HTTP/1.1 302 Found
Location: https://tnspoctest123.backstory.chronicle.security/initAuth?continueUrl=https://tnspoctest123.backstory.chronicle.security/issueCookie?continueUrl%3Dhttps://tnspoctest123.backstory.chronicle.security
Content-Type: text/html
Date: Sun, 04 May 2025 09:26:31 GMT
Server: ESF
Content-Length: 0
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff
Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
Connection: close

{
   "@category" : "datascan",
   "@timestamp" : "2025-05-04T09:26:34.000Z",
   "app" : {
      "extract" : {
         "domain" : [
            "chronicle.security"
         ],
         "hostname" : [
            "tnspoctest123.backstory.chronicle.security"
         ],
         "url" : [
            "https://tnspoctest123.backstory.chronicle.security/initAuth?continueUrl=https://tnspoctest123.backstory.chronicle.security/issueCookie?continueUrl%3Dhttps://tnspoctest123.backstory.chronicle.security"
         ]
      },
      "http" : {
         "bodymd5" : "d41d8cd98f00b204e9800998ecf8427e",
         "bodymmh3" : -1,
         "headermd5" : "f5de9db4e3c049ac0795829efc25499c",
         "headermmh3" : -1447177308
      },
      "length" : 486
   },
   "asn" : "AS15169",
   "basicconstraints" : "critical",
   "ca" : "false",
   "company" : {
      "country" : "<enterprise field>: company.country",
      "globalrank" : "<enterprise field>: company.globalrank",
      "industry" : "<enterprise field>: company.industry",
      "name" : "<enterprise field>: company.name",
      "sector" : "<enterprise field>: company.sector"
   },
   "country" : "US",
   "data" : "HTTP/1.1 302 Found\r\nLocation: https://tnspoctest123.backstory.chronicle.security/initAuth?continueUrl=https://tnspoctest123.backstory.chronicle.security/issueCookie?continueUrl%3Dhttps://tnspoctest123.backstory.chronicle.security\r\nContent-Type: text/html\r\nDate: Sun, 04 May 2025 09:26:31 GMT\r\nServer: ESF\r\nContent-Length: 0\r\nX-XSS-Protection: 0\r\nX-Frame-Options: SAMEORIGIN\r\nX-Content-Type-Options: nosniff\r\nAlt-Svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nConnection: close\r\n\r\n",
   "datamd5" : "9ea75bdda47fada1486971a27c0f39a9",
   "datammh3" : 173808290,
   "device" : {
      "class" : "<enterprise field>: device.class"
   },
   "domain" : [
      "1e100.net",
      "abc.xyz",
      "adsense.com",
      "adsensecustomsearchads.com",
      "adsenseformobileapps.com",
      "advertisercommunity.com",
      "alphanucleo.google",
      "amie.google",
      "ampcache.com",
      "ampproject.com",
      "ampproject.net",
      "ampproject.org",
      "androidify.com",
      "app-ads-services.com",
      "bazel.build",
      "brocaproject.com",
      "channel-app.google",
      "chronicle.security",
      "chronicleforgood.com",
      "chroniclesec.com",
      "cloud.google",
      "cloudyoryx.dev",
      "crossmediapanel.com",
      "crowdcalling.google",
      "dataliberation.org",
      "digitalassetlinks.org",
      "domains.google",
      "duetai.google",
      "eageroryx.dev",
      "earlydays.google",
      "engineering.google",
      "fastlane.ci",
      "floonet.goog",
      "g.dev",
      "g.page",
      "gateway.dev",
      "gmbads.gle",
      "go-lang.com",
      "go-lang.net",
      "go-lang.org",
      "golang.com",
      "golang.net",
      "golang.org",
      "goo.gl",
      "google-syndication.com",
      "google.cn",
      "google.co.in",
      "google.com",
      "googleacquisitionmigration.com",
      "googleblog.com",
      "googlecert.net",
      "googlestore.com",
      "grow.google",
      "gvt5.com",
      "hats.goog",
      "hey.gle",
      "iamremarkable.org",
      "identityplatform.google",
      "lanternal.com",
      "lers.google",
      "liftware.com",
      "liftware.jp",
      "macservice.goog",
      "makersuite.google",
      "nel.goog",
      "nomulus.foo",
      "notebooklm.google",
      "ok.gle",
      "ordering.page",
      "payment.goog",
      "picasaweb.com",
      "picasaweb.net",
      "picasaweb.org",
      "picnik.com",
      "pixate.com",
      "pki.goog",
      "play.space",
      "podcasts.goog",
      "projectgomie.google",
      "rbm.goog",
      "registry-qa.google",
      "registry-sandbox.google",
      "registry.google",
      "research.youtube",
      "savethedate.foo",
      "searchingforsyria.org",
      "share.google",
      "songwriters.youtube",
      "sprayscape.com",
      "tfhub.dev",
      "thegooglestore.com",
      "tiltbrush.com",
      "travel.google",
      "waze.com",
      "web.dev",
      "webmproject.org",
      "webpkgcache.com",
      "webrtc.org",
      "workinxr.dev",
      "xn--ngstr-lra8j.com",
      "xplr.co",
      "zynamics.com"
   ],
   "extkeyusage" : [
      "serverAuth"
   ],
   "fingerprint" : {
      "md5" : "0313201c34c3597cb385f2441a82e21e",
      "sha1" : "3b25f5656048e43fa6df0b0b2376cfd9fa33d9d5",
      "sha256" : "f716d1212526f495e3f3a0ffec08fde1b6d548b342952f70192e5e56ed4e7af0"
   },
   "forward" : "tnspoctest123.backstory.chronicle.security",
   "geolocus" : {
      "asn" : "AS15169",
      "continent" : "NA",
      "continentname" : "North America",
      "country" : "US",
      "countryname" : "United States",
      "domain" : [
         "1e100.net",
         "google.com"
      ],
      "isineu" : "false",
      "latitude" : "37.09024",
      "location" : "37.09024,-95.712891",
      "longitude" : "-95.712891",
      "netname" : "GOOGLE",
      "organization" : "Google LLC",
      "subnet" : "172.217.0.0/16"
   },
   "host" : [
      "app",
      "bugs",
      "code",
      "colab",
      "console",
      "datasetsearch",
      "de",
      "dg-meta",
      "discover",
      "ehr-search",
      "en",
      "es",
      "fr",
      "gapi",
      "golang",
      "id",
      "issues",
      "it",
      "ja",
      "looker",
      "looker-staging",
      "misc-sni",
      "pagespeed",
      "par10s49-in-f4",
      "pl",
      "privacysandbox",
      "pt",
      "ru",
      "source",
      "stage",
      "support",
      "th",
      "vi",
      "waw02s07-in-f164",
      "waw02s07-in-f4",
      "www",
      "zh"
   ],
   "hostname" : [
      "abc.xyz",
      "adsense.com",
      "adsensecustomsearchads.com",
      "adsenseformobileapps.com",
      "advertisercommunity.com",
      "alphanucleo.google",
      "amie.google",
      "ampcache.com",
      "ampproject.com",
      "ampproject.net",
      "ampproject.org",
      "androidify.com",
      "app-ads-services.com",
      "app.goo.gl",
      "brocaproject.com",
      "bugs.webrtc.org",
      "channel-app.google",
      "chronicle.security",
      "chronicleforgood.com",
      "chroniclesec.com",
      "cloud.google",
      "cloudyoryx.dev",
      "code.webrtc.org",
      "colab.research.google.com",
      "console.au.cloud.google",
      "console.ca.cloud.google",
      "console.eu.cloud.google",
      "console.eu.cloud.google.com",
      "console.il.cloud.google",
      "console.in.cloud.google",
      "console.it.cloud.google",
      "console.jp.cloud.google",
      "console.sa.cloud.google",
      "console.uk.cloud.google",
      "console.us.cloud.google",
      "crossmediapanel.com",
      "crowdcalling.google",
      "dataliberation.org",
      "datasetsearch.research.google.com",
      "de.advertisercommunity.com",
      "dg-meta.video.google.com",
      "digitalassetlinks.org",
      "discover.google.com",
      "domains.google",
      "duetai.google",
      "eageroryx.dev",
      "earlydays.google",
      "ehr-search.health.google.com",
      "en.advertisercommunity.com",
      "engineering.google",
      "es.advertisercommunity.com",
      "fastlane.ci",
      "floonet.goog",
      "fr.advertisercommunity.com",
      "g.dev",
      "g.page",
      "gapi.waze.com",
      "gmbads.gle",
      "go-lang.com",
      "go-lang.net",
      "go-lang.org",
      "golang.com",
      "golang.google.cn",
      "golang.net",
      "golang.org",
      "googleblog.com",
      "googlecert.net",
      "googlestore.com",
      "grow.google",
      "hats.goog",
      "hey.gle",
      "iamremarkable.org",
      "id.advertisercommunity.com",
      "identityplatform.google",
      "issues.webmproject.org",
      "issues.webrtc.org",
      "it.advertisercommunity.com",
      "ja.advertisercommunity.com",
      "lanternal.com",
      "lers.google",
      "liftware.com",
      "liftware.jp",
      "looker-staging.chronicle.security",
      "looker.chronicle.security",
      "macservice.goog",
      "makersuite.google",
      "misc-sni.google.com",
      "nel.goog",
      "nomulus.foo",
      "notebooklm.google",
      "ok.gle",
      "ordering.page",
      "pagespeed.web.dev",
      "par10s49-in-f4.1e100.net",
      "payment.goog",
      "picasaweb.com",
      "picasaweb.net",
      "picasaweb.org",
      "picnik.com",
      "pixate.com",
      "pki.goog",
      "pl.advertisercommunity.com",
      "play.space",
      "privacysandbox.google.com",
      "projectgomie.google",
      "pt.advertisercommunity.com",
      "rbm.goog",
      "registry-qa.google",
      "registry-sandbox.google",
      "registry.google",
      "research.youtube",
      "ru.advertisercommunity.com",
      "savethedate.foo",
      "searchingforsyria.org",
      "share.google",
      "songwriters.youtube",
      "source.bazel.build",
      "sprayscape.com",
      "stage.advertisercommunity.com",
      "support.registry-qa.google",
      "support.registry-sandbox.google",
      "support.registry.google",
      "tfhub.dev",
      "th.advertisercommunity.com",
      "thegooglestore.com",
      "tiltbrush.com",
      "tnspoctest123.backstory.chronicle.security",
      "travel.google",
      "vi.advertisercommunity.com",
      "waw02s07-in-f164.1e100.net",
      "waw02s07-in-f4.1e100.net",
      "webmproject.org",
      "webpkgcache.com",
      "workinxr.dev",
      "www.adsense.com",
      "www.googlestore.com",
      "www.iamremarkable.org",
      "www.pixate.com",
      "www.registry-qa.google",
      "www.registry-sandbox.google",
      "www.registry.google",
      "www.sprayscape.com",
      "www.thegooglestore.com",
      "xn--ngstr-lra8j.com",
      "xplr.co",
      "zh.advertisercommunity.com",
      "zynamics.com"
   ],
   "ip" : "172.217.20.164",
   "ipv6" : "false",
   "issuer" : {
      "commonname" : "WR2",
      "country" : "US",
      "organization" : "Google Trust Services"
   },
   "keyusage" : [
      "digitalSignature"
   ],
   "latitude" : "37.7510",
   "location" : "37.7510,-97.8220",
   "longitude" : "-97.8220",
   "node" : {
      "country" : "<enterprise field>: node.country",
      "groupid" : "<enterprise field>: node.groupid",
      "id" : "<enterprise field>: node.id",
      "physicalcountry" : "<enterprise field>: node.physicalcountry"
   },
   "organization" : "GOOGLE",
   "port" : 443,
   "protocol" : "http",
   "protocolversion" : "1.1",
   "publickey" : {
      "algorithm" : "id-ecPublicKey",
      "length" : 256
   },
   "reason" : "Found",
   "reverse" : [
      "waw02s07-in-f164.1e100.net",
      "waw02s07-in-f4.1e100.net",
      "par10s49-in-f4.1e100.net"
   ],
   "rtt" : 0.205663,
   "seen_date" : "2025-05-04",
   "serial" : "64:18:88:79:58:5b:5b:52:10:0c:66:22:3f:30:e9:7c",
   "signature" : {
      "algorithm" : "sha256WithRSAEncryption"
   },
   "source" : "urlscan",
   "srcip" : "178.32.72.211",
   "srcport" : 60895,
   "status" : 302,
   "subdomains" : [
      "accountverification.cloud.google",
      "aiplatform-notebook.cloud.google.com",
      "aiplatform-training.cloud.google.com",
      "app.goo.gl",
      "au.cloud.google",
      "autopush-global.identityplatform.google",
      "backstory-staging.chronicle.security",
      "backstory.chronicle.security",
      "backstory.chroniclesec.com",
      "backupdr-autopush.cloud.google",
      "backupdr-autopush.cloud.google.com",
      "backupdr-dev.cloud.google",
      "backupdr-dev.cloud.google.com",
      "backupdr-sandbox.cloud.google",
      "backupdr-sandbox.cloud.google.com",
      "backupdr-staging.cloud.google",
      "backupdr-staging.cloud.google.com",
      "backupdr.cloud.google",
      "backupdr.cloud.google.com",
      "ca.cloud.google",
      "cdn.ampproject.org",
      "cloud.google.com",
      "composer-dev.cloud.google",
      "composer-dev.cloud.google.com",
      "composer-qa.cloud.google",
      "composer-qa.cloud.google.com",
      "composer-staging.cloud.google",
      "composer-staging.cloud.google.com",
      "composer.cloud.google",
      "composer.cloud.google.com",
      "datafusion-api-dev.cloud.google",
      "datafusion-api-dev.cloud.google.com",
      "datafusion-api-staging.cloud.google",
      "datafusion-api-staging.cloud.google.com",
      "datafusion-api.cloud.google",
      "datafusion-api.cloud.google.com",
      "datafusion-dev.cloud.google",
      "datafusion-dev.cloud.google.com",
      "datafusion-staging.cloud.google",
      "datafusion-staging.cloud.google.com",
      "datafusion.cloud.google",
      "datafusion.cloud.google.com",
      "datalab.cloud.google.com",
      "dataplex-dev.cloud.google.com",
      "dataplex-staging.cloud.google.com",
      "dataplex.cloud.google.com",
      "dataproc-image-staging.cloud.google",
      "dataproc-image-staging.cloud.google.com",
      "dataproc-staging.cloud.google",
      "dataproc-staging.cloud.google.com",
      "dataproc-test.cloud.google",
      "dataproc-test.cloud.google.com",
      "dataproc.cloud.google",
      "dataproc.cloud.google.com",
      "de.advertisercommunity.com",
      "de.gateway.dev",
      "dev.google-syndication.com",
      "discover.google.com",
      "earthengine.google.co.in",
      "earthengine.google.com",
      "en.advertisercommunity.com",
      "es.advertisercommunity.com",
      "eu.cloud.google",
      "eu.cloud.google.com",
      "ew.gateway.dev",
      "fiber.google.com",
      "fr.advertisercommunity.com",
      "global.accountverification.cloud.google",
      "global.identityplatform.google",
      "golang.google.cn",
      "health.google.com",
      "healthcare.cloud.google.com",
      "id.advertisercommunity.com",
      "il.cloud.google",
      "in.cloud.google",
      "issues.webmproject.org",
      "issues.webrtc.org",
      "it.advertisercommunity.com",
      "it.cloud.google",
      "ja.advertisercommunity.com",
      "jp.cloud.google",
      "looker-staging.chronicle.security",
      "looker.chronicle.security",
      "mapmaker.google.com",
      "microhost.google.com",
      "notebooks.cloud.google",
      "notebooks.cloud.google.com",
      "pipelines.cloud.google.com",
      "pl.advertisercommunity.com",
      "privacysandbox.google.com",
      "pt.advertisercommunity.com",
      "recaptcha.ampproject.net",
      "research.google.com",
      "ru.advertisercommunity.com",
      "sa.cloud.google",
      "source.bazel.build",
      "stage.advertisercommunity.com",
      "staging-global.identityplatform.google",
      "staging.google-syndication.com",
      "tensorboard-autopush.cloud.google.com",
      "tensorboard-dev.cloud.google.com",
      "tensorboard-staging.cloud.google.com",
      "tensorboard-test.cloud.google.com",
      "tensorboard.cloud.google.com",
      "th.advertisercommunity.com",
      "uc.gateway.dev",
      "uk.cloud.google",
      "us.cloud.google",
      "vi.advertisercommunity.com",
      "video.google.com",
      "zh.advertisercommunity.com"
   ],
   "subject" : {
      "altname" : [
         "misc-sni.google.com",
         "*.aiplatform-notebook.cloud.google.com",
         "*.aiplatform-training.cloud.google.com",
         "*.alphanucleo.google",
         "alphanucleo.google",
         "*.backupdr.cloud.google.com",
         "*.backupdr.cloud.google",
         "*.backupdr-staging.cloud.google.com",
         "*.backupdr-staging.cloud.google",
         "*.backupdr-autopush.cloud.google.com",
         "*.backupdr-autopush.cloud.google",
         "*.backupdr-dev.cloud.google.com",
         "*.backupdr-dev.cloud.google",
         "*.backupdr-sandbox.cloud.google.com",
         "*.backupdr-sandbox.cloud.google",
         "*.brocaproject.com",
         "brocaproject.com",
         "*.composer.cloud.google.com",
         "*.composer.cloud.google",
         "*.composer-staging.cloud.google.com",
         "*.composer-staging.cloud.google",
         "*.composer-qa.cloud.google.com",
         "*.composer-qa.cloud.google",
         "*.composer-dev.cloud.google.com",
         "*.composer-dev.cloud.google",
         "*.datalab.cloud.google.com",
         "*.datafusion.cloud.google.com",
         "*.datafusion.cloud.google",
         "*.datafusion-staging.cloud.google.com",
         "*.datafusion-staging.cloud.google",
         "*.datafusion-dev.cloud.google.com",
         "*.datafusion-dev.cloud.google",
         "*.datafusion-api.cloud.google.com",
         "*.datafusion-api.cloud.google",
         "*.datafusion-api-staging.cloud.google.com",
         "*.datafusion-api-staging.cloud.google",
         "*.datafusion-api-dev.cloud.google.com",
         "*.datafusion-api-dev.cloud.google",
         "*.dataplex.cloud.google.com",
         "*.dataplex-staging.cloud.google.com",
         "*.dataplex-dev.cloud.google.com",
         "*.dataproc.cloud.google.com",
         "*.dataproc.cloud.google",
         "*.dataproc-image-staging.cloud.google.com",
         "*.dataproc-image-staging.cloud.google",
         "*.dataproc-staging.cloud.google.com",
         "*.dataproc-staging.cloud.google",
         "*.dataproc-test.cloud.google.com",
         "*.dataproc-test.cloud.google",
         "*.earthengine.google.co.in",
         "*.earthengine.google.com",
         "*.fiber.google.com",
         "*.gateway.dev",
         "*.de.gateway.dev",
         "*.ew.gateway.dev",
         "*.uc.gateway.dev",
         "*.global.accountverification.cloud.google",
         "*.google-syndication.com",
         "*.dev.google-syndication.com",
         "*.staging.google-syndication.com",
         "*.googleacquisitionmigration.com",
         "*.gvt5.com",
         "*.healthcare.cloud.google.com",
         "*.mapmaker.google.com",
         "*.microhost.google.com",
         "*.notebooks.cloud.google.com",
         "*.notebooks.cloud.google",
         "*.picnik.com",
         "picnik.com",
         "*.pipelines.cloud.google.com",
         "*.podcasts.goog",
         "*.tensorboard.cloud.google.com",
         "*.tensorboard-autopush.cloud.google.com",
         "*.tensorboard-dev.cloud.google.com",
         "*.tensorboard-staging.cloud.google.com",
         "*.tensorboard-test.cloud.google.com",
         "abc.xyz",
         "*.abc.xyz",
         "adsense.com",
         "www.adsense.com",
         "adsensecustomsearchads.com",
         "*.adsensecustomsearchads.com",
         "adsenseformobileapps.com",
         "advertisercommunity.com",
         "*.advertisercommunity.com",
         "cloudyoryx.dev",
         "*.cloudyoryx.dev",
         "eageroryx.dev",
         "*.eageroryx.dev",
         "stage.advertisercommunity.com",
         "*.stage.advertisercommunity.com",
         "de.advertisercommunity.com",
         "*.de.advertisercommunity.com",
         "en.advertisercommunity.com",
         "*.en.advertisercommunity.com",
         "es.advertisercommunity.com",
         "*.es.advertisercommunity.com",
         "fr.advertisercommunity.com",
         "*.fr.advertisercommunity.com",
         "id.advertisercommunity.com",
         "*.id.advertisercommunity.com",
         "it.advertisercommunity.com",
         "*.it.advertisercommunity.com",
         "ja.advertisercommunity.com",
         "*.ja.advertisercommunity.com",
         "pl.advertisercommunity.com",
         "*.pl.advertisercommunity.com",
         "pt.advertisercommunity.com",
         "*.pt.advertisercommunity.com",
         "ru.advertisercommunity.com",
         "*.ru.advertisercommunity.com",
         "th.advertisercommunity.com",
         "*.th.advertisercommunity.com",
         "vi.advertisercommunity.com",
         "*.vi.advertisercommunity.com",
         "zh.advertisercommunity.com",
         "*.zh.advertisercommunity.com",
         "amie.google",
         "*.amie.google",
         "ampcache.com",
         "*.ampcache.com",
         "ampproject.com",
         "*.ampproject.com",
         "ampproject.net",
         "*.ampproject.net",
         "*.recaptcha.ampproject.net",
         "ampproject.org",
         "*.ampproject.org",
         "*.cdn.ampproject.org",
         "androidify.com",
         "*.androidify.com",
         "app.goo.gl",
         "*.app.goo.gl",
         "channel-app.google",
         "console.au.cloud.google",
         "*.au.cloud.google",
         "console.ca.cloud.google",
         "*.ca.cloud.google",
         "console.eu.cloud.google",
         "*.eu.cloud.google",
         "console.eu.cloud.google.com",
         "console.il.cloud.google",
         "*.il.cloud.google",
         "console.in.cloud.google",
         "*.in.cloud.google",
         "console.it.cloud.google",
         "*.it.cloud.google",
         "console.jp.cloud.google",
         "*.jp.cloud.google",
         "console.sa.cloud.google",
         "*.sa.cloud.google",
         "console.uk.cloud.google",
         "*.uk.cloud.google",
         "console.us.cloud.google",
         "*.us.cloud.google",
         "cloud.google",
         "*.cloud.google",
         "colab.research.google.com",
         "code.webrtc.org",
         "bugs.webrtc.org",
         "issues.webrtc.org",
         "*.issues.webrtc.org",
         "chronicle.security",
         "*.chronicle.security",
         "*.backstory.chronicle.security",
         "*.backstory-staging.chronicle.security",
         "chronicleforgood.com",
         "*.chronicleforgood.com",
         "looker.chronicle.security",
         "*.looker.chronicle.security",
         "looker-staging.chronicle.security",
         "*.looker-staging.chronicle.security",
         "chroniclesec.com",
         "*.chroniclesec.com",
         "*.backstory.chroniclesec.com",
         "crossmediapanel.com",
         "*.crossmediapanel.com",
         "crowdcalling.google",
         "dataliberation.org",
         "*.dataliberation.org",
         "datasetsearch.research.google.com",
         "dg-meta.video.google.com",
         "digitalassetlinks.org",
         "*.digitalassetlinks.org",
         "discover.google.com",
         "*.discover.google.com",
         "domains.google",
         "*.domains.google",
         "duetai.google",
         "*.duetai.google",
         "earlydays.google",
         "*.earlydays.google",
         "ehr-search.health.google.com",
         "engineering.google",
         "*.engineering.google",
         "fastlane.ci",
         "floonet.goog",
         "*.floonet.goog",
         "gapi.waze.com",
         "gmbads.gle",
         "*.gmbads.gle",
         "go-lang.com",
         "*.go-lang.com",
         "go-lang.net",
         "*.go-lang.net",
         "go-lang.org",
         "*.go-lang.org",
         "golang.com",
         "*.golang.com",
         "golang.net",
         "*.golang.net",
         "golang.org",
         "*.golang.org",
         "golang.google.cn",
         "*.golang.google.cn",
         "googleblog.com",
         "*.googleblog.com",
         "googlecert.net",
         "*.googlecert.net",
         "googlestore.com",
         "www.googlestore.com",
         "grow.google",
         "*.grow.google",
         "g.dev",
         "*.g.dev",
         "g.page",
         "*.g.page",
         "hey.gle",
         "*.hey.gle",
         "ok.gle",
         "*.ok.gle",
         "hats.goog",
         "*.hats.goog",
         "iamremarkable.org",
         "www.iamremarkable.org",
         "identityplatform.google",
         "*.identityplatform.google",
         "*.global.identityplatform.google",
         "*.staging-global.identityplatform.google",
         "*.autopush-global.identityplatform.google",
         "lanternal.com",
         "*.lanternal.com",
         "lers.google",
         "liftware.com",
         "*.liftware.com",
         "liftware.jp",
         "*.liftware.jp",
         "nel.goog",
         "*.nel.goog",
         "nomulus.foo",
         "*.nomulus.foo",
         "notebooklm.google",
         "ordering.page",
         "*.ordering.page",
         "macservice.goog",
         "*.macservice.goog",
         "makersuite.google",
         "*.makersuite.google",
         "pagespeed.web.dev",
         "payment.goog",
         "*.payment.goog",
         "picasaweb.com",
         "*.picasaweb.com",
         "picasaweb.net",
         "*.picasaweb.net",
         "picasaweb.org",
         "*.picasaweb.org",
         "pixate.com",
         "www.pixate.com",
         "pki.goog",
         "*.pki.goog",
         "play.space",
         "*.play.space",
         "privacysandbox.google.com",
         "*.privacysandbox.google.com",
         "projectgomie.google",
         "*.projectgomie.google",
         "rbm.goog",
         "*.rbm.goog",
         "registry-qa.google",
         "www.registry-qa.google",
         "registry-sandbox.google",
         "www.registry-sandbox.google",
         "registry.google",
         "www.registry.google",
         "research.youtube",
         "*.research.youtube",
         "savethedate.foo",
         "*.savethedate.foo",
         "searchingforsyria.org",
         "*.searchingforsyria.org",
         "share.google",
         "*.share.google",
         "songwriters.youtube",
         "*.songwriters.youtube",
         "source.bazel.build",
         "*.source.bazel.build",
         "support.registry-qa.google",
         "support.registry-sandbox.google",
         "support.registry.google",
         "sprayscape.com",
         "www.sprayscape.com",
         "tfhub.dev",
         "*.tfhub.dev",
         "thegooglestore.com",
         "www.thegooglestore.com",
         "tiltbrush.com",
         "*.tiltbrush.com",
         "travel.google",
         "*.travel.google",
         "webmproject.org",
         "*.webmproject.org",
         "issues.webmproject.org",
         "*.issues.webmproject.org",
         "webpkgcache.com",
         "*.webpkgcache.com",
         "workinxr.dev",
         "*.workinxr.dev",
         "xn--ngstr-lra8j.com",
         "*.xn--ngstr-lra8j.com",
         "xplr.co",
         "*.xplr.co",
         "zynamics.com",
         "*.zynamics.com",
         "app-ads-services.com",
         "*.app-ads-services.com"
      ],
      "commonname" : "misc-sni.google.com"
   },
   "subnet" : "172.217.0.0/19",
   "tag" : "<enterprise field>: tag",
   "tld" : [
      "build",
      "ci",
      "cn",
      "co",
      "co.in",
      "com",
      "dev",
      "foo",
      "gl",
      "gle",
      "goog",
      "google",
      "jp",
      "net",
      "org",
      "page",
      "security",
      "space",
      "xyz",
      "youtube"
   ],
   "tls" : "true",
   "transport" : "tcp",
   "url" : "/issueCookie?continueUrl=https://tnspoctest123.backstory.chronicle.security",
   "validity" : {
      "notafter" : "2025-06-23T08:54:44Z",
      "notbefore" : "2025-03-31T08:54:45Z"
   },
   "version" : "v3",
   "wildcard" : "true"
}

HTTP/1.1 302 Found
Content-Type: application/binary
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Expires: Mon, 01 Jan 1990 00:00:00 GMT
Date: Sun, 04 May 2025 08:03:48 GMT
Location: https://login.microsoftonline.com/e7c6f609-f63a-4ec7-b71e-6734c4c9d231/saml2?SAMLRequest=tVLLbtswEPwVgXeJsqRKNmE5cBsUDZCiRqz0kEtBUyuZCMVVuZTb9OvD%2BIGmQJBbAV7IHe7Mzuzy6vdgogM40mhrNktSFoFV2Grb1%2By%2B%2BRzP2dVqSXIw2SjWk9/bO/g5AfkofLQkTpWaTc4KlKRJWDkACa/Edv31VmRJKkaHHhUaFq2JwPlA9QktTQO4LbiDVnB/d1uzvfcjCc5lYEl2Uj2SR/eUqL1Dq5WBhEBNTvsnTrq32sZKGvOC4waVfOlKvDe4k4b/QvfYoVOwQTTEaZTOS2sl7WP5Z3IQj%2BGdB10H3YbZ3wKcayy6DsNqe%2Bz/V6PBXttk0MohYefRGm0hUThwqFTZleki7spcxgWoKt5VM4jLKi9UoRZtls/40TUW3VzX7EfXdSqDqgXZpnm6aFtYyGqXwaKcVZBXZYARTXBjKSj0NcvS7EOchlM06VykuSjmSVHNHli0Ofv8UdtTfu%2BFsjuBSHxpmk28%2BbZtWPT9sgcBwM6piyO7ex33%2B43lJWO2uril5ZD0iL0BOWo62vQfI1vy18JX5%2Bu/27t6Bg%3D%3D&RelayState=AXb-DOTzRtVG2ZcKDWEgJh4jZM552yEBh9jCY5-maW65KtUk360w6Q_Z-nSQ3moD9vQZg3y4RE5Ru6pnLOSoRK5hKtOf4UYigfFf9OtuWR5j48_o9ofCdUuRurDH_Ck_Wk3nX0XZ5EHW-15-tUpBBaB_Qj8keF7YsLztZznnkywefo2HYnGBaK2kqzwY80wPBSlfwasflG2MvLw9SFQlfhXv8KfiEt06LTFZ3H2qraU0LZKNBphNd2SeFDBUFZEDPE0ISnhXCllnN1tP1CA5eAnRLOf2mkfgcwQ5FA7tpq7PA7r_CHh-_M0NaLPpKE6r6UH3K17oFXmpiwqzf73aTPXTcyjGbHB8sfvzZCS7y9sS7iRjv2bjvaUZeFLgIgJvW6-XRJhiJQv7QnONx-p2kedWmEut0Od6DHK5JsrkCZfZ4itckkHP0oTuKx-0Pp3Bg_cbX45nQjK0G61H9i0mAGbACmDPKGE90Rm9H8LOI1ENomf8VVPyFeE45e5wfkV8MY8fBrBrCCKFCXxtt1A
Strict-Transport-Security: max-age=31536000
Permissions-Policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/AuthPortalFederationHttp/cspreport
Content-Security-Policy: script-src 'nonce-IsptTFlmriZWIw3FGPSM2g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/AuthPortalFederationHttp/cspreport;worker-src 'self'
Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/AuthPortalFederationHttp/cspreport/allowlist
Cross-Origin-Opener-Policy: unsafe-none
Cross-Origin-Resource-Policy: same-site
Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
Server: ESF
Content-Length: 0
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff
Set-Cookie: __Host-AP_SignIn=ChtGZ0hpMG9MNXVTN3JpSWs5SVlqeTJKeWVuSWcSNkNBSVNKR05pWWpjNE4yTXpMVE0zWXpVdE5ERTROUzFoT1RrNExUazFNR05qTlRJeU1tSmtNQQ; Expires=Sun, 04-May-2025 08:23:48 GMT; Path=/; Secure; HttpOnly; Priority=HIGH; SameSite=strict
Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
Connection: close

<redacted>

{
   "@category" : "datascan",
   "@timestamp" : "2025-05-04T08:03:48.000Z",
   "app" : {
      "extract" : {
         "domain" : [
            "google-analytics.com",
            "gstatic.com",
            "googletagmanager.com",
            "microsoftonline.com",
            "google.com"
         ],
         "hostname" : [
            "apis.google.com",
            "login.microsoftonline.com",
            "ssl.gstatic.com",
            "www.google-analytics.com",
            "www.google.com",
            "www.googletagmanager.com",
            "www.gstatic.com"
         ],
         "url" : [
            "https://apis.google.com",
            "https://login.microsoftonline.com/e7c6f609-f63a-4ec7-b71e-6734c4c9d231/saml2?SAMLRequest=tVLLbtswEPwVgXeJsqRKNmE5cBsUDZCiRqz0kEtBUyuZCMVVuZTb9OvD%2BIGmQJBbAV7IHe7Mzuzy6vdgogM40mhrNktSFoFV2Grb1%2By%2B%2BRzP2dVqSXIw2SjWk9/bO/g5AfkofLQkTpWaTc4KlKRJWDkACa/Edv31VmRJKkaHHhUaFq2JwPlA9QktTQO4LbiDVnB/d1uzvfcjCc5lYEl2Uj2SR/eUqL1Dq5WBhEBNTvsnTrq32sZKGvOC4waVfOlKvDe4k4b/QvfYoVOwQTTEaZTOS2sl7WP5Z3IQj%2BGdB10H3YbZ3wKcayy6DsNqe%2Bz/V6PBXttk0MohYefRGm0hUThwqFTZleki7spcxgWoKt5VM4jLKi9UoRZtls/40TUW3VzX7EfXdSqDqgXZpnm6aFtYyGqXwaKcVZBXZYARTXBjKSj0NcvS7EOchlM06VykuSjmSVHNHli0Ofv8UdtTfu%2BFsjuBSHxpmk28%2BbZtWPT9sgcBwM6piyO7ex33%2B43lJWO2uril5ZD0iL0BOWo62vQfI1vy18JX5%2Bu/27t6Bg%3D%3D&RelayState=AXb-DOTzRtVG2ZcKDWEgJh4jZM552yEBh9jCY5-maW65KtUk360w6Q_Z-nSQ3moD9vQZg3y4RE5Ru6pnLOSoRK5hKtOf4UYigfFf9OtuWR5j48_o9ofCdUuRurDH_Ck_Wk3nX0XZ5EHW-15-tUpBBaB_Qj8keF7YsLztZznnkywefo2HYnGBaK2kqzwY80wPBSlfwasflG2MvLw9SFQlfhXv8KfiEt06LTFZ3H2qraU0LZKNBphNd2SeFDBUFZEDPE0ISnhXCllnN1tP1CA5eAnRLOf2mkfgcwQ5FA7tpq7PA7r_CHh-_M0NaLPpKE6r6UH3K17oFXmpiwqzf73aTPXTcyjGbHB8sfvzZCS7y9sS7iRjv2bjvaUZeFLgIgJvW6-XRJhiJQv7QnONx-p2kedWmEut0Od6DHK5JsrkCZfZ4itckkHP0oTuKx-0Pp3Bg_cbX45nQjK0G61H9i0mAGbACmDPKGE90Rm9H8LOI1ENomf8VVPyFeE45e5wfkV8MY8fBrBrCCKFCXxtt1A",
            "https://ssl.gstatic.com",
            "https://www.google-analytics.com",
            "https://www.google.com",
            "https://www.googletagmanager.com",
            "https://www.gstatic.com"
         ]
      },
      "http" : {
         "bodymd5" : "d41d8cd98f00b204e9800998ecf8427e",
         "bodymmh3" : -1636538602,
         "headermd5" : "d7913170ec69376857d7e5c55290c6e5",
         "headermmh3" : 413217585
      },
      "length" : 3000
   },
   "asn" : "AS15169",
   "basicconstraints" : "critical",
   "ca" : "false",
   "company" : {
      "country" : "<enterprise field>: company.country",
      "globalrank" : "<enterprise field>: company.globalrank",
      "industry" : "<enterprise field>: company.industry",
      "name" : "<enterprise field>: company.name",
      "sector" : "<enterprise field>: company.sector"
   },
   "country" : "US",
   "data" : "HTTP/1.1 302 Found\r\nContent-Type: application/binary\r\nCache-Control: no-cache, no-store, max-age=0, must-revalidate\r\nPragma: no-cache\r\nExpires: Mon, 01 Jan 1990 00:00:00 GMT\r\nDate: Sun, 04 May 2025 08:03:48 GMT\r\nLocation: https://login.microsoftonline.com/e7c6f609-f63a-4ec7-b71e-6734c4c9d231/saml2?SAMLRequest=tVLLbtswEPwVgXeJsqRKNmE5cBsUDZCiRqz0kEtBUyuZCMVVuZTb9OvD%2BIGmQJBbAV7IHe7Mzuzy6vdgogM40mhrNktSFoFV2Grb1%2By%2B%2BRzP2dVqSXIw2SjWk9/bO/g5AfkofLQkTpWaTc4KlKRJWDkACa/Edv31VmRJKkaHHhUaFq2JwPlA9QktTQO4LbiDVnB/d1uzvfcjCc5lYEl2Uj2SR/eUqL1Dq5WBhEBNTvsnTrq32sZKGvOC4waVfOlKvDe4k4b/QvfYoVOwQTTEaZTOS2sl7WP5Z3IQj%2BGdB10H3YbZ3wKcayy6DsNqe%2Bz/V6PBXttk0MohYefRGm0hUThwqFTZleki7spcxgWoKt5VM4jLKi9UoRZtls/40TUW3VzX7EfXdSqDqgXZpnm6aFtYyGqXwaKcVZBXZYARTXBjKSj0NcvS7EOchlM06VykuSjmSVHNHli0Ofv8UdtTfu%2BFsjuBSHxpmk28%2BbZtWPT9sgcBwM6piyO7ex33%2B43lJWO2uril5ZD0iL0BOWo62vQfI1vy18JX5%2Bu/27t6Bg%3D%3D&RelayState=AXb-DOTzRtVG2ZcKDWEgJh4jZM552yEBh9jCY5-maW65KtUk360w6Q_Z-nSQ3moD9vQZg3y4RE5Ru6pnLOSoRK5hKtOf4UYigfFf9OtuWR5j48_o9ofCdUuRurDH_Ck_Wk3nX0XZ5EHW-15-tUpBBaB_Qj8keF7YsLztZznnkywefo2HYnGBaK2kqzwY80wPBSlfwasflG2MvLw9SFQlfhXv8KfiEt06LTFZ3H2qraU0LZKNBphNd2SeFDBUFZEDPE0ISnhXCllnN1tP1CA5eAnRLOf2mkfgcwQ5FA7tpq7PA7r_CHh-_M0NaLPpKE6r6UH3K17oFXmpiwqzf73aTPXTcyjGbHB8sfvzZCS7y9sS7iRjv2bjvaUZeFLgIgJvW6-XRJhiJQv7QnONx-p2kedWmEut0Od6DHK5JsrkCZfZ4itckkHP0oTuKx-0Pp3Bg_cbX45nQjK0G61H9i0mAGbACmDPKGE90Rm9H8LOI1ENomf8VVPyFeE45e5wfkV8MY8fBrBrCCKFCXxtt1A\r\nStrict-Transport-Security: max-age=31536000\r\nPermissions-Policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*\r\nContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/AuthPortalFederationHttp/cspreport\r\nContent-Security-Policy: script-src 'nonce-IsptTFlmriZWIw3FGPSM2g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/AuthPortalFederationHttp/cspreport;worker-src 'self'\r\nContent-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/AuthPortalFederationHttp/cspreport/allowlist\r\nCross-Origin-Opener-Policy: unsafe-none\r\nCross-Origin-Resource-Policy: same-site\r\nAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version\r\nServer: ESF\r\nContent-Length: 0\r\nX-XSS-Protection: 0\r\nX-Frame-Options: SAMEORIGIN\r\nX-Content-Type-Options: nosniff\r\nSet-Cookie: __Host-AP_SignIn=ChtGZ0hpMG9MNXVTN3JpSWs5SVlqeTJKeWVuSWcSNkNBSVNKR05pWWpjNE4yTXpMVE0zWXpVdE5ERTROUzFoT1RrNExUazFNR05qTlRJeU1tSmtNQQ; Expires=Sun, 04-May-2025 08:23:48 GMT; Path=/; Secure; HttpOnly; Priority=HIGH; SameSite=strict\r\nAlt-Svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nConnection: close\n\n<redacted>",
   "datamd5" : "1f15c95e314f97dadd15a919e4f4e17b",
   "datammh3" : 1562541841,
   "device" : {
      "class" : "<enterprise field>: device.class"
   },
   "domain" : [
      "1e100.net",
      "abc.xyz",
      "adsense.com",
      "adsensecustomsearchads.com",
      "adsenseformobileapps.com",
      "advertisercommunity.com",
      "alphanucleo.google",
      "amie.google",
      "ampcache.com",
      "ampproject.com",
      "ampproject.net",
      "ampproject.org",
      "androidify.com",
      "app-ads-services.com",
      "bazel.build",
      "brocaproject.com",
      "channel-app.google",
      "chronicle.security",
      "chronicleforgood.com",
      "chroniclesec.com",
      "cloud.google",
      "cloudyoryx.dev",
      "crossmediapanel.com",
      "crowdcalling.google",
      "dataliberation.org",
      "digitalassetlinks.org",
      "domains.google",
      "duetai.google",
      "eageroryx.dev",
      "earlydays.google",
      "engineering.google",
      "fastlane.ci",
      "floonet.goog",
      "g.dev",
      "g.page",
      "gateway.dev",
      "gmbads.gle",
      "go-lang.com",
      "go-lang.net",
      "go-lang.org",
      "golang.com",
      "golang.net",
      "golang.org",
      "goo.gl",
      "google-syndication.com",
      "google.cn",
      "google.co.in",
      "google.com",
      "googleacquisitionmigration.com",
      "googleblog.com",
      "googlecert.net",
      "googlestore.com",
      "grow.google",
      "gvt5.com",
      "hats.goog",
      "hey.gle",
      "iamremarkable.org",
      "identityplatform.google",
      "lanternal.com",
      "lers.google",
      "liftware.com",
      "liftware.jp",
      "macservice.goog",
      "makersuite.google",
      "nel.goog",
      "nomulus.foo",
      "notebooklm.google",
      "ok.gle",
      "ordering.page",
      "payment.goog",
      "picasaweb.com",
      "picasaweb.net",
      "picasaweb.org",
      "picnik.com",
      "pixate.com",
      "pki.goog",
      "play.space",
      "podcasts.goog",
      "projectgomie.google",
      "rbm.goog",
      "registry-qa.google",
      "registry-sandbox.google",
      "registry.google",
      "research.youtube",
      "savethedate.foo",
      "searchingforsyria.org",
      "share.google",
      "songwriters.youtube",
      "sprayscape.com",
      "tfhub.dev",
      "thegooglestore.com",
      "tiltbrush.com",
      "travel.google",
      "waze.com",
      "web.dev",
      "webmproject.org",
      "webpkgcache.com",
      "webrtc.org",
      "workinxr.dev",
      "xn--ngstr-lra8j.com",
      "xplr.co",
      "zynamics.com"
   ],
   "extkeyusage" : [
      "serverAuth"
   ],
   "fingerprint" : {
      "md5" : "0313201c34c3597cb385f2441a82e21e",
      "sha1" : "3b25f5656048e43fa6df0b0b2376cfd9fa33d9d5",
      "sha256" : "f716d1212526f495e3f3a0ffec08fde1b6d548b342952f70192e5e56ed4e7af0"
   },
   "forward" : "auth.backstory.chronicle.security",
   "geolocus" : {
      "asn" : "AS15169",
      "continent" : "NA",
      "continentname" : "North America",
      "country" : "US",
      "countryname" : "United States",
      "domain" : [
         "1e100.net",
         "google.com"
      ],
      "isineu" : "false",
      "latitude" : "37.09024",
      "location" : "37.09024,-95.712891",
      "longitude" : "-95.712891",
      "netname" : "GOOGLE",
      "organization" : "Google LLC",
      "subnet" : "172.217.0.0/16"
   },
   "host" : [
      "app",
      "bugs",
      "code",
      "colab",
      "console",
      "datasetsearch",
      "de",
      "dg-meta",
      "discover",
      "ehr-search",
      "en",
      "es",
      "fr",
      "gapi",
      "golang",
      "id",
      "issues",
      "it",
      "ja",
      "looker",
      "looker-staging",
      "misc-sni",
      "pagespeed",
      "par10s49-in-f4",
      "pl",
      "privacysandbox",
      "pt",
      "ru",
      "source",
      "stage",
      "support",
      "th",
      "vi",
      "waw02s07-in-f164",
      "waw02s07-in-f4",
      "www",
      "zh"
   ],
   "hostname" : [
      "abc.xyz",
      "adsense.com",
      "adsensecustomsearchads.com",
      "adsenseformobileapps.com",
      "advertisercommunity.com",
      "alphanucleo.google",
      "amie.google",
      "ampcache.com",
      "ampproject.com",
      "ampproject.net",
      "ampproject.org",
      "androidify.com",
      "app-ads-services.com",
      "app.goo.gl",
      "auth.backstory.chronicle.security",
      "brocaproject.com",
      "bugs.webrtc.org",
      "channel-app.google",
      "chronicle.security",
      "chronicleforgood.com",
      "chroniclesec.com",
      "cloud.google",
      "cloudyoryx.dev",
      "code.webrtc.org",
      "colab.research.google.com",
      "console.au.cloud.google",
      "console.ca.cloud.google",
      "console.eu.cloud.google",
      "console.eu.cloud.google.com",
      "console.il.cloud.google",
      "console.in.cloud.google",
      "console.it.cloud.google",
      "console.jp.cloud.google",
      "console.sa.cloud.google",
      "console.uk.cloud.google",
      "console.us.cloud.google",
      "crossmediapanel.com",
      "crowdcalling.google",
      "dataliberation.org",
      "datasetsearch.research.google.com",
      "de.advertisercommunity.com",
      "dg-meta.video.google.com",
      "digitalassetlinks.org",
      "discover.google.com",
      "domains.google",
      "duetai.google",
      "eageroryx.dev",
      "earlydays.google",
      "ehr-search.health.google.com",
      "en.advertisercommunity.com",
      "engineering.google",
      "es.advertisercommunity.com",
      "fastlane.ci",
      "floonet.goog",
      "fr.advertisercommunity.com",
      "g.dev",
      "g.page",
      "gapi.waze.com",
      "gmbads.gle",
      "go-lang.com",
      "go-lang.net",
      "go-lang.org",
      "golang.com",
      "golang.google.cn",
      "golang.net",
      "golang.org",
      "googleblog.com",
      "googlecert.net",
      "googlestore.com",
      "grow.google",
      "hats.goog",
      "hey.gle",
      "iamremarkable.org",
      "id.advertisercommunity.com",
      "identityplatform.google",
      "issues.webmproject.org",
      "issues.webrtc.org",
      "it.advertisercommunity.com",
      "ja.advertisercommunity.com",
      "lanternal.com",
      "lers.google",
      "liftware.com",
      "liftware.jp",
      "looker-staging.chronicle.security",
      "looker.chronicle.security",
      "macservice.goog",
      "makersuite.google",
      "misc-sni.google.com",
      "nel.goog",
      "nomulus.foo",
      "notebooklm.google",
      "ok.gle",
      "ordering.page",
      "pagespeed.web.dev",
      "par10s49-in-f4.1e100.net",
      "payment.goog",
      "picasaweb.com",
      "picasaweb.net",
      "picasaweb.org",
      "picnik.com",
      "pixate.com",
      "pki.goog",
      "pl.advertisercommunity.com",
      "play.space",
      "privacysandbox.google.com",
      "projectgomie.google",
      "pt.advertisercommunity.com",
      "rbm.goog",
      "registry-qa.google",
      "registry-sandbox.google",
      "registry.google",
      "research.youtube",
      "ru.advertisercommunity.com",
      "savethedate.foo",
      "searchingforsyria.org",
      "share.google",
      "songwriters.youtube",
      "source.bazel.build",
      "sprayscape.com",
      "stage.advertisercommunity.com",
      "support.registry-qa.google",
      "support.registry-sandbox.google",
      "support.registry.google",
      "tfhub.dev",
      "th.advertisercommunity.com",
      "thegooglestore.com",
      "tiltbrush.com",
      "travel.google",
      "vi.advertisercommunity.com",
      "waw02s07-in-f164.1e100.net",
      "waw02s07-in-f4.1e100.net",
      "webmproject.org",
      "webpkgcache.com",
      "workinxr.dev",
      "www.adsense.com",
      "www.googlestore.com",
      "www.iamremarkable.org",
      "www.pixate.com",
      "www.registry-qa.google",
      "www.registry-sandbox.google",
      "www.registry.google",
      "www.sprayscape.com",
      "www.thegooglestore.com",
      "xn--ngstr-lra8j.com",
      "xplr.co",
      "zh.advertisercommunity.com",
      "zynamics.com"
   ],
   "ip" : "172.217.20.164",
   "ipv6" : "false",
   "issuer" : {
      "commonname" : "WR2",
      "country" : "US",
      "organization" : "Google Trust Services"
   },
   "keyusage" : [
      "digitalSignature"
   ],
   "latitude" : "37.7510",
   "location" : "37.7510,-97.8220",
   "longitude" : "-97.8220",
   "node" : {
      "country" : "<enterprise field>: node.country",
      "groupid" : "<enterprise field>: node.groupid",
      "id" : "<enterprise field>: node.id",
      "physicalcountry" : "<enterprise field>: node.physicalcountry"
   },
   "organization" : "GOOGLE",
   "port" : 443,
   "protocol" : "http",
   "protocolversion" : "1.1",
   "publickey" : {
      "algorithm" : "id-ecPublicKey",
      "length" : 256
   },
   "reason" : "Found",
   "reverse" : [
      "waw02s07-in-f164.1e100.net",
      "par10s49-in-f4.1e100.net",
      "waw02s07-in-f4.1e100.net"
   ],
   "rtt" : 0.007812,
   "seen_date" : "2025-05-04",
   "serial" : "64:18:88:79:58:5b:5b:52:10:0c:66:22:3f:30:e9:7c",
   "signature" : {
      "algorithm" : "sha256WithRSAEncryption"
   },
   "source" : "urlscan::redirect::5",
   "srcip" : "91.196.152.230",
   "srcport" : 54343,
   "status" : 302,
   "subdomains" : [
      "accountverification.cloud.google",
      "aiplatform-notebook.cloud.google.com",
      "aiplatform-training.cloud.google.com",
      "app.goo.gl",
      "au.cloud.google",
      "autopush-global.identityplatform.google",
      "backstory-staging.chronicle.security",
      "backstory.chronicle.security",
      "backstory.chroniclesec.com",
      "backupdr-autopush.cloud.google",
      "backupdr-autopush.cloud.google.com",
      "backupdr-dev.cloud.google",
      "backupdr-dev.cloud.google.com",
      "backupdr-sandbox.cloud.google",
      "backupdr-sandbox.cloud.google.com",
      "backupdr-staging.cloud.google",
      "backupdr-staging.cloud.google.com",
      "backupdr.cloud.google",
      "backupdr.cloud.google.com",
      "ca.cloud.google",
      "cdn.ampproject.org",
      "cloud.google.com",
      "composer-dev.cloud.google",
      "composer-dev.cloud.google.com",
      "composer-qa.cloud.google",
      "composer-qa.cloud.google.com",
      "composer-staging.cloud.google",
      "composer-staging.cloud.google.com",
      "composer.cloud.google",
      "composer.cloud.google.com",
      "datafusion-api-dev.cloud.google",
      "datafusion-api-dev.cloud.google.com",
      "datafusion-api-staging.cloud.google",
      "datafusion-api-staging.cloud.google.com",
      "datafusion-api.cloud.google",
      "datafusion-api.cloud.google.com",
      "datafusion-dev.cloud.google",
      "datafusion-dev.cloud.google.com",
      "datafusion-staging.cloud.google",
      "datafusion-staging.cloud.google.com",
      "datafusion.cloud.google",
      "datafusion.cloud.google.com",
      "datalab.cloud.google.com",
      "dataplex-dev.cloud.google.com",
      "dataplex-staging.cloud.google.com",
      "dataplex.cloud.google.com",
      "dataproc-image-staging.cloud.google",
      "dataproc-image-staging.cloud.google.com",
      "dataproc-staging.cloud.google",
      "dataproc-staging.cloud.google.com",
      "dataproc-test.cloud.google",
      "dataproc-test.cloud.google.com",
      "dataproc.cloud.google",
      "dataproc.cloud.google.com",
      "de.advertisercommunity.com",
      "de.gateway.dev",
      "dev.google-syndication.com",
      "discover.google.com",
      "earthengine.google.co.in",
      "earthengine.google.com",
      "en.advertisercommunity.com",
      "es.advertisercommunity.com",
      "eu.cloud.google",
      "eu.cloud.google.com",
      "ew.gateway.dev",
      "fiber.google.com",
      "fr.advertisercommunity.com",
      "global.accountverification.cloud.google",
      "global.identityplatform.google",
      "golang.google.cn",
      "health.google.com",
      "healthcare.cloud.google.com",
      "id.advertisercommunity.com",
      "il.cloud.google",
      "in.cloud.google",
      "issues.webmproject.org",
      "issues.webrtc.org",
      "it.advertisercommunity.com",
      "it.cloud.google",
      "ja.advertisercommunity.com",
      "jp.cloud.google",
      "looker-staging.chronicle.security",
      "looker.chronicle.security",
      "mapmaker.google.com",
      "microhost.google.com",
      "notebooks.cloud.google",
      "notebooks.cloud.google.com",
      "pipelines.cloud.google.com",
      "pl.advertisercommunity.com",
      "privacysandbox.google.com",
      "pt.advertisercommunity.com",
      "recaptcha.ampproject.net",
      "research.google.com",
      "ru.advertisercommunity.com",
      "sa.cloud.google",
      "source.bazel.build",
      "stage.advertisercommunity.com",
      "staging-global.identityplatform.google",
      "staging.google-syndication.com",
      "tensorboard-autopush.cloud.google.com",
      "tensorboard-dev.cloud.google.com",
      "tensorboard-staging.cloud.google.com",
      "tensorboard-test.cloud.google.com",
      "tensorboard.cloud.google.com",
      "th.advertisercommunity.com",
      "uc.gateway.dev",
      "uk.cloud.google",
      "us.cloud.google",
      "vi.advertisercommunity.com",
      "video.google.com",
      "zh.advertisercommunity.com"
   ],
   "subject" : {
      "altname" : [
         "misc-sni.google.com",
         "*.aiplatform-notebook.cloud.google.com",
         "*.aiplatform-training.cloud.google.com",
         "*.alphanucleo.google",
         "alphanucleo.google",
         "*.backupdr.cloud.google.com",
         "*.backupdr.cloud.google",
         "*.backupdr-staging.cloud.google.com",
         "*.backupdr-staging.cloud.google",
         "*.backupdr-autopush.cloud.google.com",
         "*.backupdr-autopush.cloud.google",
         "*.backupdr-dev.cloud.google.com",
         "*.backupdr-dev.cloud.google",
         "*.backupdr-sandbox.cloud.google.com",
         "*.backupdr-sandbox.cloud.google",
         "*.brocaproject.com",
         "brocaproject.com",
         "*.composer.cloud.google.com",
         "*.composer.cloud.google",
         "*.composer-staging.cloud.google.com",
         "*.composer-staging.cloud.google",
         "*.composer-qa.cloud.google.com",
         "*.composer-qa.cloud.google",
         "*.composer-dev.cloud.google.com",
         "*.composer-dev.cloud.google",
         "*.datalab.cloud.google.com",
         "*.datafusion.cloud.google.com",
         "*.datafusion.cloud.google",
         "*.datafusion-staging.cloud.google.com",
         "*.datafusion-staging.cloud.google",
         "*.datafusion-dev.cloud.google.com",
         "*.datafusion-dev.cloud.google",
         "*.datafusion-api.cloud.google.com",
         "*.datafusion-api.cloud.google",
         "*.datafusion-api-staging.cloud.google.com",
         "*.datafusion-api-staging.cloud.google",
         "*.datafusion-api-dev.cloud.google.com",
         "*.datafusion-api-dev.cloud.google",
         "*.dataplex.cloud.google.com",
         "*.dataplex-staging.cloud.google.com",
         "*.dataplex-dev.cloud.google.com",
         "*.dataproc.cloud.google.com",
         "*.dataproc.cloud.google",
         "*.dataproc-image-staging.cloud.google.com",
         "*.dataproc-image-staging.cloud.google",
         "*.dataproc-staging.cloud.google.com",
         "*.dataproc-staging.cloud.google",
         "*.dataproc-test.cloud.google.com",
         "*.dataproc-test.cloud.google",
         "*.earthengine.google.co.in",
         "*.earthengine.google.com",
         "*.fiber.google.com",
         "*.gateway.dev",
         "*.de.gateway.dev",
         "*.ew.gateway.dev",
         "*.uc.gateway.dev",
         "*.global.accountverification.cloud.google",
         "*.google-syndication.com",
         "*.dev.google-syndication.com",
         "*.staging.google-syndication.com",
         "*.googleacquisitionmigration.com",
         "*.gvt5.com",
         "*.healthcare.cloud.google.com",
         "*.mapmaker.google.com",
         "*.microhost.google.com",
         "*.notebooks.cloud.google.com",
         "*.notebooks.cloud.google",
         "*.picnik.com",
         "picnik.com",
         "*.pipelines.cloud.google.com",
         "*.podcasts.goog",
         "*.tensorboard.cloud.google.com",
         "*.tensorboard-autopush.cloud.google.com",
         "*.tensorboard-dev.cloud.google.com",
         "*.tensorboard-staging.cloud.google.com",
         "*.tensorboard-test.cloud.google.com",
         "abc.xyz",
         "*.abc.xyz",
         "adsense.com",
         "www.adsense.com",
         "adsensecustomsearchads.com",
         "*.adsensecustomsearchads.com",
         "adsenseformobileapps.com",
         "advertisercommunity.com",
         "*.advertisercommunity.com",
         "cloudyoryx.dev",
         "*.cloudyoryx.dev",
         "eageroryx.dev",
         "*.eageroryx.dev",
         "stage.advertisercommunity.com",
         "*.stage.advertisercommunity.com",
         "de.advertisercommunity.com",
         "*.de.advertisercommunity.com",
         "en.advertisercommunity.com",
         "*.en.advertisercommunity.com",
         "es.advertisercommunity.com",
         "*.es.advertisercommunity.com",
         "fr.advertisercommunity.com",
         "*.fr.advertisercommunity.com",
         "id.advertisercommunity.com",
         "*.id.advertisercommunity.com",
         "it.advertisercommunity.com",
         "*.it.advertisercommunity.com",
         "ja.advertisercommunity.com",
         "*.ja.advertisercommunity.com",
         "pl.advertisercommunity.com",
         "*.pl.advertisercommunity.com",
         "pt.advertisercommunity.com",
         "*.pt.advertisercommunity.com",
         "ru.advertisercommunity.com",
         "*.ru.advertisercommunity.com",
         "th.advertisercommunity.com",
         "*.th.advertisercommunity.com",
         "vi.advertisercommunity.com",
         "*.vi.advertisercommunity.com",
         "zh.advertisercommunity.com",
         "*.zh.advertisercommunity.com",
         "amie.google",
         "*.amie.google",
         "ampcache.com",
         "*.ampcache.com",
         "ampproject.com",
         "*.ampproject.com",
         "ampproject.net",
         "*.ampproject.net",
         "*.recaptcha.ampproject.net",
         "ampproject.org",
         "*.ampproject.org",
         "*.cdn.ampproject.org",
         "androidify.com",
         "*.androidify.com",
         "app.goo.gl",
         "*.app.goo.gl",
         "channel-app.google",
         "console.au.cloud.google",
         "*.au.cloud.google",
         "console.ca.cloud.google",
         "*.ca.cloud.google",
         "console.eu.cloud.google",
         "*.eu.cloud.google",
         "console.eu.cloud.google.com",
         "console.il.cloud.google",
         "*.il.cloud.google",
         "console.in.cloud.google",
         "*.in.cloud.google",
         "console.it.cloud.google",
         "*.it.cloud.google",
         "console.jp.cloud.google",
         "*.jp.cloud.google",
         "console.sa.cloud.google",
         "*.sa.cloud.google",
         "console.uk.cloud.google",
         "*.uk.cloud.google",
         "console.us.cloud.google",
         "*.us.cloud.google",
         "cloud.google",
         "*.cloud.google",
         "colab.research.google.com",
         "code.webrtc.org",
         "bugs.webrtc.org",
         "issues.webrtc.org",
         "*.issues.webrtc.org",
         "chronicle.security",
         "*.chronicle.security",
         "*.backstory.chronicle.security",
         "*.backstory-staging.chronicle.security",
         "chronicleforgood.com",
         "*.chronicleforgood.com",
         "looker.chronicle.security",
         "*.looker.chronicle.security",
         "looker-staging.chronicle.security",
         "*.looker-staging.chronicle.security",
         "chroniclesec.com",
         "*.chroniclesec.com",
         "*.backstory.chroniclesec.com",
         "crossmediapanel.com",
         "*.crossmediapanel.com",
         "crowdcalling.google",
         "dataliberation.org",
         "*.dataliberation.org",
         "datasetsearch.research.google.com",
         "dg-meta.video.google.com",
         "digitalassetlinks.org",
         "*.digitalassetlinks.org",
         "discover.google.com",
         "*.discover.google.com",
         "domains.google",
         "*.domains.google",
         "duetai.google",
         "*.duetai.google",
         "earlydays.google",
         "*.earlydays.google",
         "ehr-search.health.google.com",
         "engineering.google",
         "*.engineering.google",
         "fastlane.ci",
         "floonet.goog",
         "*.floonet.goog",
         "gapi.waze.com",
         "gmbads.gle",
         "*.gmbads.gle",
         "go-lang.com",
         "*.go-lang.com",
         "go-lang.net",
         "*.go-lang.net",
         "go-lang.org",
         "*.go-lang.org",
         "golang.com",
         "*.golang.com",
         "golang.net",
         "*.golang.net",
         "golang.org",
         "*.golang.org",
         "golang.google.cn",
         "*.golang.google.cn",
         "googleblog.com",
         "*.googleblog.com",
         "googlecert.net",
         "*.googlecert.net",
         "googlestore.com",
         "www.googlestore.com",
         "grow.google",
         "*.grow.google",
         "g.dev",
         "*.g.dev",
         "g.page",
         "*.g.page",
         "hey.gle",
         "*.hey.gle",
         "ok.gle",
         "*.ok.gle",
         "hats.goog",
         "*.hats.goog",
         "iamremarkable.org",
         "www.iamremarkable.org",
         "identityplatform.google",
         "*.identityplatform.google",
         "*.global.identityplatform.google",
         "*.staging-global.identityplatform.google",
         "*.autopush-global.identityplatform.google",
         "lanternal.com",
         "*.lanternal.com",
         "lers.google",
         "liftware.com",
         "*.liftware.com",
         "liftware.jp",
         "*.liftware.jp",
         "nel.goog",
         "*.nel.goog",
         "nomulus.foo",
         "*.nomulus.foo",
         "notebooklm.google",
         "ordering.page",
         "*.ordering.page",
         "macservice.goog",
         "*.macservice.goog",
         "makersuite.google",
         "*.makersuite.google",
         "pagespeed.web.dev",
         "payment.goog",
         "*.payment.goog",
         "picasaweb.com",
         "*.picasaweb.com",
         "picasaweb.net",
         "*.picasaweb.net",
         "picasaweb.org",
         "*.picasaweb.org",
         "pixate.com",
         "www.pixate.com",
         "pki.goog",
         "*.pki.goog",
         "play.space",
         "*.play.space",
         "privacysandbox.google.com",
         "*.privacysandbox.google.com",
         "projectgomie.google",
         "*.projectgomie.google",
         "rbm.goog",
         "*.rbm.goog",
         "registry-qa.google",
         "www.registry-qa.google",
         "registry-sandbox.google",
         "www.registry-sandbox.google",
         "registry.google",
         "www.registry.google",
         "research.youtube",
         "*.research.youtube",
         "savethedate.foo",
         "*.savethedate.foo",
         "searchingforsyria.org",
         "*.searchingforsyria.org",
         "share.google",
         "*.share.google",
         "songwriters.youtube",
         "*.songwriters.youtube",
         "source.bazel.build",
         "*.source.bazel.build",
         "support.registry-qa.google",
         "support.registry-sandbox.google",
         "support.registry.google",
         "sprayscape.com",
         "www.sprayscape.com",
         "tfhub.dev",
         "*.tfhub.dev",
         "thegooglestore.com",
         "www.thegooglestore.com",
         "tiltbrush.com",
         "*.tiltbrush.com",
         "travel.google",
         "*.travel.google",
         "webmproject.org",
         "*.webmproject.org",
         "issues.webmproject.org",
         "*.issues.webmproject.org",
         "webpkgcache.com",
         "*.webpkgcache.com",
         "workinxr.dev",
         "*.workinxr.dev",
         "xn--ngstr-lra8j.com",
         "*.xn--ngstr-lra8j.com",
         "xplr.co",
         "*.xplr.co",
         "zynamics.com",
         "*.zynamics.com",
         "app-ads-services.com",
         "*.app-ads-services.com"
      ],
      "commonname" : "misc-sni.google.com"
   },
   "subnet" : "172.217.0.0/19",
   "tag" : "<enterprise field>: tag",
   "tld" : [
      "build",
      "ci",
      "cn",
      "co",
      "co.in",
      "com",
      "dev",
      "foo",
      "gl",
      "gle",
      "goog",
      "google",
      "jp",
      "net",
      "org",
      "page",
      "security",
      "space",
      "xyz",
      "youtube"
   ],
   "tls" : "true",
   "transport" : "tcp",
   "url" : "/signin/locations/global/workforcePools/spartannash-azure-pool/providers/spartannash-azure-provider?continueUrl=https://sprtnnshq.backstory.chronicle.security/issueCookie?continueUrl%3Dhttps://sprtnnshq.backstory.chronicle.security/",
   "validity" : {
      "notafter" : "2025-06-23T08:54:44Z",
      "notbefore" : "2025-03-31T08:54:45Z"
   },
   "version" : "v3",
   "wildcard" : "true"
}

HTTP/1.1 302 Found
Content-Type: application/binary
Vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Expires: Mon, 01 Jan 1990 00:00:00 GMT
Date: Sun, 04 May 2025 06:24:24 GMT
Location: https://poccalheers.backstory.chronicle.security/issueCookie?continueUrl=https://poccalheers.backstory.chronicle.security/
Strict-Transport-Security: max-age=31536000; includeSubDomains
Cross-Origin-Resource-Policy: same-site
Content-Security-Policy: script-src 'nonce-TaqKk4fSWNFXE6mlR1aEaw' 'unsafe-inline' 'strict-dynamic' https: http: 'wasm-unsafe-eval';object-src 'none';base-uri 'self';report-uri /cspreport
Cross-Origin-Opener-Policy: same-origin
Server: ESF
Content-Length: 0
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff
Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
Connection: close

<redacted>

{
   "@category" : "datascan",
   "@timestamp" : "2025-05-04T06:24:25.000Z",
   "app" : {
      "extract" : {
         "domain" : [
            "chronicle.security"
         ],
         "hostname" : [
            "poccalheers.backstory.chronicle.security"
         ],
         "url" : [
            "https://poccalheers.backstory.chronicle.security/issueCookie?continueUrl=https://poccalheers.backstory.chronicle.security/"
         ]
      },
      "http" : {
         "bodymd5" : "d41d8cd98f00b204e9800998ecf8427e",
         "bodymmh3" : -1636538602,
         "headermd5" : "12f0f5db4bece4324c52fc183787f639",
         "headermmh3" : -1997343411
      },
      "length" : 928
   },
   "asn" : "AS15169",
   "basicconstraints" : "critical",
   "ca" : "false",
   "company" : {
      "country" : "<enterprise field>: company.country",
      "globalrank" : "<enterprise field>: company.globalrank",
      "industry" : "<enterprise field>: company.industry",
      "name" : "<enterprise field>: company.name",
      "sector" : "<enterprise field>: company.sector"
   },
   "country" : "US",
   "data" : "HTTP/1.1 302 Found\r\nContent-Type: application/binary\r\nVary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site\r\nCache-Control: no-cache, no-store, max-age=0, must-revalidate\r\nPragma: no-cache\r\nExpires: Mon, 01 Jan 1990 00:00:00 GMT\r\nDate: Sun, 04 May 2025 06:24:24 GMT\r\nLocation: https://poccalheers.backstory.chronicle.security/issueCookie?continueUrl=https://poccalheers.backstory.chronicle.security/\r\nStrict-Transport-Security: max-age=31536000; includeSubDomains\r\nCross-Origin-Resource-Policy: same-site\r\nContent-Security-Policy: script-src 'nonce-TaqKk4fSWNFXE6mlR1aEaw' 'unsafe-inline' 'strict-dynamic' https: http: 'wasm-unsafe-eval';object-src 'none';base-uri 'self';report-uri /cspreport\r\nCross-Origin-Opener-Policy: same-origin\r\nServer: ESF\r\nContent-Length: 0\r\nX-XSS-Protection: 0\r\nX-Frame-Options: SAMEORIGIN\r\nX-Content-Type-Options: nosniff\r\nAlt-Svc: h3=\":443\"; ma=2592000,h3-29=\":443\"; ma=2592000\r\nConnection: close\n\n<redacted>",
   "datamd5" : "7ff66f57f0b7da0597281ee7fb4412a2",
   "datammh3" : -508211823,
   "device" : {
      "class" : "<enterprise field>: device.class"
   },
   "domain" : [
      "1e100.net",
      "abc.xyz",
      "adsense.com",
      "adsensecustomsearchads.com",
      "adsenseformobileapps.com",
      "advertisercommunity.com",
      "alphanucleo.google",
      "amie.google",
      "ampcache.com",
      "ampproject.com",
      "ampproject.net",
      "ampproject.org",
      "androidify.com",
      "app-ads-services.com",
      "bazel.build",
      "brocaproject.com",
      "channel-app.google",
      "chronicle.security",
      "chronicleforgood.com",
      "chroniclesec.com",
      "cloud.google",
      "cloudyoryx.dev",
      "crossmediapanel.com",
      "crowdcalling.google",
      "dataliberation.org",
      "digitalassetlinks.org",
      "domains.google",
      "duetai.google",
      "eageroryx.dev",
      "earlydays.google",
      "engineering.google",
      "fastlane.ci",
      "floonet.goog",
      "g.dev",
      "g.page",
      "gateway.dev",
      "gmbads.gle",
      "go-lang.com",
      "go-lang.net",
      "go-lang.org",
      "golang.com",
      "golang.net",
      "golang.org",
      "goo.gl",
      "google-syndication.com",
      "google.cn",
      "google.co.in",
      "google.com",
      "googleacquisitionmigration.com",
      "googleblog.com",
      "googlecert.net",
      "googlestore.com",
      "grow.google",
      "gvt5.com",
      "hats.goog",
      "hey.gle",
      "iamremarkable.org",
      "identityplatform.google",
      "lanternal.com",
      "lers.google",
      "liftware.com",
      "liftware.jp",
      "macservice.goog",
      "makersuite.google",
      "nel.goog",
      "nomulus.foo",
      "notebooklm.google",
      "ok.gle",
      "ordering.page",
      "payment.goog",
      "picasaweb.com",
      "picasaweb.net",
      "picasaweb.org",
      "picnik.com",
      "pixate.com",
      "pki.goog",
      "play.space",
      "podcasts.goog",
      "projectgomie.google",
      "rbm.goog",
      "registry-qa.google",
      "registry-sandbox.google",
      "registry.google",
      "research.youtube",
      "savethedate.foo",
      "searchingforsyria.org",
      "share.google",
      "songwriters.youtube",
      "sprayscape.com",
      "tfhub.dev",
      "thegooglestore.com",
      "tiltbrush.com",
      "travel.google",
      "waze.com",
      "web.dev",
      "webmproject.org",
      "webpkgcache.com",
      "webrtc.org",
      "workinxr.dev",
      "xn--ngstr-lra8j.com",
      "xplr.co",
      "zynamics.com"
   ],
   "extkeyusage" : [
      "serverAuth"
   ],
   "fingerprint" : {
      "md5" : "0313201c34c3597cb385f2441a82e21e",
      "sha1" : "3b25f5656048e43fa6df0b0b2376cfd9fa33d9d5",
      "sha256" : "f716d1212526f495e3f3a0ffec08fde1b6d548b342952f70192e5e56ed4e7af0"
   },
   "forward" : "poccalheers.backstory.chronicle.security",
   "geolocus" : {
      "asn" : "AS15169",
      "continent" : "NA",
      "continentname" : "North America",
      "country" : "US",
      "countryname" : "United States",
      "domain" : [
         "1e100.net",
         "google.com"
      ],
      "isineu" : "false",
      "latitude" : "37.09024",
      "location" : "37.09024,-95.712891",
      "longitude" : "-95.712891",
      "netname" : "GOOGLE",
      "organization" : "Google LLC",
      "subnet" : "172.217.0.0/16"
   },
   "host" : [
      "app",
      "bugs",
      "code",
      "colab",
      "console",
      "datasetsearch",
      "de",
      "dg-meta",
      "discover",
      "ehr-search",
      "en",
      "es",
      "fr",
      "gapi",
      "golang",
      "id",
      "issues",
      "it",
      "ja",
      "looker",
      "looker-staging",
      "misc-sni",
      "pagespeed",
      "par10s49-in-f4",
      "pl",
      "privacysandbox",
      "pt",
      "ru",
      "source",
      "stage",
      "support",
      "th",
      "vi",
      "waw02s07-in-f164",
      "waw02s07-in-f4",
      "www",
      "zh"
   ],
   "hostname" : [
      "abc.xyz",
      "adsense.com",
      "adsensecustomsearchads.com",
      "adsenseformobileapps.com",
      "advertisercommunity.com",
      "alphanucleo.google",
      "amie.google",
      "ampcache.com",
      "ampproject.com",
      "ampproject.net",
      "ampproject.org",
      "androidify.com",
      "app-ads-services.com",
      "app.goo.gl",
      "brocaproject.com",
      "bugs.webrtc.org",
      "channel-app.google",
      "chronicle.security",
      "chronicleforgood.com",
      "chroniclesec.com",
      "cloud.google",
      "cloudyoryx.dev",
      "code.webrtc.org",
      "colab.research.google.com",
      "console.au.cloud.google",
      "console.ca.cloud.google",
      "console.eu.cloud.google",
      "console.eu.cloud.google.com",
      "console.il.cloud.google",
      "console.in.cloud.google",
      "console.it.cloud.google",
      "console.jp.cloud.google",
      "console.sa.cloud.google",
      "console.uk.cloud.google",
      "console.us.cloud.google",
      "crossmediapanel.com",
      "crowdcalling.google",
      "dataliberation.org",
      "datasetsearch.research.google.com",
      "de.advertisercommunity.com",
      "dg-meta.video.google.com",
      "digitalassetlinks.org",
      "discover.google.com",
      "domains.google",
      "duetai.google",
      "eageroryx.dev",
      "earlydays.google",
      "ehr-search.health.google.com",
      "en.advertisercommunity.com",
      "engineering.google",
      "es.advertisercommunity.com",
      "fastlane.ci",
      "floonet.goog",
      "fr.advertisercommunity.com",
      "g.dev",
      "g.page",
      "gapi.waze.com",
      "gmbads.gle",
      "go-lang.com",
      "go-lang.net",
      "go-lang.org",
      "golang.com",
      "golang.google.cn",
      "golang.net",
      "golang.org",
      "googleblog.com",
      "googlecert.net",
      "googlestore.com",
      "grow.google",
      "hats.goog",
      "hey.gle",
      "iamremarkable.org",
      "id.advertisercommunity.com",
      "identityplatform.google",
      "issues.webmproject.org",
      "issues.webrtc.org",
      "it.advertisercommunity.com",
      "ja.advertisercommunity.com",
      "lanternal.com",
      "lers.google",
      "liftware.com",
      "liftware.jp",
      "looker-staging.chronicle.security",
      "looker.chronicle.security",
      "macservice.goog",
      "makersuite.google",
      "misc-sni.google.com",
      "nel.goog",
      "nomulus.foo",
      "notebooklm.google",
      "ok.gle",
      "ordering.page",
      "pagespeed.web.dev",
      "par10s49-in-f4.1e100.net",
      "payment.goog",
      "picasaweb.com",
      "picasaweb.net",
      "picasaweb.org",
      "picnik.com",
      "pixate.com",
      "pki.goog",
      "pl.advertisercommunity.com",
      "play.space",
      "poccalheers.backstory.chronicle.security",
      "privacysandbox.google.com",
      "projectgomie.google",
      "pt.advertisercommunity.com",
      "rbm.goog",
      "registry-qa.google",
      "registry-sandbox.google",
      "registry.google",
      "research.youtube",
      "ru.advertisercommunity.com",
      "savethedate.foo",
      "searchingforsyria.org",
      "share.google",
      "songwriters.youtube",
      "source.bazel.build",
      "sprayscape.com",
      "stage.advertisercommunity.com",
      "support.registry-qa.google",
      "support.registry-sandbox.google",
      "support.registry.google",
      "tfhub.dev",
      "th.advertisercommunity.com",
      "thegooglestore.com",
      "tiltbrush.com",
      "travel.google",
      "vi.advertisercommunity.com",
      "waw02s07-in-f164.1e100.net",
      "waw02s07-in-f4.1e100.net",
      "webmproject.org",
      "webpkgcache.com",
      "workinxr.dev",
      "www.adsense.com",
      "www.googlestore.com",
      "www.iamremarkable.org",
      "www.pixate.com",
      "www.registry-qa.google",
      "www.registry-sandbox.google",
      "www.registry.google",
      "www.sprayscape.com",
      "www.thegooglestore.com",
      "xn--ngstr-lra8j.com",
      "xplr.co",
      "zh.advertisercommunity.com",
      "zynamics.com"
   ],
   "ip" : "172.217.20.164",
   "ipv6" : "false",
   "issuer" : {
      "commonname" : "WR2",
      "country" : "US",
      "organization" : "Google Trust Services"
   },
   "keyusage" : [
      "digitalSignature"
   ],
   "latitude" : "37.7510",
   "location" : "37.7510,-97.8220",
   "longitude" : "-97.8220",
   "node" : {
      "country" : "<enterprise field>: node.country",
      "groupid" : "<enterprise field>: node.groupid",
      "id" : "<enterprise field>: node.id",
      "physicalcountry" : "<enterprise field>: node.physicalcountry"
   },
   "organization" : "GOOGLE",
   "port" : 443,
   "protocol" : "http",
   "protocolversion" : "1.1",
   "publickey" : {
      "algorithm" : "id-ecPublicKey",
      "length" : 256
   },
   "reason" : "Found",
   "reverse" : [
      "par10s49-in-f4.1e100.net",
      "waw02s07-in-f164.1e100.net",
      "waw02s07-in-f4.1e100.net"
   ],
   "rtt" : 0.071748,
   "seen_date" : "2025-05-04",
   "serial" : "64:18:88:79:58:5b:5b:52:10:0c:66:22:3f:30:e9:7c",
   "signature" : {
      "algorithm" : "sha256WithRSAEncryption"
   },
   "source" : "urlscan::redirect::2",
   "srcip" : "91.196.152.231",
   "srcport" : 35673,
   "status" : 302,
   "subdomains" : [
      "accountverification.cloud.google",
      "aiplatform-notebook.cloud.google.com",
      "aiplatform-training.cloud.google.com",
      "app.goo.gl",
      "au.cloud.google",
      "autopush-global.identityplatform.google",
      "backstory-staging.chronicle.security",
      "backstory.chronicle.security",
      "backstory.chroniclesec.com",
      "backupdr-autopush.cloud.google",
      "backupdr-autopush.cloud.google.com",
      "backupdr-dev.cloud.google",
      "backupdr-dev.cloud.google.com",
      "backupdr-sandbox.cloud.google",
      "backupdr-sandbox.cloud.google.com",
      "backupdr-staging.cloud.google",
      "backupdr-staging.cloud.google.com",
      "backupdr.cloud.google",
      "backupdr.cloud.google.com",
      "ca.cloud.google",
      "cdn.ampproject.org",
      "cloud.google.com",
      "composer-dev.cloud.google",
      "composer-dev.cloud.google.com",
      "composer-qa.cloud.google",
      "composer-qa.cloud.google.com",
      "composer-staging.cloud.google",
      "composer-staging.cloud.google.com",
      "composer.cloud.google",
      "composer.cloud.google.com",
      "datafusion-api-dev.cloud.google",
      "datafusion-api-dev.cloud.google.com",
      "datafusion-api-staging.cloud.google",
      "datafusion-api-staging.cloud.google.com",
      "datafusion-api.cloud.google",
      "datafusion-api.cloud.google.com",
      "datafusion-dev.cloud.google",
      "datafusion-dev.cloud.google.com",
      "datafusion-staging.cloud.google",
      "datafusion-staging.cloud.google.com",
      "datafusion.cloud.google",
      "datafusion.cloud.google.com",
      "datalab.cloud.google.com",
      "dataplex-dev.cloud.google.com",
      "dataplex-staging.cloud.google.com",
      "dataplex.cloud.google.com",
      "dataproc-image-staging.cloud.google",
      "dataproc-image-staging.cloud.google.com",
      "dataproc-staging.cloud.google",
      "dataproc-staging.cloud.google.com",
      "dataproc-test.cloud.google",
      "dataproc-test.cloud.google.com",
      "dataproc.cloud.google",
      "dataproc.cloud.google.com",
      "de.advertisercommunity.com",
      "de.gateway.dev",
      "dev.google-syndication.com",
      "discover.google.com",
      "earthengine.google.co.in",
      "earthengine.google.com",
      "en.advertisercommunity.com",
      "es.advertisercommunity.com",
      "eu.cloud.google",
      "eu.cloud.google.com",
      "ew.gateway.dev",
      "fiber.google.com",
      "fr.advertisercommunity.com",
      "global.accountverification.cloud.google",
      "global.identityplatform.google",
      "golang.google.cn",
      "health.google.com",
      "healthcare.cloud.google.com",
      "id.advertisercommunity.com",
      "il.cloud.google",
      "in.cloud.google",
      "issues.webmproject.org",
      "issues.webrtc.org",
      "it.advertisercommunity.com",
      "it.cloud.google",
      "ja.advertisercommunity.com",
      "jp.cloud.google",
      "looker-staging.chronicle.security",
      "looker.chronicle.security",
      "mapmaker.google.com",
      "microhost.google.com",
      "notebooks.cloud.google",
      "notebooks.cloud.google.com",
      "pipelines.cloud.google.com",
      "pl.advertisercommunity.com",
      "privacysandbox.google.com",
      "pt.advertisercommunity.com",
      "recaptcha.ampproject.net",
      "research.google.com",
      "ru.advertisercommunity.com",
      "sa.cloud.google",
      "source.bazel.build",
      "stage.advertisercommunity.com",
      "staging-global.identityplatform.google",
      "staging.google-syndication.com",
      "tensorboard-autopush.cloud.google.com",
      "tensorboard-dev.cloud.google.com",
      "tensorboard-staging.cloud.google.com",
      "tensorboard-test.cloud.google.com",
      "tensorboard.cloud.google.com",
      "th.advertisercommunity.com",
      "uc.gateway.dev",
      "uk.cloud.google",
      "us.cloud.google",
      "vi.advertisercommunity.com",
      "video.google.com",
      "zh.advertisercommunity.com"
   ],
   "subject" : {
      "altname" : [
         "misc-sni.google.com",
         "*.aiplatform-notebook.cloud.google.com",
         "*.aiplatform-training.cloud.google.com",
         "*.alphanucleo.google",
         "alphanucleo.google",
         "*.backupdr.cloud.google.com",
         "*.backupdr.cloud.google",
         "*.backupdr-staging.cloud.google.com",
         "*.backupdr-staging.cloud.google",
         "*.backupdr-autopush.cloud.google.com",
         "*.backupdr-autopush.cloud.google",
         "*.backupdr-dev.cloud.google.com",
         "*.backupdr-dev.cloud.google",
         "*.backupdr-sandbox.cloud.google.com",
         "*.backupdr-sandbox.cloud.google",
         "*.brocaproject.com",
         "brocaproject.com",
         "*.composer.cloud.google.com",
         "*.composer.cloud.google",
         "*.composer-staging.cloud.google.com",
         "*.composer-staging.cloud.google",
         "*.composer-qa.cloud.google.com",
         "*.composer-qa.cloud.google",
         "*.composer-dev.cloud.google.com",
         "*.composer-dev.cloud.google",
         "*.datalab.cloud.google.com",
         "*.datafusion.cloud.google.com",
         "*.datafusion.cloud.google",
         "*.datafusion-staging.cloud.google.com",
         "*.datafusion-staging.cloud.google",
         "*.datafusion-dev.cloud.google.com",
         "*.datafusion-dev.cloud.google",
         "*.datafusion-api.cloud.google.com",
         "*.datafusion-api.cloud.google",
         "*.datafusion-api-staging.cloud.google.com",
         "*.datafusion-api-staging.cloud.google",
         "*.datafusion-api-dev.cloud.google.com",
         "*.datafusion-api-dev.cloud.google",
         "*.dataplex.cloud.google.com",
         "*.dataplex-staging.cloud.google.com",
         "*.dataplex-dev.cloud.google.com",
         "*.dataproc.cloud.google.com",
         "*.dataproc.cloud.google",
         "*.dataproc-image-staging.cloud.google.com",
         "*.dataproc-image-staging.cloud.google",
         "*.dataproc-staging.cloud.google.com",
         "*.dataproc-staging.cloud.google",
         "*.dataproc-test.cloud.google.com",
         "*.dataproc-test.cloud.google",
         "*.earthengine.google.co.in",
         "*.earthengine.google.com",
         "*.fiber.google.com",
         "*.gateway.dev",
         "*.de.gateway.dev",
         "*.ew.gateway.dev",
         "*.uc.gateway.dev",
         "*.global.accountverification.cloud.google",
         "*.google-syndication.com",
         "*.dev.google-syndication.com",
         "*.staging.google-syndication.com",
         "*.googleacquisitionmigration.com",
         "*.gvt5.com",
         "*.healthcare.cloud.google.com",
         "*.mapmaker.google.com",
         "*.microhost.google.com",
         "*.notebooks.cloud.google.com",
         "*.notebooks.cloud.google",
         "*.picnik.com",
         "picnik.com",
         "*.pipelines.cloud.google.com",
         "*.podcasts.goog",
         "*.tensorboard.cloud.google.com",
         "*.tensorboard-autopush.cloud.google.com",
         "*.tensorboard-dev.cloud.google.com",
         "*.tensorboard-staging.cloud.google.com",
         "*.tensorboard-test.cloud.google.com",
         "abc.xyz",
         "*.abc.xyz",
         "adsense.com",
         "www.adsense.com",
         "adsensecustomsearchads.com",
         "*.adsensecustomsearchads.com",
         "adsenseformobileapps.com",
         "advertisercommunity.com",
         "*.advertisercommunity.com",
         "cloudyoryx.dev",
         "*.cloudyoryx.dev",
         "eageroryx.dev",
         "*.eageroryx.dev",
         "stage.advertisercommunity.com",
         "*.stage.advertisercommunity.com",
         "de.advertisercommunity.com",
         "*.de.advertisercommunity.com",
         "en.advertisercommunity.com",
         "*.en.advertisercommunity.com",
         "es.advertisercommunity.com",
         "*.es.advertisercommunity.com",
         "fr.advertisercommunity.com",
         "*.fr.advertisercommunity.com",
         "id.advertisercommunity.com",
         "*.id.advertisercommunity.com",
         "it.advertisercommunity.com",
         "*.it.advertisercommunity.com",
         "ja.advertisercommunity.com",
         "*.ja.advertisercommunity.com",
         "pl.advertisercommunity.com",
         "*.pl.advertisercommunity.com",
         "pt.advertisercommunity.com",
         "*.pt.advertisercommunity.com",
         "ru.advertisercommunity.com",
         "*.ru.advertisercommunity.com",
         "th.advertisercommunity.com",
         "*.th.advertisercommunity.com",
         "vi.advertisercommunity.com",
         "*.vi.advertisercommunity.com",
         "zh.advertisercommunity.com",
         "*.zh.advertisercommunity.com",
         "amie.google",
         "*.amie.google",
         "ampcache.com",
         "*.ampcache.com",
         "ampproject.com",
         "*.ampproject.com",
         "ampproject.net",
         "*.ampproject.net",
         "*.recaptcha.ampproject.net",
         "ampproject.org",
         "*.ampproject.org",
         "*.cdn.ampproject.org",
         "androidify.com",
         "*.androidify.com",
         "app.goo.gl",
         "*.app.goo.gl",
         "channel-app.google",
         "console.au.cloud.google",
         "*.au.cloud.google",
         "console.ca.cloud.google",
         "*.ca.cloud.google",
         "console.eu.cloud.google",
         "*.eu.cloud.google",
         "console.eu.cloud.google.com",
         "console.il.cloud.google",
         "*.il.cloud.google",
         "console.in.cloud.google",
         "*.in.cloud.google",
         "console.it.cloud.google",
         "*.it.cloud.google",
         "console.jp.cloud.google",
         "*.jp.cloud.google",
         "console.sa.cloud.google",
         "*.sa.cloud.google",
         "console.uk.cloud.google",
         "*.uk.cloud.google",
         "console.us.cloud.google",
         "*.us.cloud.google",
         "cloud.google",
         "*.cloud.google",
         "colab.research.google.com",
         "code.webrtc.org",
         "bugs.webrtc.org",
         "issues.webrtc.org",
         "*.issues.webrtc.org",
         "chronicle.security",
         "*.chronicle.security",
         "*.backstory.chronicle.security",
         "*.backstory-staging.chronicle.security",
         "chronicleforgood.com",
         "*.chronicleforgood.com",
         "looker.chronicle.security",
         "*.looker.chronicle.security",
         "looker-staging.chronicle.security",
         "*.looker-staging.chronicle.security",
         "chroniclesec.com",
         "*.chroniclesec.com",
         "*.backstory.chroniclesec.com",
         "crossmediapanel.com",
         "*.crossmediapanel.com",
         "crowdcalling.google",
         "dataliberation.org",
         "*.dataliberation.org",
         "datasetsearch.research.google.com",
         "dg-meta.video.google.com",
         "digitalassetlinks.org",
         "*.digitalassetlinks.org",
         "discover.google.com",
         "*.discover.google.com",
         "domains.google",
         "*.domains.google",
         "duetai.google",
         "*.duetai.google",
         "earlydays.google",
         "*.earlydays.google",
         "ehr-search.health.google.com",
         "engineering.google",
         "*.engineering.google",
         "fastlane.ci",
         "floonet.goog",
         "*.floonet.goog",
         "gapi.waze.com",
         "gmbads.gle",
         "*.gmbads.gle",
         "go-lang.com",
         "*.go-lang.com",
         "go-lang.net",
         "*.go-lang.net",
         "go-lang.org",
         "*.go-lang.org",
         "golang.com",
         "*.golang.com",
         "golang.net",
         "*.golang.net",
         "golang.org",
         "*.golang.org",
         "golang.google.cn",
         "*.golang.google.cn",
         "googleblog.com",
         "*.googleblog.com",
         "googlecert.net",
         "*.googlecert.net",
         "googlestore.com",
         "www.googlestore.com",
         "grow.google",
         "*.grow.google",
         "g.dev",
         "*.g.dev",
         "g.page",
         "*.g.page",
         "hey.gle",
         "*.hey.gle",
         "ok.gle",
         "*.ok.gle",
         "hats.goog",
         "*.hats.goog",
         "iamremarkable.org",
         "www.iamremarkable.org",
         "identityplatform.google",
         "*.identityplatform.google",
         "*.global.identityplatform.google",
         "*.staging-global.identityplatform.google",
         "*.autopush-global.identityplatform.google",
         "lanternal.com",
         "*.lanternal.com",
         "lers.google",
         "liftware.com",
         "*.liftware.com",
         "liftware.jp",
         "*.liftware.jp",
         "nel.goog",
         "*.nel.goog",
         "nomulus.foo",
         "*.nomulus.foo",
         "notebooklm.google",
         "ordering.page",
         "*.ordering.page",
         "macservice.goog",
         "*.macservice.goog",
         "makersuite.google",
         "*.makersuite.google",
         "pagespeed.web.dev",
         "payment.goog",
         "*.payment.goog",
         "picasaweb.com",
         "*.picasaweb.com",
         "picasaweb.net",
         "*.picasaweb.net",
         "picasaweb.org",
         "*.picasaweb.org",
         "pixate.com",
         "www.pixate.com",
         "pki.goog",
         "*.pki.goog",
         "play.space",
         "*.play.space",
         "privacysandbox.google.com",
         "*.privacysandbox.google.com",
         "projectgomie.google",
         "*.projectgomie.google",
         "rbm.goog",
         "*.rbm.goog",
         "registry-qa.google",
         "www.registry-qa.google",
         "registry-sandbox.google",
         "www.registry-sandbox.google",
         "registry.google",
         "www.registry.google",
         "research.youtube",
         "*.research.youtube",
         "savethedate.foo",
         "*.savethedate.foo",
         "searchingforsyria.org",
         "*.searchingforsyria.org",
         "share.google",
         "*.share.google",
         "songwriters.youtube",
         "*.songwriters.youtube",
         "source.bazel.build",
         "*.source.bazel.build",
         "support.registry-qa.google",
         "support.registry-sandbox.google",
         "support.registry.google",
         "sprayscape.com",
         "www.sprayscape.com",
         "tfhub.dev",
         "*.tfhub.dev",
         "thegooglestore.com",
         "www.thegooglestore.com",
         "tiltbrush.com",
         "*.tiltbrush.com",
         "travel.google",
         "*.travel.google",
         "webmproject.org",
         "*.webmproject.org",
         "issues.webmproject.org",
         "*.issues.webmproject.org",
         "webpkgcache.com",
         "*.webpkgcache.com",
         "workinxr.dev",
         "*.workinxr.dev",
         "xn--ngstr-lra8j.com",
         "*.xn--ngstr-lra8j.com",
         "xplr.co",
         "*.xplr.co",
         "zynamics.com",
         "*.zynamics.com",
         "app-ads-services.com",
         "*.app-ads-services.com"
      ],
      "commonname" : "misc-sni.google.com"
   },
   "subnet" : "172.217.0.0/19",
   "tag" : "<enterprise field>: tag",
   "tld" : [
      "build",
      "ci",
      "cn",
      "co",
      "co.in",
      "com",
      "dev",
      "foo",
      "gl",
      "gle",
      "goog",
      "google",
      "jp",
      "net",
      "org",
      "page",
      "security",
      "space",
      "xyz",
      "youtube"
   ],
   "tls" : "true",
   "transport" : "tcp",
   "url" : "/",
   "validity" : {
      "notafter" : "2025-06-23T08:54:44Z",
      "notbefore" : "2025-03-31T08:54:45Z"
   },
   "version" : "v3",
   "wildcard" : "true"
}