These originate from "report-uri" (not "report-to") tags in CSP
headers, and appear as application/csp-report requests.