The question
A script loads from measure.getmantis.net. What does that tell us about the technology involved? The hostname establishes that the endpoint uses a subdomain of the site. Identifying the software requires examining the request and its response.
This walkthrough examines two public HTTP responses from getmantis.net. It demonstrates how to build a supported finding before moving into a browser-session audit.
Scope and method
On November 5, 2026, at 14:53 UTC, we retrieved the homepage HTML and one JavaScript loader over HTTPS without an account or supplied cookies. This collection did not execute the JavaScript, exercise consent choices, or submit analytics events. The response observations and SHA-256 hashes are available in the downloadable evidence summary.
- Retrieve the public homepage and locate the tag bootstrap.
- Follow the script URL declared by that bootstrap.
- Compare the container identifier and data-layer name in the HTML with the returned JavaScript.
- Record what the HTML declares about consent, and identify the runtime questions that remain open.
What the responses show
| Observation | Supported finding |
|---|---|
The homepage builds a script URL under measure.getmantis.net/assets/pulse/. | The page declares a loader on a same-site subdomain. The hostname alone does not identify its supplier. |
The bootstrap supplies GTM-T7RGM9H4 and the data-layer name mantisEvents. | The HTML declares a Google Tag Manager container identifier and a custom data-layer name. |
The retrieved JavaScript contains the same container identifier and data-layer name, plus a www.googletagmanager.com marker. | The response corroborates Google Tag Manager delivery through the custom-domain loader. |
| The HTML places a consent-default command before the loader bootstrap. | A denied default is declared for six consent fields. This is a source-level observation; it does not establish that every runtime component honors that state. |
The loader URL
https://measure.getmantis.net/assets/pulse/?id=GTM-T7RGM9H4&l=mantisEventsThe GTM- identifier is a useful clue. The matching response provides stronger support than the URL’s spelling alone. This observation also explains why grouping every same-site request as application code can hide the technology responsible for it.
The declared consent defaults
The homepage contains this command before the tag bootstrap:
gtag('consent', 'default', {
analytics_storage: 'denied',
ad_storage: 'denied',
ad_user_data: 'denied',
ad_personalization: 'denied',
functionality_storage: 'denied',
personalization_storage: 'denied',
security_storage: 'granted'
});The command describes the intended initial state. Establishing the state at a particular request requires runtime evidence. The presence of a loader request during a denied state also requires examining its purpose and payload before reaching a privacy conclusion.
Continue the investigation in MANTIS
Use the same site in a fresh browser context to investigate how the declared configuration behaves. The following steps describe a follow-up audit; they were not performed by the two-response collection reported above.
- Start a recording before the page loads. Inspect the Requests view and filter for
assets/pulse. - Open the matching request. Review its initiator, response context and available identification evidence. Preserve any uncertainty if the tool remains unresolved.
- Use the Timeline to place the request alongside captured consent and lifecycle events. Inspect the consent evidence associated with the request’s start time.
- Record separate scenarios for the initial state, rejection, acceptance and withdrawal. Keep the page, browser state and actions documented for each capture.
- Compare the captures, review the actual collection requests and payload fields, and export the evidence supporting the finding.
See the request, consent and comparison features and the privacy-review use cases for the surrounding workflow.
What remains unknown
- These responses do not establish whether a browser executed the loader or which later tags fired.
- They do not establish the payloads or destinations of later collection requests, or what happens to data after a server receives it.
- They do not test consent rejection, acceptance, withdrawal, or storage changes.
- They do not establish a legal basis, regulatory compliance, or the absence of other technologies.
Further consent findings need fresh runtime captures. Server-to-server forwarding needs separate server-side evidence. A future response can change as the tag container is republished, so repeat the collection before relying on these observations.
The finding we can document
At the recorded time, getmantis.net declared a same-site tag loader whose retrieved JavaScript corroborated Google Tag Manager delivery. Its HTML declared denied defaults for six consent fields before that bootstrap. The collection supports those source-level findings and leaves runtime consent behavior open for testing.
This is the review discipline MANTIS is built to support: connect an observation to its evidence, state the uncertainty, and identify the next check.