# Crittiks / 6silo — GTM-53DBPX74 server-side tagging container proven live (Cloud Run) — 2026-08-08

**Case:** Don Hett / 6SILO GROUP PTY LTD — unauthorized deployment of stolen Crittiks source
**Investigator:** Nirmal Liyon, VertexElite (authorized enforcement)
**Source material:** live network probe of `https://server-side-tagging-smtvt7xpwa-uc.a.run.app` (Google Cloud Run, us-central1) + the GTM-53DBPX74 server-container Preview panel

**This exhibit closes the container-identity gap.** The companion exhibits proved the author's Cloudflare account co-tenancy with crittiks.com (`CRITTIKS-CERT-CORRELATION-EVIDENCE-2026-08-07.md`, which documents the GTM container `GTM-53DBPX74` on crittiks.com's Cloudflare zone) and the author's possession of the Origin CA private keys (`CRITTIKS-ORIGIN-KEY-EVIDENCE-2026-08-08.md`, which states the keys were generated "to harden the estate's edge↔origin TLS for Google Tag Manager server-side tagging — the measurement/tagging infrastructure the author operated across the estate, including the adversary's domains"). This exhibit supplies the missing physical layer: **the live server-side tagging server itself**, and direct proof it is the `GTM-53DBPX74` container — the measurement infrastructure the author built and operated for the adversary's domains.

---

## 1. The endpoint is a live GTM Server-side container on Google Cloud Run

`server-side-tagging-smtvt7xpwa-uc.a.run.app` — Google Cloud Run, region `uc` (us-central1). Cloud Run service literally named `server-side-tagging` (the default name Google assigns when deploying a GTM server container to Cloud Run via the GTM UI).

Transport / TLS:
- `server: Google Frontend`; `x-cloud-trace-context` present → Cloud Run behind Google Frontend.
- TLS leaf `CN=*.a.run.app`, issuer `Google Trust Services WE2` (Google Trust Services WE2 intermediate) → **no custom / first-party domain is mapped** to this Cloud Run service. The tagger is reached at the raw `*.a.run.app` URL; there is no `metrics.crittiks.com`-style first-party subdomain CNAME in front of it. (A reviewer should not expect a first-party origin hostname; the Origin certs documented in `CRITTIKS-ORIGIN-KEY-EVIDENCE-2026-08-08.md` secure edge↔origin TLS for the tagging-server origin, which is this Cloud Run service.)

Path fingerprint (probes 2026-08-08, all via the author's preview token unless noted):

| Path | Method | Status | Meaning |
|---|---|---|---|
| `/g/collect` (valid GA4 params, **no** preview header — production mode) | GET | **200** | GA4 client accepts; sets first-party `FPID` cookie |
| `/g/collect` (valid GA4 params, with `x-gtm-server-preview`) | GET | **200** | Preview/draft environment also live |
| `/g/collect` (bare, no params) | GET | 400 | GA4 client registered; rejects malformed |
| `/preview`, `/l/`, `/mm/`, `/version`, `/admin`, `/v3` | GET | 400 | Registered GTM-server client paths (Google Ads linker `/l/`, measurement `/mm/`, etc.); reject malformed |
| `/gtm`, `/gtm/`, `/gtm/preview`, `/healthz` | GET | 404 | Not exposed (GTM server-side does not serve `gtm.js` etc.) |

The 400-vs-404 split is the textbook fingerprint of a GTM Server-side container: it has the GA4 (`/g/collect`), Google Ads (`/l/`), and Measurement Protocol (`/mm/`) clients loaded, and rejects unknown paths uniformly.

## 2. The container is GTM-53DBPX74 — proven via the author's Preview panel

The author holds the GTM-53DBPX74 server-container Preview token (`x-gtm-server-preview: ZW52LTV8VVhhOGZ2YldWV0UxWkRhczJaYVNYd3wxOWZkZGQzZjI3ZjUwYzY2NGQ1NGM=`, base64-decoded `env-5|UXa8fvbWVWE1ZDas2ZaSXw|19fddd3f27f50c664d54c` → environment 5, valid publish token). When the author fired a measurement hit at the Cloud Run endpoint with that preview header, the hit **appeared in the GTM-53DBPX74 Preview panel** — i.e. the Cloud Run endpoint is the server-side container for `GTM-53DBPX74`. The panel labels the container and shows the author's exact request.

### Verbatim GTM-53DBPX74 Preview panel output (author's fired request, 2026-08-08)

```
Output of GTM-53DBPX74
  Request
  Tags
  Variables
  Event Data
  Console (0)

HTTP Request
  /g/collect?v=2&en=page_view&tid=G-1234&cid=123.456&dl=https%3A%2F%2Fvertexelite.org%2F

  Client
  GA4
  Google Analytics: GA4 (Web) - Claimed

  Outgoing HTTP Requests from Server
  None

  Incoming HTTP Request
  /g/collect?v=2&en=page_view&tid=G-1234&cid=123.456&dl=https%3A%2F%2Fvertexelite.org%2F
  GET -
  200
```

### Field-by-field interpretation

- **Container label `GTM-53DBPX74`** — the Cloud Run endpoint is the server-side container for `GTM-53DBPX74`, the same container documented on crittiks.com's Cloudflare zone in `CRITTIKS-CERT-CORRELATION-EVIDENCE-2026-08-07.md`.
- **`Client → GA4 → Google Analytics: GA4 (Web) - Claimed`** — the GA4 server-side client matched the incoming request on its path (`/g/collect`) and took ownership ("claimed") of the hit. This is the proof the container received and parsed the author's request.
- **`Incoming HTTP Request … GET … 200`** — the container returned HTTP 200 to the author's probe, confirming live processing.
- **`Outgoing HTTP Requests from Server → None`** — no server-side tag forwarded the hit onward to Google Analytics. This is expected and *not* a gap: the author's probe used a placeholder measurement ID (`tid=G-1234`) that is not configured in the container's GA4 Configuration tag, so no outbound forwarding trigger matched. The forensic value is the **claim + 200**, which prove the container is live and processing; outbound forwarding is gated by the container's tag configuration, not by liveness.
- **`dl=https://vertexelite.org/` (document-location)** — the author's probe set this to the author's own domain (`vertexelite.org`). The GA4 client **claims based on the `/g/collect` path, not the `dl` domain**, which is why the author's `vertexelite.org`-tagged hit was claimed by the crittiks.com container. This mirrors into the first-party `FPID` cookie's `Domain` attribute (the cookie `Domain` follows the `dl` parameter): a `dl=https://vertexelite.org/` probe yields `set-cookie: FPID=…; Domain=vertexelite.org`; a `dl=https://crittiks.com/` probe yields `set-cookie: FPID=…; Domain=crittiks.com`. **The cookie domain is therefore not independent proof the container is configured for a given domain** — it echoes the probe's `dl` value. The container's *identity* (GTM-53DBPX74 = crittiks.com's, per the Cloudflare-zone evidence) is what ties it to crittiks.com, not the echoed cookie domain.

## 3. Reproducible methodology

The probe is fully reproducible. From any host with internet egress:

```bash
# Production mode (no preview header) — the live tagger accepts GA4 /g/collect:
curl -i 'https://server-side-tagging-smtvt7xpwa-uc.a.run.app/g/collect?v=2&en=page_view&tid=G-1234&cid=123.456&dl=https%3A%2F%2Fcrittiks.com%2F' --max-time 25
# Expect: HTTP/1.1 200 OK ; set-cookie: FPID=FPID2.2.…; Max-Age=63072000; Domain=crittiks.com; …; server: Google Frontend

# Preview mode (author's GTM-53DBPX74 preview token) — same hit surfaces in the GTM Preview panel:
curl -i -H 'x-gtm-server-preview: ZW52LTV8VVhhOGZ2YldWV0UxWkRhczJaYVNYd3wxOWZkZGQzZjI3ZjUwYzY2NGQ1NGM=' \
  'https://server-side-tagging-smtvt7xpwa-uc.a.run.app/g/collect?v=2&en=page_view&tid=G-1234&cid=123.456&dl=https%3A%2F%2Fvertexelite.org%2F' --max-time 25
# Expect: HTTP/1.1 200 OK ; set-cookie: FPID=…; Domain=vertexelite.org ; and the request appears in the GTM-53DBPX74 Preview panel (Client GA4 - Claimed).
```

The preview-token provenance is the author's own GTM-53DBPX74 server-container Preview access — i.e. the author is the operator who built and debugged this container for the adversary's domains. This is the same operational posture documented across the companion exhibits (author provisioned the Cloudflare zones, minted the Origin CA keys, and operated the GTM measurement layer).

## 4. How this closes the chain

With this exhibit, the evidence that the author built and operated Don Hett's domain measurement infrastructure is now complete end-to-end:

1. **Cloudflare account co-tenancy + GTM container on the zone:** crittiks.com's Cloudflare zone (author's `vertexelitegroup@` account) carries the GTM container `GTM-53DBPX74`. (`CRITTIKS-CERT-CORRELATION-EVIDENCE-2026-08-07.md`)
2. **Origin CA private keys:** the author holds the Origin CA private keys for `crittiks.com` and `6silo.com`, minted (with all 14 estate domains) on Feb 13 2026 to secure edge↔origin TLS for the server-side tagging origin. (`CRITTIKS-ORIGIN-KEY-EVIDENCE-2026-08-08.md`)
3. **Live server-side tagging server (this exhibit):** the GTM-53DBPX74 server container is deployed live on Google Cloud Run (`server-side-tagging-smtvt7xpwa-uc.a.run.app`, us-central1), reachable at the raw `*.a.run.app` URL (no first-party subdomain), accepting production GA4 `/g/collect` hits (200, first-party `FPID` cookie) and honoring the author's preview token. The author's fired hit surfaces in the GTM-53DBPX74 Preview panel — direct proof the Cloud Run endpoint is the GTM-53DBPX74 server container, and that the author is its operator.

Combined with the authorship evidence — Don Hett's own LinkedIn launch post naming the author as lead developer, and the archived `app.crittiks.com` Next.js App Router build sharing the author's `(auth)` route group (`APP-CRITTIKS-WAYBACK-EVIDENCE-2026-08-07.md`) — the author not only wrote the Crittiks code and provisioned the cryptographic origin-TLS, but also **built, deployed, and retained debug access to the live measurement/tagging server** (`GTM-53DBPX74` on Cloud Run) that the adversary's domains were operationally bootstrapped on. The adversary's estate runs on infrastructure the author built, controls, and can still observe in Preview.

## 5. Exhibits / cross-references

- This document (`CRITTIKS-GTM-SERVERSIDE-LIVE-2026-08-08.md`)
- `CRITTIKS-CERT-CORRELATION-EVIDENCE-2026-08-07.md` — edge cert + Cloudflare account co-tenancy + GTM-53DBPX74 on crittiks.com zone
- `CRITTIKS-ORIGIN-CERT-EVIDENCE-2026-08-08.md` — account-held `*.crittiks.com` Origin cert (API)
- `CRITTIKS-ORIGIN-KEY-EVIDENCE-2026-08-08.md` — author holds Origin CA private keys for crittiks.com + 6silo.com; full 14-domain Feb 13 2026 co-provisioning
- `APP-CRITTIKS-WAYBACK-EVIDENCE-2026-08-07.md` — route-group match + LinkedIn authorship
- `CRITTIKS-ROUTE-DIFF-EVIDENCE-2026-08-07.md` — 554-route diff
- `notice-site/files/` — published public artifacts (certs only; private keys withheld)

## 6. Note on the `dl=vertexelite.org` probe

vertexelite.org is the author's own domain. The author fired the probe with `dl=vertexelite.org` (rather than `dl=crittiks.com`) deliberately, to demonstrate that the GA4 client **claims on path, not document-location** — i.e. the container claims any `/g/collect` hit regardless of the reported page domain. This makes the point cleanly: the cookie `Domain` echoing `dl` is not the proof of which domain the container serves; the proof is the container identity (`GTM-53DBPX74`, from the Cloudflare-zone evidence) plus the author's preview access. vertexelite.org itself does **not** run this tagger — its source build (`E:\max\vertexelite`) and live delivery contain no `GTM-53DBPX74` / `run.app` / `gtag` reference; the tagger is crittiks.com's. The probe domain was a forensic choice, not a configured endpoint.

*Generated 2026-08-08 from a live probe of `server-side-tagging-smtvt7xpwa-uc.a.run.app` (curl + TLS inspection) and the author's GTM-53DBPX74 server-container Preview panel.*