBfww-avHA.es5.O/ck=boq-cloudx-web-blog.TransformBlogUi.zcSOI-C_kx0.L.B1.O/am=MBgwCw/d=1/exm=A1yn5d,A7fCU,BBI74,BVgquf,CHCSlb,EEDORb,EFQ78c,GkRiKb,IZT63,JNoxi,KUM7Z,L1AAkb,LEikZe,MdUzUe,Mlhmy,MpJwZc,NwH0H,O1Gjze,O6y8ed,OTA3Ae,OmgaI,Pkx8hb,PrPYRd,QIhFr,RMhBfe,SCGBie,SdcwHb,SpsfSb,UUJqVe,Uas9Hd,Ug7Xab,Ulmmrd,V3dDOb,XVMNvd,YSybTb,Yq43cc,Z3rB,Z5uLle,ZDZcre,ZfAoz,ZwDk9d,_b,_tp,aW3pY,aurFic,byfTOb,e5qFLc,ebZ3mb,fKUV3e,fmklff,gychg,hc6Ubd,kWgXee,kxO7ab,lazG7b,lsjVmc,lwddkf,mI3LFb,mdR7q,mzzZzc,n73qwf,o60eef,oTg6l,ovKuLd,pjICDe,pw70Gc,rJ9tU,s39S4,w9hDv,ws9Tlc,xQtZb,xUdipf,yDVVkb,zbML3c,zr1jrb/excm=_b,_tp,articleview/ed=1/wt=2/ujg=1/rs=AHrnUqULJgN1VoWooeKGHI572lTeRkS7ww/ee=EVNhjf:pw70Gc;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:SdcwHb;Me32dd:MEeYgc;NPKaK:SdcwHb;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;Uvc8o:VDovNc;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:QIhFr;lOO0Vd:OTA3Ae;nAFL3:s39S4;oGtAuc:sOXFj;pXdRYb:MdUzUe;qafBPd:yDVVkb;qddgKe:xQtZb;wR5FRb:O1Gjze;xqZiqf:BBI74;yxTchf:KUM7Z;zxnPse:GkRiKb/m=NsSboe

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.206.67 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lhr35s11-in-f3.1e100.net

Software

sffe /

Resource Hash

9407b3728d9a96dcba2215e0f30fc4cb2c07ef45f28b35a12d32f5db04abbca6

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/boq-infra/cloudx-web-blog-boq-js-css-signers
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://cloud.google.com/

Response headers

content-encoding: gzip
age: 107632
report-to: {"group":"boq-infra/cloudx-web-blog-boq-js-css-signers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/boq-infra/cloudx-web-blog-boq-js-css-signers"}]}
x-content-type-options: nosniff
expires: Sat, 18 Oct 2025 18:30:22 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 18 Oct 2024 18:30:22 GMT
last-modified: Fri, 18 Oct 2024 00:13:23 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding, Origin
content-security-policy: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/boq-infra/cloudx-web-blog-boq-js-css-signers
cache-control: public, immutable, max-age=31536000
cross-origin-opener-policy: same-origin; report-to="boq-infra/cloudx-web-blog-boq-js-css-signers"
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
content-length: 2933
x-xss-protection: 0
server: sffe

GET
H3 200 lazy.min.js Show response
www.gstatic.com/feedback/js/help/prod/service/ 120 KB
39 KB 14ms
14ms Script
text/javascript 216.58.206.67
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/feedback/js/help/prod/service/lazy.min.js

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/_/mss/boq-cloudx-web-blog/_/js/k=boq-cloudx-web-blog.TransformBlogUi.en.GhBfww-avHA.es5.O/ck=boq-cloudx-web-blog.TransformBlogUi.zcSOI-C_kx0.L.B1.O/am=MBgwCw/d=1/exm=_b,_tp/excm=_b,_tp,articleview/ed=1/wt=2/ujg=1/rs=AHrnUqULJgN1VoWooeKGHI572lTeRkS7ww/ee=EVNhjf:pw70Gc;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:SdcwHb;Me32dd:MEeYgc;NPKaK:SdcwHb;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;Uvc8o:VDovNc;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:QIhFr;lOO0Vd:OTA3Ae;nAFL3:s39S4;oGtAuc:sOXFj;pXdRYb:MdUzUe;qafBPd:yDVVkb;qddgKe:xQtZb;wR5FRb:O1Gjze;xqZiqf:BBI74;yxTchf:KUM7Z;zxnPse:GkRiKb/m=ws9Tlc,n73qwf,GkRiKb,e5qFLc,IZT63,UUJqVe,O1Gjze,byfTOb,lsjVmc,xUdipf,OTA3Ae,A1yn5d,fKUV3e,aurFic,Ug7Xab,ZwDk9d,V3dDOb,Pkx8hb,mI3LFb,mzzZzc,CHCSlb,o60eef,kxO7ab,YSybTb,SCGBie,O6y8ed,PrPYRd,MpJwZc,LEikZe,NwH0H,OmgaI,lazG7b,XVMNvd,L1AAkb,KUM7Z,Mlhmy,s39S4,fmklff,lwddkf,gychg,w9hDv,EEDORb,RMhBfe,SdcwHb,aW3pY,pw70Gc,EFQ78c,Ulmmrd,ZfAoz,mdR7q,xQtZb,JNoxi,kWgXee,oTg6l,BVgquf,QIhFr,ovKuLd,yDVVkb,hc6Ubd,SpsfSb,ebZ3mb,Z5uLle,BBI74,ZDZcre,Z3rB,rJ9tU,MdUzUe,A7fCU,zbML3c,zr1jrb,Yq43cc,Uas9Hd,pjICDe

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.206.67 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lhr35s11-in-f3.1e100.net

Software

sffe /

Resource Hash

665eb302f730c65c8752a1998114c6f4d7f0d5e0250465c18665772d14500389

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://cloud.google.com/

Response headers

content-encoding: gzip
age: 765
report-to: {"group":"product-feedback-gathering","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/product-feedback-gathering"}]}
x-content-type-options: nosniff
expires: Sun, 20 Oct 2024 01:01:29 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sun, 20 Oct 2024 00:11:29 GMT
last-modified: Fri, 18 Oct 2024 18:46:54 GMT
content-type: text/javascript
vary: Accept-Encoding, Origin
cache-control: public, max-age=3000
cross-origin-opener-policy: same-origin-allow-popups; report-to="product-feedback-gathering"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/product-feedback-gathering
accept-ranges: bytes
content-length: 39638
x-xss-protection: 0
server: sffe

GET
H3 200 m=RqjULd Show response
www.gstatic.com/_/mss/boq-cloudx-web-blog/_/js/k=boq-cloudx-web-blog.TransformBlogUi.en.GhBfww-avHA.es5.O/ck=boq-cloudx-web-blog.TransformBlogUi.zcSOI-C_kx0.L.B1.O/am=MBgwCw/d=1/exm=A1yn5d,A7fCU,BB... 22 KB
7 KB 16ms
15ms Script
text/javascript 216.58.206.67
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/_/mss/boq-cloudx-web-blog/_/js/k=boq-cloudx-web-blog.TransformBlogUi.en.GhBfww-avHA.es5.O/ck=boq-cloudx-web-blog.TransformBlogUi.zcSOI-C_kx0.L.B1.O/am=MBgwCw/d=1/exm=A1yn5d,A7fCU,BBI74,BVgquf,CHCSlb,EEDORb,EFQ78c,GkRiKb,IZT63,JNoxi,KUM7Z,L1AAkb,LEikZe,MdUzUe,Mlhmy,MpJwZc,NsSboe,NwH0H,O1Gjze,O6y8ed,OTA3Ae,OmgaI,Pkx8hb,PrPYRd,QIhFr,RMhBfe,SCGBie,SdcwHb,SpsfSb,UUJqVe,Uas9Hd,Ug7Xab,Ulmmrd,V3dDOb,XVMNvd,YSybTb,Yq43cc,Z3rB,Z5uLle,ZDZcre,ZfAoz,ZwDk9d,_b,_tp,aW3pY,aurFic,byfTOb,e5qFLc,ebZ3mb,fKUV3e,fmklff,gychg,hc6Ubd,kWgXee,kxO7ab,lazG7b,lsjVmc,lwddkf,mI3LFb,mdR7q,mzzZzc,n73qwf,o60eef,oTg6l,ovKuLd,pjICDe,pw70Gc,rJ9tU,s39S4,w9hDv,ws9Tlc,xQtZb,xUdipf,yDVVkb,zbML3c,zr1jrb/excm=_b,_tp,articleview/ed=1/wt=2/ujg=1/rs=AHrnUqULJgN1VoWooeKGHI572lTeRkS7ww/ee=EVNhjf:pw70Gc;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:SdcwHb;Me32dd:MEeYgc;NPKaK:SdcwHb;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;Uvc8o:VDovNc;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:QIhFr;lOO0Vd:OTA3Ae;nAFL3:s39S4;oGtAuc:sOXFj;pXdRYb:MdUzUe;qafBPd:yDVVkb;qddgKe:xQtZb;wR5FRb:O1Gjze;xqZiqf:BBI74;yxTchf:KUM7Z;zxnPse:GkRiKb/m=RqjULd

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.206.67 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lhr35s11-in-f3.1e100.net

Software

sffe /

Resource Hash

c69bf5a9569cb5b16c873b8fd829ed0125e5135585cda560a18b134be5859f0a

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/boq-infra/cloudx-web-blog-boq-js-css-signers
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://cloud.google.com/

Response headers

content-encoding: gzip
age: 107632
report-to: {"group":"boq-infra/cloudx-web-blog-boq-js-css-signers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/boq-infra/cloudx-web-blog-boq-js-css-signers"}]}
x-content-type-options: nosniff
expires: Sat, 18 Oct 2025 18:30:22 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 18 Oct 2024 18:30:22 GMT
last-modified: Fri, 18 Oct 2024 00:13:23 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding, Origin
content-security-policy: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/boq-infra/cloudx-web-blog-boq-js-css-signers
cache-control: public, immutable, max-age=31536000
cross-origin-opener-policy: same-origin; report-to="boq-infra/cloudx-web-blog-boq-js-css-signers"
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
content-length: 7518
x-xss-protection: 0
server: sffe

GET
H3 200 m=P6sQOc Show response
www.gstatic.com/_/mss/boq-cloudx-web-blog/_/js/k=boq-cloudx-web-blog.TransformBlogUi.en.GhBfww-avHA.es5.O/ck=boq-cloudx-web-blog.TransformBlogUi.zcSOI-C_kx0.L.B1.O/am=MBgwCw/d=1/exm=A1yn5d,A7fCU,BB... 1 KB
786 B 15ms
15ms Script
text/javascript 216.58.206.67
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/_/mss/boq-cloudx-web-blog/_/js/k=boq-cloudx-web-blog.TransformBlogUi.en.GhBfww-avHA.es5.O/ck=boq-cloudx-web-blog.TransformBlogUi.zcSOI-C_kx0.L.B1.O/am=MBgwCw/d=1/exm=A1yn5d,A7fCU,BBI74,BVgquf,CHCSlb,EEDORb,EFQ78c,GkRiKb,IZT63,JNoxi,KUM7Z,L1AAkb,LEikZe,MdUzUe,Mlhmy,MpJwZc,NsSboe,NwH0H,O1Gjze,O6y8ed,OTA3Ae,OmgaI,Pkx8hb,PrPYRd,QIhFr,RMhBfe,RqjULd,SCGBie,SdcwHb,SpsfSb,UUJqVe,Uas9Hd,Ug7Xab,Ulmmrd,V3dDOb,XVMNvd,YSybTb,Yq43cc,Z3rB,Z5uLle,ZDZcre,ZfAoz,ZwDk9d,_b,_tp,aW3pY,aurFic,byfTOb,e5qFLc,ebZ3mb,fKUV3e,fmklff,gychg,hc6Ubd,kWgXee,kxO7ab,lazG7b,lsjVmc,lwddkf,mI3LFb,mdR7q,mzzZzc,n73qwf,o60eef,oTg6l,ovKuLd,pjICDe,pw70Gc,rJ9tU,s39S4,w9hDv,ws9Tlc,xQtZb,xUdipf,yDVVkb,zbML3c,zr1jrb/excm=_b,_tp,articleview/ed=1/wt=2/ujg=1/rs=AHrnUqULJgN1VoWooeKGHI572lTeRkS7ww/ee=EVNhjf:pw70Gc;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:SdcwHb;Me32dd:MEeYgc;NPKaK:SdcwHb;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;Uvc8o:VDovNc;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:QIhFr;lOO0Vd:OTA3Ae;nAFL3:s39S4;oGtAuc:sOXFj;pXdRYb:MdUzUe;qafBPd:yDVVkb;qddgKe:xQtZb;wR5FRb:O1Gjze;xqZiqf:BBI74;yxTchf:KUM7Z;zxnPse:GkRiKb/m=P6sQOc

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.206.67 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lhr35s11-in-f3.1e100.net

Software

sffe /

Resource Hash

d04a897abbfa80f90a10bb2fad32e25ffb213d21d0ca4a52d126308ab98cc697

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/boq-infra/cloudx-web-blog-boq-js-css-signers
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://cloud.google.com/

Response headers

content-encoding: gzip
age: 107632
report-to: {"group":"boq-infra/cloudx-web-blog-boq-js-css-signers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/boq-infra/cloudx-web-blog-boq-js-css-signers"}]}
x-content-type-options: nosniff
expires: Sat, 18 Oct 2025 18:30:22 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 18 Oct 2024 18:30:22 GMT
last-modified: Fri, 18 Oct 2024 00:13:23 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding, Origin
content-security-policy: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/boq-infra/cloudx-web-blog-boq-js-css-signers
cache-control: public, immutable, max-age=31536000
cross-origin-opener-policy: same-origin; report-to="boq-infra/cloudx-web-blog-boq-js-css-signers"
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
content-length: 760
x-xss-protection: 0
server: sffe

GET
H3 200 2a.json Show response
www.gstatic.com/glue/cookienotificationbar/config/ 559 B
241 B 44ms
22ms Fetch
application/json 216.58.206.67
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/glue/cookienotificationbar/config/2a.json?hl=en

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.206.67 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lhr35s11-in-f3.1e100.net

Software

sffe /

Resource Hash

548c0c92bb7a2a4a4d59b283c4179b176912575a3dd2dce1dcbba5c5835ffe2e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://cloud.google.com/

Response headers

content-encoding: br
report-to: {"group":"uxe-owners-acl/gstatic","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/uxe-owners-acl/gstatic"}]}
x-content-type-options: nosniff
expires: Sun, 20 Oct 2024 00:24:14 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sun, 20 Oct 2024 00:24:14 GMT
content-type: application/json
vary: Accept-Encoding
last-modified: Thu, 25 Jul 2024 10:08:00 GMT
cache-control: private, max-age=3000
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/uxe-owners-acl/gstatic
accept-ranges: bytes
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="uxe-owners-acl/gstatic"
content-length: 215
x-xss-protection: 0
server: sffe

GET
H3 200 pingz Show response
cloud.google.com/__/ 136 B
174 B 132ms
132ms Fetch
application/json 142.250.185.78
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cloud.google.com/__/pingz?hl=en&platform=boq&page=%2Fblog%2Ftopics%2Fthreat-intelligence%2Fevolution-of-fin7%2F&ifgr=true

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.78 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s48-in-f14.1e100.net

Software

ESF /

Resource Hash

aa76d407d6b29ddaa75aaab2221c45db8f998001ceb0e631adedfe61743db694

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /_/CloudWebCgcHttp/cspreport
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://cloud.google.com/

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sun, 20 Oct 2024 00:24:14 GMT
content-type: application/json; charset=utf-8
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
content-disposition: attachment; filename="response.bin"; filename*=UTF-8''response.bin
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000
content-security-policy: require-trusted-types-for 'script';report-uri /_/CloudWebCgcHttp/cspreport
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
x-xss-protection: 0
server: ESF

GET
H2 200 client.js Show response
apis.google.com/js/ 14 KB
6 KB 100ms
36ms Script
text/javascript 2a00:1450:4001:806::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://apis.google.com/js/client.js

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/feedback/js/help/prod/service/lazy.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

149bc7eb2508c059032b40954da7856e73fe022f058ed433ad92b12d38e5751b

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/gapi-team
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://cloud.google.com/

Response headers

content-encoding: gzip
etag: "7016c5fbddab0339"
report-to: {"group":"gapi-team","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gapi-team"}]}
x-content-type-options: nosniff
expires: Sun, 20 Oct 2024 00:24:14 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sun, 20 Oct 2024 00:24:14 GMT
content-type: text/javascript
vary: Accept-Encoding
content-security-policy: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/gapi-team
cache-control: private, max-age=1800, stale-while-revalidate=1800
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="gapi-team"
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
content-length: 5771
x-xss-protection: 0
server: sffe

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 203 KB
71 KB 64ms
28ms Script
application/javascript 2a00:1450:4001:82f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-5CVQBG

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

ff6ca740a352d65db24af7a3fec0da2503b3244a066794ad4397eaa0e320bf68

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://cloud.google.com/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:1080:0"}],}
expires: Sun, 20 Oct 2024 00:24:14 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sun, 20 Oct 2024 00:24:14 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Sun, 20 Oct 2024 00:00:00 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:1080:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 72408
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 cb=gapi.loaded_0 Show response
apis.google.com/_/scs/abc-static/_/js/k=gapi.lb.de.n5o4atTRbEk.O/m=client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo89LjB0PzAni2ztsziMpIuu6JMJSg/ 315 KB
108 KB 26ms
26ms Script
text/javascript 2a00:1450:4001:806::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://apis.google.com/_/scs/abc-static/_/js/k=gapi.lb.de.n5o4atTRbEk.O/m=client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo89LjB0PzAni2ztsziMpIuu6JMJSg/cb=gapi.loaded_0?le=scs

Requested by

Host: apis.google.com
URL: https://apis.google.com/js/client.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

af79d4a18b4bd0babefdb6249f39490be7331f912c06bb392c6881ffc8f57161

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://cloud.google.com/

Response headers

content-encoding: gzip
age: 370346
report-to: {"group":"social-frontend-mpm-access","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/social-frontend-mpm-access"}]}
x-content-type-options: nosniff
expires: Wed, 15 Oct 2025 17:31:48 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 15 Oct 2024 17:31:48 GMT
last-modified: Thu, 10 Oct 2024 20:03:27 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=31536000
cross-origin-opener-policy: same-origin; report-to="social-frontend-mpm-access"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/social-frontend-mpm-access
accept-ranges: bytes
access-control-allow-origin: *
content-length: 109634
x-xss-protection: 0
server: sffe

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 251 KB
81 KB 39ms
37ms Script
application/javascript 2a00:1450:4001:82f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-M8NRS5J&l=dataLayer

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5CVQBG

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

3485e39c56236e34e19db687a01300ebcf72b9feb3de7fd31e4da2792ad83a35

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://cloud.google.com/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:1080:0"}],}
expires: Sun, 20 Oct 2024 00:24:14 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sun, 20 Oct 2024 00:24:14 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Sun, 20 Oct 2024 00:00:00 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:1080:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 82360
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 proxy.html Show response
scone-pa.clients6.google.com/static/ Frame A666 432 B
865 B 97ms
32ms Document
text/html 2a00:1450:4001:806::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://scone-pa.clients6.google.com/static/proxy.html?usegapi=1&jsh=m%3B%2F_%2Fscs%2Fabc-static%2F_%2Fjs%2Fk%3Dgapi.lb.de.n5o4atTRbEk.O%2Fam%3DAACA%2Fd%3D1%2Frs%3DAHpOoo89LjB0PzAni2ztsziMpIuu6JMJSg%2Fm%3D__features__

Requested by

Host: apis.google.com
URL: https://apis.google.com/_/scs/abc-static/_/js/k=gapi.lb.de.n5o4atTRbEk.O/m=client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo89LjB0PzAni2ztsziMpIuu6JMJSg/cb=gapi.loaded_0?le=scs

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

scaffolding on HTTPServer2 /

Resource Hash

e6ed4e6e2311ab88b0a94c289d30a8a1bc5b3893dec00c6b32702b190800581a

Security Headers

Name	Value
Content-Security-Policy	object-src 'none';base-uri 'self';script-src 'nonce-Y8gHu_ARjSObADHfQP_TTw' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/xd3cpp/2 require-trusted-types-for 'script'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://cloud.google.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: gzip
content-length: 288
content-security-policy: object-src 'none';base-uri 'self';script-src 'nonce-Y8gHu_ARjSObADHfQP_TTw' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/xd3cpp/2 require-trusted-types-for 'script'
content-type: text/html; charset=UTF-8
cross-origin-embedder-policy: require-corp; report-to="gapi"
cross-origin-resource-policy: cross-origin
date: Sun, 20 Oct 2024 00:24:14 GMT
report-to: {"group":"gapi","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gapi"}]}
server: scaffolding on HTTPServer2
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 273 KB
94 KB 33ms
33ms Script
application/javascript 142.250.181.232
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-WH2QY8WWF5&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-M8NRS5J&l=dataLayer

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.181.232 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s56-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

5c06a9c253cdea0183ffd715334c100a27c0396c4c367d392ec3f8d7c1f1610a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://cloud.google.com/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Sun, 20 Oct 2024 00:24:14 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sun, 20 Oct 2024 00:24:14 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 96222
x-xss-protection: 0
server: Google Tag Manager

GET
H3 200 googleapis.proxy.js Show response
apis.google.com/js/ Frame A666 14 KB
6 KB 24ms
22ms Script
text/javascript 142.250.186.110
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://apis.google.com/js/googleapis.proxy.js?onload=startup

Requested by

Host: scone-pa.clients6.google.com
URL: https://scone-pa.clients6.google.com/static/proxy.html?usegapi=1&jsh=m%3B%2F_%2Fscs%2Fabc-static%2F_%2Fjs%2Fk%3Dgapi.lb.de.n5o4atTRbEk.O%2Fam%3DAACA%2Fd%3D1%2Frs%3DAHpOoo89LjB0PzAni2ztsziMpIuu6JMJSg%2Fm%3D__features__

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.110 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s06-in-f14.1e100.net

Software

sffe /

Resource Hash

10486fd8c9aefec703fe160e27f17b23c30fbb25588b7fd89efb8f8b66c628a7

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/gapi-team
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://scone-pa.clients6.google.com/

Response headers

content-encoding: gzip
etag: "06df189f2277d21d"
report-to: {"group":"gapi-team","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gapi-team"}]}
x-content-type-options: nosniff
expires: Sun, 20 Oct 2024 00:24:14 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sun, 20 Oct 2024 00:24:14 GMT
content-type: text/javascript
vary: Accept-Encoding
content-security-policy: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/gapi-team
cache-control: private, max-age=1800, stale-while-revalidate=1800
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="gapi-team"
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
access-control-allow-origin: *
content-length: 5771
x-xss-protection: 0
server: sffe

POST
H2 204 collect
region1.google-analytics.com/g/ 0
0 59ms
18ms Fetch
text/plain 2001:4860:4802:32::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.google-analytics.com/g/collect?v=2&tid=G-WH2QY8WWF5&gtm=45je4ah0v873759632z8897536842za200zb897536842&_p=1729383854467&gcs=G101&gcd=13q3rPl2l5l1&npa=1&dma_cps=-&dma=1&tag_exp=101686685~101823848~101836705&cid=2014632062.1729383855&ul=de-de&sr=1600x1200&_ng=1&ir=1&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=denied&_eu=EA&_s=1&dl=https%3A%2F%2Fcloud.google-b197145817.com%2Fblog%2Ftopics%2Fthreat-intelligence%2Fevolution-of-fin7%2F&sid=1729383854&sct=1&seg=0&dt=FIN7%20Power%20Hour%3A%20Adversary%20Archaeology%20and%20the%20Evolution%20of%20FIN7%20%7C%20Mandiant%20%7C%20Google%20Cloud%20Blog&en=active_experiments&_fv=1&_nsi=1&_ss=1&ep.container_id_and_version=GTM-M8NRS5J%3A86&ep.is_queued=false&epn.event_number=0&epn.queue_batch_number=0&epn.queue_batch_hit_number=0&ep.country=DE&ep.page_hl_parameter=en&ep.utmz=utmcsr%3D(direct)%7Cutmcmd%3D(none)%7Cutmccn%3D(direct)&ep.is_internal_user=false&ep.language_served=en&ep.is_signed_in=false&ep.non_interaction=true&ep.active_experiments=97706004%2C97684533%2C97785986%2C48897392%2C97442197%2C48554503%2C97656897%2C97517170%2C1706538%2C97535270%2C48887080%2C93874002%2C93778619%2C48830069%2C1714259%2C97716269%2C48489833%2C97684517%2C97785970%2C97442181%2C97656881%2C97517154%2C48887064%2C93873986&ep.has_cj_refparam=false&ep.is_eea=true&tfd=1534
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-WH2QY8WWF5&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:32::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://cloud.google.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:86:0
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:86:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://cloud.google.com
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sun, 20 Oct 2024 00:24:14 GMT
content-type: text/plain
server: Golfe2

POST
H2 204 collect
region1.google-analytics.com/g/ 0
0 57ms
19ms Fetch
text/plain 2001:4860:4802:32::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.google-analytics.com/g/collect?v=2&tid=G-WH2QY8WWF5&gtm=45je4ah0v873759632z8897536842za200zb897536842&_p=1729383854467&gcs=G101&gcd=13q3rPl2l5l1&npa=1&dma_cps=-&dma=1&tag_exp=101686685~101823848~101836705&cid=2014632062.1729383855&ul=de-de&sr=1600x1200&_ng=1&ir=1&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=denied&_eu=EA&_s=2&dl=https%3A%2F%2Fcloud.google-b197145817.com%2Fblog%2Ftopics%2Fthreat-intelligence%2Fevolution-of-fin7%2F&sid=1729383854&sct=1&seg=1&dt=FIN7%20Power%20Hour%3A%20Adversary%20Archaeology%20and%20the%20Evolution%20of%20FIN7%20%7C%20Mandiant%20%7C%20Google%20Cloud%20Blog&en=page_view&_c=1&ep.container_id_and_version=GTM-M8NRS5J%3A86&ep.is_queued=false&epn.event_number=1&epn.queue_batch_number=1&epn.queue_batch_hit_number=0&ep.country=DE&ep.page_hl_parameter=en&ep.utmz=utmcsr%3D(direct)%7Cutmcmd%3D(none)%7Cutmccn%3D(direct)&ep.is_internal_user=false&ep.language_served=en&ep.is_signed_in=false&epn.page_client_height=32735&epn.page_client_width=1600&ep.page_first_published=2024-03-25%2022%3A03%3A00&ep.page_hosting_platform=blog_boq&ep.page_last_published=2022-04-04%2009%3A04%3A00&ep.page_post_author=mandiant%20&ep.page_post_author_role=&ep.page_post_labels=threat%20intelligence&ep.page_post_title=fin7%20power%20hour%3A%20adversary%20archaeology%20and%20the%20evolution%20of%20fin7%20%7C%20mandiant&ep.page_original_url=https%3A%2F%2Fcloud.google.com%2Fblog%2Ftopics%2Fthreat-intelligence%2Fevolution-of-fin7%2F&ep.non_interaction=false&ep.has_cj_refparam=false&ep.is_eea=true&_et=3&tfd=1537
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-WH2QY8WWF5&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:32::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://cloud.google.com/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:86:0
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:86:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://cloud.google.com
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sun, 20 Oct 2024 00:24:14 GMT
content-type: text/plain
server: Golfe2

GET
H3 200 cb=gapi.loaded_0 Show response
apis.google.com/_/scs/abc-static/_/js/k=gapi.lb.de.n5o4atTRbEk.O/m=googleapis_proxy/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo89LjB0PzAni2ztsziMpIuu6JMJSg/ Frame A666 73 KB
25 KB 14ms
14ms Script
text/javascript 142.250.186.110
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://apis.google.com/_/scs/abc-static/_/js/k=gapi.lb.de.n5o4atTRbEk.O/m=googleapis_proxy/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo89LjB0PzAni2ztsziMpIuu6JMJSg/cb=gapi.loaded_0?le=scs

Requested by

Host: apis.google.com
URL: https://apis.google.com/js/googleapis.proxy.js?onload=startup

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.110 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s06-in-f14.1e100.net

Software

sffe /

Resource Hash

4a55571a4c063f08a1b647ed9fbabdefff4b69aee365a7090a7319b766d075c0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://scone-pa.clients6.google.com/

Response headers

content-encoding: gzip
age: 381915
report-to: {"group":"social-frontend-mpm-access","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/social-frontend-mpm-access"}]}
x-content-type-options: nosniff
expires: Wed, 15 Oct 2025 14:18:59 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 15 Oct 2024 14:18:59 GMT
last-modified: Thu, 10 Oct 2024 20:03:27 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=31536000
cross-origin-opener-policy: same-origin; report-to="social-frontend-mpm-access"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/social-frontend-mpm-access
accept-ranges: bytes
access-control-allow-origin: *
content-length: 25806
x-xss-protection: 0
server: sffe

POST
H2 200 trigger_anonymous Show response
scone-pa.clients6.google.com/v1/survey/trigger/ Frame A666 2 KB
1 KB 250ms
244ms XHR
application/json+protobuf 2a00:1450:4001:806::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://scone-pa.clients6.google.com/v1/survey/trigger/trigger_anonymous?key=AIzaSyD3LJeW4Q6gtdgJlyeFZUp-GhpIoc6EUeg

Requested by

Host: apis.google.com
URL: https://apis.google.com/_/scs/abc-static/_/js/k=gapi.lb.de.n5o4atTRbEk.O/m=googleapis_proxy/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo89LjB0PzAni2ztsziMpIuu6JMJSg/cb=gapi.loaded_0?le=scs

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

scaffolding on HTTPServer2 /

Resource Hash

d010bcb9f4da592531fb64f2725e3daf2a946f1652c27e92fd914057a107eeb7

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubdomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://scone-pa.clients6.google.com/static/proxy.html?usegapi=1&jsh=m%3B%2F_%2Fscs%2Fabc-static%2F_%2Fjs%2Fk%3Dgapi.lb.de.n5o4atTRbEk.O%2Fam%3DAACA%2Fd%3D1%2Frs%3DAHpOoo89LjB0PzAni2ztsziMpIuu6JMJSg%2Fm%3D__features__
X-Referer: https://cloud.google.com
X-Goog-Encode-Response-If-Executable: base64
X-ClientDetails: appVersion=5.0%20(X11%3B%20Linux%20x86_64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F129.0.0.0%20Safari%2F537.36&platform=Linux%20x86_64&userAgent=Mozilla%2F5.0%20(X11%3B%20Linux%20x86_64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F129.0.0.0%20Safari%2F537.36
X-JavaScript-User-Agent: google-api-javascript-client/1.1.0
X-Goog-Api-Key: AIzaSyD3LJeW4Q6gtdgJlyeFZUp-GhpIoc6EUeg
X-Origin: https://cloud.google.com
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-Type: application/json+protobuf

Response headers

strict-transport-security: max-age=10886400; includeSubdomains
cache-control: private
content-encoding: gzip
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1008
date: Sun, 20 Oct 2024 00:24:15 GMT
x-xss-protection: 0
content-type: application/json+protobuf; charset=UTF-8
vary: Origin, X-Origin, Referer
server: scaffolding on HTTPServer2
x-frame-options: SAMEORIGIN

GET
H3 200 m=Wt6vjf,hhhU8,FCpbqb,WhJNk Show response
www.gstatic.com/_/mss/boq-cloudx-web-blog/_/js/k=boq-cloudx-web-blog.TransformBlogUi.en.GhBfww-avHA.es5.O/ck=boq-cloudx-web-blog.TransformBlogUi.zcSOI-C_kx0.L.B1.O/am=MBgwCw/d=1/exm=A1yn5d,A7fCU,BB... 3 KB
2 KB 15ms
14ms Script
text/javascript 216.58.206.67
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/_/mss/boq-cloudx-web-blog/_/js/k=boq-cloudx-web-blog.TransformBlogUi.en.GhBfww-avHA.es5.O/ck=boq-cloudx-web-blog.TransformBlogUi.zcSOI-C_kx0.L.B1.O/am=MBgwCw/d=1/exm=A1yn5d,A7fCU,BBI74,BVgquf,CHCSlb,EEDORb,EFQ78c,GkRiKb,IZT63,JNoxi,KUM7Z,L1AAkb,LEikZe,MdUzUe,Mlhmy,MpJwZc,NsSboe,NwH0H,O1Gjze,O6y8ed,OTA3Ae,OmgaI,P6sQOc,Pkx8hb,PrPYRd,QIhFr,RMhBfe,RqjULd,SCGBie,SdcwHb,SpsfSb,UUJqVe,Uas9Hd,Ug7Xab,Ulmmrd,V3dDOb,XVMNvd,YSybTb,Yq43cc,Z3rB,Z5uLle,ZDZcre,ZfAoz,ZwDk9d,_b,_tp,aW3pY,aurFic,byfTOb,e5qFLc,ebZ3mb,fKUV3e,fmklff,gychg,hc6Ubd,kWgXee,kxO7ab,lazG7b,lsjVmc,lwddkf,mI3LFb,mdR7q,mzzZzc,n73qwf,o60eef,oTg6l,ovKuLd,pjICDe,pw70Gc,rJ9tU,s39S4,w9hDv,ws9Tlc,xQtZb,xUdipf,yDVVkb,zbML3c,zr1jrb/excm=_b,_tp,articleview/ed=1/wt=2/ujg=1/rs=AHrnUqULJgN1VoWooeKGHI572lTeRkS7ww/ee=EVNhjf:pw70Gc;EmZ2Bf:zr1jrb;JsbNhc:Xd8iUd;K5nYTd:ZDZcre;LBgRLc:SdcwHb;Me32dd:MEeYgc;NPKaK:SdcwHb;NSEoX:lazG7b;Pjplud:EEDORb;QGR0gd:Mlhmy;SNUn3:ZwDk9d;ScI3Yc:e7Hzgb;Uvc8o:VDovNc;YIZmRd:A1yn5d;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;dowIGb:ebZ3mb;eBAeSb:zbML3c;iFQyKf:QIhFr;lOO0Vd:OTA3Ae;nAFL3:s39S4;oGtAuc:sOXFj;pXdRYb:MdUzUe;qafBPd:yDVVkb;qddgKe:xQtZb;wR5FRb:O1Gjze;xqZiqf:BBI74;yxTchf:KUM7Z;zxnPse:GkRiKb/m=Wt6vjf,hhhU8,FCpbqb,WhJNk

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.206.67 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lhr35s11-in-f3.1e100.net

Software

sffe /

Resource Hash

294373a1c6b7a200fa0895b128a05e6d9e3c07f5bedb5dee18e6a773f74fe2cc

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/boq-infra/cloudx-web-blog-boq-js-css-signers
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://cloud.google.com/

Response headers

content-encoding: gzip
age: 107628
report-to: {"group":"boq-infra/cloudx-web-blog-boq-js-css-signers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/boq-infra/cloudx-web-blog-boq-js-css-signers"}]}
x-content-type-options: nosniff
expires: Sat, 18 Oct 2025 18:30:27 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Fri, 18 Oct 2024 18:30:27 GMT
last-modified: Fri, 18 Oct 2024 00:13:23 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding, Origin
content-security-policy: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/boq-infra/cloudx-web-blog-boq-js-css-signers
cache-control: public, immutable, max-age=31536000
cross-origin-opener-policy: same-origin; report-to="boq-infra/cloudx-web-blog-boq-js-css-signers"
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
content-length: 1585
x-xss-protection: 0
server: sffe

GET
H3 200 favicon.ico
www.gstatic.com/cloud/images/icons/ 5 KB
1 KB 16ms
16ms Other
image/x-icon 216.58.206.67
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/cloud/images/icons/favicon.ico

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.206.67 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lhr35s11-in-f3.1e100.net

Software

sffe /

Resource Hash

5f8e85ad05f888bc475b93312fc8c80af8193347af3042ac7027903be6b319da

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://cloud.google.com/

Response headers

content-encoding: br
age: 430085
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
x-content-type-options: nosniff
expires: Wed, 15 Oct 2025 00:56:10 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 15 Oct 2024 00:56:10 GMT
last-modified: Tue, 27 Jun 2023 04:48:00 GMT
content-type: image/x-icon
vary: Accept-Encoding
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
content-length: 1046
x-xss-protection: 0
server: sffe

POST
H3 200 log Show response
cloud.google.com/ 131 B
155 B 76ms
75ms Fetch
text/plain 142.250.185.78
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cloud.google.com/log?format=json&hasfast=true&authuser=0

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.78 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s48-in-f14.1e100.net

Software

Playlog /

Resource Hash

502e9680cfa78fa8be779cbf4f1947c8eaa3d43bf8c7464800ec772b2ddea358

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://cloud.google.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
X-Goog-AuthUser: 0

Response headers

x-frame-options: SAMEORIGIN
cache-control: private
content-encoding: gzip
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
expires: Sun, 20 Oct 2024 00:24:16 GMT
access-control-allow-origin: https://cloud.google.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
content-length: 131
date: Sun, 20 Oct 2024 00:24:16 GMT
x-xss-protection: 0
content-type: text/plain; charset=UTF-8
server: Playlog
access-control-allow-headers: X-Playlog-Web

POST
H3 200 log Show response
cloud.google.com/ 131 B
155 B 85ms
83ms Fetch
text/plain 142.250.185.78
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cloud.google.com/log?format=json&hasfast=true&authuser=0

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.78 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s48-in-f14.1e100.net

Software

Playlog /

Resource Hash

502e9680cfa78fa8be779cbf4f1947c8eaa3d43bf8c7464800ec772b2ddea358

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://cloud.google.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
X-Goog-AuthUser: 0

Response headers

x-frame-options: SAMEORIGIN
cache-control: private
content-encoding: gzip
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
expires: Sun, 20 Oct 2024 00:24:17 GMT
access-control-allow-origin: https://cloud.google.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
content-length: 131
date: Sun, 20 Oct 2024 00:24:17 GMT
x-xss-protection: 0
content-type: text/plain; charset=UTF-8
server: Playlog
access-control-allow-headers: X-Playlog-Web

POST
H3 200 browserinfo Show response
cloud.google.com/blog/_/TransformBlogUi/ 92 B
134 B 79ms
79ms XHR
application/json 142.250.185.78
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cloud.google.com/blog/_/TransformBlogUi/browserinfo?f.sid=7217085967987177581&bl=boq_cloudx-web-blog-uiserver_20241017.07_p0&hl=en&soc-app=1&soc-platform=1&soc-device=1&_reqid=8658&rt=j

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.78 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s48-in-f14.1e100.net

Software

ESF /

Resource Hash

77a1b9d4a89097aa7e17fb36a5bcbed327db706daa1f3f2c35189e24609c2969

Security Headers

Name	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /blog/_/TransformBlogUi/cspreport
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://cloud.google.com/
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-Type: application/x-www-form-urlencoded;charset=UTF-8
X-Same-Domain: 1

Response headers

content-encoding: gzip
x-content-type-options: nosniff
expires: Mon, 01 Jan 1990 00:00:00 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Sun, 20 Oct 2024 00:24:17 GMT
content-type: application/json; charset=utf-8
content-disposition: attachment; filename="response.bin"; filename*=UTF-8''response.bin
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000
content-security-policy: require-trusted-types-for 'script';report-uri /blog/_/TransformBlogUi/cspreport
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-opener-policy: same-origin
pragma: no-cache
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy: same-site
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
x-xss-protection: 0
server: ESF

Verdicts & Comments Add Verdict or Comment

61 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

7 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.mandiant.com/	1970-01-21 00:23:05	Name: __cf_bm Value: ltUrE7PrjHUSoYWXvOMJSAVk6fIKtkXG0XPPeB.8DaE-1729383853-1.0.1.1-08nZfTfCuXrsAhOdiQe3KsvhJVO8BC8wVMs_EYsJ3PJA7kRzBBujji0RAyeINDIuqaXd.FnfvZpoSDbQ5SyQrw
.mandiant.com/	1969-12-31 23:59:59	Name: _cfuvid Value: ZDKjId.IUUqzH3GbFuVKBsSb9g6hjSyRkoXjYitwlYY-1729383853697-0.0.1.1-604800000
.cloud.google.com/	1970-01-21 04:42:15	Name: __utmz Value: utmcsr=(direct)\|utmcmd=(none)\|utmccn=(direct)
.cloud.google.com/	1970-01-21 09:59:03	Name: _ga Value: GA1.1.2014632062.1729383855
.cloud.google.com/	1970-01-21 09:59:03	Name: _ga_WH2QY8WWF5 Value: GS1.1.1729383854.1.1.1729383854.0.0.0
cloud.google.com/	1970-01-21 01:06:15	Name: OTZ Value: 7784664_48_52_123900_48_436380
.google.com/	1970-01-21 04:46:35	Name: NID Value: 518=tcI42bOYOvuejJ4sKre6Geec8JimIMfadi0EYURFG8decQMFEQm3x6dbzXf_oFmSpkxecl1Bx7yyQ6KFWsjTw8WIJ67b2Q-AiyQOeRZpV6yQeSLG5D_VYm9sGhhZrkfSL2_dCo9yBgov3k2XD_Soi7Iu7C8ixWsjgWM0e21fRy6MaKyZgQiUqA

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	require-trusted-types-for 'script';report-uri /blog/_/TransformBlogUi/cspreport script-src 'report-sample' 'nonce-SJOefFOGFWwVv5awAXwX8Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /blog/_/TransformBlogUi/cspreport;worker-src 'self' script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com https://ssl.google-analytics.com https://www.googleadservices.com/pagead/conversion_async.js https://www.youtube.com https://googleads.g.doubleclick.net https://www.googleadservices.com/pagead/ https://support.google.com/inapp/ https://www.google.com/tools/feedback/ https://www.gstatic.com/inproduct_help/ https://www.gstatic.com/support/content/;report-uri /blog/_/TransformBlogUi/cspreport/allowlist
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

apis.google.com
cloud.google.com
fonts.googleapis.com
fonts.gstatic.com
region1.google-analytics.com
scone-pa.clients6.google.com
storage.googleapis.com
www.googletagmanager.com
www.gstatic.com
www.mandiant.com
142.250.181.232
142.250.185.78
142.250.186.110
172.217.18.3
2001:4860:4802:32::36
216.58.206.67
2606:4700:300b::a29f:f17d
2a00:1450:4001:806::200a
2a00:1450:4001:806::200e
2a00:1450:4001:80e::200e
2a00:1450:4001:812::201b
2a00:1450:4001:81d::200a
2a00:1450:4001:82f::2008
06e60764f2f683ef1562780a928735ca90bd7ff7b7376d2818c8445be9c29669
0af670810630c5efe0961873077a5ad14c12ac6ae4c8dd9f5d8bbe9e69034f28
0f0c9a6824743e74e287574ef92dc872cbd02f44b9285f0564381b3d9b9173cf
10486fd8c9aefec703fe160e27f17b23c30fbb25588b7fd89efb8f8b66c628a7
128bfed9cdfc66eab2d09d82bc0c87b5784243d1a8c23aa992e5745314f4377b
149bc7eb2508c059032b40954da7856e73fe022f058ed433ad92b12d38e5751b
14e50adfc4eaedc74c842c05913526a483d4bb07c23bb1b1c1fd7062e745fdb5
261d94022f74ec70efe933e3b0707a01d5b85c84f0900194965078f07ac7d653
294373a1c6b7a200fa0895b128a05e6d9e3c07f5bedb5dee18e6a773f74fe2cc
2e0bdc192134bb3950a1ba4c1148901e39ebd8d2d01f64ef23106e90a9f771b0
3485e39c56236e34e19db687a01300ebcf72b9feb3de7fd31e4da2792ad83a35
4a55571a4c063f08a1b647ed9fbabdefff4b69aee365a7090a7319b766d075c0
502e9680cfa78fa8be779cbf4f1947c8eaa3d43bf8c7464800ec772b2ddea358
548c0c92bb7a2a4a4d59b283c4179b176912575a3dd2dce1dcbba5c5835ffe2e
5c06a9c253cdea0183ffd715334c100a27c0396c4c367d392ec3f8d7c1f1610a
5f8e85ad05f888bc475b93312fc8c80af8193347af3042ac7027903be6b319da
65c99d3b9f1a1b905046e30d00a97f2d4d605e565c32917e7a89a35926e04b98
665eb302f730c65c8752a1998114c6f4d7f0d5e0250465c18665772d14500389
77a1b9d4a89097aa7e17fb36a5bcbed327db706daa1f3f2c35189e24609c2969
8071b149660b49d9b5738d7bcde92963fed9d7b451b8220efdf0623a77fb938b
80b96a151d114ccd04b03d571e7562622fd97d5cccb528e3caa68b2781e0c562
9407b3728d9a96dcba2215e0f30fc4cb2c07ef45f28b35a12d32f5db04abbca6
97399a2914c593da2895d9729aa0170a1956e91ee54cf7550696691949558a37
aa76d407d6b29ddaa75aaab2221c45db8f998001ceb0e631adedfe61743db694
af79d4a18b4bd0babefdb6249f39490be7331f912c06bb392c6881ffc8f57161
ba191bf3b5c39a50676e4ecae47adff7f404f9481890530cdbf64252fbb1a57e
c64d4e621adbcc54a58cad839ff4223818b1fd3f234d16e4ae0599bafb0a616e
c69bf5a9569cb5b16c873b8fd829ed0125e5135585cda560a18b134be5859f0a
d010bcb9f4da592531fb64f2725e3daf2a946f1652c27e92fd914057a107eeb7
d04a897abbfa80f90a10bb2fad32e25ffb213d21d0ca4a52d126308ab98cc697
e6ed4e6e2311ab88b0a94c289d30a8a1bc5b3893dec00c6b32702b190800581a
ff6ca740a352d65db24af7a3fec0da2503b3244a066794ad4397eaa0e320bf68

cloud.google.com Open in urlscan Pro 2a00:1450:4001:80e::200e Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

34 Requests

100 %HTTPS

62 %IPv6

6 Domains

10 Subdomains

13 IPs

2 Countries

1509 kBTransfer

4881 kBSize

7 Cookies

22 Outgoing links

Page URL History

Redirected requests

34 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

cloud.google.com Open in urlscan Pro
2a00:1450:4001:80e::200e Public Scan

Screenshot
Live screenshot

Full Image

34
Requests

100 %
HTTPS

62 %
IPv6

6
Domains

10
Subdomains

13
IPs

2
Countries

1509 kB
Transfer

4881 kB
Size

7
Cookies

34 HTTP transactions
1 data transactions