Scribd
Upload
186 views119 pages

ServiceNow Auth Redirect Analysis

The document summarizes a request made to a ServiceNow instance at perkinscoiedev.service-now.com. The request was redirected to an authentication page, which then redirected back to the ServiceNow homepage. Security details show the request was made over TLS 1.2 with AES encryption.

Uploaded by

Spit Fire
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
186 views119 pages

ServiceNow Auth Redirect Analysis

The document summarizes a request made to a ServiceNow instance at perkinscoiedev.service-now.com. The request was redirected to an authentication page, which then redirected back to the ServiceNow homepage. Security details show the request was made over TLS 1.2 with AES encryption.

Uploaded by

Spit Fire
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd

03.10.

2021, 14:47

{
"data": {
"requests": [
{
"request": {
"requestId": "57C22717099627F4ACFB8060C2A3AA76",
"loaderId": "57C22717099627F4ACFB8060C2A3AA76",
"documentURL": "https://perkinscoiedev.service-now.com/auth_redirect.do?
sysparm_stack=no&sysparm_url=https%3A%2F%2Fmyapps.perkinscoie.com%2Fapp%2Fservicenow_ud%2Fexk
1jsx6trpNIFLGO0h8%2Fsso%2Fsaml%3FSAMLRequest%3DnVJdb9MwFP0rkd8TJ2aZgtVUCq0GlUoXrYUHXpAT365miW
18naz796Ru0coDE%252BL1%252Btxzz4dnKPqOWV4N%252FqAf4OcA6KNj32nk55eSDE5zI1Ah16IH5L7l2%252BrzmrM
k5dYZb1rTkahCBOeV0QujcejBbcGNqoUvD%252BuSHLy3yCm14J6UxtYokDAmeIbE2jwnrempFqMVj5BIQ6LlJERpcWJ8
3e9fhLWYXNGEvWlIL1wT1fdBUjg%252BZT%252FweOud3azu1h%252Fv00NBEQ09mSLRnXEtBMsl2YsOgUSrZUm2m0XeN
LdMvG%252F27wqWF1I2NyxrRJbnTZaLVBQTEGuBqEZ4XUUcYKXRC%252B1LwlKWxSmL03yXFpzd8DRPWM6%252Bkai%25
2BhPVBaan049vJNmcQ8k%252B7XR3X99tdIBiVBLeZ0P8V6ldwGAKdLpD5LDTMg3x3XfrbysTvpsn83yTM6PWhy1nLTy5
Wy9p0qn2Jqq4zzwsHwk%252FOvBsglNQL%252F3ctWZKFiZLxPkA59EJ1lZQOEAmdX%252B7%252B%252BbnnvwA%253D
%26RelayState%3Dhttps%253A%252F%252Fperkinscoiedev.service-now.com%252Fnavpage.do",
"request": {
"url": "https://perkinscoiedev.service-now.com/auth_redirect.do?
sysparm_stack=no&sysparm_url=https%3A%2F%2Fmyapps.perkinscoie.com%2Fapp%2Fservicenow_ud%2Fexk
1jsx6trpNIFLGO0h8%2Fsso%2Fsaml%3FSAMLRequest%3DnVJdb9MwFP0rkd8TJ2aZgtVUCq0GlUoXrYUHXpAT365miW
18naz796Ru0coDE%252BL1%252Btxzz4dnKPqOWV4N%252FqAf4OcA6KNj32nk55eSDE5zI1Ah16IH5L7l2%252BrzmrM
k5dYZb1rTkahCBOeV0QujcejBbcGNqoUvD%252BuSHLy3yCm14J6UxtYokDAmeIbE2jwnrempFqMVj5BIQ6LlJERpcWJ8
3e9fhLWYXNGEvWlIL1wT1fdBUjg%252BZT%252FweOud3azu1h%252Fv00NBEQ09mSLRnXEtBMsl2YsOgUSrZUm2m0XeN
LdMvG%252F27wqWF1I2NyxrRJbnTZaLVBQTEGuBqEZ4XUUcYKXRC%252B1LwlKWxSmL03yXFpzd8DRPWM6%252Bkai%25
2BhPVBaan049vJNmcQ8k%252B7XR3X99tdIBiVBLeZ0P8V6ldwGAKdLpD5LDTMg3x3XfrbysTvpsn83yTM6PWhy1nLTy5
Wy9p0qn2Jqq4zzwsHwk%252FOvBsglNQL%252F3ctWZKFiZLxPkA59EJ1lZQOEAmdX%252B7%252B%252BbnnvwA%253D
%26RelayState%3Dhttps%253A%252F%252Fperkinscoiedev.service-now.com%252Fnavpage.do",
"method": "GET",
"headers": {
"Upgrade-Insecure-Requests": "1",
"User-Agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5)
AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36"
},
"mixedContentType": "none",
"initialPriority": "VeryHigh",
"referrerPolicy": "no-referrer-when-downgrade"
},
"timestamp": 23727520.746925,
"wallTime": 1612513445.605608,
"initiator": {
"type": "other"
},
"redirectResponse": {
"url": "https://perkinscoiedev.service-now.com/",
"status": 302,
"statusText": "Found",
"headers": {
"X-Frame-Options": "SAMEORIGIN",
"X-Is-Logged-In": "false",
"X-Transaction-ID": "3dbade47db46",
"Location": "/auth_redirect.do?
sysparm_stack=no&sysparm_url=https%3A%2F%2Fmyapps.perkinscoie.com%2Fapp%2Fservicenow_ud%2Fexk
1jsx6trpNIFLGO0h8%2Fsso%2Fsaml%3FSAMLRequest%3DnVJdb9MwFP0rkd8TJ2aZgtVUCq0GlUoXrYUHXpAT365miW
18naz796Ru0coDE%252BL1%252Btxzz4dnKPqOWV4N%252FqAf4OcA6KNj32nk55eSDE5zI1Ah16IH5L7l2%252BrzmrM
k5dYZb1rTkahCBOeV0QujcejBbcGNqoUvD%252BuSHLy3yCm14J6UxtYokDAmeIbE2jwnrempFqMVj5BIQ6LlJERpcWJ8
3e9fhLWYXNGEvWlIL1wT1fdBUjg%252BZT%252FweOud3azu1h%252Fv00NBEQ09mSLRnXEtBMsl2YsOgUSrZUm2m0XeN
LdMvG%252F27wqWF1I2NyxrRJbnTZaLVBQTEGuBqEZ4XUUcYKXRC%252B1LwlKWxSmL03yXFpzd8DRPWM6%252Bkai%25
2BhPVBaan049vJNmcQ8k%252B7XR3X99tdIBiVBLeZ0P8V6ldwGAKdLpD5LDTMg3x3XfrbysTvpsn83yTM6PWhy1nLTy5
Wy9p0qn2Jqq4zzwsHwk%252FOvBsglNQL%252F3ctWZKFiZLxPkA59EJ1lZQOEAmdX%252B7%252B%252BbnnvwA%253D
%26RelayState%3Dhttps%253A%252F%252Fperkinscoiedev.service-now.com%252Fnavpage.do",
"Content-Length": "0",
"Date": "Fri, 05 Feb 2021 08:24:05 GMT",
"Server": "ServiceNow",
"Set-Cookie": "JSESSIONID=92F3840F3A071EE98A86BD47C49BFA1B; Path=/; HttpOnly;

https://urlscan.io/api/v1/result/3a2c746e-192e-4901-9a5d-78b8b2ee32e3/ Page 1 of 119


03.10.2021, 14:47

SameSite=None; Secure\nglide_user=; Max-Age=0; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/;


HttpOnly; SameSite=None; Secure\nglide_user_session=; Max-Age=0; Expires=Thu, 01-Jan-1970
00:00:10 GMT; Path=/; HttpOnly; SameSite=None;
Secure\nglide_user_route=glide.55434a10c1293928cafe5a3771ebd707; Max-Age=2147483647;
Expires=Wed, 23-Feb-2089 11:38:12 GMT; Path=/; HttpOnly; SameSite=None;
Secure\nBIGipServerpool_perkinscoiedev=696801290.42558.0000; path=/; Httponly; Secure;
SameSite=None; Secure",
"Strict-Transport-Security": "max-age=63072000; includeSubDomains"
},
"mimeType": "",
"requestHeaders": {
"Host": "perkinscoiedev.service-now.com",
"Connection": "keep-alive",
"Pragma": "no-cache",
"Cache-Control": "no-cache",
"Upgrade-Insecure-Requests": "1",
"User-Agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5)
AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36",
"Accept":
"text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q
=0.8,application/signed-exchange;v=b3;q=0.9",
"Sec-Fetch-Site": "none",
"Sec-Fetch-Mode": "navigate",
"Sec-Fetch-User": "?1",
"Sec-Fetch-Dest": "document",
"Accept-Encoding": "gzip, deflate, br",
"Accept-Language": "en-US"
},
"remoteIPAddress": "149.96.248.4",
"remotePort": 443,
"fromPrefetchCache": false,
"encodedDataLength": 1722,
"timing": {
"requestTime": 23727519.684688,
"proxyStart": -1,
"proxyEnd": -1,
"dnsStart": 0.368,
"dnsEnd": 0.373,
"connectStart": 0.373,
"connectEnd": 605.106,
"sslStart": 19.173,
"sslEnd": 605.101,
"workerStart": -1,
"workerReady": -1,
"workerFetchStart": -1,
"workerRespondWithSettled": -1,
"sendStart": 605.152,
"sendEnd": 605.211,
"pushStart": 0,
"pushEnd": 0,
"receiveHeadersEnd": 1060.491
},
"responseTime": 1612513445603.302,
"protocol": "http/1.1",
"securityState": "secure",
"securityDetails": {
"protocol": "TLS 1.2",
"keyExchange": "ECDHE_RSA",
"keyExchangeGroup": "P-256",
"cipher": "AES_128_GCM",
"certificateId": 0,
"subjectName": "*.service-now.com",
"sanList": [
"*.service-now.com",
"service-now.com"
],

https://urlscan.io/api/v1/result/3a2c746e-192e-4901-9a5d-78b8b2ee32e3/ Page 2 of 119


03.10.2021, 14:47

"issuer": "Entrust Certification Authority - L1K",


"validFrom": 1595462153,
"validTo": 1617321353,
"signedCertificateTimestampList": [],
"certificateTransparencyCompliance": "unknown"
}
},
"type": "Document",
"frameId": "A7C87A170B6FF1BFF9C1519BD77B8C40",
"hasUserGesture": false
},
"requests": [
{
"requestId": "57C22717099627F4ACFB8060C2A3AA76",
"loaderId": "57C22717099627F4ACFB8060C2A3AA76",
"documentURL": "http://perkinscoiedev.service-now.com/",
"request": {
"url": "http://perkinscoiedev.service-now.com/",
"method": "GET",
"headers": {
"Upgrade-Insecure-Requests": "1",
"User-Agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5)
AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36"
},
"mixedContentType": "none",
"initialPriority": "VeryHigh",
"referrerPolicy": "no-referrer-when-downgrade"
},
"timestamp": 23727519.317042,
"wallTime": 1612513444.175507,
"initiator": {
"type": "other"
},
"type": "Document",
"frameId": "A7C87A170B6FF1BFF9C1519BD77B8C40",
"hasUserGesture": false
},
{
"requestId": "57C22717099627F4ACFB8060C2A3AA76",
"loaderId": "57C22717099627F4ACFB8060C2A3AA76",
"documentURL": "https://perkinscoiedev.service-now.com/",
"request": {
"url": "https://perkinscoiedev.service-now.com/",
"method": "GET",
"headers": {
"Upgrade-Insecure-Requests": "1",
"User-Agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5)
AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36"
},
"mixedContentType": "none",
"initialPriority": "VeryHigh",
"referrerPolicy": "no-referrer-when-downgrade"
},
"timestamp": 23727519.68438,
"wallTime": 1612513444.542897,
"initiator": {
"type": "other"
},
"redirectResponse": {
"url": "http://perkinscoiedev.service-now.com/",
"status": 302,
"statusText": "Found",
"headers": {
"Location": "https://perkinscoiedev.service-now.com/",
"Server": "ServiceNow",
"Connection": "Keep-Alive",

https://urlscan.io/api/v1/result/3a2c746e-192e-4901-9a5d-78b8b2ee32e3/ Page 3 of 119


03.10.2021, 14:47

"Content-Length": "0"
},
"mimeType": "",
"requestHeaders": {
"Host": "perkinscoiedev.service-now.com",
"Connection": "keep-alive",
"Pragma": "no-cache",
"Cache-Control": "no-cache",
"Upgrade-Insecure-Requests": "1",
"User-Agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5)
AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36",
"Accept":
"text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q
=0.8,application/signed-exchange;v=b3;q=0.9",
"Accept-Encoding": "gzip, deflate",
"Accept-Language": "en-US"
},
"remoteIPAddress": "149.96.248.4",
"remotePort": 80,
"fromPrefetchCache": false,
"encodedDataLength": 136,
"timing": {
"requestTime": 23727519.317593,
"proxyStart": -1,
"proxyEnd": -1,
"dnsStart": 0.428,
"dnsEnd": 8.061,
"connectStart": 8.061,
"connectEnd": 25.41,
"sslStart": -1,
"sslEnd": -1,
"workerStart": -1,
"workerReady": -1,
"workerFetchStart": -1,
"workerRespondWithSettled": -1,
"sendStart": 25.458,
"sendEnd": 25.5,
"pushStart": 0,
"pushEnd": 0,
"receiveHeadersEnd": 366.487
},
"responseTime": 1612513444542.501,
"protocol": "http/1.0",
"securityState": "insecure",
"asn": {
"ip": "149.96.248.4",
"asn": "16839",
"country": "US",
"registrar": "arin",
"date": "2010-12-16",
"description": "SNC, US",
"route": "149.96.240.0/20",
"name": "SNC"
},
"geoip": {
"range": [
2506096640,
2506162175
],
"country": "US",
"region": "",
"eu": "0",
"timezone": "America/Chicago",
"city": "",
"ll": [
37.751,

https://urlscan.io/api/v1/result/3a2c746e-192e-4901-9a5d-78b8b2ee32e3/ Page 4 of 119


03.10.2021, 14:47

-97.822
],
"metro": 0,
"area": 1000,
"country_name": "United States"
},
"rdns": {
"ip": "149.96.248.4",
"ptr": "vip-149-96-248-4.cust.service-now.com"
}
},
"type": "Document",
"frameId": "A7C87A170B6FF1BFF9C1519BD77B8C40",
"hasUserGesture": false
},
{
"requestId": "57C22717099627F4ACFB8060C2A3AA76",
"loaderId": "57C22717099627F4ACFB8060C2A3AA76",
"documentURL": "https://perkinscoiedev.service-now.com/auth_redirect.do?
sysparm_stack=no&sysparm_url=https%3A%2F%2Fmyapps.perkinscoie.com%2Fapp%2Fservicenow_ud%2Fexk
1jsx6trpNIFLGO0h8%2Fsso%2Fsaml%3FSAMLRequest%3DnVJdb9MwFP0rkd8TJ2aZgtVUCq0GlUoXrYUHXpAT365miW
18naz796Ru0coDE%252BL1%252Btxzz4dnKPqOWV4N%252FqAf4OcA6KNj32nk55eSDE5zI1Ah16IH5L7l2%252BrzmrM
k5dYZb1rTkahCBOeV0QujcejBbcGNqoUvD%252BuSHLy3yCm14J6UxtYokDAmeIbE2jwnrempFqMVj5BIQ6LlJERpcWJ8
3e9fhLWYXNGEvWlIL1wT1fdBUjg%252BZT%252FweOud3azu1h%252Fv00NBEQ09mSLRnXEtBMsl2YsOgUSrZUm2m0XeN
LdMvG%252F27wqWF1I2NyxrRJbnTZaLVBQTEGuBqEZ4XUUcYKXRC%252B1LwlKWxSmL03yXFpzd8DRPWM6%252Bkai%25
2BhPVBaan049vJNmcQ8k%252B7XR3X99tdIBiVBLeZ0P8V6ldwGAKdLpD5LDTMg3x3XfrbysTvpsn83yTM6PWhy1nLTy5
Wy9p0qn2Jqq4zzwsHwk%252FOvBsglNQL%252F3ctWZKFiZLxPkA59EJ1lZQOEAmdX%252B7%252B%252BbnnvwA%253D
%26RelayState%3Dhttps%253A%252F%252Fperkinscoiedev.service-now.com%252Fnavpage.do",
"request": {
"url": "https://perkinscoiedev.service-now.com/auth_redirect.do?
sysparm_stack=no&sysparm_url=https%3A%2F%2Fmyapps.perkinscoie.com%2Fapp%2Fservicenow_ud%2Fexk
1jsx6trpNIFLGO0h8%2Fsso%2Fsaml%3FSAMLRequest%3DnVJdb9MwFP0rkd8TJ2aZgtVUCq0GlUoXrYUHXpAT365miW
18naz796Ru0coDE%252BL1%252Btxzz4dnKPqOWV4N%252FqAf4OcA6KNj32nk55eSDE5zI1Ah16IH5L7l2%252BrzmrM
k5dYZb1rTkahCBOeV0QujcejBbcGNqoUvD%252BuSHLy3yCm14J6UxtYokDAmeIbE2jwnrempFqMVj5BIQ6LlJERpcWJ8
3e9fhLWYXNGEvWlIL1wT1fdBUjg%252BZT%252FweOud3azu1h%252Fv00NBEQ09mSLRnXEtBMsl2YsOgUSrZUm2m0XeN
LdMvG%252F27wqWF1I2NyxrRJbnTZaLVBQTEGuBqEZ4XUUcYKXRC%252B1LwlKWxSmL03yXFpzd8DRPWM6%252Bkai%25
2BhPVBaan049vJNmcQ8k%252B7XR3X99tdIBiVBLeZ0P8V6ldwGAKdLpD5LDTMg3x3XfrbysTvpsn83yTM6PWhy1nLTy5
Wy9p0qn2Jqq4zzwsHwk%252FOvBsglNQL%252F3ctWZKFiZLxPkA59EJ1lZQOEAmdX%252B7%252B%252BbnnvwA%253D
%26RelayState%3Dhttps%253A%252F%252Fperkinscoiedev.service-now.com%252Fnavpage.do",
"method": "GET",
"headers": {
"Upgrade-Insecure-Requests": "1",
"User-Agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5)
AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36"
},
"mixedContentType": "none",
"initialPriority": "VeryHigh",
"referrerPolicy": "no-referrer-when-downgrade"
},
"timestamp": 23727520.746925,
"wallTime": 1612513445.605608,
"initiator": {
"type": "other"
},
"redirectResponse": {
"url": "https://perkinscoiedev.service-now.com/",
"status": 302,
"statusText": "Found",
"headers": {
"X-Frame-Options": "SAMEORIGIN",
"X-Is-Logged-In": "false",
"X-Transaction-ID": "3dbade47db46",
"Location": "/auth_redirect.do?
sysparm_stack=no&sysparm_url=https%3A%2F%2Fmyapps.perkinscoie.com%2Fapp%2Fservicenow_ud%2Fexk
1jsx6trpNIFLGO0h8%2Fsso%2Fsaml%3FSAMLRequest%3DnVJdb9MwFP0rkd8TJ2aZgtVUCq0GlUoXrYUHXpAT365miW
18naz796Ru0coDE%252BL1%252Btxzz4dnKPqOWV4N%252FqAf4OcA6KNj32nk55eSDE5zI1Ah16IH5L7l2%252BrzmrM

https://urlscan.io/api/v1/result/3a2c746e-192e-4901-9a5d-78b8b2ee32e3/ Page 5 of 119


03.10.2021, 14:47

k5dYZb1rTkahCBOeV0QujcejBbcGNqoUvD%252BuSHLy3yCm14J6UxtYokDAmeIbE2jwnrempFqMVj5BIQ6LlJERpcWJ8
3e9fhLWYXNGEvWlIL1wT1fdBUjg%252BZT%252FweOud3azu1h%252Fv00NBEQ09mSLRnXEtBMsl2YsOgUSrZUm2m0XeN
LdMvG%252F27wqWF1I2NyxrRJbnTZaLVBQTEGuBqEZ4XUUcYKXRC%252B1LwlKWxSmL03yXFpzd8DRPWM6%252Bkai%25
2BhPVBaan049vJNmcQ8k%252B7XR3X99tdIBiVBLeZ0P8V6ldwGAKdLpD5LDTMg3x3XfrbysTvpsn83yTM6PWhy1nLTy5
Wy9p0qn2Jqq4zzwsHwk%252FOvBsglNQL%252F3ctWZKFiZLxPkA59EJ1lZQOEAmdX%252B7%252B%252BbnnvwA%253D
%26RelayState%3Dhttps%253A%252F%252Fperkinscoiedev.service-now.com%252Fnavpage.do",
"Content-Length": "0",
"Date": "Fri, 05 Feb 2021 08:24:05 GMT",
"Server": "ServiceNow",
"Set-Cookie": "JSESSIONID=92F3840F3A071EE98A86BD47C49BFA1B; Path=/; HttpOnly;
SameSite=None; Secure\nglide_user=; Max-Age=0; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/;
HttpOnly; SameSite=None; Secure\nglide_user_session=; Max-Age=0; Expires=Thu, 01-Jan-1970
00:00:10 GMT; Path=/; HttpOnly; SameSite=None;
Secure\nglide_user_route=glide.55434a10c1293928cafe5a3771ebd707; Max-Age=2147483647;
Expires=Wed, 23-Feb-2089 11:38:12 GMT; Path=/; HttpOnly; SameSite=None;
Secure\nBIGipServerpool_perkinscoiedev=696801290.42558.0000; path=/; Httponly; Secure;
SameSite=None; Secure",
"Strict-Transport-Security": "max-age=63072000; includeSubDomains"
},
"mimeType": "",
"requestHeaders": {
"Host": "perkinscoiedev.service-now.com",
"Connection": "keep-alive",
"Pragma": "no-cache",
"Cache-Control": "no-cache",
"Upgrade-Insecure-Requests": "1",
"User-Agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5)
AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36",
"Accept":
"text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q
=0.8,application/signed-exchange;v=b3;q=0.9",
"Sec-Fetch-Site": "none",
"Sec-Fetch-Mode": "navigate",
"Sec-Fetch-User": "?1",
"Sec-Fetch-Dest": "document",
"Accept-Encoding": "gzip, deflate, br",
"Accept-Language": "en-US"
},
"remoteIPAddress": "149.96.248.4",
"remotePort": 443,
"fromPrefetchCache": false,
"encodedDataLength": 1722,
"timing": {
"requestTime": 23727519.684688,
"proxyStart": -1,
"proxyEnd": -1,
"dnsStart": 0.368,
"dnsEnd": 0.373,
"connectStart": 0.373,
"connectEnd": 605.106,
"sslStart": 19.173,
"sslEnd": 605.101,
"workerStart": -1,
"workerReady": -1,
"workerFetchStart": -1,
"workerRespondWithSettled": -1,
"sendStart": 605.152,
"sendEnd": 605.211,
"pushStart": 0,
"pushEnd": 0,
"receiveHeadersEnd": 1060.491
},
"responseTime": 1612513445603.302,
"protocol": "http/1.1",
"securityState": "secure",
"securityDetails": {

https://urlscan.io/api/v1/result/3a2c746e-192e-4901-9a5d-78b8b2ee32e3/ Page 6 of 119


03.10.2021, 14:47

"protocol": "TLS 1.2",


"keyExchange": "ECDHE_RSA",
"keyExchangeGroup": "P-256",
"cipher": "AES_128_GCM",
"certificateId": 0,
"subjectName": "*.service-now.com",
"sanList": [
"*.service-now.com",
"service-now.com"
],
"issuer": "Entrust Certification Authority - L1K",
"validFrom": 1595462153,
"validTo": 1617321353,
"signedCertificateTimestampList": [],
"certificateTransparencyCompliance": "unknown"
},
"asn": {
"ip": "149.96.248.4",
"asn": "16839",
"country": "US",
"registrar": "arin",
"date": "2010-12-16",
"description": "SNC, US",
"route": "149.96.240.0/20",
"name": "SNC"
},
"geoip": {
"range": [
2506096640,
2506162175
],
"country": "US",
"region": "",
"eu": "0",
"timezone": "America/Chicago",
"city": "",
"ll": [
37.751,
-97.822
],
"metro": 0,
"area": 1000,
"country_name": "United States"
},
"rdns": {
"ip": "149.96.248.4",
"ptr": "vip-149-96-248-4.cust.service-now.com"
}
},
"type": "Document",
"frameId": "A7C87A170B6FF1BFF9C1519BD77B8C40",
"hasUserGesture": false
}
],
"response": {
"encodedDataLength": 8788,
"dataLength": 26537,
"requestId": "57C22717099627F4ACFB8060C2A3AA76",
"type": "Document",
"response": {
"url": "https://perkinscoiedev.service-now.com/auth_redirect.do?
sysparm_stack=no&sysparm_url=https%3A%2F%2Fmyapps.perkinscoie.com%2Fapp%2Fservicenow_ud%2Fexk
1jsx6trpNIFLGO0h8%2Fsso%2Fsaml%3FSAMLRequest%3DnVJdb9MwFP0rkd8TJ2aZgtVUCq0GlUoXrYUHXpAT365miW
18naz796Ru0coDE%252BL1%252Btxzz4dnKPqOWV4N%252FqAf4OcA6KNj32nk55eSDE5zI1Ah16IH5L7l2%252BrzmrM
k5dYZb1rTkahCBOeV0QujcejBbcGNqoUvD%252BuSHLy3yCm14J6UxtYokDAmeIbE2jwnrempFqMVj5BIQ6LlJERpcWJ8
3e9fhLWYXNGEvWlIL1wT1fdBUjg%252BZT%252FweOud3azu1h%252Fv00NBEQ09mSLRnXEtBMsl2YsOgUSrZUm2m0XeN

https://urlscan.io/api/v1/result/3a2c746e-192e-4901-9a5d-78b8b2ee32e3/ Page 7 of 119


03.10.2021, 14:47

LdMvG%252F27wqWF1I2NyxrRJbnTZaLVBQTEGuBqEZ4XUUcYKXRC%252B1LwlKWxSmL03yXFpzd8DRPWM6%252Bkai%25
2BhPVBaan049vJNmcQ8k%252B7XR3X99tdIBiVBLeZ0P8V6ldwGAKdLpD5LDTMg3x3XfrbysTvpsn83yTM6PWhy1nLTy5
Wy9p0qn2Jqq4zzwsHwk%252FOvBsglNQL%252F3ctWZKFiZLxPkA59EJ1lZQOEAmdX%252B7%252B%252BbnnvwA%253D
%26RelayState%3Dhttps%253A%252F%252Fperkinscoiedev.service-now.com%252Fnavpage.do",
"status": 200,
"statusText": "OK",
"headers": {
"X-Frame-Options": "SAMEORIGIN",
"X-Is-Logged-In": "false",
"X-Transaction-ID": "8aba1acbdb4a",
"Pragma": "no-store,no-cache",
"Cache-Control": "no-cache,no-store,must-revalidate,max-age=-1",
"Expires": "0",
"Referrer-Policy": "same-origin",
"Content-Encoding": "gzip",
"Content-Type": "text/html;charset=UTF-8",
"Content-Length": "8109",
"Date": "Fri, 05 Feb 2021 08:24:05 GMT",
"Server": "ServiceNow",
"Set-Cookie": "glide_user=; Max-Age=0; Expires=Thu, 01-Jan-1970 00:00:10 GMT;
Path=/; HttpOnly; SameSite=None; Secure\nglide_user_session=; Max-Age=0; Expires=Thu, 01-Jan-
1970 00:00:10 GMT; Path=/; HttpOnly; SameSite=None; Secure",
"Strict-Transport-Security": "max-age=63072000; includeSubDomains"
},
"mimeType": "text/html",
"requestHeaders": {
"Host": "perkinscoiedev.service-now.com",
"Connection": "keep-alive",
"Pragma": "no-cache",
"Cache-Control": "no-cache",
"Upgrade-Insecure-Requests": "1",
"User-Agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5)
AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36",
"Accept":
"text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q
=0.8,application/signed-exchange;v=b3;q=0.9",
"Sec-Fetch-Site": "none",
"Sec-Fetch-Mode": "navigate",
"Sec-Fetch-User": "?1",
"Sec-Fetch-Dest": "document",
"Accept-Encoding": "gzip, deflate, br",
"Accept-Language": "en-US",
"Cookie": "JSESSIONID=92F3840F3A071EE98A86BD47C49BFA1B;
glide_user_route=glide.55434a10c1293928cafe5a3771ebd707;
BIGipServerpool_perkinscoiedev=696801290.42558.0000"
},
"remoteIPAddress": "149.96.248.4",
"remotePort": 443,
"fromPrefetchCache": false,
"encodedDataLength": 679,
"timing": {
"requestTime": 23727520.747696,
"proxyStart": -1,
"proxyEnd": -1,
"dnsStart": -1,
"dnsEnd": -1,
"connectStart": -1,
"connectEnd": -1,
"sslStart": -1,
"sslEnd": -1,
"workerStart": -1,
"workerReady": -1,
"workerFetchStart": -1,
"workerRespondWithSettled": -1,
"sendStart": 0.976,
"sendEnd": 1.169,

https://urlscan.io/api/v1/result/3a2c746e-192e-4901-9a5d-78b8b2ee32e3/ Page 8 of 119


03.10.2021, 14:47

"pushStart": 0,
"pushEnd": 0,
"receiveHeadersEnd": 587.358
},
"responseTime": 1612513446193.397,
"protocol": "http/1.1",
"securityState": "secure",
"securityDetails": {
"protocol": "TLS 1.2",
"keyExchange": "ECDHE_RSA",
"keyExchangeGroup": "P-256",
"cipher": "AES_128_GCM",
"certificateId": 0,
"subjectName": "*.service-now.com",
"sanList": [
"*.service-now.com",
"service-now.com"
],
"issuer": "Entrust Certification Authority - L1K",
"validFrom": 1595462153,
"validTo": 1617321353,
"signedCertificateTimestampList": [],
"certificateTransparencyCompliance": "unknown"
},
"securityHeaders": [
{
"name": "Strict-Transport-Security",
"value": "max-age=63072000; includeSubDomains"
},
{
"name": "X-Frame-Options",
"value": "SAMEORIGIN"
}
]
},
"hash": "30240ebbbe23fcad1de859bdb45c4c80a2f40e0d235a1b6b787c77a1bfc649d4",
"size": 26537,
"asn": {
"ip": "149.96.248.4",
"asn": "16839",
"country": "US",
"registrar": "arin",
"date": "2010-12-16",
"description": "SNC, US",
"route": "149.96.240.0/20",
"name": "SNC"
},
"geoip": {
"range": [
2506096640,
2506162175
],
"country": "US",
"region": "",
"eu": "0",
"timezone": "America/Chicago",
"city": "",
"ll": [
37.751,
-97.822
],
"metro": 0,
"area": 1000,
"country_name": "United States"
},
"rdns": {

https://urlscan.io/api/v1/result/3a2c746e-192e-4901-9a5d-78b8b2ee32e3/ Page 9 of 119


03.10.2021, 14:47

"ip": "149.96.248.4",
"ptr": "vip-149-96-248-4.cust.service-now.com"
}
}
},
{
"request": {
"requestId": "24603.2",
"loaderId": "57C22717099627F4ACFB8060C2A3AA76",
"documentURL": "https://perkinscoiedev.service-now.com/auth_redirect.do?
sysparm_stack=no&sysparm_url=https%3A%2F%2Fmyapps.perkinscoie.com%2Fapp%2Fservicenow_ud%2Fexk
1jsx6trpNIFLGO0h8%2Fsso%2Fsaml%3FSAMLRequest%3DnVJdb9MwFP0rkd8TJ2aZgtVUCq0GlUoXrYUHXpAT365miW
18naz796Ru0coDE%252BL1%252Btxzz4dnKPqOWV4N%252FqAf4OcA6KNj32nk55eSDE5zI1Ah16IH5L7l2%252BrzmrM
k5dYZb1rTkahCBOeV0QujcejBbcGNqoUvD%252BuSHLy3yCm14J6UxtYokDAmeIbE2jwnrempFqMVj5BIQ6LlJERpcWJ8
3e9fhLWYXNGEvWlIL1wT1fdBUjg%252BZT%252FweOud3azu1h%252Fv00NBEQ09mSLRnXEtBMsl2YsOgUSrZUm2m0XeN
LdMvG%252F27wqWF1I2NyxrRJbnTZaLVBQTEGuBqEZ4XUUcYKXRC%252B1LwlKWxSmL03yXFpzd8DRPWM6%252Bkai%25
2BhPVBaan049vJNmcQ8k%252B7XR3X99tdIBiVBLeZ0P8V6ldwGAKdLpD5LDTMg3x3XfrbysTvpsn83yTM6PWhy1nLTy5
Wy9p0qn2Jqq4zzwsHwk%252FOvBsglNQL%252F3ctWZKFiZLxPkA59EJ1lZQOEAmdX%252B7%252B%252BbnnvwA%253D
%26RelayState%3Dhttps%253A%252F%252Fperkinscoiedev.service-now.com%252Fnavpage.do",
"request": {
"url": "https://perkinscoiedev.service-now.com/ConditionalFocus.jsdbx?v=12-09-
2020_1945&c=9_108",
"method": "GET",
"headers": {
"Referer": "https://perkinscoiedev.service-now.com/auth_redirect.do?
sysparm_stack=no&sysparm_url=https%3A%2F%2Fmyapps.perkinscoie.com%2Fapp%2Fservicenow_ud%2Fexk
1jsx6trpNIFLGO0h8%2Fsso%2Fsaml%3FSAMLRequest%3DnVJdb9MwFP0rkd8TJ2aZgtVUCq0GlUoXrYUHXpAT365miW
18naz796Ru0coDE%252BL1%252Btxzz4dnKPqOWV4N%252FqAf4OcA6KNj32nk55eSDE5zI1Ah16IH5L7l2%252BrzmrM
k5dYZb1rTkahCBOeV0QujcejBbcGNqoUvD%252BuSHLy3yCm14J6UxtYokDAmeIbE2jwnrempFqMVj5BIQ6LlJERpcWJ8
3e9fhLWYXNGEvWlIL1wT1fdBUjg%252BZT%252FweOud3azu1h%252Fv00NBEQ09mSLRnXEtBMsl2YsOgUSrZUm2m0XeN
LdMvG%252F27wqWF1I2NyxrRJbnTZaLVBQTEGuBqEZ4XUUcYKXRC%252B1LwlKWxSmL03yXFpzd8DRPWM6%252Bkai%25
2BhPVBaan049vJNmcQ8k%252B7XR3X99tdIBiVBLeZ0P8V6ldwGAKdLpD5LDTMg3x3XfrbysTvpsn83yTM6PWhy1nLTy5
Wy9p0qn2Jqq4zzwsHwk%252FOvBsglNQL%252F3ctWZKFiZLxPkA59EJ1lZQOEAmdX%252B7%252B%252BbnnvwA%253D
%26RelayState%3Dhttps%253A%252F%252Fperkinscoiedev.service-now.com%252Fnavpage.do",
"User-Agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5)
AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36"
},
"mixedContentType": "none",
"initialPriority": "High",
"referrerPolicy": "same-origin"
},
"timestamp": 23727521.345707,
"wallTime": 1612513446.204165,
"initiator": {
"type": "parser",
"url": "https://perkinscoiedev.service-now.com/auth_redirect.do?
sysparm_stack=no&sysparm_url=https%3A%2F%2Fmyapps.perkinscoie.com%2Fapp%2Fservicenow_ud%2Fexk
1jsx6trpNIFLGO0h8%2Fsso%2Fsaml%3FSAMLRequest%3DnVJdb9MwFP0rkd8TJ2aZgtVUCq0GlUoXrYUHXpAT365miW
18naz796Ru0coDE%252BL1%252Btxzz4dnKPqOWV4N%252FqAf4OcA6KNj32nk55eSDE5zI1Ah16IH5L7l2%252BrzmrM
k5dYZb1rTkahCBOeV0QujcejBbcGNqoUvD%252BuSHLy3yCm14J6UxtYokDAmeIbE2jwnrempFqMVj5BIQ6LlJERpcWJ8
3e9fhLWYXNGEvWlIL1wT1fdBUjg%252BZT%252FweOud3azu1h%252Fv00NBEQ09mSLRnXEtBMsl2YsOgUSrZUm2m0XeN
LdMvG%252F27wqWF1I2NyxrRJbnTZaLVBQTEGuBqEZ4XUUcYKXRC%252B1LwlKWxSmL03yXFpzd8DRPWM6%252Bkai%25
2BhPVBaan049vJNmcQ8k%252B7XR3X99tdIBiVBLeZ0P8V6ldwGAKdLpD5LDTMg3x3XfrbysTvpsn83yTM6PWhy1nLTy5
Wy9p0qn2Jqq4zzwsHwk%252FOvBsglNQL%252F3ctWZKFiZLxPkA59EJ1lZQOEAmdX%252B7%252B%252BbnnvwA%253D
%26RelayState%3Dhttps%253A%252F%252Fperkinscoiedev.service-now.com%252Fnavpage.do",
"lineNumber": 142,
"columnNumber": 141
},
"type": "Script",
"frameId": "A7C87A170B6FF1BFF9C1519BD77B8C40",
"hasUserGesture": false
},
"response": {
"encodedDataLength": 720,
"dataLength": 376,
"requestId": "24603.2",

https://urlscan.io/api/v1/result/3a2c746e-192e-4901-9a5d-78b8b2ee32e3/ Page 10 of 119


03.10.2021, 14:47

"type": "Script",
"response": {
"url": "https://perkinscoiedev.service-now.com/ConditionalFocus.jsdbx?v=12-09-
2020_1945&c=9_108",
"status": 200,
"statusText": "OK",
"headers": {
"Content-Security-Policy": "default-src 'self'; frame-ancestors 'self'; style-
src 'self' 'unsafe-inline'",
"Content-Encoding": "gzip",
"X-Content-Security-Policy": "sandbox",
"Last-Modified": "Tue, 17 Sep 2019 10:30:50 GMT",
"Server": "ServiceNow",
"Date": "Fri, 05 Feb 2021 08:24:06 GMT",
"Strict-Transport-Security": "max-age=63072000; includeSubDomains",
"Content-Type": "text/javascript;charset=UTF-8",
"Cache-Control": "public",
"x-edge-enc-proxy-static": "true",
"Content-Length": "211",
"Expires": "Wed, 09 Feb 2022 08:24:06 GMT"
},
"mimeType": "text/javascript",
"remoteIPAddress": "149.96.248.4",
"remotePort": 443,
"fromPrefetchCache": false,
"encodedDataLength": 509,
"timing": {
"requestTime": 23727521.346359,
"proxyStart": -1,
"proxyEnd": -1,
"dnsStart": 8.425,
"dnsEnd": 8.44,
"connectStart": 8.44,
"connectEnd": 528.714,
"sslStart": 25.322,
"sslEnd": 528.699,
"workerStart": -1,
"workerReady": -1,
"workerFetchStart": -1,
"workerRespondWithSettled": -1,
"sendStart": 528.874,
"sendEnd": 529.1,
"pushStart": 0,
"pushEnd": 0,
"receiveHeadersEnd": 709.295
},
"responseTime": 1612513446913.907,
"protocol": "http/1.1",
"securityState": "secure",
"securityDetails": {
"protocol": "TLS 1.2",
"keyExchange": "ECDHE_RSA",
"keyExchangeGroup": "P-256",
"cipher": "AES_128_GCM",
"certificateId": 0,
"subjectName": "*.service-now.com",
"sanList": [
"*.service-now.com",
"service-now.com"
],
"issuer": "Entrust Certification Authority - L1K",
"validFrom": 1595462153,
"validTo": 1617321353,
"signedCertificateTimestampList": [],
"certificateTransparencyCompliance": "unknown"
},

https://urlscan.io/api/v1/result/3a2c746e-192e-4901-9a5d-78b8b2ee32e3/ Page 11 of 119


03.10.2021, 14:47

"securityHeaders": [
{
"name": "Content-Security-Policy",
"value": "default-src 'self'; frame-ancestors 'self'; style-src 'self'
'unsafe-inline'"
},
{
"name": "Strict-Transport-Security",
"value": "max-age=63072000; includeSubDomains"
},
{
"name": "X-Content-Security-Policy",
"value": "sandbox"
}
]
},
"hash": "35a86319d80b941df7db498279450d00c7aaff7f890b8c0779a8536a2a51ebef",
"size": 376,
"asn": {
"ip": "149.96.248.4",
"asn": "16839",
"country": "US",
"registrar": "arin",
"date": "2010-12-16",
"description": "SNC, US",
"route": "149.96.240.0/20",
"name": "SNC"
},
"geoip": {
"range": [
2506096640,
2506162175
],
"country": "US",
"region": "",
"eu": "0",
"timezone": "America/Chicago",
"city": "",
"ll": [
37.751,
-97.822
],
"metro": 0,
"area": 1000,
"country_name": "United States"
},
"rdns": {
"ip": "149.96.248.4",
"ptr": "vip-149-96-248-4.cust.service-now.com"
}
},
"initiatorInfo": {
"url": "https://perkinscoiedev.service-now.com/auth_redirect.do?
sysparm_stack=no&sysparm_url=https%3A%2F%2Fmyapps.perkinscoie.com%2Fapp%2Fservicenow_ud%2Fexk
1jsx6trpNIFLGO0h8%2Fsso%2Fsaml%3FSAMLRequest%3DnVJdb9MwFP0rkd8TJ2aZgtVUCq0GlUoXrYUHXpAT365miW
18naz796Ru0coDE%252BL1%252Btxzz4dnKPqOWV4N%252FqAf4OcA6KNj32nk55eSDE5zI1Ah16IH5L7l2%252BrzmrM
k5dYZb1rTkahCBOeV0QujcejBbcGNqoUvD%252BuSHLy3yCm14J6UxtYokDAmeIbE2jwnrempFqMVj5BIQ6LlJERpcWJ8
3e9fhLWYXNGEvWlIL1wT1fdBUjg%252BZT%252FweOud3azu1h%252Fv00NBEQ09mSLRnXEtBMsl2YsOgUSrZUm2m0XeN
LdMvG%252F27wqWF1I2NyxrRJbnTZaLVBQTEGuBqEZ4XUUcYKXRC%252B1LwlKWxSmL03yXFpzd8DRPWM6%252Bkai%25
2BhPVBaan049vJNmcQ8k%252B7XR3X99tdIBiVBLeZ0P8V6ldwGAKdLpD5LDTMg3x3XfrbysTvpsn83yTM6PWhy1nLTy5
Wy9p0qn2Jqq4zzwsHwk%252FOvBsglNQL%252F3ctWZKFiZLxPkA59EJ1lZQOEAmdX%252B7%252B%252BbnnvwA%253D
%26RelayState%3Dhttps%253A%252F%252Fperkinscoiedev.service-now.com%252Fnavpage.do",
"host": "perkinscoiedev.service-now.com",
"type": "parser"
}
},

https://urlscan.io/api/v1/result/3a2c746e-192e-4901-9a5d-78b8b2ee32e3/ Page 12 of 119


03.10.2021, 14:47

{
"request": {
"requestId": "24603.3",
"loaderId": "57C22717099627F4ACFB8060C2A3AA76",
"documentURL": "https://perkinscoiedev.service-now.com/auth_redirect.do?
sysparm_stack=no&sysparm_url=https%3A%2F%2Fmyapps.perkinscoie.com%2Fapp%2Fservicenow_ud%2Fexk
1jsx6trpNIFLGO0h8%2Fsso%2Fsaml%3FSAMLRequest%3DnVJdb9MwFP0rkd8TJ2aZgtVUCq0GlUoXrYUHXpAT365miW
18naz796Ru0coDE%252BL1%252Btxzz4dnKPqOWV4N%252FqAf4OcA6KNj32nk55eSDE5zI1Ah16IH5L7l2%252BrzmrM
k5dYZb1rTkahCBOeV0QujcejBbcGNqoUvD%252BuSHLy3yCm14J6UxtYokDAmeIbE2jwnrempFqMVj5BIQ6LlJERpcWJ8
3e9fhLWYXNGEvWlIL1wT1fdBUjg%252BZT%252FweOud3azu1h%252Fv00NBEQ09mSLRnXEtBMsl2YsOgUSrZUm2m0XeN
LdMvG%252F27wqWF1I2NyxrRJbnTZaLVBQTEGuBqEZ4XUUcYKXRC%252B1LwlKWxSmL03yXFpzd8DRPWM6%252Bkai%25
2BhPVBaan049vJNmcQ8k%252B7XR3X99tdIBiVBLeZ0P8V6ldwGAKdLpD5LDTMg3x3XfrbysTvpsn83yTM6PWhy1nLTy5
Wy9p0qn2Jqq4zzwsHwk%252FOvBsglNQL%252F3ctWZKFiZLxPkA59EJ1lZQOEAmdX%252B7%252B%252BbnnvwA%253D
%26RelayState%3Dhttps%253A%252F%252Fperkinscoiedev.service-now.com%252Fnavpage.do",
"request": {
"url": "https://perkinscoiedev.service-now.com/styles/css_includes_doctype.cssx?
v=12-09-2020_1945&c=2020-06-08_10:09:13_8ebad68fdb4aa0106a80464e13961950&theme=system",
"method": "GET",
"headers": {
"Referer": "https://perkinscoiedev.service-now.com/auth_redirect.do?
sysparm_stack=no&sysparm_url=https%3A%2F%2Fmyapps.perkinscoie.com%2Fapp%2Fservicenow_ud%2Fexk
1jsx6trpNIFLGO0h8%2Fsso%2Fsaml%3FSAMLRequest%3DnVJdb9MwFP0rkd8TJ2aZgtVUCq0GlUoXrYUHXpAT365miW
18naz796Ru0coDE%252BL1%252Btxzz4dnKPqOWV4N%252FqAf4OcA6KNj32nk55eSDE5zI1Ah16IH5L7l2%252BrzmrM
k5dYZb1rTkahCBOeV0QujcejBbcGNqoUvD%252BuSHLy3yCm14J6UxtYokDAmeIbE2jwnrempFqMVj5BIQ6LlJERpcWJ8
3e9fhLWYXNGEvWlIL1wT1fdBUjg%252BZT%252FweOud3azu1h%252Fv00NBEQ09mSLRnXEtBMsl2YsOgUSrZUm2m0XeN
LdMvG%252F27wqWF1I2NyxrRJbnTZaLVBQTEGuBqEZ4XUUcYKXRC%252B1LwlKWxSmL03yXFpzd8DRPWM6%252Bkai%25
2BhPVBaan049vJNmcQ8k%252B7XR3X99tdIBiVBLeZ0P8V6ldwGAKdLpD5LDTMg3x3XfrbysTvpsn83yTM6PWhy1nLTy5
Wy9p0qn2Jqq4zzwsHwk%252FOvBsglNQL%252F3ctWZKFiZLxPkA59EJ1lZQOEAmdX%252B7%252B%252BbnnvwA%253D
%26RelayState%3Dhttps%253A%252F%252Fperkinscoiedev.service-now.com%252Fnavpage.do",
"User-Agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5)
AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36"
},
"mixedContentType": "none",
"initialPriority": "VeryHigh",
"referrerPolicy": "same-origin"
},
"timestamp": 23727521.346232,
"wallTime": 1612513446.20469,
"initiator": {
"type": "parser",
"url": "https://perkinscoiedev.service-now.com/auth_redirect.do?
sysparm_stack=no&sysparm_url=https%3A%2F%2Fmyapps.perkinscoie.com%2Fapp%2Fservicenow_ud%2Fexk
1jsx6trpNIFLGO0h8%2Fsso%2Fsaml%3FSAMLRequest%3DnVJdb9MwFP0rkd8TJ2aZgtVUCq0GlUoXrYUHXpAT365miW
18naz796Ru0coDE%252BL1%252Btxzz4dnKPqOWV4N%252FqAf4OcA6KNj32nk55eSDE5zI1Ah16IH5L7l2%252BrzmrM
k5dYZb1rTkahCBOeV0QujcejBbcGNqoUvD%252BuSHLy3yCm14J6UxtYokDAmeIbE2jwnrempFqMVj5BIQ6LlJERpcWJ8
3e9fhLWYXNGEvWlIL1wT1fdBUjg%252BZT%252FweOud3azu1h%252Fv00NBEQ09mSLRnXEtBMsl2YsOgUSrZUm2m0XeN
LdMvG%252F27wqWF1I2NyxrRJbnTZaLVBQTEGuBqEZ4XUUcYKXRC%252B1LwlKWxSmL03yXFpzd8DRPWM6%252Bkai%25
2BhPVBaan049vJNmcQ8k%252B7XR3X99tdIBiVBLeZ0P8V6ldwGAKdLpD5LDTMg3x3XfrbysTvpsn83yTM6PWhy1nLTy5
Wy9p0qn2Jqq4zzwsHwk%252FOvBsglNQL%252F3ctWZKFiZLxPkA59EJ1lZQOEAmdX%252B7%252B%252BbnnvwA%253D
%26RelayState%3Dhttps%253A%252F%252Fperkinscoiedev.service-now.com%252Fnavpage.do",
"lineNumber": 148,
"columnNumber": 224
},
"type": "Stylesheet",
"frameId": "A7C87A170B6FF1BFF9C1519BD77B8C40",
"hasUserGesture": false
},
"response": {
"encodedDataLength": 45111,
"dataLength": 239200,
"requestId": "24603.3",
"type": "Stylesheet",
"response": {
"url": "https://perkinscoiedev.service-now.com/styles/css_includes_doctype.cssx?
v=12-09-2020_1945&c=2020-06-08_10:09:13_8ebad68fdb4aa0106a80464e13961950&theme=system",
"status": 200,

https://urlscan.io/api/v1/result/3a2c746e-192e-4901-9a5d-78b8b2ee32e3/ Page 13 of 119


03.10.2021, 14:47

"statusText": "OK",
"headers": {
"Date": "Fri, 05 Feb 2021 08:24:05 GMT",
"Content-Encoding": "gzip",
"Last-Modified": "Thu, 10 Dec 2020 03:49:20 GMT",
"Server": "ServiceNow",
"Transfer-Encoding": "chunked",
"Content-Type": "text/css;charset=UTF-8",
"Cache-Control": "public",
"x-edge-enc-proxy-static": "true",
"Strict-Transport-Security": "max-age=63072000; includeSubDomains",
"Expires": "Wed, 09 Feb 2022 08:24:06 GMT"
},
"mimeType": "text/css",
"remoteIPAddress": "149.96.248.4",
"remotePort": 443,
"fromPrefetchCache": false,
"encodedDataLength": 370,
"timing": {
"requestTime": 23727521.346914,
"proxyStart": -1,
"proxyEnd": -1,
"dnsStart": -1,
"dnsEnd": -1,
"connectStart": -1,
"connectEnd": -1,
"sslStart": -1,
"sslEnd": -1,
"workerStart": -1,
"workerReady": -1,
"workerFetchStart": -1,
"workerRespondWithSettled": -1,
"sendStart": 167.651,
"sendEnd": 167.73,
"pushStart": 0,
"pushEnd": 0,
"receiveHeadersEnd": 355.124
},
"responseTime": 1612513446560.297,
"protocol": "http/1.1",
"securityState": "secure",
"securityDetails": {
"protocol": "TLS 1.2",
"keyExchange": "ECDHE_RSA",
"keyExchangeGroup": "P-256",
"cipher": "AES_128_GCM",
"certificateId": 0,
"subjectName": "*.service-now.com",
"sanList": [
"*.service-now.com",
"service-now.com"
],
"issuer": "Entrust Certification Authority - L1K",
"validFrom": 1595462153,
"validTo": 1617321353,
"signedCertificateTimestampList": [],
"certificateTransparencyCompliance": "unknown"
},
"securityHeaders": [
{
"name": "Strict-Transport-Security",
"value": "max-age=63072000; includeSubDomains"
}
]
},
"hash": "ede95d2a25d48b7f00ba0b0c914de1c235b6e7bad938d206e829e68ef7633bdd",

https://urlscan.io/api/v1/result/3a2c746e-192e-4901-9a5d-78b8b2ee32e3/ Page 14 of 119


03.10.2021, 14:47

"size": 239200,
"asn": {
"ip": "149.96.248.4",
"asn": "16839",
"country": "US",
"registrar": "arin",
"date": "2010-12-16",
"description": "SNC, US",
"route": "149.96.240.0/20",
"name": "SNC"
},
"geoip": {
"range": [
2506096640,
2506162175
],
"country": "US",
"region": "",
"eu": "0",
"timezone": "America/Chicago",
"city": "",
"ll": [
37.751,
-97.822
],
"metro": 0,
"area": 1000,
"country_name": "United States"
},
"rdns": {
"ip": "149.96.248.4",
"ptr": "vip-149-96-248-4.cust.service-now.com"
}
},
"initiatorInfo": {
"url": "https://perkinscoiedev.service-now.com/auth_redirect.do?
sysparm_stack=no&sysparm_url=https%3A%2F%2Fmyapps.perkinscoie.com%2Fapp%2Fservicenow_ud%2Fexk
1jsx6trpNIFLGO0h8%2Fsso%2Fsaml%3FSAMLRequest%3DnVJdb9MwFP0rkd8TJ2aZgtVUCq0GlUoXrYUHXpAT365miW
18naz796Ru0coDE%252BL1%252Btxzz4dnKPqOWV4N%252FqAf4OcA6KNj32nk55eSDE5zI1Ah16IH5L7l2%252BrzmrM
k5dYZb1rTkahCBOeV0QujcejBbcGNqoUvD%252BuSHLy3yCm14J6UxtYokDAmeIbE2jwnrempFqMVj5BIQ6LlJERpcWJ8
3e9fhLWYXNGEvWlIL1wT1fdBUjg%252BZT%252FweOud3azu1h%252Fv00NBEQ09mSLRnXEtBMsl2YsOgUSrZUm2m0XeN
LdMvG%252F27wqWF1I2NyxrRJbnTZaLVBQTEGuBqEZ4XUUcYKXRC%252B1LwlKWxSmL03yXFpzd8DRPWM6%252Bkai%25
2BhPVBaan049vJNmcQ8k%252B7XR3X99tdIBiVBLeZ0P8V6ldwGAKdLpD5LDTMg3x3XfrbysTvpsn83yTM6PWhy1nLTy5
Wy9p0qn2Jqq4zzwsHwk%252FOvBsglNQL%252F3ctWZKFiZLxPkA59EJ1lZQOEAmdX%252B7%252B%252BbnnvwA%253D
%26RelayState%3Dhttps%253A%252F%252Fperkinscoiedev.service-now.com%252Fnavpage.do",
"host": "perkinscoiedev.service-now.com",
"type": "parser"
}
},
{
"request": {
"requestId": "24603.4",
"loaderId": "57C22717099627F4ACFB8060C2A3AA76",
"documentURL": "https://perkinscoiedev.service-now.com/auth_redirect.do?
sysparm_stack=no&sysparm_url=https%3A%2F%2Fmyapps.perkinscoie.com%2Fapp%2Fservicenow_ud%2Fexk
1jsx6trpNIFLGO0h8%2Fsso%2Fsaml%3FSAMLRequest%3DnVJdb9MwFP0rkd8TJ2aZgtVUCq0GlUoXrYUHXpAT365miW
18naz796Ru0coDE%252BL1%252Btxzz4dnKPqOWV4N%252FqAf4OcA6KNj32nk55eSDE5zI1Ah16IH5L7l2%252BrzmrM
k5dYZb1rTkahCBOeV0QujcejBbcGNqoUvD%252BuSHLy3yCm14J6UxtYokDAmeIbE2jwnrempFqMVj5BIQ6LlJERpcWJ8
3e9fhLWYXNGEvWlIL1wT1fdBUjg%252BZT%252FweOud3azu1h%252Fv00NBEQ09mSLRnXEtBMsl2YsOgUSrZUm2m0XeN
LdMvG%252F27wqWF1I2NyxrRJbnTZaLVBQTEGuBqEZ4XUUcYKXRC%252B1LwlKWxSmL03yXFpzd8DRPWM6%252Bkai%25
2BhPVBaan049vJNmcQ8k%252B7XR3X99tdIBiVBLeZ0P8V6ldwGAKdLpD5LDTMg3x3XfrbysTvpsn83yTM6PWhy1nLTy5
Wy9p0qn2Jqq4zzwsHwk%252FOvBsglNQL%252F3ctWZKFiZLxPkA59EJ1lZQOEAmdX%252B7%252B%252BbnnvwA%253D
%26RelayState%3Dhttps%253A%252F%252Fperkinscoiedev.service-now.com%252Fnavpage.do",
"request": {
"url": "https://perkinscoiedev.service-
now.com/styles/heisenberg/source_sans_pro.cssx?v=12-09-2020_1945&c=2020-06-

https://urlscan.io/api/v1/result/3a2c746e-192e-4901-9a5d-78b8b2ee32e3/ Page 15 of 119


03.10.2021, 14:47

08_10:09:13_8ebad68fdb4aa0106a80464e13961950&theme=system",
"method": "GET",
"headers": {
"Referer": "https://perkinscoiedev.service-now.com/auth_redirect.do?
sysparm_stack=no&sysparm_url=https%3A%2F%2Fmyapps.perkinscoie.com%2Fapp%2Fservicenow_ud%2Fexk
1jsx6trpNIFLGO0h8%2Fsso%2Fsaml%3FSAMLRequest%3DnVJdb9MwFP0rkd8TJ2aZgtVUCq0GlUoXrYUHXpAT365miW
18naz796Ru0coDE%252BL1%252Btxzz4dnKPqOWV4N%252FqAf4OcA6KNj32nk55eSDE5zI1Ah16IH5L7l2%252BrzmrM
k5dYZb1rTkahCBOeV0QujcejBbcGNqoUvD%252BuSHLy3yCm14J6UxtYokDAmeIbE2jwnrempFqMVj5BIQ6LlJERpcWJ8
3e9fhLWYXNGEvWlIL1wT1fdBUjg%252BZT%252FweOud3azu1h%252Fv00NBEQ09mSLRnXEtBMsl2YsOgUSrZUm2m0XeN
LdMvG%252F27wqWF1I2NyxrRJbnTZaLVBQTEGuBqEZ4XUUcYKXRC%252B1LwlKWxSmL03yXFpzd8DRPWM6%252Bkai%25
2BhPVBaan049vJNmcQ8k%252B7XR3X99tdIBiVBLeZ0P8V6ldwGAKdLpD5LDTMg3x3XfrbysTvpsn83yTM6PWhy1nLTy5
Wy9p0qn2Jqq4zzwsHwk%252FOvBsglNQL%252F3ctWZKFiZLxPkA59EJ1lZQOEAmdX%252B7%252B%252BbnnvwA%253D
%26RelayState%3Dhttps%253A%252F%252Fperkinscoiedev.service-now.com%252Fnavpage.do",
"User-Agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5)
AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36"
},
"mixedContentType": "none",
"initialPriority": "VeryHigh",
"referrerPolicy": "same-origin"
},
"timestamp": 23727521.346678,
"wallTime": 1612513446.205137,
"initiator": {
"type": "parser",
"url": "https://perkinscoiedev.service-now.com/auth_redirect.do?
sysparm_stack=no&sysparm_url=https%3A%2F%2Fmyapps.perkinscoie.com%2Fapp%2Fservicenow_ud%2Fexk
1jsx6trpNIFLGO0h8%2Fsso%2Fsaml%3FSAMLRequest%3DnVJdb9MwFP0rkd8TJ2aZgtVUCq0GlUoXrYUHXpAT365miW
18naz796Ru0coDE%252BL1%252Btxzz4dnKPqOWV4N%252FqAf4OcA6KNj32nk55eSDE5zI1Ah16IH5L7l2%252BrzmrM
k5dYZb1rTkahCBOeV0QujcejBbcGNqoUvD%252BuSHLy3yCm14J6UxtYokDAmeIbE2jwnrempFqMVj5BIQ6LlJERpcWJ8
3e9fhLWYXNGEvWlIL1wT1fdBUjg%252BZT%252FweOud3azu1h%252Fv00NBEQ09mSLRnXEtBMsl2YsOgUSrZUm2m0XeN
LdMvG%252F27wqWF1I2NyxrRJbnTZaLVBQTEGuBqEZ4XUUcYKXRC%252B1LwlKWxSmL03yXFpzd8DRPWM6%252Bkai%25
2BhPVBaan049vJNmcQ8k%252B7XR3X99tdIBiVBLeZ0P8V6ldwGAKdLpD5LDTMg3x3XfrbysTvpsn83yTM6PWhy1nLTy5
Wy9p0qn2Jqq4zzwsHwk%252FOvBsglNQL%252F3ctWZKFiZLxPkA59EJ1lZQOEAmdX%252B7%252B%252BbnnvwA%253D
%26RelayState%3Dhttps%253A%252F%252Fperkinscoiedev.service-now.com%252Fnavpage.do",
"lineNumber": 148,
"columnNumber": 411
},
"type": "Stylesheet",
"frameId": "A7C87A170B6FF1BFF9C1519BD77B8C40",
"hasUserGesture": false
},
"response": {
"encodedDataLength": 607,
"dataLength": 1541,
"requestId": "24603.4",
"type": "Stylesheet",
"response": {
"url": "https://perkinscoiedev.service-
now.com/styles/heisenberg/source_sans_pro.cssx?v=12-09-2020_1945&c=2020-06-
08_10:09:13_8ebad68fdb4aa0106a80464e13961950&theme=system",
"status": 200,
"statusText": "OK",
"headers": {
"Date": "Fri, 05 Feb 2021 08:24:06 GMT",
"Content-Encoding": "gzip",
"Last-Modified": "Thu, 10 Dec 2020 03:49:20 GMT",
"Server": "ServiceNow",
"Strict-Transport-Security": "max-age=63072000; includeSubDomains",
"Content-Type": "text/css;charset=UTF-8",
"Cache-Control": "public",
"x-edge-enc-proxy-static": "true",
"Content-Length": "244",
"Expires": "Wed, 09 Feb 2022 08:24:06 GMT"
},
"mimeType": "text/css",
"remoteIPAddress": "149.96.248.4",

https://urlscan.io/api/v1/result/3a2c746e-192e-4901-9a5d-78b8b2ee32e3/ Page 16 of 119


03.10.2021, 14:47

"remotePort": 443,
"fromPrefetchCache": false,
"encodedDataLength": 363,
"timing": {
"requestTime": 23727521.347599,
"proxyStart": -1,
"proxyEnd": -1,
"dnsStart": 5.801,
"dnsEnd": 5.811,
"connectStart": 5.811,
"connectEnd": 452.776,
"sslStart": 22.955,
"sslEnd": 452.769,
"workerStart": -1,
"workerReady": -1,
"workerFetchStart": -1,
"workerRespondWithSettled": -1,
"sendStart": 452.834,
"sendEnd": 452.9,
"pushStart": 0,
"pushEnd": 0,
"receiveHeadersEnd": 609.796
},
"responseTime": 1612513446815.678,
"protocol": "http/1.1",
"securityState": "secure",
"securityDetails": {
"protocol": "TLS 1.2",
"keyExchange": "ECDHE_RSA",
"keyExchangeGroup": "P-256",
"cipher": "AES_128_GCM",
"certificateId": 0,
"subjectName": "*.service-now.com",
"sanList": [
"*.service-now.com",
"service-now.com"
],
"issuer": "Entrust Certification Authority - L1K",
"validFrom": 1595462153,
"validTo": 1617321353,
"signedCertificateTimestampList": [],
"certificateTransparencyCompliance": "unknown"
},
"securityHeaders": [
{
"name": "Strict-Transport-Security",
"value": "max-age=63072000; includeSubDomains"
}
]
},
"hash": "e74b813f0c8790db2120c41289144f7cd781b1a0fae2361c931d605c928cdf61",
"size": 1541,
"asn": {
"ip": "149.96.248.4",
"asn": "16839",
"country": "US",
"registrar": "arin",
"date": "2010-12-16",
"description": "SNC, US",
"route": "149.96.240.0/20",
"name": "SNC"
},
"geoip": {
"range": [
2506096640,
2506162175

https://urlscan.io/api/v1/result/3a2c746e-192e-4901-9a5d-78b8b2ee32e3/ Page 17 of 119


03.10.2021, 14:47

],
"country": "US",
"region": "",
"eu": "0",
"timezone": "America/Chicago",
"city": "",
"ll": [
37.751,
-97.822
],
"metro": 0,
"area": 1000,
"country_name": "United States"
},
"rdns": {
"ip": "149.96.248.4",
"ptr": "vip-149-96-248-4.cust.service-now.com"
}
},
"initiatorInfo": {
"url": "https://perkinscoiedev.service-now.com/auth_redirect.do?
sysparm_stack=no&sysparm_url=https%3A%2F%2Fmyapps.perkinscoie.com%2Fapp%2Fservicenow_ud%2Fexk
1jsx6trpNIFLGO0h8%2Fsso%2Fsaml%3FSAMLRequest%3DnVJdb9MwFP0rkd8TJ2aZgtVUCq0GlUoXrYUHXpAT365miW
18naz796Ru0coDE%252BL1%252Btxzz4dnKPqOWV4N%252FqAf4OcA6KNj32nk55eSDE5zI1Ah16IH5L7l2%252BrzmrM
k5dYZb1rTkahCBOeV0QujcejBbcGNqoUvD%252BuSHLy3yCm14J6UxtYokDAmeIbE2jwnrempFqMVj5BIQ6LlJERpcWJ8
3e9fhLWYXNGEvWlIL1wT1fdBUjg%252BZT%252FweOud3azu1h%252Fv00NBEQ09mSLRnXEtBMsl2YsOgUSrZUm2m0XeN
LdMvG%252F27wqWF1I2NyxrRJbnTZaLVBQTEGuBqEZ4XUUcYKXRC%252B1LwlKWxSmL03yXFpzd8DRPWM6%252Bkai%25
2BhPVBaan049vJNmcQ8k%252B7XR3X99tdIBiVBLeZ0P8V6ldwGAKdLpD5LDTMg3x3XfrbysTvpsn83yTM6PWhy1nLTy5
Wy9p0qn2Jqq4zzwsHwk%252FOvBsglNQL%252F3ctWZKFiZLxPkA59EJ1lZQOEAmdX%252B7%252B%252BbnnvwA%253D
%26RelayState%3Dhttps%253A%252F%252Fperkinscoiedev.service-now.com%252Fnavpage.do",
"host": "perkinscoiedev.service-now.com",
"type": "parser"
}
},
{
"request": {
"requestId": "24603.5",
"loaderId": "57C22717099627F4ACFB8060C2A3AA76",
"documentURL": "https://perkinscoiedev.service-now.com/auth_redirect.do?
sysparm_stack=no&sysparm_url=https%3A%2F%2Fmyapps.perkinscoie.com%2Fapp%2Fservicenow_ud%2Fexk
1jsx6trpNIFLGO0h8%2Fsso%2Fsaml%3FSAMLRequest%3DnVJdb9MwFP0rkd8TJ2aZgtVUCq0GlUoXrYUHXpAT365miW
18naz796Ru0coDE%252BL1%252Btxzz4dnKPqOWV4N%252FqAf4OcA6KNj32nk55eSDE5zI1Ah16IH5L7l2%252BrzmrM
k5dYZb1rTkahCBOeV0QujcejBbcGNqoUvD%252BuSHLy3yCm14J6UxtYokDAmeIbE2jwnrempFqMVj5BIQ6LlJERpcWJ8
3e9fhLWYXNGEvWlIL1wT1fdBUjg%252BZT%252FweOud3azu1h%252Fv00NBEQ09mSLRnXEtBMsl2YsOgUSrZUm2m0XeN
LdMvG%252F27wqWF1I2NyxrRJbnTZaLVBQTEGuBqEZ4XUUcYKXRC%252B1LwlKWxSmL03yXFpzd8DRPWM6%252Bkai%25
2BhPVBaan049vJNmcQ8k%252B7XR3X99tdIBiVBLeZ0P8V6ldwGAKdLpD5LDTMg3x3XfrbysTvpsn83yTM6PWhy1nLTy5
Wy9p0qn2Jqq4zzwsHwk%252FOvBsglNQL%252F3ctWZKFiZLxPkA59EJ1lZQOEAmdX%252B7%252B%252BbnnvwA%253D
%26RelayState%3Dhttps%253A%252F%252Fperkinscoiedev.service-now.com%252Fnavpage.do",
"request": {
"url": "https://perkinscoiedev.service-
now.com/styles/heisenberg/heisenberg_all.cssx?v=12-09-2020_1945&c=2020-06-
08_10:09:13_8ebad68fdb4aa0106a80464e13961950&theme=system",
"method": "GET",
"headers": {
"Referer": "https://perkinscoiedev.service-now.com/auth_redirect.do?
sysparm_stack=no&sysparm_url=https%3A%2F%2Fmyapps.perkinscoie.com%2Fapp%2Fservicenow_ud%2Fexk
1jsx6trpNIFLGO0h8%2Fsso%2Fsaml%3FSAMLRequest%3DnVJdb9MwFP0rkd8TJ2aZgtVUCq0GlUoXrYUHXpAT365miW
18naz796Ru0coDE%252BL1%252Btxzz4dnKPqOWV4N%252FqAf4OcA6KNj32nk55eSDE5zI1Ah16IH5L7l2%252BrzmrM
k5dYZb1rTkahCBOeV0QujcejBbcGNqoUvD%252BuSHLy3yCm14J6UxtYokDAmeIbE2jwnrempFqMVj5BIQ6LlJERpcWJ8
3e9fhLWYXNGEvWlIL1wT1fdBUjg%252BZT%252FweOud3azu1h%252Fv00NBEQ09mSLRnXEtBMsl2YsOgUSrZUm2m0XeN
LdMvG%252F27wqWF1I2NyxrRJbnTZaLVBQTEGuBqEZ4XUUcYKXRC%252B1LwlKWxSmL03yXFpzd8DRPWM6%252Bkai%25
2BhPVBaan049vJNmcQ8k%252B7XR3X99tdIBiVBLeZ0P8V6ldwGAKdLpD5LDTMg3x3XfrbysTvpsn83yTM6PWhy1nLTy5
Wy9p0qn2Jqq4zzwsHwk%252FOvBsglNQL%252F3ctWZKFiZLxPkA59EJ1lZQOEAmdX%252B7%252B%252BbnnvwA%253D
%26RelayState%3Dhttps%253A%252F%252Fperkinscoiedev.service-now.com%252Fnavpage.do",
"User-Agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5)
AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36"

https://urlscan.io/api/v1/result/3a2c746e-192e-4901-9a5d-78b8b2ee32e3/ Page 18 of 119


03.10.2021, 14:47

},
"mixedContentType": "none",
"initialPriority": "VeryHigh",
"referrerPolicy": "same-origin"
},
"timestamp": 23727521.347108,
"wallTime": 1612513446.205566,
"initiator": {
"type": "parser",
"url": "https://perkinscoiedev.service-now.com/auth_redirect.do?
sysparm_stack=no&sysparm_url=https%3A%2F%2Fmyapps.perkinscoie.com%2Fapp%2Fservicenow_ud%2Fexk
1jsx6trpNIFLGO0h8%2Fsso%2Fsaml%3FSAMLRequest%3DnVJdb9MwFP0rkd8TJ2aZgtVUCq0GlUoXrYUHXpAT365miW
18naz796Ru0coDE%252BL1%252Btxzz4dnKPqOWV4N%252FqAf4OcA6KNj32nk55eSDE5zI1Ah16IH5L7l2%252BrzmrM
k5dYZb1rTkahCBOeV0QujcejBbcGNqoUvD%252BuSHLy3yCm14J6UxtYokDAmeIbE2jwnrempFqMVj5BIQ6LlJERpcWJ8
3e9fhLWYXNGEvWlIL1wT1fdBUjg%252BZT%252FweOud3azu1h%252Fv00NBEQ09mSLRnXEtBMsl2YsOgUSrZUm2m0XeN
LdMvG%252F27wqWF1I2NyxrRJbnTZaLVBQTEGuBqEZ4XUUcYKXRC%252B1LwlKWxSmL03yXFpzd8DRPWM6%252Bkai%25
2BhPVBaan049vJNmcQ8k%252B7XR3X99tdIBiVBLeZ0P8V6ldwGAKdLpD5LDTMg3x3XfrbysTvpsn83yTM6PWhy1nLTy5
Wy9p0qn2Jqq4zzwsHwk%252FOvBsglNQL%252F3ctWZKFiZLxPkA59EJ1lZQOEAmdX%252B7%252B%252BbnnvwA%253D
%26RelayState%3Dhttps%253A%252F%252Fperkinscoiedev.service-now.com%252Fnavpage.do",
"lineNumber": 148,
"columnNumber": 597
},
"type": "Stylesheet",
"frameId": "A7C87A170B6FF1BFF9C1519BD77B8C40",
"hasUserGesture": false
},
"response": {
"encodedDataLength": 38268,
"dataLength": 295832,
"requestId": "24603.5",
"type": "Stylesheet",
"response": {
"url": "https://perkinscoiedev.service-
now.com/styles/heisenberg/heisenberg_all.cssx?v=12-09-2020_1945&c=2020-06-
08_10:09:13_8ebad68fdb4aa0106a80464e13961950&theme=system",
"status": 200,
"statusText": "OK",
"headers": {
"Date": "Fri, 05 Feb 2021 08:24:06 GMT",
"Content-Encoding": "gzip",
"Last-Modified": "Thu, 10 Dec 2020 03:49:20 GMT",
"Server": "ServiceNow",
"Transfer-Encoding": "chunked",
"Content-Type": "text/css;charset=UTF-8",
"Cache-Control": "public",
"x-edge-enc-proxy-static": "true",
"Strict-Transport-Security": "max-age=63072000; includeSubDomains",
"Expires": "Wed, 09 Feb 2022 08:24:06 GMT"
},
"mimeType": "text/css",
"remoteIPAddress": "149.96.248.4",
"remotePort": 443,
"fromPrefetchCache": false,
"encodedDataLength": 370,
"timing": {
"requestTime": 23727521.348305,
"proxyStart": -1,
"proxyEnd": -1,
"dnsStart": 6.248,
"dnsEnd": 6.262,
"connectStart": 6.262,
"connectEnd": 477.235,
"sslStart": 23.265,
"sslEnd": 477.227,
"workerStart": -1,
"workerReady": -1,

https://urlscan.io/api/v1/result/3a2c746e-192e-4901-9a5d-78b8b2ee32e3/ Page 19 of 119


03.10.2021, 14:47

"workerFetchStart": -1,
"workerRespondWithSettled": -1,
"sendStart": 477.395,
"sendEnd": 477.496,
"pushStart": 0,
"pushEnd": 0,
"receiveHeadersEnd": 662.721
},
"responseTime": 1612513446869.28,
"protocol": "http/1.1",
"securityState": "secure",
"securityDetails": {
"protocol": "TLS 1.2",
"keyExchange": "ECDHE_RSA",
"keyExchangeGroup": "P-256",
"cipher": "AES_128_GCM",
"certificateId": 0,
"subjectName": "*.service-now.com",
"sanList": [
"*.service-now.com",
"service-now.com"
],
"issuer": "Entrust Certification Authority - L1K",
"validFrom": 1595462153,
"validTo": 1617321353,
"signedCertificateTimestampList": [],
"certificateTransparencyCompliance": "unknown"
},
"securityHeaders": [
{
"name": "Strict-Transport-Security",
"value": "max-age=63072000; includeSubDomains"
}
]
},
"hash": "1de37f7f59ec0714a26cb9307aba10d73fb0d30952f9f5e9b7b49b0aa5177ff6",
"size": 295811,
"asn": {
"ip": "149.96.248.4",
"asn": "16839",
"country": "US",
"registrar": "arin",
"date": "2010-12-16",
"description": "SNC, US",
"route": "149.96.240.0/20",
"name": "SNC"
},
"geoip": {
"range": [
2506096640,
2506162175
],
"country": "US",
"region": "",
"eu": "0",
"timezone": "America/Chicago",
"city": "",
"ll": [
37.751,
-97.822
],
"metro": 0,
"area": 1000,
"country_name": "United States"
},
"rdns": {

https://urlscan.io/api/v1/result/3a2c746e-192e-4901-9a5d-78b8b2ee32e3/ Page 20 of 119


03.10.2021, 14:47

"ip": "149.96.248.4",
"ptr": "vip-149-96-248-4.cust.service-now.com"
}
},
"initiatorInfo": {
"url": "https://perkinscoiedev.service-now.com/auth_redirect.do?
sysparm_stack=no&sysparm_url=https%3A%2F%2Fmyapps.perkinscoie.com%2Fapp%2Fservicenow_ud%2Fexk
1jsx6trpNIFLGO0h8%2Fsso%2Fsaml%3FSAMLRequest%3DnVJdb9MwFP0rkd8TJ2aZgtVUCq0GlUoXrYUHXpAT365miW
18naz796Ru0coDE%252BL1%252Btxzz4dnKPqOWV4N%252FqAf4OcA6KNj32nk55eSDE5zI1Ah16IH5L7l2%252BrzmrM
k5dYZb1rTkahCBOeV0QujcejBbcGNqoUvD%252BuSHLy3yCm14J6UxtYokDAmeIbE2jwnrempFqMVj5BIQ6LlJERpcWJ8
3e9fhLWYXNGEvWlIL1wT1fdBUjg%252BZT%252FweOud3azu1h%252Fv00NBEQ09mSLRnXEtBMsl2YsOgUSrZUm2m0XeN
LdMvG%252F27wqWF1I2NyxrRJbnTZaLVBQTEGuBqEZ4XUUcYKXRC%252B1LwlKWxSmL03yXFpzd8DRPWM6%252Bkai%25
2BhPVBaan049vJNmcQ8k%252B7XR3X99tdIBiVBLeZ0P8V6ldwGAKdLpD5LDTMg3x3XfrbysTvpsn83yTM6PWhy1nLTy5
Wy9p0qn2Jqq4zzwsHwk%252FOvBsglNQL%252F3ctWZKFiZLxPkA59EJ1lZQOEAmdX%252B7%252B%252BbnnvwA%253D
%26RelayState%3Dhttps%253A%252F%252Fperkinscoiedev.service-now.com%252Fnavpage.do",
"host": "perkinscoiedev.service-now.com",
"type": "parser"
}
},
{
"request": {
"requestId": "24603.6",
"loaderId": "57C22717099627F4ACFB8060C2A3AA76",
"documentURL": "https://perkinscoiedev.service-now.com/auth_redirect.do?
sysparm_stack=no&sysparm_url=https%3A%2F%2Fmyapps.perkinscoie.com%2Fapp%2Fservicenow_ud%2Fexk
1jsx6trpNIFLGO0h8%2Fsso%2Fsaml%3FSAMLRequest%3DnVJdb9MwFP0rkd8TJ2aZgtVUCq0GlUoXrYUHXpAT365miW
18naz796Ru0coDE%252BL1%252Btxzz4dnKPqOWV4N%252FqAf4OcA6KNj32nk55eSDE5zI1Ah16IH5L7l2%252BrzmrM
k5dYZb1rTkahCBOeV0QujcejBbcGNqoUvD%252BuSHLy3yCm14J6UxtYokDAmeIbE2jwnrempFqMVj5BIQ6LlJERpcWJ8
3e9fhLWYXNGEvWlIL1wT1fdBUjg%252BZT%252FweOud3azu1h%252Fv00NBEQ09mSLRnXEtBMsl2YsOgUSrZUm2m0XeN
LdMvG%252F27wqWF1I2NyxrRJbnTZaLVBQTEGuBqEZ4XUUcYKXRC%252B1LwlKWxSmL03yXFpzd8DRPWM6%252Bkai%25
2BhPVBaan049vJNmcQ8k%252B7XR3X99tdIBiVBLeZ0P8V6ldwGAKdLpD5LDTMg3x3XfrbysTvpsn83yTM6PWhy1nLTy5
Wy9p0qn2Jqq4zzwsHwk%252FOvBsglNQL%252F3ctWZKFiZLxPkA59EJ1lZQOEAmdX%252B7%252B%252BbnnvwA%253D
%26RelayState%3Dhttps%253A%252F%252Fperkinscoiedev.service-now.com%252Fnavpage.do",
"request": {
"url": "https://perkinscoiedev.service-
now.com/scripts/doctype/js_includes_doctype.jsx?v=12-09-
2020_1945&lp=Thu_Feb_04_13_15_24_PST_2021&c=9_108",
"method": "GET",
"headers": {
"Referer": "https://perkinscoiedev.service-now.com/auth_redirect.do?
sysparm_stack=no&sysparm_url=https%3A%2F%2Fmyapps.perkinscoie.com%2Fapp%2Fservicenow_ud%2Fexk
1jsx6trpNIFLGO0h8%2Fsso%2Fsaml%3FSAMLRequest%3DnVJdb9MwFP0rkd8TJ2aZgtVUCq0GlUoXrYUHXpAT365miW
18naz796Ru0coDE%252BL1%252Btxzz4dnKPqOWV4N%252FqAf4OcA6KNj32nk55eSDE5zI1Ah16IH5L7l2%252BrzmrM
k5dYZb1rTkahCBOeV0QujcejBbcGNqoUvD%252BuSHLy3yCm14J6UxtYokDAmeIbE2jwnrempFqMVj5BIQ6LlJERpcWJ8
3e9fhLWYXNGEvWlIL1wT1fdBUjg%252BZT%252FweOud3azu1h%252Fv00NBEQ09mSLRnXEtBMsl2YsOgUSrZUm2m0XeN
LdMvG%252F27wqWF1I2NyxrRJbnTZaLVBQTEGuBqEZ4XUUcYKXRC%252B1LwlKWxSmL03yXFpzd8DRPWM6%252Bkai%25
2BhPVBaan049vJNmcQ8k%252B7XR3X99tdIBiVBLeZ0P8V6ldwGAKdLpD5LDTMg3x3XfrbysTvpsn83yTM6PWhy1nLTy5
Wy9p0qn2Jqq4zzwsHwk%252FOvBsglNQL%252F3ctWZKFiZLxPkA59EJ1lZQOEAmdX%252B7%252B%252BbnnvwA%253D
%26RelayState%3Dhttps%253A%252F%252Fperkinscoiedev.service-now.com%252Fnavpage.do",
"User-Agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5)
AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36"
},
"mixedContentType": "none",
"initialPriority": "High",
"referrerPolicy": "same-origin"
},
"timestamp": 23727521.347577,
"wallTime": 1612513446.206036,
"initiator": {
"type": "parser",
"url": "https://perkinscoiedev.service-now.com/auth_redirect.do?
sysparm_stack=no&sysparm_url=https%3A%2F%2Fmyapps.perkinscoie.com%2Fapp%2Fservicenow_ud%2Fexk
1jsx6trpNIFLGO0h8%2Fsso%2Fsaml%3FSAMLRequest%3DnVJdb9MwFP0rkd8TJ2aZgtVUCq0GlUoXrYUHXpAT365miW
18naz796Ru0coDE%252BL1%252Btxzz4dnKPqOWV4N%252FqAf4OcA6KNj32nk55eSDE5zI1Ah16IH5L7l2%252BrzmrM
k5dYZb1rTkahCBOeV0QujcejBbcGNqoUvD%252BuSHLy3yCm14J6UxtYokDAmeIbE2jwnrempFqMVj5BIQ6LlJERpcWJ8
3e9fhLWYXNGEvWlIL1wT1fdBUjg%252BZT%252FweOud3azu1h%252Fv00NBEQ09mSLRnXEtBMsl2YsOgUSrZUm2m0XeN

https://urlscan.io/api/v1/result/3a2c746e-192e-4901-9a5d-78b8b2ee32e3/ Page 21 of 119


03.10.2021, 14:47

LdMvG%252F27wqWF1I2NyxrRJbnTZaLVBQTEGuBqEZ4XUUcYKXRC%252B1LwlKWxSmL03yXFpzd8DRPWM6%252Bkai%25
2BhPVBaan049vJNmcQ8k%252B7XR3X99tdIBiVBLeZ0P8V6ldwGAKdLpD5LDTMg3x3XfrbysTvpsn83yTM6PWhy1nLTy5
Wy9p0qn2Jqq4zzwsHwk%252FOvBsglNQL%252F3ctWZKFiZLxPkA59EJ1lZQOEAmdX%252B7%252B%252BbnnvwA%253D
%26RelayState%3Dhttps%253A%252F%252Fperkinscoiedev.service-now.com%252Fnavpage.do",
"lineNumber": 149,
"columnNumber": 196
},
"type": "Script",
"frameId": "A7C87A170B6FF1BFF9C1519BD77B8C40",
"hasUserGesture": false
},
"response": {
"encodedDataLength": 326192,
"dataLength": 1247590,
"requestId": "24603.6",
"type": "Script",
"response": {
"url": "https://perkinscoiedev.service-
now.com/scripts/doctype/js_includes_doctype.jsx?v=12-09-
2020_1945&lp=Thu_Feb_04_13_15_24_PST_2021&c=9_108",
"status": 200,
"statusText": "OK",
"headers": {
"Date": "Fri, 05 Feb 2021 08:24:06 GMT",
"Content-Encoding": "gzip",
"Last-Modified": "Thu, 10 Dec 2020 03:49:20 GMT",
"Server": "ServiceNow",
"Transfer-Encoding": "chunked",
"Content-Type": "text/javascript;charset=UTF-8",
"Cache-Control": "public",
"x-edge-enc-proxy-static": "true",
"Strict-Transport-Security": "max-age=63072000; includeSubDomains",
"Expires": "Wed, 09 Feb 2022 08:24:06 GMT"
},
"mimeType": "text/javascript",
"remoteIPAddress": "149.96.248.4",
"remotePort": 443,
"fromPrefetchCache": false,
"encodedDataLength": 377,
"timing": {
"requestTime": 23727521.348911,
"proxyStart": -1,
"proxyEnd": -1,
"dnsStart": 5.433,
"dnsEnd": 5.444,
"connectStart": 5.444,
"connectEnd": 527.16,
"sslStart": 22.445,
"sslEnd": 527.147,
"workerStart": -1,
"workerReady": -1,
"workerFetchStart": -1,
"workerRespondWithSettled": -1,
"sendStart": 527.29,
"sendEnd": 527.588,
"pushStart": 0,
"pushEnd": 0,
"receiveHeadersEnd": 714.381
},
"responseTime": 1612513446921.633,
"protocol": "http/1.1",
"securityState": "secure",
"securityDetails": {
"protocol": "TLS 1.2",
"keyExchange": "ECDHE_RSA",
"keyExchangeGroup": "P-256",

https://urlscan.io/api/v1/result/3a2c746e-192e-4901-9a5d-78b8b2ee32e3/ Page 22 of 119


03.10.2021, 14:47

"cipher": "AES_128_GCM",
"certificateId": 0,
"subjectName": "*.service-now.com",
"sanList": [
"*.service-now.com",
"service-now.com"
],
"issuer": "Entrust Certification Authority - L1K",
"validFrom": 1595462153,
"validTo": 1617321353,
"signedCertificateTimestampList": [],
"certificateTransparencyCompliance": "unknown"
},
"securityHeaders": [
{
"name": "Strict-Transport-Security",
"value": "max-age=63072000; includeSubDomains"
}
]
},
"hash": "8bfc49880c042ad3da265a5a57976497ff5f6ca2023a41609745c8d674bf42e6",
"size": 1247585,
"asn": {
"ip": "149.96.248.4",
"asn": "16839",
"country": "US",
"registrar": "arin",
"date": "2010-12-16",
"description": "SNC, US",
"route": "149.96.240.0/20",
"name": "SNC"
},
"geoip": {
"range": [
2506096640,
2506162175
],
"country": "US",
"region": "",
"eu": "0",
"timezone": "America/Chicago",
"city": "",
"ll": [
37.751,
-97.822
],
"metro": 0,
"area": 1000,
"country_name": "United States"
},
"rdns": {
"ip": "149.96.248.4",
"ptr": "vip-149-96-248-4.cust.service-now.com"
}
},
"initiatorInfo": {
"url": "https://perkinscoiedev.service-now.com/auth_redirect.do?
sysparm_stack=no&sysparm_url=https%3A%2F%2Fmyapps.perkinscoie.com%2Fapp%2Fservicenow_ud%2Fexk
1jsx6trpNIFLGO0h8%2Fsso%2Fsaml%3FSAMLRequest%3DnVJdb9MwFP0rkd8TJ2aZgtVUCq0GlUoXrYUHXpAT365miW
18naz796Ru0coDE%252BL1%252Btxzz4dnKPqOWV4N%252FqAf4OcA6KNj32nk55eSDE5zI1Ah16IH5L7l2%252BrzmrM
k5dYZb1rTkahCBOeV0QujcejBbcGNqoUvD%252BuSHLy3yCm14J6UxtYokDAmeIbE2jwnrempFqMVj5BIQ6LlJERpcWJ8
3e9fhLWYXNGEvWlIL1wT1fdBUjg%252BZT%252FweOud3azu1h%252Fv00NBEQ09mSLRnXEtBMsl2YsOgUSrZUm2m0XeN
LdMvG%252F27wqWF1I2NyxrRJbnTZaLVBQTEGuBqEZ4XUUcYKXRC%252B1LwlKWxSmL03yXFpzd8DRPWM6%252Bkai%25
2BhPVBaan049vJNmcQ8k%252B7XR3X99tdIBiVBLeZ0P8V6ldwGAKdLpD5LDTMg3x3XfrbysTvpsn83yTM6PWhy1nLTy5
Wy9p0qn2Jqq4zzwsHwk%252FOvBsglNQL%252F3ctWZKFiZLxPkA59EJ1lZQOEAmdX%252B7%252B%252BbnnvwA%253D
%26RelayState%3Dhttps%253A%252F%252Fperkinscoiedev.service-now.com%252Fnavpage.do",

https://urlscan.io/api/v1/result/3a2c746e-192e-4901-9a5d-78b8b2ee32e3/ Page 23 of 119


03.10.2021, 14:47

"host": "perkinscoiedev.service-now.com",
"type": "parser"
}
},
{
"request": {
"requestId": "24603.7",
"loaderId": "57C22717099627F4ACFB8060C2A3AA76",
"documentURL": "https://perkinscoiedev.service-now.com/auth_redirect.do?
sysparm_stack=no&sysparm_url=https%3A%2F%2Fmyapps.perkinscoie.com%2Fapp%2Fservicenow_ud%2Fexk
1jsx6trpNIFLGO0h8%2Fsso%2Fsaml%3FSAMLRequest%3DnVJdb9MwFP0rkd8TJ2aZgtVUCq0GlUoXrYUHXpAT365miW
18naz796Ru0coDE%252BL1%252Btxzz4dnKPqOWV4N%252FqAf4OcA6KNj32nk55eSDE5zI1Ah16IH5L7l2%252BrzmrM
k5dYZb1rTkahCBOeV0QujcejBbcGNqoUvD%252BuSHLy3yCm14J6UxtYokDAmeIbE2jwnrempFqMVj5BIQ6LlJERpcWJ8
3e9fhLWYXNGEvWlIL1wT1fdBUjg%252BZT%252FweOud3azu1h%252Fv00NBEQ09mSLRnXEtBMsl2YsOgUSrZUm2m0XeN
LdMvG%252F27wqWF1I2NyxrRJbnTZaLVBQTEGuBqEZ4XUUcYKXRC%252B1LwlKWxSmL03yXFpzd8DRPWM6%252Bkai%25
2BhPVBaan049vJNmcQ8k%252B7XR3X99tdIBiVBLeZ0P8V6ldwGAKdLpD5LDTMg3x3XfrbysTvpsn83yTM6PWhy1nLTy5
Wy9p0qn2Jqq4zzwsHwk%252FOvBsglNQL%252F3ctWZKFiZLxPkA59EJ1lZQOEAmdX%252B7%252B%252BbnnvwA%253D
%26RelayState%3Dhttps%253A%252F%252Fperkinscoiedev.service-now.com%252Fnavpage.do",
"request": {
"url": "https://perkinscoiedev.service-now.com/scripts/js_includes_customer.jsx?
v=12-09-2020_1945&lp=Thu_Feb_04_13_15_24_PST_2021&c=9_108",
"method": "GET",
"headers": {
"Referer": "https://perkinscoiedev.service-now.com/auth_redirect.do?
sysparm_stack=no&sysparm_url=https%3A%2F%2Fmyapps.perkinscoie.com%2Fapp%2Fservicenow_ud%2Fexk
1jsx6trpNIFLGO0h8%2Fsso%2Fsaml%3FSAMLRequest%3DnVJdb9MwFP0rkd8TJ2aZgtVUCq0GlUoXrYUHXpAT365miW
18naz796Ru0coDE%252BL1%252Btxzz4dnKPqOWV4N%252FqAf4OcA6KNj32nk55eSDE5zI1Ah16IH5L7l2%252BrzmrM
k5dYZb1rTkahCBOeV0QujcejBbcGNqoUvD%252BuSHLy3yCm14J6UxtYokDAmeIbE2jwnrempFqMVj5BIQ6LlJERpcWJ8
3e9fhLWYXNGEvWlIL1wT1fdBUjg%252BZT%252FweOud3azu1h%252Fv00NBEQ09mSLRnXEtBMsl2YsOgUSrZUm2m0XeN
LdMvG%252F27wqWF1I2NyxrRJbnTZaLVBQTEGuBqEZ4XUUcYKXRC%252B1LwlKWxSmL03yXFpzd8DRPWM6%252Bkai%25
2BhPVBaan049vJNmcQ8k%252B7XR3X99tdIBiVBLeZ0P8V6ldwGAKdLpD5LDTMg3x3XfrbysTvpsn83yTM6PWhy1nLTy5
Wy9p0qn2Jqq4zzwsHwk%252FOvBsglNQL%252F3ctWZKFiZLxPkA59EJ1lZQOEAmdX%252B7%252B%252BbnnvwA%253D
%26RelayState%3Dhttps%253A%252F%252Fperkinscoiedev.service-now.com%252Fnavpage.do",
"User-Agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5)
AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36"
},
"mixedContentType": "none",
"initialPriority": "High",
"referrerPolicy": "same-origin"
},
"timestamp": 23727521.348082,
"wallTime": 1612513446.206541,
"initiator": {
"type": "parser",
"url": "https://perkinscoiedev.service-now.com/auth_redirect.do?
sysparm_stack=no&sysparm_url=https%3A%2F%2Fmyapps.perkinscoie.com%2Fapp%2Fservicenow_ud%2Fexk
1jsx6trpNIFLGO0h8%2Fsso%2Fsaml%3FSAMLRequest%3DnVJdb9MwFP0rkd8TJ2aZgtVUCq0GlUoXrYUHXpAT365miW
18naz796Ru0coDE%252BL1%252Btxzz4dnKPqOWV4N%252FqAf4OcA6KNj32nk55eSDE5zI1Ah16IH5L7l2%252BrzmrM
k5dYZb1rTkahCBOeV0QujcejBbcGNqoUvD%252BuSHLy3yCm14J6UxtYokDAmeIbE2jwnrempFqMVj5BIQ6LlJERpcWJ8
3e9fhLWYXNGEvWlIL1wT1fdBUjg%252BZT%252FweOud3azu1h%252Fv00NBEQ09mSLRnXEtBMsl2YsOgUSrZUm2m0XeN
LdMvG%252F27wqWF1I2NyxrRJbnTZaLVBQTEGuBqEZ4XUUcYKXRC%252B1LwlKWxSmL03yXFpzd8DRPWM6%252Bkai%25
2BhPVBaan049vJNmcQ8k%252B7XR3X99tdIBiVBLeZ0P8V6ldwGAKdLpD5LDTMg3x3XfrbysTvpsn83yTM6PWhy1nLTy5
Wy9p0qn2Jqq4zzwsHwk%252FOvBsglNQL%252F3ctWZKFiZLxPkA59EJ1lZQOEAmdX%252B7%252B%252BbnnvwA%253D
%26RelayState%3Dhttps%253A%252F%252Fperkinscoiedev.service-now.com%252Fnavpage.do",
"lineNumber": 149,
"columnNumber": 342
},
"type": "Script",
"frameId": "A7C87A170B6FF1BFF9C1519BD77B8C40",
"hasUserGesture": false
},
"response": {
"encodedDataLength": 4969,
"dataLength": 15730,
"requestId": "24603.7",
"type": "Script",

https://urlscan.io/api/v1/result/3a2c746e-192e-4901-9a5d-78b8b2ee32e3/ Page 24 of 119


03.10.2021, 14:47

"response": {
"url": "https://perkinscoiedev.service-now.com/scripts/js_includes_customer.jsx?
v=12-09-2020_1945&lp=Thu_Feb_04_13_15_24_PST_2021&c=9_108",
"status": 200,
"statusText": "OK",
"headers": {
"Date": "Fri, 05 Feb 2021 08:24:06 GMT",
"Content-Encoding": "gzip",
"Last-Modified": "Thu, 10 Dec 2020 03:49:20 GMT",
"Server": "ServiceNow",
"Strict-Transport-Security": "max-age=63072000; includeSubDomains",
"Content-Type": "text/javascript;charset=UTF-8",
"Cache-Control": "public",
"x-edge-enc-proxy-static": "true",
"Content-Length": "4598",
"Expires": "Wed, 09 Feb 2022 08:24:06 GMT"
},
"mimeType": "text/javascript",
"remoteIPAddress": "149.96.248.4",
"remotePort": 443,
"fromPrefetchCache": false,
"encodedDataLength": 371,
"timing": {
"requestTime": 23727521.349559,
"proxyStart": -1,
"proxyEnd": -1,
"dnsStart": 4.534,
"dnsEnd": 4.552,
"connectStart": 4.552,
"connectEnd": 536.206,
"sslStart": 21.566,
"sslEnd": 536.195,
"workerStart": -1,
"workerReady": -1,
"workerFetchStart": -1,
"workerRespondWithSettled": -1,
"sendStart": 536.333,
"sendEnd": 536.543,
"pushStart": 0,
"pushEnd": 0,
"receiveHeadersEnd": 732.401
},
"responseTime": 1612513446940.356,
"protocol": "http/1.1",
"securityState": "secure",
"securityDetails": {
"protocol": "TLS 1.2",
"keyExchange": "ECDHE_RSA",
"keyExchangeGroup": "P-256",
"cipher": "AES_128_GCM",
"certificateId": 0,
"subjectName": "*.service-now.com",
"sanList": [
"*.service-now.com",
"service-now.com"
],
"issuer": "Entrust Certification Authority - L1K",
"validFrom": 1595462153,
"validTo": 1617321353,
"signedCertificateTimestampList": [],
"certificateTransparencyCompliance": "unknown"
},
"securityHeaders": [
{
"name": "Strict-Transport-Security",
"value": "max-age=63072000; includeSubDomains"

https://urlscan.io/api/v1/result/3a2c746e-192e-4901-9a5d-78b8b2ee32e3/ Page 25 of 119


03.10.2021, 14:47

}
]
},
"hash": "c43736cbdbbd7eeb20ae469367f46e2aa1e222b46fccfaab0dd73320a95683f7",
"size": 15730,
"asn": {
"ip": "149.96.248.4",
"asn": "16839",
"country": "US",
"registrar": "arin",
"date": "2010-12-16",
"description": "SNC, US",
"route": "149.96.240.0/20",
"name": "SNC"
},
"geoip": {
"range": [
2506096640,
2506162175
],
"country": "US",
"region": "",
"eu": "0",
"timezone": "America/Chicago",
"city": "",
"ll": [
37.751,
-97.822
],
"metro": 0,
"area": 1000,
"country_name": "United States"
},
"rdns": {
"ip": "149.96.248.4",
"ptr": "vip-149-96-248-4.cust.service-now.com"
}
},
"initiatorInfo": {
"url": "https://perkinscoiedev.service-now.com/auth_redirect.do?
sysparm_stack=no&sysparm_url=https%3A%2F%2Fmyapps.perkinscoie.com%2Fapp%2Fservicenow_ud%2Fexk
1jsx6trpNIFLGO0h8%2Fsso%2Fsaml%3FSAMLRequest%3DnVJdb9MwFP0rkd8TJ2aZgtVUCq0GlUoXrYUHXpAT365miW
18naz796Ru0coDE%252BL1%252Btxzz4dnKPqOWV4N%252FqAf4OcA6KNj32nk55eSDE5zI1Ah16IH5L7l2%252BrzmrM
k5dYZb1rTkahCBOeV0QujcejBbcGNqoUvD%252BuSHLy3yCm14J6UxtYokDAmeIbE2jwnrempFqMVj5BIQ6LlJERpcWJ8
3e9fhLWYXNGEvWlIL1wT1fdBUjg%252BZT%252FweOud3azu1h%252Fv00NBEQ09mSLRnXEtBMsl2YsOgUSrZUm2m0XeN
LdMvG%252F27wqWF1I2NyxrRJbnTZaLVBQTEGuBqEZ4XUUcYKXRC%252B1LwlKWxSmL03yXFpzd8DRPWM6%252Bkai%25
2BhPVBaan049vJNmcQ8k%252B7XR3X99tdIBiVBLeZ0P8V6ldwGAKdLpD5LDTMg3x3XfrbysTvpsn83yTM6PWhy1nLTy5
Wy9p0qn2Jqq4zzwsHwk%252FOvBsglNQL%252F3ctWZKFiZLxPkA59EJ1lZQOEAmdX%252B7%252B%252BbnnvwA%253D
%26RelayState%3Dhttps%253A%252F%252Fperkinscoiedev.service-now.com%252Fnavpage.do",
"host": "perkinscoiedev.service-now.com",
"type": "parser"
}
},
{
"request": {
"requestId": "24603.8",
"loaderId": "57C22717099627F4ACFB8060C2A3AA76",
"documentURL": "https://perkinscoiedev.service-now.com/auth_redirect.do?
sysparm_stack=no&sysparm_url=https%3A%2F%2Fmyapps.perkinscoie.com%2Fapp%2Fservicenow_ud%2Fexk
1jsx6trpNIFLGO0h8%2Fsso%2Fsaml%3FSAMLRequest%3DnVJdb9MwFP0rkd8TJ2aZgtVUCq0GlUoXrYUHXpAT365miW
18naz796Ru0coDE%252BL1%252Btxzz4dnKPqOWV4N%252FqAf4OcA6KNj32nk55eSDE5zI1Ah16IH5L7l2%252BrzmrM
k5dYZb1rTkahCBOeV0QujcejBbcGNqoUvD%252BuSHLy3yCm14J6UxtYokDAmeIbE2jwnrempFqMVj5BIQ6LlJERpcWJ8
3e9fhLWYXNGEvWlIL1wT1fdBUjg%252BZT%252FweOud3azu1h%252Fv00NBEQ09mSLRnXEtBMsl2YsOgUSrZUm2m0XeN
LdMvG%252F27wqWF1I2NyxrRJbnTZaLVBQTEGuBqEZ4XUUcYKXRC%252B1LwlKWxSmL03yXFpzd8DRPWM6%252Bkai%25
2BhPVBaan049vJNmcQ8k%252B7XR3X99tdIBiVBLeZ0P8V6ldwGAKdLpD5LDTMg3x3XfrbysTvpsn83yTM6PWhy1nLTy5
Wy9p0qn2Jqq4zzwsHwk%252FOvBsglNQL%252F3ctWZKFiZLxPkA59EJ1lZQOEAmdX%252B7%252B%252BbnnvwA%253D

https://urlscan.io/api/v1/result/3a2c746e-192e-4901-9a5d-78b8b2ee32e3/ Page 26 of 119


03.10.2021, 14:47

%26RelayState%3Dhttps%253A%252F%252Fperkinscoiedev.service-now.com%252Fnavpage.do",
"request": {
"url": "https://perkinscoiedev.service-
now.com/scripts/doctype/js_includes_legacy.jsx?v=12-09-
2020_1945&lp=Thu_Feb_04_13_15_24_PST_2021&c=9_108",
"method": "GET",
"headers": {
"Referer": "https://perkinscoiedev.service-now.com/auth_redirect.do?
sysparm_stack=no&sysparm_url=https%3A%2F%2Fmyapps.perkinscoie.com%2Fapp%2Fservicenow_ud%2Fexk
1jsx6trpNIFLGO0h8%2Fsso%2Fsaml%3FSAMLRequest%3DnVJdb9MwFP0rkd8TJ2aZgtVUCq0GlUoXrYUHXpAT365miW
18naz796Ru0coDE%252BL1%252Btxzz4dnKPqOWV4N%252FqAf4OcA6KNj32nk55eSDE5zI1Ah16IH5L7l2%252BrzmrM
k5dYZb1rTkahCBOeV0QujcejBbcGNqoUvD%252BuSHLy3yCm14J6UxtYokDAmeIbE2jwnrempFqMVj5BIQ6LlJERpcWJ8
3e9fhLWYXNGEvWlIL1wT1fdBUjg%252BZT%252FweOud3azu1h%252Fv00NBEQ09mSLRnXEtBMsl2YsOgUSrZUm2m0XeN
LdMvG%252F27wqWF1I2NyxrRJbnTZaLVBQTEGuBqEZ4XUUcYKXRC%252B1LwlKWxSmL03yXFpzd8DRPWM6%252Bkai%25
2BhPVBaan049vJNmcQ8k%252B7XR3X99tdIBiVBLeZ0P8V6ldwGAKdLpD5LDTMg3x3XfrbysTvpsn83yTM6PWhy1nLTy5
Wy9p0qn2Jqq4zzwsHwk%252FOvBsglNQL%252F3ctWZKFiZLxPkA59EJ1lZQOEAmdX%252B7%252B%252BbnnvwA%253D
%26RelayState%3Dhttps%253A%252F%252Fperkinscoiedev.service-now.com%252Fnavpage.do",
"User-Agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5)
AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36"
},
"mixedContentType": "none",
"initialPriority": "High",
"referrerPolicy": "same-origin"
},
"timestamp": 23727521.348553,
"wallTime": 1612513446.207012,
"initiator": {
"type": "parser",
"url": "https://perkinscoiedev.service-now.com/auth_redirect.do?
sysparm_stack=no&sysparm_url=https%3A%2F%2Fmyapps.perkinscoie.com%2Fapp%2Fservicenow_ud%2Fexk
1jsx6trpNIFLGO0h8%2Fsso%2Fsaml%3FSAMLRequest%3DnVJdb9MwFP0rkd8TJ2aZgtVUCq0GlUoXrYUHXpAT365miW
18naz796Ru0coDE%252BL1%252Btxzz4dnKPqOWV4N%252FqAf4OcA6KNj32nk55eSDE5zI1Ah16IH5L7l2%252BrzmrM
k5dYZb1rTkahCBOeV0QujcejBbcGNqoUvD%252BuSHLy3yCm14J6UxtYokDAmeIbE2jwnrempFqMVj5BIQ6LlJERpcWJ8
3e9fhLWYXNGEvWlIL1wT1fdBUjg%252BZT%252FweOud3azu1h%252Fv00NBEQ09mSLRnXEtBMsl2YsOgUSrZUm2m0XeN
LdMvG%252F27wqWF1I2NyxrRJbnTZaLVBQTEGuBqEZ4XUUcYKXRC%252B1LwlKWxSmL03yXFpzd8DRPWM6%252Bkai%25
2BhPVBaan049vJNmcQ8k%252B7XR3X99tdIBiVBLeZ0P8V6ldwGAKdLpD5LDTMg3x3XfrbysTvpsn83yTM6PWhy1nLTy5
Wy9p0qn2Jqq4zzwsHwk%252FOvBsglNQL%252F3ctWZKFiZLxPkA59EJ1lZQOEAmdX%252B7%252B%252BbnnvwA%253D
%26RelayState%3Dhttps%253A%252F%252Fperkinscoiedev.service-now.com%252Fnavpage.do",
"lineNumber": 174,
"columnNumber": 158
},
"type": "Script",
"frameId": "A7C87A170B6FF1BFF9C1519BD77B8C40",
"hasUserGesture": false
},
"response": {
"encodedDataLength": 13691,
"dataLength": 62398,
"requestId": "24603.8",
"type": "Script",
"response": {
"url": "https://perkinscoiedev.service-
now.com/scripts/doctype/js_includes_legacy.jsx?v=12-09-
2020_1945&lp=Thu_Feb_04_13_15_24_PST_2021&c=9_108",
"status": 200,
"statusText": "OK",
"headers": {
"Date": "Fri, 05 Feb 2021 08:24:06 GMT",
"Content-Encoding": "gzip",
"Last-Modified": "Thu, 10 Dec 2020 03:49:20 GMT",
"Server": "ServiceNow",
"Transfer-Encoding": "chunked",
"Content-Type": "text/javascript;charset=UTF-8",
"Cache-Control": "public",
"x-edge-enc-proxy-static": "true",
"Strict-Transport-Security": "max-age=63072000; includeSubDomains",

https://urlscan.io/api/v1/result/3a2c746e-192e-4901-9a5d-78b8b2ee32e3/ Page 27 of 119


03.10.2021, 14:47

"Expires": "Wed, 09 Feb 2022 08:24:06 GMT"


},
"mimeType": "text/javascript",
"remoteIPAddress": "149.96.248.4",
"remotePort": 443,
"fromPrefetchCache": false,
"encodedDataLength": 377,
"timing": {
"requestTime": 23727521.350168,
"proxyStart": -1,
"proxyEnd": -1,
"dnsStart": -1,
"dnsEnd": -1,
"connectStart": -1,
"connectEnd": -1,
"sslStart": -1,
"sslEnd": -1,
"workerStart": -1,
"workerReady": -1,
"workerFetchStart": -1,
"workerRespondWithSettled": -1,
"sendStart": 609.648,
"sendEnd": 609.894,
"pushStart": 0,
"pushEnd": 0,
"receiveHeadersEnd": 776.171
},
"responseTime": 1612513446984.743,
"protocol": "http/1.1",
"securityState": "secure",
"securityDetails": {
"protocol": "TLS 1.2",
"keyExchange": "ECDHE_RSA",
"keyExchangeGroup": "P-256",
"cipher": "AES_128_GCM",
"certificateId": 0,
"subjectName": "*.service-now.com",
"sanList": [
"*.service-now.com",
"service-now.com"
],
"issuer": "Entrust Certification Authority - L1K",
"validFrom": 1595462153,
"validTo": 1617321353,
"signedCertificateTimestampList": [],
"certificateTransparencyCompliance": "unknown"
},
"securityHeaders": [
{
"name": "Strict-Transport-Security",
"value": "max-age=63072000; includeSubDomains"
}
]
},
"hash": "ce599ff875bc9d13cf4dbeaa88de17dd5b548754a4a264e30692604883b4832f",
"size": 62398,
"asn": {
"ip": "149.96.248.4",
"asn": "16839",
"country": "US",
"registrar": "arin",
"date": "2010-12-16",
"description": "SNC, US",
"route": "149.96.240.0/20",
"name": "SNC"
},

https://urlscan.io/api/v1/result/3a2c746e-192e-4901-9a5d-78b8b2ee32e3/ Page 28 of 119


03.10.2021, 14:47

"geoip": {
"range": [
2506096640,
2506162175
],
"country": "US",
"region": "",
"eu": "0",
"timezone": "America/Chicago",
"city": "",
"ll": [
37.751,
-97.822
],
"metro": 0,
"area": 1000,
"country_name": "United States"
},
"rdns": {
"ip": "149.96.248.4",
"ptr": "vip-149-96-248-4.cust.service-now.com"
}
},
"initiatorInfo": {
"url": "https://perkinscoiedev.service-now.com/auth_redirect.do?
sysparm_stack=no&sysparm_url=https%3A%2F%2Fmyapps.perkinscoie.com%2Fapp%2Fservicenow_ud%2Fexk
1jsx6trpNIFLGO0h8%2Fsso%2Fsaml%3FSAMLRequest%3DnVJdb9MwFP0rkd8TJ2aZgtVUCq0GlUoXrYUHXpAT365miW
18naz796Ru0coDE%252BL1%252Btxzz4dnKPqOWV4N%252FqAf4OcA6KNj32nk55eSDE5zI1Ah16IH5L7l2%252BrzmrM
k5dYZb1rTkahCBOeV0QujcejBbcGNqoUvD%252BuSHLy3yCm14J6UxtYokDAmeIbE2jwnrempFqMVj5BIQ6LlJERpcWJ8
3e9fhLWYXNGEvWlIL1wT1fdBUjg%252BZT%252FweOud3azu1h%252Fv00NBEQ09mSLRnXEtBMsl2YsOgUSrZUm2m0XeN
LdMvG%252F27wqWF1I2NyxrRJbnTZaLVBQTEGuBqEZ4XUUcYKXRC%252B1LwlKWxSmL03yXFpzd8DRPWM6%252Bkai%25
2BhPVBaan049vJNmcQ8k%252B7XR3X99tdIBiVBLeZ0P8V6ldwGAKdLpD5LDTMg3x3XfrbysTvpsn83yTM6PWhy1nLTy5
Wy9p0qn2Jqq4zzwsHwk%252FOvBsglNQL%252F3ctWZKFiZLxPkA59EJ1lZQOEAmdX%252B7%252B%252BbnnvwA%253D
%26RelayState%3Dhttps%253A%252F%252Fperkinscoiedev.service-now.com%252Fnavpage.do",
"host": "perkinscoiedev.service-now.com",
"type": "parser"
}
},
{
"request": {
"requestId": "24603.9",
"loaderId": "57C22717099627F4ACFB8060C2A3AA76",
"documentURL": "https://perkinscoiedev.service-now.com/auth_redirect.do?
sysparm_stack=no&sysparm_url=https%3A%2F%2Fmyapps.perkinscoie.com%2Fapp%2Fservicenow_ud%2Fexk
1jsx6trpNIFLGO0h8%2Fsso%2Fsaml%3FSAMLRequest%3DnVJdb9MwFP0rkd8TJ2aZgtVUCq0GlUoXrYUHXpAT365miW
18naz796Ru0coDE%252BL1%252Btxzz4dnKPqOWV4N%252FqAf4OcA6KNj32nk55eSDE5zI1Ah16IH5L7l2%252BrzmrM
k5dYZb1rTkahCBOeV0QujcejBbcGNqoUvD%252BuSHLy3yCm14J6UxtYokDAmeIbE2jwnrempFqMVj5BIQ6LlJERpcWJ8
3e9fhLWYXNGEvWlIL1wT1fdBUjg%252BZT%252FweOud3azu1h%252Fv00NBEQ09mSLRnXEtBMsl2YsOgUSrZUm2m0XeN
LdMvG%252F27wqWF1I2NyxrRJbnTZaLVBQTEGuBqEZ4XUUcYKXRC%252B1LwlKWxSmL03yXFpzd8DRPWM6%252Bkai%25
2BhPVBaan049vJNmcQ8k%252B7XR3X99tdIBiVBLeZ0P8V6ldwGAKdLpD5LDTMg3x3XfrbysTvpsn83yTM6PWhy1nLTy5
Wy9p0qn2Jqq4zzwsHwk%252FOvBsglNQL%252F3ctWZKFiZLxPkA59EJ1lZQOEAmdX%252B7%252B%252BbnnvwA%253D
%26RelayState%3Dhttps%253A%252F%252Fperkinscoiedev.service-now.com%252Fnavpage.do",
"request": {
"url": "https://perkinscoiedev.service-
now.com/scripts/app.guided_tours/js_guided_tours_includes.jsx?v=12-09-2020_1945",
"method": "GET",
"headers": {
"Referer": "https://perkinscoiedev.service-now.com/auth_redirect.do?
sysparm_stack=no&sysparm_url=https%3A%2F%2Fmyapps.perkinscoie.com%2Fapp%2Fservicenow_ud%2Fexk
1jsx6trpNIFLGO0h8%2Fsso%2Fsaml%3FSAMLRequest%3DnVJdb9MwFP0rkd8TJ2aZgtVUCq0GlUoXrYUHXpAT365miW
18naz796Ru0coDE%252BL1%252Btxzz4dnKPqOWV4N%252FqAf4OcA6KNj32nk55eSDE5zI1Ah16IH5L7l2%252BrzmrM
k5dYZb1rTkahCBOeV0QujcejBbcGNqoUvD%252BuSHLy3yCm14J6UxtYokDAmeIbE2jwnrempFqMVj5BIQ6LlJERpcWJ8
3e9fhLWYXNGEvWlIL1wT1fdBUjg%252BZT%252FweOud3azu1h%252Fv00NBEQ09mSLRnXEtBMsl2YsOgUSrZUm2m0XeN
LdMvG%252F27wqWF1I2NyxrRJbnTZaLVBQTEGuBqEZ4XUUcYKXRC%252B1LwlKWxSmL03yXFpzd8DRPWM6%252Bkai%25
2BhPVBaan049vJNmcQ8k%252B7XR3X99tdIBiVBLeZ0P8V6ldwGAKdLpD5LDTMg3x3XfrbysTvpsn83yTM6PWhy1nLTy5
Wy9p0qn2Jqq4zzwsHwk%252FOvBsglNQL%252F3ctWZKFiZLxPkA59EJ1lZQOEAmdX%252B7%252B%252BbnnvwA%253D

https://urlscan.io/api/v1/result/3a2c746e-192e-4901-9a5d-78b8b2ee32e3/ Page 29 of 119


03.10.2021, 14:47

%26RelayState%3Dhttps%253A%252F%252Fperkinscoiedev.service-now.com%252Fnavpage.do",
"User-Agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5)
AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36"
},
"mixedContentType": "none",
"initialPriority": "High",
"referrerPolicy": "same-origin"
},
"timestamp": 23727521.349044,
"wallTime": 1612513446.207503,
"initiator": {
"type": "parser",
"url": "https://perkinscoiedev.service-now.com/auth_redirect.do?
sysparm_stack=no&sysparm_url=https%3A%2F%2Fmyapps.perkinscoie.com%2Fapp%2Fservicenow_ud%2Fexk
1jsx6trpNIFLGO0h8%2Fsso%2Fsaml%3FSAMLRequest%3DnVJdb9MwFP0rkd8TJ2aZgtVUCq0GlUoXrYUHXpAT365miW
18naz796Ru0coDE%252BL1%252Btxzz4dnKPqOWV4N%252FqAf4OcA6KNj32nk55eSDE5zI1Ah16IH5L7l2%252BrzmrM
k5dYZb1rTkahCBOeV0QujcejBbcGNqoUvD%252BuSHLy3yCm14J6UxtYokDAmeIbE2jwnrempFqMVj5BIQ6LlJERpcWJ8
3e9fhLWYXNGEvWlIL1wT1fdBUjg%252BZT%252FweOud3azu1h%252Fv00NBEQ09mSLRnXEtBMsl2YsOgUSrZUm2m0XeN
LdMvG%252F27wqWF1I2NyxrRJbnTZaLVBQTEGuBqEZ4XUUcYKXRC%252B1LwlKWxSmL03yXFpzd8DRPWM6%252Bkai%25
2BhPVBaan049vJNmcQ8k%252B7XR3X99tdIBiVBLeZ0P8V6ldwGAKdLpD5LDTMg3x3XfrbysTvpsn83yTM6PWhy1nLTy5
Wy9p0qn2Jqq4zzwsHwk%252FOvBsglNQL%252F3ctWZKFiZLxPkA59EJ1lZQOEAmdX%252B7%252B%252BbnnvwA%253D
%26RelayState%3Dhttps%253A%252F%252Fperkinscoiedev.service-now.com%252Fnavpage.do",
"lineNumber": 252,
"columnNumber": 227
},
"type": "Script",
"frameId": "A7C87A170B6FF1BFF9C1519BD77B8C40",
"hasUserGesture": false
},
"response": {
"encodedDataLength": 4874,
"dataLength": 15847,
"requestId": "24603.9",
"type": "Script",
"response": {
"url": "https://perkinscoiedev.service-
now.com/scripts/app.guided_tours/js_guided_tours_includes.jsx?v=12-09-2020_1945",
"status": 200,
"statusText": "OK",
"headers": {
"Date": "Fri, 05 Feb 2021 08:24:06 GMT",
"Content-Encoding": "gzip",
"Last-Modified": "Thu, 04 Feb 2021 06:37:57 GMT",
"Server": "ServiceNow",
"Strict-Transport-Security": "max-age=63072000; includeSubDomains",
"Content-Type": "text/javascript;charset=UTF-8",
"Cache-Control": "public",
"x-edge-enc-proxy-static": "true",
"Content-Length": "4503",
"Expires": "Wed, 09 Feb 2022 08:24:06 GMT"
},
"mimeType": "text/javascript",
"remoteIPAddress": "149.96.248.4",
"remotePort": 443,
"fromPrefetchCache": false,
"encodedDataLength": 371,
"timing": {
"requestTime": 23727521.350794,
"proxyStart": -1,
"proxyEnd": -1,
"dnsStart": -1,
"dnsEnd": -1,
"connectStart": -1,
"connectEnd": -1,
"sslStart": -1,
"sslEnd": -1,

https://urlscan.io/api/v1/result/3a2c746e-192e-4901-9a5d-78b8b2ee32e3/ Page 30 of 119


03.10.2021, 14:47

"workerStart": -1,
"workerReady": -1,
"workerFetchStart": -1,
"workerRespondWithSettled": -1,
"sendStart": 672.774,
"sendEnd": 673.008,
"pushStart": 0,
"pushEnd": 0,
"receiveHeadersEnd": 832.847
},
"responseTime": 1612513447042.043,
"protocol": "http/1.1",
"securityState": "secure",
"securityDetails": {
"protocol": "TLS 1.2",
"keyExchange": "ECDHE_RSA",
"keyExchangeGroup": "P-256",
"cipher": "AES_128_GCM",
"certificateId": 0,
"subjectName": "*.service-now.com",
"sanList": [
"*.service-now.com",
"service-now.com"
],
"issuer": "Entrust Certification Authority - L1K",
"validFrom": 1595462153,
"validTo": 1617321353,
"signedCertificateTimestampList": [],
"certificateTransparencyCompliance": "unknown"
},
"securityHeaders": [
{
"name": "Strict-Transport-Security",
"value": "max-age=63072000; includeSubDomains"
}
]
},
"hash": "c95c95b3297ae7bc1607137f1c38ee0ebdb52e8af8bc9de50486c9bebf16c24e",
"size": 15847,
"asn": {
"ip": "149.96.248.4",
"asn": "16839",
"country": "US",
"registrar": "arin",
"date": "2010-12-16",
"description": "SNC, US",
"route": "149.96.240.0/20",
"name": "SNC"
},
"geoip": {
"range": [
2506096640,
2506162175
],
"country": "US",
"region": "",
"eu": "0",
"timezone": "America/Chicago",
"city": "",
"ll": [
37.751,
-97.822
],
"metro": 0,
"area": 1000,
"country_name": "United States"

https://urlscan.io/api/v1/result/3a2c746e-192e-4901-9a5d-78b8b2ee32e3/ Page 31 of 119


03.10.2021, 14:47

},
"rdns": {
"ip": "149.96.248.4",
"ptr": "vip-149-96-248-4.cust.service-now.com"
}
},
"initiatorInfo": {
"url": "https://perkinscoiedev.service-now.com/auth_redirect.do?
sysparm_stack=no&sysparm_url=https%3A%2F%2Fmyapps.perkinscoie.com%2Fapp%2Fservicenow_ud%2Fexk
1jsx6trpNIFLGO0h8%2Fsso%2Fsaml%3FSAMLRequest%3DnVJdb9MwFP0rkd8TJ2aZgtVUCq0GlUoXrYUHXpAT365miW
18naz796Ru0coDE%252BL1%252Btxzz4dnKPqOWV4N%252FqAf4OcA6KNj32nk55eSDE5zI1Ah16IH5L7l2%252BrzmrM
k5dYZb1rTkahCBOeV0QujcejBbcGNqoUvD%252BuSHLy3yCm14J6UxtYokDAmeIbE2jwnrempFqMVj5BIQ6LlJERpcWJ8
3e9fhLWYXNGEvWlIL1wT1fdBUjg%252BZT%252FweOud3azu1h%252Fv00NBEQ09mSLRnXEtBMsl2YsOgUSrZUm2m0XeN
LdMvG%252F27wqWF1I2NyxrRJbnTZaLVBQTEGuBqEZ4XUUcYKXRC%252B1LwlKWxSmL03yXFpzd8DRPWM6%252Bkai%25
2BhPVBaan049vJNmcQ8k%252B7XR3X99tdIBiVBLeZ0P8V6ldwGAKdLpD5LDTMg3x3XfrbysTvpsn83yTM6PWhy1nLTy5
Wy9p0qn2Jqq4zzwsHwk%252FOvBsglNQL%252F3ctWZKFiZLxPkA59EJ1lZQOEAmdX%252B7%252B%252BbnnvwA%253D
%26RelayState%3Dhttps%253A%252F%252Fperkinscoiedev.service-now.com%252Fnavpage.do",
"host": "perkinscoiedev.service-now.com",
"type": "parser"
}
},
{
"request": {
"requestId": "24603.10",
"loaderId": "57C22717099627F4ACFB8060C2A3AA76",
"documentURL": "https://perkinscoiedev.service-now.com/auth_redirect.do?
sysparm_stack=no&sysparm_url=https%3A%2F%2Fmyapps.perkinscoie.com%2Fapp%2Fservicenow_ud%2Fexk
1jsx6trpNIFLGO0h8%2Fsso%2Fsaml%3FSAMLRequest%3DnVJdb9MwFP0rkd8TJ2aZgtVUCq0GlUoXrYUHXpAT365miW
18naz796Ru0coDE%252BL1%252Btxzz4dnKPqOWV4N%252FqAf4OcA6KNj32nk55eSDE5zI1Ah16IH5L7l2%252BrzmrM
k5dYZb1rTkahCBOeV0QujcejBbcGNqoUvD%252BuSHLy3yCm14J6UxtYokDAmeIbE2jwnrempFqMVj5BIQ6LlJERpcWJ8
3e9fhLWYXNGEvWlIL1wT1fdBUjg%252BZT%252FweOud3azu1h%252Fv00NBEQ09mSLRnXEtBMsl2YsOgUSrZUm2m0XeN
LdMvG%252F27wqWF1I2NyxrRJbnTZaLVBQTEGuBqEZ4XUUcYKXRC%252B1LwlKWxSmL03yXFpzd8DRPWM6%252Bkai%25
2BhPVBaan049vJNmcQ8k%252B7XR3X99tdIBiVBLeZ0P8V6ldwGAKdLpD5LDTMg3x3XfrbysTvpsn83yTM6PWhy1nLTy5
Wy9p0qn2Jqq4zzwsHwk%252FOvBsglNQL%252F3ctWZKFiZLxPkA59EJ1lZQOEAmdX%252B7%252B%252BbnnvwA%253D
%26RelayState%3Dhttps%253A%252F%252Fperkinscoiedev.service-now.com%252Fnavpage.do",
"request": {
"url": "https://perkinscoiedev.service-
now.com/scripts/doctype/js_includes_last_doctype.jsx?v=12-09-
2020_1945&lp=Thu_Feb_04_13_15_24_PST_2021&c=9_108",
"method": "GET",
"headers": {
"Referer": "https://perkinscoiedev.service-now.com/auth_redirect.do?
sysparm_stack=no&sysparm_url=https%3A%2F%2Fmyapps.perkinscoie.com%2Fapp%2Fservicenow_ud%2Fexk
1jsx6trpNIFLGO0h8%2Fsso%2Fsaml%3FSAMLRequest%3DnVJdb9MwFP0rkd8TJ2aZgtVUCq0GlUoXrYUHXpAT365miW
18naz796Ru0coDE%252BL1%252Btxzz4dnKPqOWV4N%252FqAf4OcA6KNj32nk55eSDE5zI1Ah16IH5L7l2%252BrzmrM
k5dYZb1rTkahCBOeV0QujcejBbcGNqoUvD%252BuSHLy3yCm14J6UxtYokDAmeIbE2jwnrempFqMVj5BIQ6LlJERpcWJ8
3e9fhLWYXNGEvWlIL1wT1fdBUjg%252BZT%252FweOud3azu1h%252Fv00NBEQ09mSLRnXEtBMsl2YsOgUSrZUm2m0XeN
LdMvG%252F27wqWF1I2NyxrRJbnTZaLVBQTEGuBqEZ4XUUcYKXRC%252B1LwlKWxSmL03yXFpzd8DRPWM6%252Bkai%25
2BhPVBaan049vJNmcQ8k%252B7XR3X99tdIBiVBLeZ0P8V6ldwGAKdLpD5LDTMg3x3XfrbysTvpsn83yTM6PWhy1nLTy5
Wy9p0qn2Jqq4zzwsHwk%252FOvBsglNQL%252F3ctWZKFiZLxPkA59EJ1lZQOEAmdX%252B7%252B%252BbnnvwA%253D
%26RelayState%3Dhttps%253A%252F%252Fperkinscoiedev.service-now.com%252Fnavpage.do",
"User-Agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5)
AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36"
},
"mixedContentType": "none",
"initialPriority": "High",
"referrerPolicy": "same-origin"
},
"timestamp": 23727521.349528,
"wallTime": 1612513446.207987,
"initiator": {
"type": "parser",
"url": "https://perkinscoiedev.service-now.com/auth_redirect.do?
sysparm_stack=no&sysparm_url=https%3A%2F%2Fmyapps.perkinscoie.com%2Fapp%2Fservicenow_ud%2Fexk
1jsx6trpNIFLGO0h8%2Fsso%2Fsaml%3FSAMLRequest%3DnVJdb9MwFP0rkd8TJ2aZgtVUCq0GlUoXrYUHXpAT365miW
18naz796Ru0coDE%252BL1%252Btxzz4dnKPqOWV4N%252FqAf4OcA6KNj32nk55eSDE5zI1Ah16IH5L7l2%252BrzmrM

https://urlscan.io/api/v1/result/3a2c746e-192e-4901-9a5d-78b8b2ee32e3/ Page 32 of 119


03.10.2021, 14:47

k5dYZb1rTkahCBOeV0QujcejBbcGNqoUvD%252BuSHLy3yCm14J6UxtYokDAmeIbE2jwnrempFqMVj5BIQ6LlJERpcWJ8
3e9fhLWYXNGEvWlIL1wT1fdBUjg%252BZT%252FweOud3azu1h%252Fv00NBEQ09mSLRnXEtBMsl2YsOgUSrZUm2m0XeN
LdMvG%252F27wqWF1I2NyxrRJbnTZaLVBQTEGuBqEZ4XUUcYKXRC%252B1LwlKWxSmL03yXFpzd8DRPWM6%252Bkai%25
2BhPVBaan049vJNmcQ8k%252B7XR3X99tdIBiVBLeZ0P8V6ldwGAKdLpD5LDTMg3x3XfrbysTvpsn83yTM6PWhy1nLTy5
Wy9p0qn2Jqq4zzwsHwk%252FOvBsglNQL%252F3ctWZKFiZLxPkA59EJ1lZQOEAmdX%252B7%252B%252BbnnvwA%253D
%26RelayState%3Dhttps%253A%252F%252Fperkinscoiedev.service-now.com%252Fnavpage.do",
"lineNumber": 352,
"columnNumber": 304
},
"type": "Script",
"frameId": "A7C87A170B6FF1BFF9C1519BD77B8C40",
"hasUserGesture": false
},
"response": {
"encodedDataLength": 59091,
"dataLength": 242690,
"requestId": "24603.10",
"type": "Script",
"response": {
"url": "https://perkinscoiedev.service-
now.com/scripts/doctype/js_includes_last_doctype.jsx?v=12-09-
2020_1945&lp=Thu_Feb_04_13_15_24_PST_2021&c=9_108",
"status": 200,
"statusText": "OK",
"headers": {
"Date": "Fri, 05 Feb 2021 08:24:06 GMT",
"Content-Encoding": "gzip",
"Last-Modified": "Thu, 10 Dec 2020 03:49:20 GMT",
"Server": "ServiceNow",
"Transfer-Encoding": "chunked",
"Content-Type": "text/javascript;charset=UTF-8",
"Cache-Control": "public",
"x-edge-enc-proxy-static": "true",
"Strict-Transport-Security": "max-age=63072000; includeSubDomains",
"Expires": "Wed, 09 Feb 2022 08:24:07 GMT"
},
"mimeType": "text/javascript",
"remoteIPAddress": "149.96.248.4",
"remotePort": 443,
"fromPrefetchCache": false,
"encodedDataLength": 377,
"timing": {
"requestTime": 23727521.351314,
"proxyStart": -1,
"proxyEnd": -1,
"dnsStart": -1,
"dnsEnd": -1,
"connectStart": -1,
"connectEnd": -1,
"sslStart": -1,
"sslEnd": -1,
"workerStart": -1,
"workerReady": -1,
"workerFetchStart": -1,
"workerRespondWithSettled": -1,
"sendStart": 706.666,
"sendEnd": 706.874,
"pushStart": 0,
"pushEnd": 0,
"receiveHeadersEnd": 909.372
},
"responseTime": 1612513447118.976,
"protocol": "http/1.1",
"securityState": "secure",
"securityDetails": {
"protocol": "TLS 1.2",

https://urlscan.io/api/v1/result/3a2c746e-192e-4901-9a5d-78b8b2ee32e3/ Page 33 of 119


03.10.2021, 14:47

"keyExchange": "ECDHE_RSA",
"keyExchangeGroup": "P-256",
"cipher": "AES_128_GCM",
"certificateId": 0,
"subjectName": "*.service-now.com",
"sanList": [
"*.service-now.com",
"service-now.com"
],
"issuer": "Entrust Certification Authority - L1K",
"validFrom": 1595462153,
"validTo": 1617321353,
"signedCertificateTimestampList": [],
"certificateTransparencyCompliance": "unknown"
},
"securityHeaders": [
{
"name": "Strict-Transport-Security",
"value": "max-age=63072000; includeSubDomains"
}
]
},
"hash": "af9ab3ff73d3afdfb911aba755b01d5b853c518c5bb07dddb281b1dd421d278f",
"size": 242688,
"asn": {
"ip": "149.96.248.4",
"asn": "16839",
"country": "US",
"registrar": "arin",
"date": "2010-12-16",
"description": "SNC, US",
"route": "149.96.240.0/20",
"name": "SNC"
},
"geoip": {
"range": [
2506096640,
2506162175
],
"country": "US",
"region": "",
"eu": "0",
"timezone": "America/Chicago",
"city": "",
"ll": [
37.751,
-97.822
],
"metro": 0,
"area": 1000,
"country_name": "United States"
},
"rdns": {
"ip": "149.96.248.4",
"ptr": "vip-149-96-248-4.cust.service-now.com"
}
},
"initiatorInfo": {
"url": "https://perkinscoiedev.service-now.com/auth_redirect.do?
sysparm_stack=no&sysparm_url=https%3A%2F%2Fmyapps.perkinscoie.com%2Fapp%2Fservicenow_ud%2Fexk
1jsx6trpNIFLGO0h8%2Fsso%2Fsaml%3FSAMLRequest%3DnVJdb9MwFP0rkd8TJ2aZgtVUCq0GlUoXrYUHXpAT365miW
18naz796Ru0coDE%252BL1%252Btxzz4dnKPqOWV4N%252FqAf4OcA6KNj32nk55eSDE5zI1Ah16IH5L7l2%252BrzmrM
k5dYZb1rTkahCBOeV0QujcejBbcGNqoUvD%252BuSHLy3yCm14J6UxtYokDAmeIbE2jwnrempFqMVj5BIQ6LlJERpcWJ8
3e9fhLWYXNGEvWlIL1wT1fdBUjg%252BZT%252FweOud3azu1h%252Fv00NBEQ09mSLRnXEtBMsl2YsOgUSrZUm2m0XeN
LdMvG%252F27wqWF1I2NyxrRJbnTZaLVBQTEGuBqEZ4XUUcYKXRC%252B1LwlKWxSmL03yXFpzd8DRPWM6%252Bkai%25
2BhPVBaan049vJNmcQ8k%252B7XR3X99tdIBiVBLeZ0P8V6ldwGAKdLpD5LDTMg3x3XfrbysTvpsn83yTM6PWhy1nLTy5

https://urlscan.io/api/v1/result/3a2c746e-192e-4901-9a5d-78b8b2ee32e3/ Page 34 of 119


03.10.2021, 14:47

Wy9p0qn2Jqq4zzwsHwk%252FOvBsglNQL%252F3ctWZKFiZLxPkA59EJ1lZQOEAmdX%252B7%252B%252BbnnvwA%253D
%26RelayState%3Dhttps%253A%252F%252Fperkinscoiedev.service-now.com%252Fnavpage.do",
"host": "perkinscoiedev.service-now.com",
"type": "parser"
}
},
{
"request": {
"requestId": "24603.11",
"loaderId": "57C22717099627F4ACFB8060C2A3AA76",
"documentURL": "https://perkinscoiedev.service-now.com/auth_redirect.do?
sysparm_stack=no&sysparm_url=https%3A%2F%2Fmyapps.perkinscoie.com%2Fapp%2Fservicenow_ud%2Fexk
1jsx6trpNIFLGO0h8%2Fsso%2Fsaml%3FSAMLRequest%3DnVJdb9MwFP0rkd8TJ2aZgtVUCq0GlUoXrYUHXpAT365miW
18naz796Ru0coDE%252BL1%252Btxzz4dnKPqOWV4N%252FqAf4OcA6KNj32nk55eSDE5zI1Ah16IH5L7l2%252BrzmrM
k5dYZb1rTkahCBOeV0QujcejBbcGNqoUvD%252BuSHLy3yCm14J6UxtYokDAmeIbE2jwnrempFqMVj5BIQ6LlJERpcWJ8
3e9fhLWYXNGEvWlIL1wT1fdBUjg%252BZT%252FweOud3azu1h%252Fv00NBEQ09mSLRnXEtBMsl2YsOgUSrZUm2m0XeN
LdMvG%252F27wqWF1I2NyxrRJbnTZaLVBQTEGuBqEZ4XUUcYKXRC%252B1LwlKWxSmL03yXFpzd8DRPWM6%252Bkai%25
2BhPVBaan049vJNmcQ8k%252B7XR3X99tdIBiVBLeZ0P8V6ldwGAKdLpD5LDTMg3x3XfrbysTvpsn83yTM6PWhy1nLTy5
Wy9p0qn2Jqq4zzwsHwk%252FOvBsglNQL%252F3ctWZKFiZLxPkA59EJ1lZQOEAmdX%252B7%252B%252BbnnvwA%253D
%26RelayState%3Dhttps%253A%252F%252Fperkinscoiedev.service-now.com%252Fnavpage.do",
"request": {
"url": "https://perkinscoiedev.service-
now.com/scripts/heisenberg/heisenberg_all.jsx?v=12-09-2020_1945",
"method": "GET",
"headers": {
"Referer": "https://perkinscoiedev.service-now.com/auth_redirect.do?
sysparm_stack=no&sysparm_url=https%3A%2F%2Fmyapps.perkinscoie.com%2Fapp%2Fservicenow_ud%2Fexk
1jsx6trpNIFLGO0h8%2Fsso%2Fsaml%3FSAMLRequest%3DnVJdb9MwFP0rkd8TJ2aZgtVUCq0GlUoXrYUHXpAT365miW
18naz796Ru0coDE%252BL1%252Btxzz4dnKPqOWV4N%252FqAf4OcA6KNj32nk55eSDE5zI1Ah16IH5L7l2%252BrzmrM
k5dYZb1rTkahCBOeV0QujcejBbcGNqoUvD%252BuSHLy3yCm14J6UxtYokDAmeIbE2jwnrempFqMVj5BIQ6LlJERpcWJ8
3e9fhLWYXNGEvWlIL1wT1fdBUjg%252BZT%252FweOud3azu1h%252Fv00NBEQ09mSLRnXEtBMsl2YsOgUSrZUm2m0XeN
LdMvG%252F27wqWF1I2NyxrRJbnTZaLVBQTEGuBqEZ4XUUcYKXRC%252B1LwlKWxSmL03yXFpzd8DRPWM6%252Bkai%25
2BhPVBaan049vJNmcQ8k%252B7XR3X99tdIBiVBLeZ0P8V6ldwGAKdLpD5LDTMg3x3XfrbysTvpsn83yTM6PWhy1nLTy5
Wy9p0qn2Jqq4zzwsHwk%252FOvBsglNQL%252F3ctWZKFiZLxPkA59EJ1lZQOEAmdX%252B7%252B%252BbnnvwA%253D
%26RelayState%3Dhttps%253A%252F%252Fperkinscoiedev.service-now.com%252Fnavpage.do",
"User-Agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5)
AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36"
},
"mixedContentType": "none",
"initialPriority": "High",
"referrerPolicy": "same-origin"
},
"timestamp": 23727521.34998,
"wallTime": 1612513446.208439,
"initiator": {
"type": "parser",
"url": "https://perkinscoiedev.service-now.com/auth_redirect.do?
sysparm_stack=no&sysparm_url=https%3A%2F%2Fmyapps.perkinscoie.com%2Fapp%2Fservicenow_ud%2Fexk
1jsx6trpNIFLGO0h8%2Fsso%2Fsaml%3FSAMLRequest%3DnVJdb9MwFP0rkd8TJ2aZgtVUCq0GlUoXrYUHXpAT365miW
18naz796Ru0coDE%252BL1%252Btxzz4dnKPqOWV4N%252FqAf4OcA6KNj32nk55eSDE5zI1Ah16IH5L7l2%252BrzmrM
k5dYZb1rTkahCBOeV0QujcejBbcGNqoUvD%252BuSHLy3yCm14J6UxtYokDAmeIbE2jwnrempFqMVj5BIQ6LlJERpcWJ8
3e9fhLWYXNGEvWlIL1wT1fdBUjg%252BZT%252FweOud3azu1h%252Fv00NBEQ09mSLRnXEtBMsl2YsOgUSrZUm2m0XeN
LdMvG%252F27wqWF1I2NyxrRJbnTZaLVBQTEGuBqEZ4XUUcYKXRC%252B1LwlKWxSmL03yXFpzd8DRPWM6%252Bkai%25
2BhPVBaan049vJNmcQ8k%252B7XR3X99tdIBiVBLeZ0P8V6ldwGAKdLpD5LDTMg3x3XfrbysTvpsn83yTM6PWhy1nLTy5
Wy9p0qn2Jqq4zzwsHwk%252FOvBsglNQL%252F3ctWZKFiZLxPkA59EJ1lZQOEAmdX%252B7%252B%252BbnnvwA%253D
%26RelayState%3Dhttps%253A%252F%252Fperkinscoiedev.service-now.com%252Fnavpage.do",
"lineNumber": 352,
"columnNumber": 407
},
"type": "Script",
"frameId": "A7C87A170B6FF1BFF9C1519BD77B8C40",
"hasUserGesture": false
},
"response": {
"encodedDataLength": 38477,
"dataLength": 152904,

https://urlscan.io/api/v1/result/3a2c746e-192e-4901-9a5d-78b8b2ee32e3/ Page 35 of 119


03.10.2021, 14:47

"requestId": "24603.11",
"type": "Script",
"response": {
"url": "https://perkinscoiedev.service-
now.com/scripts/heisenberg/heisenberg_all.jsx?v=12-09-2020_1945",
"status": 200,
"statusText": "OK",
"headers": {
"Date": "Fri, 05 Feb 2021 08:24:06 GMT",
"Content-Encoding": "gzip",
"Last-Modified": "Thu, 10 Dec 2020 03:49:20 GMT",
"Server": "ServiceNow",
"Transfer-Encoding": "chunked",
"Content-Type": "text/javascript;charset=UTF-8",
"Cache-Control": "public",
"x-edge-enc-proxy-static": "true",
"Strict-Transport-Security": "max-age=63072000; includeSubDomains",
"Expires": "Wed, 09 Feb 2022 08:24:07 GMT"
},
"mimeType": "text/javascript",
"remoteIPAddress": "149.96.248.4",
"remotePort": 443,
"fromPrefetchCache": false,
"encodedDataLength": 377,
"timing": {
"requestTime": 23727521.351889,
"proxyStart": -1,
"proxyEnd": -1,
"dnsStart": -1,
"dnsEnd": -1,
"connectStart": -1,
"connectEnd": -1,
"sslStart": -1,
"sslEnd": -1,
"workerStart": -1,
"workerReady": -1,
"workerFetchStart": -1,
"workerRespondWithSettled": -1,
"sendStart": 897.381,
"sendEnd": 897.64,
"pushStart": 0,
"pushEnd": 0,
"receiveHeadersEnd": 1106.73
},
"responseTime": 1612513447317.025,
"protocol": "http/1.1",
"securityState": "secure",
"securityDetails": {
"protocol": "TLS 1.2",
"keyExchange": "ECDHE_RSA",
"keyExchangeGroup": "P-256",
"cipher": "AES_128_GCM",
"certificateId": 0,
"subjectName": "*.service-now.com",
"sanList": [
"*.service-now.com",
"service-now.com"
],
"issuer": "Entrust Certification Authority - L1K",
"validFrom": 1595462153,
"validTo": 1617321353,
"signedCertificateTimestampList": [],
"certificateTransparencyCompliance": "unknown"
},
"securityHeaders": [
{

https://urlscan.io/api/v1/result/3a2c746e-192e-4901-9a5d-78b8b2ee32e3/ Page 36 of 119


03.10.2021, 14:47

"name": "Strict-Transport-Security",
"value": "max-age=63072000; includeSubDomains"
}
]
},
"hash": "9fd51b6ee9aec10ed2fca5fe110b2d9c528b1dd7327bf518f9489b95dfd49531",
"size": 151581,
"asn": {
"ip": "149.96.248.4",
"asn": "16839",
"country": "US",
"registrar": "arin",
"date": "2010-12-16",
"description": "SNC, US",
"route": "149.96.240.0/20",
"name": "SNC"
},
"geoip": {
"range": [
2506096640,
2506162175
],
"country": "US",
"region": "",
"eu": "0",
"timezone": "America/Chicago",
"city": "",
"ll": [
37.751,
-97.822
],
"metro": 0,
"area": 1000,
"country_name": "United States"
},
"rdns": {
"ip": "149.96.248.4",
"ptr": "vip-149-96-248-4.cust.service-now.com"
}
},
"initiatorInfo": {
"url": "https://perkinscoiedev.service-now.com/auth_redirect.do?
sysparm_stack=no&sysparm_url=https%3A%2F%2Fmyapps.perkinscoie.com%2Fapp%2Fservicenow_ud%2Fexk
1jsx6trpNIFLGO0h8%2Fsso%2Fsaml%3FSAMLRequest%3DnVJdb9MwFP0rkd8TJ2aZgtVUCq0GlUoXrYUHXpAT365miW
18naz796Ru0coDE%252BL1%252Btxzz4dnKPqOWV4N%252FqAf4OcA6KNj32nk55eSDE5zI1Ah16IH5L7l2%252BrzmrM
k5dYZb1rTkahCBOeV0QujcejBbcGNqoUvD%252BuSHLy3yCm14J6UxtYokDAmeIbE2jwnrempFqMVj5BIQ6LlJERpcWJ8
3e9fhLWYXNGEvWlIL1wT1fdBUjg%252BZT%252FweOud3azu1h%252Fv00NBEQ09mSLRnXEtBMsl2YsOgUSrZUm2m0XeN
LdMvG%252F27wqWF1I2NyxrRJbnTZaLVBQTEGuBqEZ4XUUcYKXRC%252B1LwlKWxSmL03yXFpzd8DRPWM6%252Bkai%25
2BhPVBaan049vJNmcQ8k%252B7XR3X99tdIBiVBLeZ0P8V6ldwGAKdLpD5LDTMg3x3XfrbysTvpsn83yTM6PWhy1nLTy5
Wy9p0qn2Jqq4zzwsHwk%252FOvBsglNQL%252F3ctWZKFiZLxPkA59EJ1lZQOEAmdX%252B7%252B%252BbnnvwA%253D
%26RelayState%3Dhttps%253A%252F%252Fperkinscoiedev.service-now.com%252Fnavpage.do",
"host": "perkinscoiedev.service-now.com",
"type": "parser"
}
},
{
"request": {
"requestId": "24603.12",
"loaderId": "57C22717099627F4ACFB8060C2A3AA76",
"documentURL": "https://perkinscoiedev.service-now.com/auth_redirect.do?
sysparm_stack=no&sysparm_url=https%3A%2F%2Fmyapps.perkinscoie.com%2Fapp%2Fservicenow_ud%2Fexk
1jsx6trpNIFLGO0h8%2Fsso%2Fsaml%3FSAMLRequest%3DnVJdb9MwFP0rkd8TJ2aZgtVUCq0GlUoXrYUHXpAT365miW
18naz796Ru0coDE%252BL1%252Btxzz4dnKPqOWV4N%252FqAf4OcA6KNj32nk55eSDE5zI1Ah16IH5L7l2%252BrzmrM
k5dYZb1rTkahCBOeV0QujcejBbcGNqoUvD%252BuSHLy3yCm14J6UxtYokDAmeIbE2jwnrempFqMVj5BIQ6LlJERpcWJ8
3e9fhLWYXNGEvWlIL1wT1fdBUjg%252BZT%252FweOud3azu1h%252Fv00NBEQ09mSLRnXEtBMsl2YsOgUSrZUm2m0XeN
LdMvG%252F27wqWF1I2NyxrRJbnTZaLVBQTEGuBqEZ4XUUcYKXRC%252B1LwlKWxSmL03yXFpzd8DRPWM6%252Bkai%25

https://urlscan.io/api/v1/result/3a2c746e-192e-4901-9a5d-78b8b2ee32e3/ Page 37 of 119


03.10.2021, 14:47

2BhPVBaan049vJNmcQ8k%252B7XR3X99tdIBiVBLeZ0P8V6ldwGAKdLpD5LDTMg3x3XfrbysTvpsn83yTM6PWhy1nLTy5
Wy9p0qn2Jqq4zzwsHwk%252FOvBsglNQL%252F3ctWZKFiZLxPkA59EJ1lZQOEAmdX%252B7%252B%252BbnnvwA%253D
%26RelayState%3Dhttps%253A%252F%252Fperkinscoiedev.service-now.com%252Fnavpage.do",
"request": {
"url": "https://perkinscoiedev.service-
now.com/scripts/js_includes_list_edit_doctype.jsx?v=12-09-
2020_1945&lp=Thu_Feb_04_13_15_24_PST_2021&c=9_108",
"method": "GET",
"headers": {
"Referer": "https://perkinscoiedev.service-now.com/auth_redirect.do?
sysparm_stack=no&sysparm_url=https%3A%2F%2Fmyapps.perkinscoie.com%2Fapp%2Fservicenow_ud%2Fexk
1jsx6trpNIFLGO0h8%2Fsso%2Fsaml%3FSAMLRequest%3DnVJdb9MwFP0rkd8TJ2aZgtVUCq0GlUoXrYUHXpAT365miW
18naz796Ru0coDE%252BL1%252Btxzz4dnKPqOWV4N%252FqAf4OcA6KNj32nk55eSDE5zI1Ah16IH5L7l2%252BrzmrM
k5dYZb1rTkahCBOeV0QujcejBbcGNqoUvD%252BuSHLy3yCm14J6UxtYokDAmeIbE2jwnrempFqMVj5BIQ6LlJERpcWJ8
3e9fhLWYXNGEvWlIL1wT1fdBUjg%252BZT%252FweOud3azu1h%252Fv00NBEQ09mSLRnXEtBMsl2YsOgUSrZUm2m0XeN
LdMvG%252F27wqWF1I2NyxrRJbnTZaLVBQTEGuBqEZ4XUUcYKXRC%252B1LwlKWxSmL03yXFpzd8DRPWM6%252Bkai%25
2BhPVBaan049vJNmcQ8k%252B7XR3X99tdIBiVBLeZ0P8V6ldwGAKdLpD5LDTMg3x3XfrbysTvpsn83yTM6PWhy1nLTy5
Wy9p0qn2Jqq4zzwsHwk%252FOvBsglNQL%252F3ctWZKFiZLxPkA59EJ1lZQOEAmdX%252B7%252B%252BbnnvwA%253D
%26RelayState%3Dhttps%253A%252F%252Fperkinscoiedev.service-now.com%252Fnavpage.do",
"User-Agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5)
AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36"
},
"mixedContentType": "none",
"initialPriority": "High",
"referrerPolicy": "same-origin"
},
"timestamp": 23727521.350437,
"wallTime": 1612513446.208896,
"initiator": {
"type": "parser",
"url": "https://perkinscoiedev.service-now.com/auth_redirect.do?
sysparm_stack=no&sysparm_url=https%3A%2F%2Fmyapps.perkinscoie.com%2Fapp%2Fservicenow_ud%2Fexk
1jsx6trpNIFLGO0h8%2Fsso%2Fsaml%3FSAMLRequest%3DnVJdb9MwFP0rkd8TJ2aZgtVUCq0GlUoXrYUHXpAT365miW
18naz796Ru0coDE%252BL1%252Btxzz4dnKPqOWV4N%252FqAf4OcA6KNj32nk55eSDE5zI1Ah16IH5L7l2%252BrzmrM
k5dYZb1rTkahCBOeV0QujcejBbcGNqoUvD%252BuSHLy3yCm14J6UxtYokDAmeIbE2jwnrempFqMVj5BIQ6LlJERpcWJ8
3e9fhLWYXNGEvWlIL1wT1fdBUjg%252BZT%252FweOud3azu1h%252Fv00NBEQ09mSLRnXEtBMsl2YsOgUSrZUm2m0XeN
LdMvG%252F27wqWF1I2NyxrRJbnTZaLVBQTEGuBqEZ4XUUcYKXRC%252B1LwlKWxSmL03yXFpzd8DRPWM6%252Bkai%25
2BhPVBaan049vJNmcQ8k%252B7XR3X99tdIBiVBLeZ0P8V6ldwGAKdLpD5LDTMg3x3XfrbysTvpsn83yTM6PWhy1nLTy5
Wy9p0qn2Jqq4zzwsHwk%252FOvBsglNQL%252F3ctWZKFiZLxPkA59EJ1lZQOEAmdX%252B7%252B%252BbnnvwA%253D
%26RelayState%3Dhttps%253A%252F%252Fperkinscoiedev.service-now.com%252Fnavpage.do",
"lineNumber": 352,
"columnNumber": 562
},
"type": "Script",
"frameId": "A7C87A170B6FF1BFF9C1519BD77B8C40",
"hasUserGesture": false
},
"response": {
"encodedDataLength": 41223,
"dataLength": 188910,
"requestId": "24603.12",
"type": "Script",
"response": {
"url": "https://perkinscoiedev.service-
now.com/scripts/js_includes_list_edit_doctype.jsx?v=12-09-
2020_1945&lp=Thu_Feb_04_13_15_24_PST_2021&c=9_108",
"status": 200,
"statusText": "OK",
"headers": {
"Date": "Fri, 05 Feb 2021 08:24:06 GMT",
"Content-Encoding": "gzip",
"Last-Modified": "Thu, 10 Dec 2020 03:49:18 GMT",
"Server": "ServiceNow",
"Transfer-Encoding": "chunked",
"Content-Type": "text/javascript;charset=UTF-8",
"Cache-Control": "public",

https://urlscan.io/api/v1/result/3a2c746e-192e-4901-9a5d-78b8b2ee32e3/ Page 38 of 119


03.10.2021, 14:47

"x-edge-enc-proxy-static": "true",
"Strict-Transport-Security": "max-age=63072000; includeSubDomains",
"Expires": "Wed, 09 Feb 2022 08:24:07 GMT"
},
"mimeType": "text/javascript",
"remoteIPAddress": "149.96.248.4",
"remotePort": 443,
"fromPrefetchCache": false,
"encodedDataLength": 377,
"timing": {
"requestTime": 23727521.352511,
"proxyStart": -1,
"proxyEnd": -1,
"dnsStart": -1,
"dnsEnd": -1,
"connectStart": -1,
"connectEnd": -1,
"sslStart": -1,
"sslEnd": -1,
"workerStart": -1,
"workerReady": -1,
"workerFetchStart": -1,
"workerRespondWithSettled": -1,
"sendStart": 951.044,
"sendEnd": 951.245,
"pushStart": 0,
"pushEnd": 0,
"receiveHeadersEnd": 1159.683
},
"responseTime": 1612513447370.593,
"protocol": "http/1.1",
"securityState": "secure",
"securityDetails": {
"protocol": "TLS 1.2",
"keyExchange": "ECDHE_RSA",
"keyExchangeGroup": "P-256",
"cipher": "AES_128_GCM",
"certificateId": 0,
"subjectName": "*.service-now.com",
"sanList": [
"*.service-now.com",
"service-now.com"
],
"issuer": "Entrust Certification Authority - L1K",
"validFrom": 1595462153,
"validTo": 1617321353,
"signedCertificateTimestampList": [],
"certificateTransparencyCompliance": "unknown"
},
"securityHeaders": [
{
"name": "Strict-Transport-Security",
"value": "max-age=63072000; includeSubDomains"
}
]
},
"hash": "e342c45a3d715aebb66b238766a80327d66baa2182d0fa541f4d60df84ae42c6",
"size": 188910,
"asn": {
"ip": "149.96.248.4",
"asn": "16839",
"country": "US",
"registrar": "arin",
"date": "2010-12-16",
"description": "SNC, US",
"route": "149.96.240.0/20",

https://urlscan.io/api/v1/result/3a2c746e-192e-4901-9a5d-78b8b2ee32e3/ Page 39 of 119


03.10.2021, 14:47

"name": "SNC"
},
"geoip": {
"range": [
2506096640,
2506162175
],
"country": "US",
"region": "",
"eu": "0",
"timezone": "America/Chicago",
"city": "",
"ll": [
37.751,
-97.822
],
"metro": 0,
"area": 1000,
"country_name": "United States"
},
"rdns": {
"ip": "149.96.248.4",
"ptr": "vip-149-96-248-4.cust.service-now.com"
}
},
"initiatorInfo": {
"url": "https://perkinscoiedev.service-now.com/auth_redirect.do?
sysparm_stack=no&sysparm_url=https%3A%2F%2Fmyapps.perkinscoie.com%2Fapp%2Fservicenow_ud%2Fexk
1jsx6trpNIFLGO0h8%2Fsso%2Fsaml%3FSAMLRequest%3DnVJdb9MwFP0rkd8TJ2aZgtVUCq0GlUoXrYUHXpAT365miW
18naz796Ru0coDE%252BL1%252Btxzz4dnKPqOWV4N%252FqAf4OcA6KNj32nk55eSDE5zI1Ah16IH5L7l2%252BrzmrM
k5dYZb1rTkahCBOeV0QujcejBbcGNqoUvD%252BuSHLy3yCm14J6UxtYokDAmeIbE2jwnrempFqMVj5BIQ6LlJERpcWJ8
3e9fhLWYXNGEvWlIL1wT1fdBUjg%252BZT%252FweOud3azu1h%252Fv00NBEQ09mSLRnXEtBMsl2YsOgUSrZUm2m0XeN
LdMvG%252F27wqWF1I2NyxrRJbnTZaLVBQTEGuBqEZ4XUUcYKXRC%252B1LwlKWxSmL03yXFpzd8DRPWM6%252Bkai%25
2BhPVBaan049vJNmcQ8k%252B7XR3X99tdIBiVBLeZ0P8V6ldwGAKdLpD5LDTMg3x3XfrbysTvpsn83yTM6PWhy1nLTy5
Wy9p0qn2Jqq4zzwsHwk%252FOvBsglNQL%252F3ctWZKFiZLxPkA59EJ1lZQOEAmdX%252B7%252B%252BbnnvwA%253D
%26RelayState%3Dhttps%253A%252F%252Fperkinscoiedev.service-now.com%252Fnavpage.do",
"host": "perkinscoiedev.service-now.com",
"type": "parser"
}
},
{
"request": {
"requestId": "24603.13",
"loaderId": "57C22717099627F4ACFB8060C2A3AA76",
"documentURL": "https://perkinscoiedev.service-now.com/auth_redirect.do?
sysparm_stack=no&sysparm_url=https%3A%2F%2Fmyapps.perkinscoie.com%2Fapp%2Fservicenow_ud%2Fexk
1jsx6trpNIFLGO0h8%2Fsso%2Fsaml%3FSAMLRequest%3DnVJdb9MwFP0rkd8TJ2aZgtVUCq0GlUoXrYUHXpAT365miW
18naz796Ru0coDE%252BL1%252Btxzz4dnKPqOWV4N%252FqAf4OcA6KNj32nk55eSDE5zI1Ah16IH5L7l2%252BrzmrM
k5dYZb1rTkahCBOeV0QujcejBbcGNqoUvD%252BuSHLy3yCm14J6UxtYokDAmeIbE2jwnrempFqMVj5BIQ6LlJERpcWJ8
3e9fhLWYXNGEvWlIL1wT1fdBUjg%252BZT%252FweOud3azu1h%252Fv00NBEQ09mSLRnXEtBMsl2YsOgUSrZUm2m0XeN
LdMvG%252F27wqWF1I2NyxrRJbnTZaLVBQTEGuBqEZ4XUUcYKXRC%252B1LwlKWxSmL03yXFpzd8DRPWM6%252Bkai%25
2BhPVBaan049vJNmcQ8k%252B7XR3X99tdIBiVBLeZ0P8V6ldwGAKdLpD5LDTMg3x3XfrbysTvpsn83yTM6PWhy1nLTy5
Wy9p0qn2Jqq4zzwsHwk%252FOvBsglNQL%252F3ctWZKFiZLxPkA59EJ1lZQOEAmdX%252B7%252B%252BbnnvwA%253D
%26RelayState%3Dhttps%253A%252F%252Fperkinscoiedev.service-now.com%252Fnavpage.do",
"request": {
"url": "https://perkinscoiedev.service-
now.com/scripts/transaction_scope_includes.jsx?v=12-09-2020_1945",
"method": "GET",
"headers": {
"Referer": "https://perkinscoiedev.service-now.com/auth_redirect.do?
sysparm_stack=no&sysparm_url=https%3A%2F%2Fmyapps.perkinscoie.com%2Fapp%2Fservicenow_ud%2Fexk
1jsx6trpNIFLGO0h8%2Fsso%2Fsaml%3FSAMLRequest%3DnVJdb9MwFP0rkd8TJ2aZgtVUCq0GlUoXrYUHXpAT365miW
18naz796Ru0coDE%252BL1%252Btxzz4dnKPqOWV4N%252FqAf4OcA6KNj32nk55eSDE5zI1Ah16IH5L7l2%252BrzmrM
k5dYZb1rTkahCBOeV0QujcejBbcGNqoUvD%252BuSHLy3yCm14J6UxtYokDAmeIbE2jwnrempFqMVj5BIQ6LlJERpcWJ8
3e9fhLWYXNGEvWlIL1wT1fdBUjg%252BZT%252FweOud3azu1h%252Fv00NBEQ09mSLRnXEtBMsl2YsOgUSrZUm2m0XeN
LdMvG%252F27wqWF1I2NyxrRJbnTZaLVBQTEGuBqEZ4XUUcYKXRC%252B1LwlKWxSmL03yXFpzd8DRPWM6%252Bkai%25

https://urlscan.io/api/v1/result/3a2c746e-192e-4901-9a5d-78b8b2ee32e3/ Page 40 of 119


03.10.2021, 14:47

2BhPVBaan049vJNmcQ8k%252B7XR3X99tdIBiVBLeZ0P8V6ldwGAKdLpD5LDTMg3x3XfrbysTvpsn83yTM6PWhy1nLTy5
Wy9p0qn2Jqq4zzwsHwk%252FOvBsglNQL%252F3ctWZKFiZLxPkA59EJ1lZQOEAmdX%252B7%252B%252BbnnvwA%253D
%26RelayState%3Dhttps%253A%252F%252Fperkinscoiedev.service-now.com%252Fnavpage.do",
"User-Agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5)
AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36"
},
"mixedContentType": "none",
"initialPriority": "High",
"referrerPolicy": "same-origin"
},
"timestamp": 23727521.350919,
"wallTime": 1612513446.209377,
"initiator": {
"type": "parser",
"url": "https://perkinscoiedev.service-now.com/auth_redirect.do?
sysparm_stack=no&sysparm_url=https%3A%2F%2Fmyapps.perkinscoie.com%2Fapp%2Fservicenow_ud%2Fexk
1jsx6trpNIFLGO0h8%2Fsso%2Fsaml%3FSAMLRequest%3DnVJdb9MwFP0rkd8TJ2aZgtVUCq0GlUoXrYUHXpAT365miW
18naz796Ru0coDE%252BL1%252Btxzz4dnKPqOWV4N%252FqAf4OcA6KNj32nk55eSDE5zI1Ah16IH5L7l2%252BrzmrM
k5dYZb1rTkahCBOeV0QujcejBbcGNqoUvD%252BuSHLy3yCm14J6UxtYokDAmeIbE2jwnrempFqMVj5BIQ6LlJERpcWJ8
3e9fhLWYXNGEvWlIL1wT1fdBUjg%252BZT%252FweOud3azu1h%252Fv00NBEQ09mSLRnXEtBMsl2YsOgUSrZUm2m0XeN
LdMvG%252F27wqWF1I2NyxrRJbnTZaLVBQTEGuBqEZ4XUUcYKXRC%252B1LwlKWxSmL03yXFpzd8DRPWM6%252Bkai%25
2BhPVBaan049vJNmcQ8k%252B7XR3X99tdIBiVBLeZ0P8V6ldwGAKdLpD5LDTMg3x3XfrbysTvpsn83yTM6PWhy1nLTy5
Wy9p0qn2Jqq4zzwsHwk%252FOvBsglNQL%252F3ctWZKFiZLxPkA59EJ1lZQOEAmdX%252B7%252B%252BbnnvwA%253D
%26RelayState%3Dhttps%253A%252F%252Fperkinscoiedev.service-now.com%252Fnavpage.do",
"lineNumber": 352,
"columnNumber": 666
},
"type": "Script",
"frameId": "A7C87A170B6FF1BFF9C1519BD77B8C40",
"hasUserGesture": false
},
"response": {
"encodedDataLength": 765,
"dataLength": 1229,
"requestId": "24603.13",
"type": "Script",
"response": {
"url": "https://perkinscoiedev.service-
now.com/scripts/transaction_scope_includes.jsx?v=12-09-2020_1945",
"status": 200,
"statusText": "OK",
"headers": {
"Date": "Fri, 05 Feb 2021 08:24:06 GMT",
"Content-Encoding": "gzip",
"Last-Modified": "Thu, 04 Feb 2021 06:38:00 GMT",
"Server": "ServiceNow",
"Strict-Transport-Security": "max-age=63072000; includeSubDomains",
"Content-Type": "text/javascript;charset=UTF-8",
"Cache-Control": "public",
"x-edge-enc-proxy-static": "true",
"Content-Length": "395",
"Expires": "Wed, 09 Feb 2022 08:24:07 GMT"
},
"mimeType": "text/javascript",
"remoteIPAddress": "149.96.248.4",
"remotePort": 443,
"fromPrefetchCache": false,
"encodedDataLength": 370,
"timing": {
"requestTime": 23727521.352966,
"proxyStart": -1,
"proxyEnd": -1,
"dnsStart": -1,
"dnsEnd": -1,
"connectStart": -1,
"connectEnd": -1,

https://urlscan.io/api/v1/result/3a2c746e-192e-4901-9a5d-78b8b2ee32e3/ Page 41 of 119


03.10.2021, 14:47

"sslStart": -1,
"sslEnd": -1,
"workerStart": -1,
"workerReady": -1,
"workerFetchStart": -1,
"workerRespondWithSettled": -1,
"sendStart": 956.764,
"sendEnd": 956.967,
"pushStart": 0,
"pushEnd": 0,
"receiveHeadersEnd": 1118.486
},
"responseTime": 1612513447329.865,
"protocol": "http/1.1",
"securityState": "secure",
"securityDetails": {
"protocol": "TLS 1.2",
"keyExchange": "ECDHE_RSA",
"keyExchangeGroup": "P-256",
"cipher": "AES_128_GCM",
"certificateId": 0,
"subjectName": "*.service-now.com",
"sanList": [
"*.service-now.com",
"service-now.com"
],
"issuer": "Entrust Certification Authority - L1K",
"validFrom": 1595462153,
"validTo": 1617321353,
"signedCertificateTimestampList": [],
"certificateTransparencyCompliance": "unknown"
},
"securityHeaders": [
{
"name": "Strict-Transport-Security",
"value": "max-age=63072000; includeSubDomains"
}
]
},
"hash": "5a82f71dc61d033dc7a9832aa2c44b7d0b25705c268d6cf6a6cbbd687fe7ab10",
"size": 1229,
"asn": {
"ip": "149.96.248.4",
"asn": "16839",
"country": "US",
"registrar": "arin",
"date": "2010-12-16",
"description": "SNC, US",
"route": "149.96.240.0/20",
"name": "SNC"
},
"geoip": {
"range": [
2506096640,
2506162175
],
"country": "US",
"region": "",
"eu": "0",
"timezone": "America/Chicago",
"city": "",
"ll": [
37.751,
-97.822
],
"metro": 0,

https://urlscan.io/api/v1/result/3a2c746e-192e-4901-9a5d-78b8b2ee32e3/ Page 42 of 119


03.10.2021, 14:47

"area": 1000,
"country_name": "United States"
},
"rdns": {
"ip": "149.96.248.4",
"ptr": "vip-149-96-248-4.cust.service-now.com"
}
},
"initiatorInfo": {
"url": "https://perkinscoiedev.service-now.com/auth_redirect.do?
sysparm_stack=no&sysparm_url=https%3A%2F%2Fmyapps.perkinscoie.com%2Fapp%2Fservicenow_ud%2Fexk
1jsx6trpNIFLGO0h8%2Fsso%2Fsaml%3FSAMLRequest%3DnVJdb9MwFP0rkd8TJ2aZgtVUCq0GlUoXrYUHXpAT365miW
18naz796Ru0coDE%252BL1%252Btxzz4dnKPqOWV4N%252FqAf4OcA6KNj32nk55eSDE5zI1Ah16IH5L7l2%252BrzmrM
k5dYZb1rTkahCBOeV0QujcejBbcGNqoUvD%252BuSHLy3yCm14J6UxtYokDAmeIbE2jwnrempFqMVj5BIQ6LlJERpcWJ8
3e9fhLWYXNGEvWlIL1wT1fdBUjg%252BZT%252FweOud3azu1h%252Fv00NBEQ09mSLRnXEtBMsl2YsOgUSrZUm2m0XeN
LdMvG%252F27wqWF1I2NyxrRJbnTZaLVBQTEGuBqEZ4XUUcYKXRC%252B1LwlKWxSmL03yXFpzd8DRPWM6%252Bkai%25
2BhPVBaan049vJNmcQ8k%252B7XR3X99tdIBiVBLeZ0P8V6ldwGAKdLpD5LDTMg3x3XfrbysTvpsn83yTM6PWhy1nLTy5
Wy9p0qn2Jqq4zzwsHwk%252FOvBsglNQL%252F3ctWZKFiZLxPkA59EJ1lZQOEAmdX%252B7%252B%252BbnnvwA%253D
%26RelayState%3Dhttps%253A%252F%252Fperkinscoiedev.service-now.com%252Fnavpage.do",
"host": "perkinscoiedev.service-now.com",
"type": "parser"
}
},
{
"request": {
"requestId": "24603.15",
"loaderId": "57C22717099627F4ACFB8060C2A3AA76",
"documentURL": "https://perkinscoiedev.service-now.com/auth_redirect.do?
sysparm_stack=no&sysparm_url=https%3A%2F%2Fmyapps.perkinscoie.com%2Fapp%2Fservicenow_ud%2Fexk
1jsx6trpNIFLGO0h8%2Fsso%2Fsaml%3FSAMLRequest%3DnVJdb9MwFP0rkd8TJ2aZgtVUCq0GlUoXrYUHXpAT365miW
18naz796Ru0coDE%252BL1%252Btxzz4dnKPqOWV4N%252FqAf4OcA6KNj32nk55eSDE5zI1Ah16IH5L7l2%252BrzmrM
k5dYZb1rTkahCBOeV0QujcejBbcGNqoUvD%252BuSHLy3yCm14J6UxtYokDAmeIbE2jwnrempFqMVj5BIQ6LlJERpcWJ8
3e9fhLWYXNGEvWlIL1wT1fdBUjg%252BZT%252FweOud3azu1h%252Fv00NBEQ09mSLRnXEtBMsl2YsOgUSrZUm2m0XeN
LdMvG%252F27wqWF1I2NyxrRJbnTZaLVBQTEGuBqEZ4XUUcYKXRC%252B1LwlKWxSmL03yXFpzd8DRPWM6%252Bkai%25
2BhPVBaan049vJNmcQ8k%252B7XR3X99tdIBiVBLeZ0P8V6ldwGAKdLpD5LDTMg3x3XfrbysTvpsn83yTM6PWhy1nLTy5
Wy9p0qn2Jqq4zzwsHwk%252FOvBsglNQL%252F3ctWZKFiZLxPkA59EJ1lZQOEAmdX%252B7%252B%252BbnnvwA%253D
%26RelayState%3Dhttps%253A%252F%252Fperkinscoiedev.service-now.com%252Fnavpage.do",
"request": {
"url": "https://perkinscoiedev.service-
now.com/scripts/doctype/z_last_include.jsx?v=12-09-2020_1945",
"method": "GET",
"headers": {
"Referer": "https://perkinscoiedev.service-now.com/auth_redirect.do?
sysparm_stack=no&sysparm_url=https%3A%2F%2Fmyapps.perkinscoie.com%2Fapp%2Fservicenow_ud%2Fexk
1jsx6trpNIFLGO0h8%2Fsso%2Fsaml%3FSAMLRequest%3DnVJdb9MwFP0rkd8TJ2aZgtVUCq0GlUoXrYUHXpAT365miW
18naz796Ru0coDE%252BL1%252Btxzz4dnKPqOWV4N%252FqAf4OcA6KNj32nk55eSDE5zI1Ah16IH5L7l2%252BrzmrM
k5dYZb1rTkahCBOeV0QujcejBbcGNqoUvD%252BuSHLy3yCm14J6UxtYokDAmeIbE2jwnrempFqMVj5BIQ6LlJERpcWJ8
3e9fhLWYXNGEvWlIL1wT1fdBUjg%252BZT%252FweOud3azu1h%252Fv00NBEQ09mSLRnXEtBMsl2YsOgUSrZUm2m0XeN
LdMvG%252F27wqWF1I2NyxrRJbnTZaLVBQTEGuBqEZ4XUUcYKXRC%252B1LwlKWxSmL03yXFpzd8DRPWM6%252Bkai%25
2BhPVBaan049vJNmcQ8k%252B7XR3X99tdIBiVBLeZ0P8V6ldwGAKdLpD5LDTMg3x3XfrbysTvpsn83yTM6PWhy1nLTy5
Wy9p0qn2Jqq4zzwsHwk%252FOvBsglNQL%252F3ctWZKFiZLxPkA59EJ1lZQOEAmdX%252B7%252B%252BbnnvwA%253D
%26RelayState%3Dhttps%253A%252F%252Fperkinscoiedev.service-now.com%252Fnavpage.do",
"User-Agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5)
AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36"
},
"mixedContentType": "none",
"initialPriority": "High",
"referrerPolicy": "same-origin"
},
"timestamp": 23727521.514509,
"wallTime": 1612513446.372967,
"initiator": {
"type": "parser",
"url": "https://perkinscoiedev.service-now.com/auth_redirect.do?
sysparm_stack=no&sysparm_url=https%3A%2F%2Fmyapps.perkinscoie.com%2Fapp%2Fservicenow_ud%2Fexk
1jsx6trpNIFLGO0h8%2Fsso%2Fsaml%3FSAMLRequest%3DnVJdb9MwFP0rkd8TJ2aZgtVUCq0GlUoXrYUHXpAT365miW

https://urlscan.io/api/v1/result/3a2c746e-192e-4901-9a5d-78b8b2ee32e3/ Page 43 of 119


03.10.2021, 14:47

18naz796Ru0coDE%252BL1%252Btxzz4dnKPqOWV4N%252FqAf4OcA6KNj32nk55eSDE5zI1Ah16IH5L7l2%252BrzmrM
k5dYZb1rTkahCBOeV0QujcejBbcGNqoUvD%252BuSHLy3yCm14J6UxtYokDAmeIbE2jwnrempFqMVj5BIQ6LlJERpcWJ8
3e9fhLWYXNGEvWlIL1wT1fdBUjg%252BZT%252FweOud3azu1h%252Fv00NBEQ09mSLRnXEtBMsl2YsOgUSrZUm2m0XeN
LdMvG%252F27wqWF1I2NyxrRJbnTZaLVBQTEGuBqEZ4XUUcYKXRC%252B1LwlKWxSmL03yXFpzd8DRPWM6%252Bkai%25
2BhPVBaan049vJNmcQ8k%252B7XR3X99tdIBiVBLeZ0P8V6ldwGAKdLpD5LDTMg3x3XfrbysTvpsn83yTM6PWhy1nLTy5
Wy9p0qn2Jqq4zzwsHwk%252FOvBsglNQL%252F3ctWZKFiZLxPkA59EJ1lZQOEAmdX%252B7%252B%252BbnnvwA%253D
%26RelayState%3Dhttps%253A%252F%252Fperkinscoiedev.service-now.com%252Fnavpage.do",
"lineNumber": 419,
"columnNumber": 115
},
"type": "Script",
"frameId": "A7C87A170B6FF1BFF9C1519BD77B8C40",
"hasUserGesture": false
},
"response": {
"encodedDataLength": 938,
"dataLength": 1274,
"requestId": "24603.15",
"type": "Script",
"response": {
"url": "https://perkinscoiedev.service-
now.com/scripts/doctype/z_last_include.jsx?v=12-09-2020_1945",
"status": 200,
"statusText": "OK",
"headers": {
"Date": "Fri, 05 Feb 2021 08:24:06 GMT",
"Content-Encoding": "gzip",
"Last-Modified": "Thu, 10 Dec 2020 03:49:20 GMT",
"Server": "ServiceNow",
"Strict-Transport-Security": "max-age=63072000; includeSubDomains",
"Content-Type": "text/javascript;charset=UTF-8",
"Cache-Control": "public",
"x-edge-enc-proxy-static": "true",
"Content-Length": "568",
"Expires": "Wed, 09 Feb 2022 08:24:07 GMT"
},
"mimeType": "text/javascript",
"remoteIPAddress": "149.96.248.4",
"remotePort": 443,
"fromPrefetchCache": false,
"encodedDataLength": 370,
"timing": {
"requestTime": 23727521.514825,
"proxyStart": -1,
"proxyEnd": -1,
"dnsStart": -1,
"dnsEnd": -1,
"connectStart": -1,
"connectEnd": -1,
"sslStart": -1,
"sslEnd": -1,
"workerStart": -1,
"workerReady": -1,
"workerFetchStart": -1,
"workerRespondWithSettled": -1,
"sendStart": 807.375,
"sendEnd": 807.575,
"pushStart": 0,
"pushEnd": 0,
"receiveHeadersEnd": 964.354
},
"responseTime": 1612513447337.591,
"protocol": "http/1.1",
"securityState": "secure",
"securityDetails": {
"protocol": "TLS 1.2",

https://urlscan.io/api/v1/result/3a2c746e-192e-4901-9a5d-78b8b2ee32e3/ Page 44 of 119


03.10.2021, 14:47

"keyExchange": "ECDHE_RSA",
"keyExchangeGroup": "P-256",
"cipher": "AES_128_GCM",
"certificateId": 0,
"subjectName": "*.service-now.com",
"sanList": [
"*.service-now.com",
"service-now.com"
],
"issuer": "Entrust Certification Authority - L1K",
"validFrom": 1595462153,
"validTo": 1617321353,
"signedCertificateTimestampList": [],
"certificateTransparencyCompliance": "unknown"
},
"securityHeaders": [
{
"name": "Strict-Transport-Security",
"value": "max-age=63072000; includeSubDomains"
}
]
},
"hash": "2771e4e74822121736662c759a072d6d4fe24276074f2724aea0ca8d0a864566",
"size": 1274,
"asn": {
"ip": "149.96.248.4",
"asn": "16839",
"country": "US",
"registrar": "arin",
"date": "2010-12-16",
"description": "SNC, US",
"route": "149.96.240.0/20",
"name": "SNC"
},
"geoip": {
"range": [
2506096640,
2506162175
],
"country": "US",
"region": "",
"eu": "0",
"timezone": "America/Chicago",
"city": "",
"ll": [
37.751,
-97.822
],
"metro": 0,
"area": 1000,
"country_name": "United States"
},
"rdns": {
"ip": "149.96.248.4",
"ptr": "vip-149-96-248-4.cust.service-now.com"
}
},
"initiatorInfo": {
"url": "https://perkinscoiedev.service-now.com/auth_redirect.do?
sysparm_stack=no&sysparm_url=https%3A%2F%2Fmyapps.perkinscoie.com%2Fapp%2Fservicenow_ud%2Fexk
1jsx6trpNIFLGO0h8%2Fsso%2Fsaml%3FSAMLRequest%3DnVJdb9MwFP0rkd8TJ2aZgtVUCq0GlUoXrYUHXpAT365miW
18naz796Ru0coDE%252BL1%252Btxzz4dnKPqOWV4N%252FqAf4OcA6KNj32nk55eSDE5zI1Ah16IH5L7l2%252BrzmrM
k5dYZb1rTkahCBOeV0QujcejBbcGNqoUvD%252BuSHLy3yCm14J6UxtYokDAmeIbE2jwnrempFqMVj5BIQ6LlJERpcWJ8
3e9fhLWYXNGEvWlIL1wT1fdBUjg%252BZT%252FweOud3azu1h%252Fv00NBEQ09mSLRnXEtBMsl2YsOgUSrZUm2m0XeN
LdMvG%252F27wqWF1I2NyxrRJbnTZaLVBQTEGuBqEZ4XUUcYKXRC%252B1LwlKWxSmL03yXFpzd8DRPWM6%252Bkai%25
2BhPVBaan049vJNmcQ8k%252B7XR3X99tdIBiVBLeZ0P8V6ldwGAKdLpD5LDTMg3x3XfrbysTvpsn83yTM6PWhy1nLTy5

https://urlscan.io/api/v1/result/3a2c746e-192e-4901-9a5d-78b8b2ee32e3/ Page 45 of 119


03.10.2021, 14:47

Wy9p0qn2Jqq4zzwsHwk%252FOvBsglNQL%252F3ctWZKFiZLxPkA59EJ1lZQOEAmdX%252B7%252B%252BbnnvwA%253D
%26RelayState%3Dhttps%253A%252F%252Fperkinscoiedev.service-now.com%252Fnavpage.do",
"host": "perkinscoiedev.service-now.com",
"type": "parser"
}
},
{
"request": {
"requestId": "24603.33",
"loaderId": "57C22717099627F4ACFB8060C2A3AA76",
"documentURL": "https://perkinscoiedev.service-now.com/auth_redirect.do?
sysparm_stack=no&sysparm_url=https%3A%2F%2Fmyapps.perkinscoie.com%2Fapp%2Fservicenow_ud%2Fexk
1jsx6trpNIFLGO0h8%2Fsso%2Fsaml%3FSAMLRequest%3DnVJdb9MwFP0rkd8TJ2aZgtVUCq0GlUoXrYUHXpAT365miW
18naz796Ru0coDE%252BL1%252Btxzz4dnKPqOWV4N%252FqAf4OcA6KNj32nk55eSDE5zI1Ah16IH5L7l2%252BrzmrM
k5dYZb1rTkahCBOeV0QujcejBbcGNqoUvD%252BuSHLy3yCm14J6UxtYokDAmeIbE2jwnrempFqMVj5BIQ6LlJERpcWJ8
3e9fhLWYXNGEvWlIL1wT1fdBUjg%252BZT%252FweOud3azu1h%252Fv00NBEQ09mSLRnXEtBMsl2YsOgUSrZUm2m0XeN
LdMvG%252F27wqWF1I2NyxrRJbnTZaLVBQTEGuBqEZ4XUUcYKXRC%252B1LwlKWxSmL03yXFpzd8DRPWM6%252Bkai%25
2BhPVBaan049vJNmcQ8k%252B7XR3X99tdIBiVBLeZ0P8V6ldwGAKdLpD5LDTMg3x3XfrbysTvpsn83yTM6PWhy1nLTy5
Wy9p0qn2Jqq4zzwsHwk%252FOvBsglNQL%252F3ctWZKFiZLxPkA59EJ1lZQOEAmdX%252B7%252B%252BbnnvwA%253D
%26RelayState%3Dhttps%253A%252F%252Fperkinscoiedev.service-now.com%252Fnavpage.do",
"request": {
"url": "https://perkinscoiedev.service-now.com/api/now/ui/date_time/legacy",
"method": "GET",
"headers": {
"Accept": "application/json",
"Referer": "https://perkinscoiedev.service-now.com/auth_redirect.do?
sysparm_stack=no&sysparm_url=https%3A%2F%2Fmyapps.perkinscoie.com%2Fapp%2Fservicenow_ud%2Fexk
1jsx6trpNIFLGO0h8%2Fsso%2Fsaml%3FSAMLRequest%3DnVJdb9MwFP0rkd8TJ2aZgtVUCq0GlUoXrYUHXpAT365miW
18naz796Ru0coDE%252BL1%252Btxzz4dnKPqOWV4N%252FqAf4OcA6KNj32nk55eSDE5zI1Ah16IH5L7l2%252BrzmrM
k5dYZb1rTkahCBOeV0QujcejBbcGNqoUvD%252BuSHLy3yCm14J6UxtYokDAmeIbE2jwnrempFqMVj5BIQ6LlJERpcWJ8
3e9fhLWYXNGEvWlIL1wT1fdBUjg%252BZT%252FweOud3azu1h%252Fv00NBEQ09mSLRnXEtBMsl2YsOgUSrZUm2m0XeN
LdMvG%252F27wqWF1I2NyxrRJbnTZaLVBQTEGuBqEZ4XUUcYKXRC%252B1LwlKWxSmL03yXFpzd8DRPWM6%252Bkai%25
2BhPVBaan049vJNmcQ8k%252B7XR3X99tdIBiVBLeZ0P8V6ldwGAKdLpD5LDTMg3x3XfrbysTvpsn83yTM6PWhy1nLTy5
Wy9p0qn2Jqq4zzwsHwk%252FOvBsglNQL%252F3ctWZKFiZLxPkA59EJ1lZQOEAmdX%252B7%252B%252BbnnvwA%253D
%26RelayState%3Dhttps%253A%252F%252Fperkinscoiedev.service-now.com%252Fnavpage.do",
"X-UserToken":
"79bade47db46a0106a80464e13961987915de92a4c95f6a755f8118524138df2646c62e8",
"User-Agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5)
AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36"
},
"mixedContentType": "none",
"initialPriority": "High",
"referrerPolicy": "same-origin"
},
"timestamp": 23727523.086183,
"wallTime": 1612513447.944641,
"initiator": {
"type": "script",
"stack": {
"callFrames": [
{
"functionName": "",
"scriptId": "8",
"url": "https://perkinscoiedev.service-
now.com/scripts/doctype/js_includes_doctype.jsx?v=12-09-
2020_1945&lp=Thu_Feb_04_13_15_24_PST_2021&c=9_108",
"lineNumber": 17385,
"columnNumber": 4
}
]
}
},
"type": "XHR",
"frameId": "A7C87A170B6FF1BFF9C1519BD77B8C40",
"hasUserGesture": false
},

https://urlscan.io/api/v1/result/3a2c746e-192e-4901-9a5d-78b8b2ee32e3/ Page 46 of 119


03.10.2021, 14:47

"response": {
"encodedDataLength": 2343,
"dataLength": 11926,
"requestId": "24603.33",
"type": "XHR",
"response": {
"url": "https://perkinscoiedev.service-now.com/api/now/ui/date_time/legacy",
"status": 200,
"statusText": "OK",
"headers": {
"Pragma": "no-store,no-cache",
"Date": "Fri, 05 Feb 2021 08:24:08 GMT",
"Content-Encoding": "gzip",
"Server": "ServiceNow",
"Transfer-Encoding": "chunked",
"Content-Type": "application/json;charset=UTF-8",
"X-Transaction-ID": "6eba964bdb06",
"Cache-Control": "no-cache,no-store,must-revalidate,max-age=-1",
"Strict-Transport-Security": "max-age=63072000; includeSubDomains",
"X-Is-Logged-In": "false",
"Expires": "0"
},
"mimeType": "application/json",
"remoteIPAddress": "149.96.248.4",
"remotePort": 443,
"fromPrefetchCache": false,
"encodedDataLength": 633,
"timing": {
"requestTime": 23727523.086477,
"proxyStart": -1,
"proxyEnd": -1,
"dnsStart": -1,
"dnsEnd": -1,
"connectStart": -1,
"connectEnd": -1,
"sslStart": -1,
"sslEnd": -1,
"workerStart": -1,
"workerReady": -1,
"workerFetchStart": -1,
"workerRespondWithSettled": -1,
"sendStart": 0.309,
"sendEnd": 0.374,
"pushStart": 0,
"pushEnd": 0,
"receiveHeadersEnd": 188.888
},
"responseTime": 1612513448133.775,
"protocol": "http/1.1",
"securityState": "secure",
"securityDetails": {
"protocol": "TLS 1.2",
"keyExchange": "ECDHE_RSA",
"keyExchangeGroup": "P-256",
"cipher": "AES_128_GCM",
"certificateId": 0,
"subjectName": "*.service-now.com",
"sanList": [
"*.service-now.com",
"service-now.com"
],
"issuer": "Entrust Certification Authority - L1K",
"validFrom": 1595462153,
"validTo": 1617321353,
"signedCertificateTimestampList": [],
"certificateTransparencyCompliance": "unknown"

https://urlscan.io/api/v1/result/3a2c746e-192e-4901-9a5d-78b8b2ee32e3/ Page 47 of 119


03.10.2021, 14:47

},
"securityHeaders": [
{
"name": "Strict-Transport-Security",
"value": "max-age=63072000; includeSubDomains"
}
]
},
"asn": {
"ip": "149.96.248.4",
"asn": "16839",
"country": "US",
"registrar": "arin",
"date": "2010-12-16",
"description": "SNC, US",
"route": "149.96.240.0/20",
"name": "SNC"
},
"geoip": {
"range": [
2506096640,
2506162175
],
"country": "US",
"region": "",
"eu": "0",
"timezone": "America/Chicago",
"city": "",
"ll": [
37.751,
-97.822
],
"metro": 0,
"area": 1000,
"country_name": "United States"
},
"rdns": {
"ip": "149.96.248.4",
"ptr": "vip-149-96-248-4.cust.service-now.com"
}
},
"initiatorInfo": {
"url": "https://perkinscoiedev.service-
now.com/scripts/doctype/js_includes_doctype.jsx?v=12-09-
2020_1945&lp=Thu_Feb_04_13_15_24_PST_2021&c=9_108",
"host": "perkinscoiedev.service-now.com",
"type": "script"
}
},
{
"request": {
"requestId": "24603.20",
"loaderId": "57C22717099627F4ACFB8060C2A3AA76",
"documentURL": "https://perkinscoiedev.service-now.com/auth_redirect.do?
sysparm_stack=no&sysparm_url=https%3A%2F%2Fmyapps.perkinscoie.com%2Fapp%2Fservicenow_ud%2Fexk
1jsx6trpNIFLGO0h8%2Fsso%2Fsaml%3FSAMLRequest%3DnVJdb9MwFP0rkd8TJ2aZgtVUCq0GlUoXrYUHXpAT365miW
18naz796Ru0coDE%252BL1%252Btxzz4dnKPqOWV4N%252FqAf4OcA6KNj32nk55eSDE5zI1Ah16IH5L7l2%252BrzmrM
k5dYZb1rTkahCBOeV0QujcejBbcGNqoUvD%252BuSHLy3yCm14J6UxtYokDAmeIbE2jwnrempFqMVj5BIQ6LlJERpcWJ8
3e9fhLWYXNGEvWlIL1wT1fdBUjg%252BZT%252FweOud3azu1h%252Fv00NBEQ09mSLRnXEtBMsl2YsOgUSrZUm2m0XeN
LdMvG%252F27wqWF1I2NyxrRJbnTZaLVBQTEGuBqEZ4XUUcYKXRC%252B1LwlKWxSmL03yXFpzd8DRPWM6%252Bkai%25
2BhPVBaan049vJNmcQ8k%252B7XR3X99tdIBiVBLeZ0P8V6ldwGAKdLpD5LDTMg3x3XfrbysTvpsn83yTM6PWhy1nLTy5
Wy9p0qn2Jqq4zzwsHwk%252FOvBsglNQL%252F3ctWZKFiZLxPkA59EJ1lZQOEAmdX%252B7%252B%252BbnnvwA%253D
%26RelayState%3Dhttps%253A%252F%252Fperkinscoiedev.service-now.com%252Fnavpage.do",
"request": {
"url": "https://perkinscoiedev.service-now.com/styles/fonts/source-sans-
pro/SourceSansPro-Regular.otf.woff",

https://urlscan.io/api/v1/result/3a2c746e-192e-4901-9a5d-78b8b2ee32e3/ Page 48 of 119


03.10.2021, 14:47

"method": "GET",
"headers": {
"Origin": "https://perkinscoiedev.service-now.com",
"Referer": "https://perkinscoiedev.service-
now.com/styles/heisenberg/source_sans_pro.cssx?v=12-09-2020_1945&c=2020-06-
08_10:09:13_8ebad68fdb4aa0106a80464e13961950&theme=system",
"User-Agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5)
AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36"
},
"mixedContentType": "none",
"initialPriority": "VeryHigh",
"referrerPolicy": "no-referrer-when-downgrade"
},
"timestamp": 23727523.124547,
"wallTime": 1612513447.983005,
"initiator": {
"type": "parser",
"url": "https://perkinscoiedev.service-
now.com/styles/heisenberg/source_sans_pro.cssx?v=12-09-2020_1945&c=2020-06-
08_10:09:13_8ebad68fdb4aa0106a80464e13961950&theme=system"
},
"type": "Font",
"frameId": "A7C87A170B6FF1BFF9C1519BD77B8C40",
"hasUserGesture": false
},
"response": {
"encodedDataLength": 0,
"dataLength": 130859,
"requestId": "24603.20",
"type": "Font",
"response": {
"url": "https://perkinscoiedev.service-now.com/styles/fonts/source-sans-
pro/SourceSansPro-Regular.otf.woff",
"status": 200,
"statusText": "OK",
"headers": {
"Date": "Fri, 05 Feb 2021 08:24:08 GMT",
"Content-Encoding": "gzip",
"Last-Modified": "Thu, 10 Dec 2020 03:49:20 GMT",
"Server": "ServiceNow",
"Transfer-Encoding": "chunked",
"Content-Type": "application/font-woff;charset=UTF-8",
"Cache-Control": "public",
"x-edge-enc-proxy-static": "true",
"Strict-Transport-Security": "max-age=63072000; includeSubDomains",
"Accept-Ranges": "bytes",
"Expires": "Wed, 09 Feb 2022 08:24:08 GMT"
},
"mimeType": "application/font-woff",
"remoteIPAddress": "149.96.248.4",
"remotePort": 443,
"fromPrefetchCache": false,
"encodedDataLength": 405,
"timing": {
"requestTime": 23727523.124826,
"proxyStart": -1,
"proxyEnd": -1,
"dnsStart": -1,
"dnsEnd": -1,
"connectStart": -1,
"connectEnd": -1,
"sslStart": -1,
"sslEnd": -1,
"workerStart": -1,
"workerReady": -1,
"workerFetchStart": -1,

https://urlscan.io/api/v1/result/3a2c746e-192e-4901-9a5d-78b8b2ee32e3/ Page 49 of 119


03.10.2021, 14:47

"workerRespondWithSettled": -1,
"sendStart": 0.36,
"sendEnd": 0.417,
"pushStart": 0,
"pushEnd": 0,
"receiveHeadersEnd": 181.776
},
"responseTime": 1612513448165.002,
"protocol": "http/1.1",
"securityState": "secure",
"securityDetails": {
"protocol": "TLS 1.2",
"keyExchange": "ECDHE_RSA",
"keyExchangeGroup": "P-256",
"cipher": "AES_128_GCM",
"certificateId": 0,
"subjectName": "*.service-now.com",
"sanList": [
"*.service-now.com",
"service-now.com"
],
"issuer": "Entrust Certification Authority - L1K",
"validFrom": 1595462153,
"validTo": 1617321353,
"signedCertificateTimestampList": [],
"certificateTransparencyCompliance": "unknown"
},
"securityHeaders": [
{
"name": "Strict-Transport-Security",
"value": "max-age=63072000; includeSubDomains"
}
]
},
"asn": {
"ip": "149.96.248.4",
"asn": "16839",
"country": "US",
"registrar": "arin",
"date": "2010-12-16",
"description": "SNC, US",
"route": "149.96.240.0/20",
"name": "SNC"
},
"geoip": {
"range": [
2506096640,
2506162175
],
"country": "US",
"region": "",
"eu": "0",
"timezone": "America/Chicago",
"city": "",
"ll": [
37.751,
-97.822
],
"metro": 0,
"area": 1000,
"country_name": "United States"
},
"rdns": {
"ip": "149.96.248.4",
"ptr": "vip-149-96-248-4.cust.service-now.com"
}

https://urlscan.io/api/v1/result/3a2c746e-192e-4901-9a5d-78b8b2ee32e3/ Page 50 of 119


03.10.2021, 14:47

},
"initiatorInfo": {
"url": "https://perkinscoiedev.service-
now.com/styles/heisenberg/source_sans_pro.cssx?v=12-09-2020_1945&c=2020-06-
08_10:09:13_8ebad68fdb4aa0106a80464e13961950&theme=system",
"host": "perkinscoiedev.service-now.com",
"type": "parser"
}
},
{
"request": {
"requestId": "24603.28",
"loaderId": "57C22717099627F4ACFB8060C2A3AA76",
"documentURL": "https://perkinscoiedev.service-now.com/auth_redirect.do?
sysparm_stack=no&sysparm_url=https%3A%2F%2Fmyapps.perkinscoie.com%2Fapp%2Fservicenow_ud%2Fexk
1jsx6trpNIFLGO0h8%2Fsso%2Fsaml%3FSAMLRequest%3DnVJdb9MwFP0rkd8TJ2aZgtVUCq0GlUoXrYUHXpAT365miW
18naz796Ru0coDE%252BL1%252Btxzz4dnKPqOWV4N%252FqAf4OcA6KNj32nk55eSDE5zI1Ah16IH5L7l2%252BrzmrM
k5dYZb1rTkahCBOeV0QujcejBbcGNqoUvD%252BuSHLy3yCm14J6UxtYokDAmeIbE2jwnrempFqMVj5BIQ6LlJERpcWJ8
3e9fhLWYXNGEvWlIL1wT1fdBUjg%252BZT%252FweOud3azu1h%252Fv00NBEQ09mSLRnXEtBMsl2YsOgUSrZUm2m0XeN
LdMvG%252F27wqWF1I2NyxrRJbnTZaLVBQTEGuBqEZ4XUUcYKXRC%252B1LwlKWxSmL03yXFpzd8DRPWM6%252Bkai%25
2BhPVBaan049vJNmcQ8k%252B7XR3X99tdIBiVBLeZ0P8V6ldwGAKdLpD5LDTMg3x3XfrbysTvpsn83yTM6PWhy1nLTy5
Wy9p0qn2Jqq4zzwsHwk%252FOvBsglNQL%252F3ctWZKFiZLxPkA59EJ1lZQOEAmdX%252B7%252B%252BbnnvwA%253D
%26RelayState%3Dhttps%253A%252F%252Fperkinscoiedev.service-now.com%252Fnavpage.do",
"request": {
"url": "https://perkinscoiedev.service-
now.com/styles/retina_icons/retina_icons.woff?66761fc96b7c554a5daacdbed174fa9c",
"method": "GET",
"headers": {
"Origin": "https://perkinscoiedev.service-now.com",
"Referer": "https://perkinscoiedev.service-
now.com/styles/heisenberg/heisenberg_all.cssx?v=12-09-2020_1945&c=2020-06-
08_10:09:13_8ebad68fdb4aa0106a80464e13961950&theme=system",
"User-Agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5)
AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36"
},
"mixedContentType": "none",
"initialPriority": "VeryHigh",
"referrerPolicy": "no-referrer-when-downgrade"
},
"timestamp": 23727523.124681,
"wallTime": 1612513447.983139,
"initiator": {
"type": "parser",
"url": "https://perkinscoiedev.service-
now.com/styles/heisenberg/heisenberg_all.cssx?v=12-09-2020_1945&c=2020-06-
08_10:09:13_8ebad68fdb4aa0106a80464e13961950&theme=system"
},
"type": "Font",
"frameId": "A7C87A170B6FF1BFF9C1519BD77B8C40",
"hasUserGesture": false
},
"response": {
"encodedDataLength": 58802,
"dataLength": 58356,
"requestId": "24603.28",
"type": "Font",
"response": {
"url": "https://perkinscoiedev.service-
now.com/styles/retina_icons/retina_icons.woff?66761fc96b7c554a5daacdbed174fa9c",
"status": 200,
"statusText": "OK",
"headers": {
"Date": "Fri, 05 Feb 2021 08:24:08 GMT",
"Content-Encoding": "gzip",
"Last-Modified": "Thu, 10 Dec 2020 03:49:20 GMT",
"Server": "ServiceNow",

https://urlscan.io/api/v1/result/3a2c746e-192e-4901-9a5d-78b8b2ee32e3/ Page 51 of 119


03.10.2021, 14:47

"Transfer-Encoding": "chunked",
"Content-Type": "application/font-woff;charset=UTF-8",
"Cache-Control": "public",
"x-edge-enc-proxy-static": "true",
"Strict-Transport-Security": "max-age=63072000; includeSubDomains",
"Accept-Ranges": "bytes",
"Expires": "Wed, 09 Feb 2022 08:24:08 GMT"
},
"mimeType": "application/font-woff",
"remoteIPAddress": "149.96.248.4",
"remotePort": 443,
"fromPrefetchCache": false,
"encodedDataLength": 405,
"timing": {
"requestTime": 23727523.125004,
"proxyStart": -1,
"proxyEnd": -1,
"dnsStart": -1,
"dnsEnd": -1,
"connectStart": -1,
"connectEnd": -1,
"sslStart": -1,
"sslEnd": -1,
"workerStart": -1,
"workerReady": -1,
"workerFetchStart": -1,
"workerRespondWithSettled": -1,
"sendStart": 0.297,
"sendEnd": 0.336,
"pushStart": 0,
"pushEnd": 0,
"receiveHeadersEnd": 199.042
},
"responseTime": 1612513448182.438,
"protocol": "http/1.1",
"securityState": "secure",
"securityDetails": {
"protocol": "TLS 1.2",
"keyExchange": "ECDHE_RSA",
"keyExchangeGroup": "P-256",
"cipher": "AES_128_GCM",
"certificateId": 0,
"subjectName": "*.service-now.com",
"sanList": [
"*.service-now.com",
"service-now.com"
],
"issuer": "Entrust Certification Authority - L1K",
"validFrom": 1595462153,
"validTo": 1617321353,
"signedCertificateTimestampList": [],
"certificateTransparencyCompliance": "unknown"
},
"securityHeaders": [
{
"name": "Strict-Transport-Security",
"value": "max-age=63072000; includeSubDomains"
}
]
},
"asn": {
"ip": "149.96.248.4",
"asn": "16839",
"country": "US",
"registrar": "arin",
"date": "2010-12-16",

https://urlscan.io/api/v1/result/3a2c746e-192e-4901-9a5d-78b8b2ee32e3/ Page 52 of 119


03.10.2021, 14:47

"description": "SNC, US",


"route": "149.96.240.0/20",
"name": "SNC"
},
"geoip": {
"range": [
2506096640,
2506162175
],
"country": "US",
"region": "",
"eu": "0",
"timezone": "America/Chicago",
"city": "",
"ll": [
37.751,
-97.822
],
"metro": 0,
"area": 1000,
"country_name": "United States"
},
"rdns": {
"ip": "149.96.248.4",
"ptr": "vip-149-96-248-4.cust.service-now.com"
}
},
"initiatorInfo": {
"url": "https://perkinscoiedev.service-
now.com/styles/heisenberg/heisenberg_all.cssx?v=12-09-2020_1945&c=2020-06-
08_10:09:13_8ebad68fdb4aa0106a80464e13961950&theme=system",
"host": "perkinscoiedev.service-now.com",
"type": "parser"
}
},
{
"request": {
"requestId": "53DE0799AA0EDCD8D4539C351504D3CB",
"loaderId": "53DE0799AA0EDCD8D4539C351504D3CB",
"documentURL": "https://myapps.perkinscoie.com/login/login.htm?
fromURI=%2Fapp%2Fservicenow_ud%2Fexk1jsx6trpNIFLGO0h8%2Fsso%2Fsaml%3FSAMLRequest%3DnVJdb9MwFP
0rkd8TJ2aZgtVUCq0GlUoXrYUHXpAT365miW18naz796Ru0coDE%252BL1%252Btxzz4dnKPqOWV4N%252FqAf4OcA6KN
j32nk55eSDE5zI1Ah16IH5L7l2%252BrzmrMk5dYZb1rTkahCBOeV0QujcejBbcGNqoUvD%252BuSHLy3yCm14J6UxtYo
kDAmeIbE2jwnrempFqMVj5BIQ6LlJERpcWJ83e9fhLWYXNGEvWlIL1wT1fdBUjg%252BZT%252FweOud3azu1h%252Fv0
0NBEQ09mSLRnXEtBMsl2YsOgUSrZUm2m0XeNLdMvG%252F27wqWF1I2NyxrRJbnTZaLVBQTEGuBqEZ4XUUcYKXRC%252B
1LwlKWxSmL03yXFpzd8DRPWM6%252Bkai%252BhPVBaan049vJNmcQ8k%252B7XR3X99tdIBiVBLeZ0P8V6ldwGAKdLpD
5LDTMg3x3XfrbysTvpsn83yTM6PWhy1nLTy5Wy9p0qn2Jqq4zzwsHwk%252FOvBsglNQL%252F3ctWZKFiZLxPkA59EJ1
lZQOEAmdX%252B7%252B%252BbnnvwA%253D%26RelayState%3Dhttps%253A%252F%252Fperkinscoiedev.servic
e-now.com%252Fnavpage.do",
"request": {
"url": "https://myapps.perkinscoie.com/login/login.htm?
fromURI=%2Fapp%2Fservicenow_ud%2Fexk1jsx6trpNIFLGO0h8%2Fsso%2Fsaml%3FSAMLRequest%3DnVJdb9MwFP
0rkd8TJ2aZgtVUCq0GlUoXrYUHXpAT365miW18naz796Ru0coDE%252BL1%252Btxzz4dnKPqOWV4N%252FqAf4OcA6KN
j32nk55eSDE5zI1Ah16IH5L7l2%252BrzmrMk5dYZb1rTkahCBOeV0QujcejBbcGNqoUvD%252BuSHLy3yCm14J6UxtYo
kDAmeIbE2jwnrempFqMVj5BIQ6LlJERpcWJ83e9fhLWYXNGEvWlIL1wT1fdBUjg%252BZT%252FweOud3azu1h%252Fv0
0NBEQ09mSLRnXEtBMsl2YsOgUSrZUm2m0XeNLdMvG%252F27wqWF1I2NyxrRJbnTZaLVBQTEGuBqEZ4XUUcYKXRC%252B
1LwlKWxSmL03yXFpzd8DRPWM6%252Bkai%252BhPVBaan049vJNmcQ8k%252B7XR3X99tdIBiVBLeZ0P8V6ldwGAKdLpD
5LDTMg3x3XfrbysTvpsn83yTM6PWhy1nLTy5Wy9p0qn2Jqq4zzwsHwk%252FOvBsglNQL%252F3ctWZKFiZLxPkA59EJ1
lZQOEAmdX%252B7%252B%252BbnnvwA%253D%26RelayState%3Dhttps%253A%252F%252Fperkinscoiedev.servic
e-now.com%252Fnavpage.do",
"method": "GET",
"headers": {
"Upgrade-Insecure-Requests": "1",
"User-Agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5)
AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36",
"Referer": "https://perkinscoiedev.service-now.com/auth_redirect.do?

https://urlscan.io/api/v1/result/3a2c746e-192e-4901-9a5d-78b8b2ee32e3/ Page 53 of 119


03.10.2021, 14:47

sysparm_stack=no&sysparm_url=https%3A%2F%2Fmyapps.perkinscoie.com%2Fapp%2Fservicenow_ud%2Fexk
1jsx6trpNIFLGO0h8%2Fsso%2Fsaml%3FSAMLRequest%3DnVJdb9MwFP0rkd8TJ2aZgtVUCq0GlUoXrYUHXpAT365miW
18naz796Ru0coDE%252BL1%252Btxzz4dnKPqOWV4N%252FqAf4OcA6KNj32nk55eSDE5zI1Ah16IH5L7l2%252BrzmrM
k5dYZb1rTkahCBOeV0QujcejBbcGNqoUvD%252BuSHLy3yCm14J6UxtYokDAmeIbE2jwnrempFqMVj5BIQ6LlJERpcWJ8
3e9fhLWYXNGEvWlIL1wT1fdBUjg%252BZT%252FweOud3azu1h%252Fv00NBEQ09mSLRnXEtBMsl2YsOgUSrZUm2m0XeN
LdMvG%252F27wqWF1I2NyxrRJbnTZaLVBQTEGuBqEZ4XUUcYKXRC%252B1LwlKWxSmL03yXFpzd8DRPWM6%252Bkai%25
2BhPVBaan049vJNmcQ8k%252B7XR3X99tdIBiVBLeZ0P8V6ldwGAKdLpD5LDTMg3x3XfrbysTvpsn83yTM6PWhy1nLTy5
Wy9p0qn2Jqq4zzwsHwk%252FOvBsglNQL%252F3ctWZKFiZLxPkA59EJ1lZQOEAmdX%252B7%252B%252BbnnvwA%253D
%26RelayState%3Dhttps%253A%252F%252Fperkinscoiedev.service-now.com%252Fnavpage.do"
},
"mixedContentType": "none",
"initialPriority": "VeryHigh",
"referrerPolicy": "same-origin"
},
"timestamp": 23727523.577476,
"wallTime": 1612513448.436013,
"initiator": {
"type": "script",
"stack": {
"callFrames": [
{
"functionName": "",
"scriptId": "20",
"url": "https://perkinscoiedev.service-now.com/auth_redirect.do?
sysparm_stack=no&sysparm_url=https%3A%2F%2Fmyapps.perkinscoie.com%2Fapp%2Fservicenow_ud%2Fexk
1jsx6trpNIFLGO0h8%2Fsso%2Fsaml%3FSAMLRequest%3DnVJdb9MwFP0rkd8TJ2aZgtVUCq0GlUoXrYUHXpAT365miW
18naz796Ru0coDE%252BL1%252Btxzz4dnKPqOWV4N%252FqAf4OcA6KNj32nk55eSDE5zI1Ah16IH5L7l2%252BrzmrM
k5dYZb1rTkahCBOeV0QujcejBbcGNqoUvD%252BuSHLy3yCm14J6UxtYokDAmeIbE2jwnrempFqMVj5BIQ6LlJERpcWJ8
3e9fhLWYXNGEvWlIL1wT1fdBUjg%252BZT%252FweOud3azu1h%252Fv00NBEQ09mSLRnXEtBMsl2YsOgUSrZUm2m0XeN
LdMvG%252F27wqWF1I2NyxrRJbnTZaLVBQTEGuBqEZ4XUUcYKXRC%252B1LwlKWxSmL03yXFpzd8DRPWM6%252Bkai%25
2BhPVBaan049vJNmcQ8k%252B7XR3X99tdIBiVBLeZ0P8V6ldwGAKdLpD5LDTMg3x3XfrbysTvpsn83yTM6PWhy1nLTy5
Wy9p0qn2Jqq4zzwsHwk%252FOvBsglNQL%252F3ctWZKFiZLxPkA59EJ1lZQOEAmdX%252B7%252B%252BbnnvwA%253D
%26RelayState%3Dhttps%253A%252F%252Fperkinscoiedev.service-now.com%252Fnavpage.do",
"lineNumber": 260,
"columnNumber": 22
}
]
}
},
"redirectResponse": {
"url":
"https://myapps.perkinscoie.com/app/servicenow_ud/exk1jsx6trpNIFLGO0h8/sso/saml?
SAMLRequest=nVJdb9MwFP0rkd8TJ2aZgtVUCq0GlUoXrYUHXpAT365miW18naz796Ru0coDE%2BL1%2Btxzz4dnKPqOW
V4N%2FqAf4OcA6KNj32nk55eSDE5zI1Ah16IH5L7l2%2BrzmrMk5dYZb1rTkahCBOeV0QujcejBbcGNqoUvD%2BuSHLy3
yCm14J6UxtYokDAmeIbE2jwnrempFqMVj5BIQ6LlJERpcWJ83e9fhLWYXNGEvWlIL1wT1fdBUjg%2BZT%2FweOud3azu1
h%2Fv00NBEQ09mSLRnXEtBMsl2YsOgUSrZUm2m0XeNLdMvG%2F27wqWF1I2NyxrRJbnTZaLVBQTEGuBqEZ4XUUcYKXRC%
2B1LwlKWxSmL03yXFpzd8DRPWM6%2Bkai%2BhPVBaan049vJNmcQ8k%2B7XR3X99tdIBiVBLeZ0P8V6ldwGAKdLpD5LDT
Mg3x3XfrbysTvpsn83yTM6PWhy1nLTy5Wy9p0qn2Jqq4zzwsHwk%2FOvBsglNQL%2F3ctWZKFiZLxPkA59EJ1lZQOEAmd
X%2B7%2B%2BbnnvwA%3D&RelayState=https%3A%2F%2Fperkinscoiedev.service-now.com%2Fnavpage.do",
"status": 302,
"statusText": "Found",
"headers": {
"Date": "Fri, 05 Feb 2021 08:24:08 GMT",
"Server": "nginx",
"Content-Length": "0",
"x-okta-request-id": "YB0AqIFr8Gz2LALmqRcSLQAABQg",
"x-xss-protection": "0",
"p3p": "CP=\"HONK\"",
"location": "https://myapps.perkinscoie.com/login/login.htm?
fromURI=%2Fapp%2Fservicenow_ud%2Fexk1jsx6trpNIFLGO0h8%2Fsso%2Fsaml%3FSAMLRequest%3DnVJdb9MwFP
0rkd8TJ2aZgtVUCq0GlUoXrYUHXpAT365miW18naz796Ru0coDE%252BL1%252Btxzz4dnKPqOWV4N%252FqAf4OcA6KN
j32nk55eSDE5zI1Ah16IH5L7l2%252BrzmrMk5dYZb1rTkahCBOeV0QujcejBbcGNqoUvD%252BuSHLy3yCm14J6UxtYo
kDAmeIbE2jwnrempFqMVj5BIQ6LlJERpcWJ83e9fhLWYXNGEvWlIL1wT1fdBUjg%252BZT%252FweOud3azu1h%252Fv0
0NBEQ09mSLRnXEtBMsl2YsOgUSrZUm2m0XeNLdMvG%252F27wqWF1I2NyxrRJbnTZaLVBQTEGuBqEZ4XUUcYKXRC%252B
1LwlKWxSmL03yXFpzd8DRPWM6%252Bkai%252BhPVBaan049vJNmcQ8k%252B7XR3X99tdIBiVBLeZ0P8V6ldwGAKdLpD
5LDTMg3x3XfrbysTvpsn83yTM6PWhy1nLTy5Wy9p0qn2Jqq4zzwsHwk%252FOvBsglNQL%252F3ctWZKFiZLxPkA59EJ1

https://urlscan.io/api/v1/result/3a2c746e-192e-4901-9a5d-78b8b2ee32e3/ Page 54 of 119


03.10.2021, 14:47

lZQOEAmdX%252B7%252B%252BbnnvwA%253D%26RelayState%3Dhttps%253A%252F%252Fperkinscoiedev.servic
e-now.com%252Fnavpage.do",
"content-language": "en",
"Strict-Transport-Security": "max-age=315360000; includeSubDomains",
"X-Robots-Tag": "none",
"set-cookie": "sid=\"\"; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/",
"Keep-Alive": "timeout=5, max=100",
"Connection": "Keep-Alive"
},
"mimeType": "",
"requestHeaders": {
"Host": "myapps.perkinscoie.com",
"Connection": "keep-alive",
"Pragma": "no-cache",
"Cache-Control": "no-cache",
"Upgrade-Insecure-Requests": "1",
"User-Agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5)
AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36",
"Accept":
"text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q
=0.8,application/signed-exchange;v=b3;q=0.9",
"Sec-Fetch-Site": "cross-site",
"Sec-Fetch-Mode": "navigate",
"Sec-Fetch-Dest": "document",
"Accept-Encoding": "gzip, deflate, br",
"Accept-Language": "en-US"
},
"remoteIPAddress": "34.203.255.203",
"remotePort": 443,
"fromPrefetchCache": false,
"encodedDataLength": 1235,
"timing": {
"requestTime": 23727523.174499,
"proxyStart": -1,
"proxyEnd": -1,
"dnsStart": 0.362,
"dnsEnd": 38.608,
"connectStart": 38.608,
"connectEnd": 266.735,
"sslStart": 55.761,
"sslEnd": 266.731,
"workerStart": -1,
"workerReady": -1,
"workerFetchStart": -1,
"workerRespondWithSettled": -1,
"sendStart": 266.775,
"sendEnd": 266.817,
"pushStart": 0,
"pushEnd": 0,
"receiveHeadersEnd": 402.529
},
"responseTime": 1612513448435.407,
"protocol": "http/1.1",
"securityState": "secure",
"securityDetails": {
"protocol": "TLS 1.2",
"keyExchange": "ECDHE_RSA",
"keyExchangeGroup": "P-256",
"cipher": "AES_128_GCM",
"certificateId": 0,
"subjectName": "myapps.perkinscoie.com",
"sanList": [
"myapps.perkinscoie.com",
"www.myapps.perkinscoie.com"
],
"issuer": "DigiCert SHA2 Secure Server CA",

https://urlscan.io/api/v1/result/3a2c746e-192e-4901-9a5d-78b8b2ee32e3/ Page 55 of 119


03.10.2021, 14:47

"validFrom": 1583107200,
"validTo": 1615377600,
"signedCertificateTimestampList": [],
"certificateTransparencyCompliance": "unknown"
}
},
"type": "Document",
"frameId": "A7C87A170B6FF1BFF9C1519BD77B8C40",
"hasUserGesture": false,
"primaryRequest": true
},
"requests": [
{
"requestId": "53DE0799AA0EDCD8D4539C351504D3CB",
"loaderId": "53DE0799AA0EDCD8D4539C351504D3CB",
"documentURL":
"https://myapps.perkinscoie.com/app/servicenow_ud/exk1jsx6trpNIFLGO0h8/sso/saml?
SAMLRequest=nVJdb9MwFP0rkd8TJ2aZgtVUCq0GlUoXrYUHXpAT365miW18naz796Ru0coDE%2BL1%2Btxzz4dnKPqOW
V4N%2FqAf4OcA6KNj32nk55eSDE5zI1Ah16IH5L7l2%2BrzmrMk5dYZb1rTkahCBOeV0QujcejBbcGNqoUvD%2BuSHLy3
yCm14J6UxtYokDAmeIbE2jwnrempFqMVj5BIQ6LlJERpcWJ83e9fhLWYXNGEvWlIL1wT1fdBUjg%2BZT%2FweOud3azu1
h%2Fv00NBEQ09mSLRnXEtBMsl2YsOgUSrZUm2m0XeNLdMvG%2F27wqWF1I2NyxrRJbnTZaLVBQTEGuBqEZ4XUUcYKXRC%
2B1LwlKWxSmL03yXFpzd8DRPWM6%2Bkai%2BhPVBaan049vJNmcQ8k%2B7XR3X99tdIBiVBLeZ0P8V6ldwGAKdLpD5LDT
Mg3x3XfrbysTvpsn83yTM6PWhy1nLTy5Wy9p0qn2Jqq4zzwsHwk%2FOvBsglNQL%2F3ctWZKFiZLxPkA59EJ1lZQOEAmd
X%2B7%2B%2BbnnvwA%3D&RelayState=https%3A%2F%2Fperkinscoiedev.service-now.com%2Fnavpage.do",
"request": {
"url":
"https://myapps.perkinscoie.com/app/servicenow_ud/exk1jsx6trpNIFLGO0h8/sso/saml?
SAMLRequest=nVJdb9MwFP0rkd8TJ2aZgtVUCq0GlUoXrYUHXpAT365miW18naz796Ru0coDE%2BL1%2Btxzz4dnKPqOW
V4N%2FqAf4OcA6KNj32nk55eSDE5zI1Ah16IH5L7l2%2BrzmrMk5dYZb1rTkahCBOeV0QujcejBbcGNqoUvD%2BuSHLy3
yCm14J6UxtYokDAmeIbE2jwnrempFqMVj5BIQ6LlJERpcWJ83e9fhLWYXNGEvWlIL1wT1fdBUjg%2BZT%2FweOud3azu1
h%2Fv00NBEQ09mSLRnXEtBMsl2YsOgUSrZUm2m0XeNLdMvG%2F27wqWF1I2NyxrRJbnTZaLVBQTEGuBqEZ4XUUcYKXRC%
2B1LwlKWxSmL03yXFpzd8DRPWM6%2Bkai%2BhPVBaan049vJNmcQ8k%2B7XR3X99tdIBiVBLeZ0P8V6ldwGAKdLpD5LDT
Mg3x3XfrbysTvpsn83yTM6PWhy1nLTy5Wy9p0qn2Jqq4zzwsHwk%2FOvBsglNQL%2F3ctWZKFiZLxPkA59EJ1lZQOEAmd
X%2B7%2B%2BbnnvwA%3D&RelayState=https%3A%2F%2Fperkinscoiedev.service-now.com%2Fnavpage.do",
"method": "GET",
"headers": {
"Upgrade-Insecure-Requests": "1",
"User-Agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5)
AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36"
},
"mixedContentType": "none",
"initialPriority": "VeryHigh",
"referrerPolicy": "same-origin"
},
"timestamp": 23727523.173916,
"wallTime": 1612513448.032401,
"initiator": {
"type": "script",
"stack": {
"callFrames": [
{
"functionName": "",
"scriptId": "20",
"url": "https://perkinscoiedev.service-now.com/auth_redirect.do?
sysparm_stack=no&sysparm_url=https%3A%2F%2Fmyapps.perkinscoie.com%2Fapp%2Fservicenow_ud%2Fexk
1jsx6trpNIFLGO0h8%2Fsso%2Fsaml%3FSAMLRequest%3DnVJdb9MwFP0rkd8TJ2aZgtVUCq0GlUoXrYUHXpAT365miW
18naz796Ru0coDE%252BL1%252Btxzz4dnKPqOWV4N%252FqAf4OcA6KNj32nk55eSDE5zI1Ah16IH5L7l2%252BrzmrM
k5dYZb1rTkahCBOeV0QujcejBbcGNqoUvD%252BuSHLy3yCm14J6UxtYokDAmeIbE2jwnrempFqMVj5BIQ6LlJERpcWJ8
3e9fhLWYXNGEvWlIL1wT1fdBUjg%252BZT%252FweOud3azu1h%252Fv00NBEQ09mSLRnXEtBMsl2YsOgUSrZUm2m0XeN
LdMvG%252F27wqWF1I2NyxrRJbnTZaLVBQTEGuBqEZ4XUUcYKXRC%252B1LwlKWxSmL03yXFpzd8DRPWM6%252Bkai%25
2BhPVBaan049vJNmcQ8k%252B7XR3X99tdIBiVBLeZ0P8V6ldwGAKdLpD5LDTMg3x3XfrbysTvpsn83yTM6PWhy1nLTy5
Wy9p0qn2Jqq4zzwsHwk%252FOvBsglNQL%252F3ctWZKFiZLxPkA59EJ1lZQOEAmdX%252B7%252B%252BbnnvwA%253D
%26RelayState%3Dhttps%253A%252F%252Fperkinscoiedev.service-now.com%252Fnavpage.do",
"lineNumber": 260,
"columnNumber": 22
}

https://urlscan.io/api/v1/result/3a2c746e-192e-4901-9a5d-78b8b2ee32e3/ Page 56 of 119


03.10.2021, 14:47

]
}
},
"type": "Document",
"frameId": "A7C87A170B6FF1BFF9C1519BD77B8C40",
"hasUserGesture": false
},
{
"requestId": "53DE0799AA0EDCD8D4539C351504D3CB",
"loaderId": "53DE0799AA0EDCD8D4539C351504D3CB",
"documentURL": "https://myapps.perkinscoie.com/login/login.htm?
fromURI=%2Fapp%2Fservicenow_ud%2Fexk1jsx6trpNIFLGO0h8%2Fsso%2Fsaml%3FSAMLRequest%3DnVJdb9MwFP
0rkd8TJ2aZgtVUCq0GlUoXrYUHXpAT365miW18naz796Ru0coDE%252BL1%252Btxzz4dnKPqOWV4N%252FqAf4OcA6KN
j32nk55eSDE5zI1Ah16IH5L7l2%252BrzmrMk5dYZb1rTkahCBOeV0QujcejBbcGNqoUvD%252BuSHLy3yCm14J6UxtYo
kDAmeIbE2jwnrempFqMVj5BIQ6LlJERpcWJ83e9fhLWYXNGEvWlIL1wT1fdBUjg%252BZT%252FweOud3azu1h%252Fv0
0NBEQ09mSLRnXEtBMsl2YsOgUSrZUm2m0XeNLdMvG%252F27wqWF1I2NyxrRJbnTZaLVBQTEGuBqEZ4XUUcYKXRC%252B
1LwlKWxSmL03yXFpzd8DRPWM6%252Bkai%252BhPVBaan049vJNmcQ8k%252B7XR3X99tdIBiVBLeZ0P8V6ldwGAKdLpD
5LDTMg3x3XfrbysTvpsn83yTM6PWhy1nLTy5Wy9p0qn2Jqq4zzwsHwk%252FOvBsglNQL%252F3ctWZKFiZLxPkA59EJ1
lZQOEAmdX%252B7%252B%252BbnnvwA%253D%26RelayState%3Dhttps%253A%252F%252Fperkinscoiedev.servic
e-now.com%252Fnavpage.do",
"request": {
"url": "https://myapps.perkinscoie.com/login/login.htm?
fromURI=%2Fapp%2Fservicenow_ud%2Fexk1jsx6trpNIFLGO0h8%2Fsso%2Fsaml%3FSAMLRequest%3DnVJdb9MwFP
0rkd8TJ2aZgtVUCq0GlUoXrYUHXpAT365miW18naz796Ru0coDE%252BL1%252Btxzz4dnKPqOWV4N%252FqAf4OcA6KN
j32nk55eSDE5zI1Ah16IH5L7l2%252BrzmrMk5dYZb1rTkahCBOeV0QujcejBbcGNqoUvD%252BuSHLy3yCm14J6UxtYo
kDAmeIbE2jwnrempFqMVj5BIQ6LlJERpcWJ83e9fhLWYXNGEvWlIL1wT1fdBUjg%252BZT%252FweOud3azu1h%252Fv0
0NBEQ09mSLRnXEtBMsl2YsOgUSrZUm2m0XeNLdMvG%252F27wqWF1I2NyxrRJbnTZaLVBQTEGuBqEZ4XUUcYKXRC%252B
1LwlKWxSmL03yXFpzd8DRPWM6%252Bkai%252BhPVBaan049vJNmcQ8k%252B7XR3X99tdIBiVBLeZ0P8V6ldwGAKdLpD
5LDTMg3x3XfrbysTvpsn83yTM6PWhy1nLTy5Wy9p0qn2Jqq4zzwsHwk%252FOvBsglNQL%252F3ctWZKFiZLxPkA59EJ1
lZQOEAmdX%252B7%252B%252BbnnvwA%253D%26RelayState%3Dhttps%253A%252F%252Fperkinscoiedev.servic
e-now.com%252Fnavpage.do",
"method": "GET",
"headers": {
"Upgrade-Insecure-Requests": "1",
"User-Agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5)
AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36",
"Referer": "https://perkinscoiedev.service-now.com/auth_redirect.do?
sysparm_stack=no&sysparm_url=https%3A%2F%2Fmyapps.perkinscoie.com%2Fapp%2Fservicenow_ud%2Fexk
1jsx6trpNIFLGO0h8%2Fsso%2Fsaml%3FSAMLRequest%3DnVJdb9MwFP0rkd8TJ2aZgtVUCq0GlUoXrYUHXpAT365miW
18naz796Ru0coDE%252BL1%252Btxzz4dnKPqOWV4N%252FqAf4OcA6KNj32nk55eSDE5zI1Ah16IH5L7l2%252BrzmrM
k5dYZb1rTkahCBOeV0QujcejBbcGNqoUvD%252BuSHLy3yCm14J6UxtYokDAmeIbE2jwnrempFqMVj5BIQ6LlJERpcWJ8
3e9fhLWYXNGEvWlIL1wT1fdBUjg%252BZT%252FweOud3azu1h%252Fv00NBEQ09mSLRnXEtBMsl2YsOgUSrZUm2m0XeN
LdMvG%252F27wqWF1I2NyxrRJbnTZaLVBQTEGuBqEZ4XUUcYKXRC%252B1LwlKWxSmL03yXFpzd8DRPWM6%252Bkai%25
2BhPVBaan049vJNmcQ8k%252B7XR3X99tdIBiVBLeZ0P8V6ldwGAKdLpD5LDTMg3x3XfrbysTvpsn83yTM6PWhy1nLTy5
Wy9p0qn2Jqq4zzwsHwk%252FOvBsglNQL%252F3ctWZKFiZLxPkA59EJ1lZQOEAmdX%252B7%252B%252BbnnvwA%253D
%26RelayState%3Dhttps%253A%252F%252Fperkinscoiedev.service-now.com%252Fnavpage.do"
},
"mixedContentType": "none",
"initialPriority": "VeryHigh",
"referrerPolicy": "same-origin"
},
"timestamp": 23727523.577476,
"wallTime": 1612513448.436013,
"initiator": {
"type": "script",
"stack": {
"callFrames": [
{
"functionName": "",
"scriptId": "20",
"url": "https://perkinscoiedev.service-now.com/auth_redirect.do?
sysparm_stack=no&sysparm_url=https%3A%2F%2Fmyapps.perkinscoie.com%2Fapp%2Fservicenow_ud%2Fexk
1jsx6trpNIFLGO0h8%2Fsso%2Fsaml%3FSAMLRequest%3DnVJdb9MwFP0rkd8TJ2aZgtVUCq0GlUoXrYUHXpAT365miW
18naz796Ru0coDE%252BL1%252Btxzz4dnKPqOWV4N%252FqAf4OcA6KNj32nk55eSDE5zI1Ah16IH5L7l2%252BrzmrM
k5dYZb1rTkahCBOeV0QujcejBbcGNqoUvD%252BuSHLy3yCm14J6UxtYokDAmeIbE2jwnrempFqMVj5BIQ6LlJERpcWJ8
3e9fhLWYXNGEvWlIL1wT1fdBUjg%252BZT%252FweOud3azu1h%252Fv00NBEQ09mSLRnXEtBMsl2YsOgUSrZUm2m0XeN

https://urlscan.io/api/v1/result/3a2c746e-192e-4901-9a5d-78b8b2ee32e3/ Page 57 of 119


03.10.2021, 14:47

LdMvG%252F27wqWF1I2NyxrRJbnTZaLVBQTEGuBqEZ4XUUcYKXRC%252B1LwlKWxSmL03yXFpzd8DRPWM6%252Bkai%25
2BhPVBaan049vJNmcQ8k%252B7XR3X99tdIBiVBLeZ0P8V6ldwGAKdLpD5LDTMg3x3XfrbysTvpsn83yTM6PWhy1nLTy5
Wy9p0qn2Jqq4zzwsHwk%252FOvBsglNQL%252F3ctWZKFiZLxPkA59EJ1lZQOEAmdX%252B7%252B%252BbnnvwA%253D
%26RelayState%3Dhttps%253A%252F%252Fperkinscoiedev.service-now.com%252Fnavpage.do",
"lineNumber": 260,
"columnNumber": 22
}
]
}
},
"redirectResponse": {
"url":
"https://myapps.perkinscoie.com/app/servicenow_ud/exk1jsx6trpNIFLGO0h8/sso/saml?
SAMLRequest=nVJdb9MwFP0rkd8TJ2aZgtVUCq0GlUoXrYUHXpAT365miW18naz796Ru0coDE%2BL1%2Btxzz4dnKPqOW
V4N%2FqAf4OcA6KNj32nk55eSDE5zI1Ah16IH5L7l2%2BrzmrMk5dYZb1rTkahCBOeV0QujcejBbcGNqoUvD%2BuSHLy3
yCm14J6UxtYokDAmeIbE2jwnrempFqMVj5BIQ6LlJERpcWJ83e9fhLWYXNGEvWlIL1wT1fdBUjg%2BZT%2FweOud3azu1
h%2Fv00NBEQ09mSLRnXEtBMsl2YsOgUSrZUm2m0XeNLdMvG%2F27wqWF1I2NyxrRJbnTZaLVBQTEGuBqEZ4XUUcYKXRC%
2B1LwlKWxSmL03yXFpzd8DRPWM6%2Bkai%2BhPVBaan049vJNmcQ8k%2B7XR3X99tdIBiVBLeZ0P8V6ldwGAKdLpD5LDT
Mg3x3XfrbysTvpsn83yTM6PWhy1nLTy5Wy9p0qn2Jqq4zzwsHwk%2FOvBsglNQL%2F3ctWZKFiZLxPkA59EJ1lZQOEAmd
X%2B7%2B%2BbnnvwA%3D&RelayState=https%3A%2F%2Fperkinscoiedev.service-now.com%2Fnavpage.do",
"status": 302,
"statusText": "Found",
"headers": {
"Date": "Fri, 05 Feb 2021 08:24:08 GMT",
"Server": "nginx",
"Content-Length": "0",
"x-okta-request-id": "YB0AqIFr8Gz2LALmqRcSLQAABQg",
"x-xss-protection": "0",
"p3p": "CP=\"HONK\"",
"location": "https://myapps.perkinscoie.com/login/login.htm?
fromURI=%2Fapp%2Fservicenow_ud%2Fexk1jsx6trpNIFLGO0h8%2Fsso%2Fsaml%3FSAMLRequest%3DnVJdb9MwFP
0rkd8TJ2aZgtVUCq0GlUoXrYUHXpAT365miW18naz796Ru0coDE%252BL1%252Btxzz4dnKPqOWV4N%252FqAf4OcA6KN
j32nk55eSDE5zI1Ah16IH5L7l2%252BrzmrMk5dYZb1rTkahCBOeV0QujcejBbcGNqoUvD%252BuSHLy3yCm14J6UxtYo
kDAmeIbE2jwnrempFqMVj5BIQ6LlJERpcWJ83e9fhLWYXNGEvWlIL1wT1fdBUjg%252BZT%252FweOud3azu1h%252Fv0
0NBEQ09mSLRnXEtBMsl2YsOgUSrZUm2m0XeNLdMvG%252F27wqWF1I2NyxrRJbnTZaLVBQTEGuBqEZ4XUUcYKXRC%252B
1LwlKWxSmL03yXFpzd8DRPWM6%252Bkai%252BhPVBaan049vJNmcQ8k%252B7XR3X99tdIBiVBLeZ0P8V6ldwGAKdLpD
5LDTMg3x3XfrbysTvpsn83yTM6PWhy1nLTy5Wy9p0qn2Jqq4zzwsHwk%252FOvBsglNQL%252F3ctWZKFiZLxPkA59EJ1
lZQOEAmdX%252B7%252B%252BbnnvwA%253D%26RelayState%3Dhttps%253A%252F%252Fperkinscoiedev.servic
e-now.com%252Fnavpage.do",
"content-language": "en",
"Strict-Transport-Security": "max-age=315360000; includeSubDomains",
"X-Robots-Tag": "none",
"set-cookie": "sid=\"\"; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/",
"Keep-Alive": "timeout=5, max=100",
"Connection": "Keep-Alive"
},
"mimeType": "",
"requestHeaders": {
"Host": "myapps.perkinscoie.com",
"Connection": "keep-alive",
"Pragma": "no-cache",
"Cache-Control": "no-cache",
"Upgrade-Insecure-Requests": "1",
"User-Agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5)
AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36",
"Accept":
"text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q
=0.8,application/signed-exchange;v=b3;q=0.9",
"Sec-Fetch-Site": "cross-site",
"Sec-Fetch-Mode": "navigate",
"Sec-Fetch-Dest": "document",
"Accept-Encoding": "gzip, deflate, br",
"Accept-Language": "en-US"
},
"remoteIPAddress": "34.203.255.203",
"remotePort": 443,

https://urlscan.io/api/v1/result/3a2c746e-192e-4901-9a5d-78b8b2ee32e3/ Page 58 of 119


03.10.2021, 14:47

"fromPrefetchCache": false,
"encodedDataLength": 1235,
"timing": {
"requestTime": 23727523.174499,
"proxyStart": -1,
"proxyEnd": -1,
"dnsStart": 0.362,
"dnsEnd": 38.608,
"connectStart": 38.608,
"connectEnd": 266.735,
"sslStart": 55.761,
"sslEnd": 266.731,
"workerStart": -1,
"workerReady": -1,
"workerFetchStart": -1,
"workerRespondWithSettled": -1,
"sendStart": 266.775,
"sendEnd": 266.817,
"pushStart": 0,
"pushEnd": 0,
"receiveHeadersEnd": 402.529
},
"responseTime": 1612513448435.407,
"protocol": "http/1.1",
"securityState": "secure",
"securityDetails": {
"protocol": "TLS 1.2",
"keyExchange": "ECDHE_RSA",
"keyExchangeGroup": "P-256",
"cipher": "AES_128_GCM",
"certificateId": 0,
"subjectName": "myapps.perkinscoie.com",
"sanList": [
"myapps.perkinscoie.com",
"www.myapps.perkinscoie.com"
],
"issuer": "DigiCert SHA2 Secure Server CA",
"validFrom": 1583107200,
"validTo": 1615377600,
"signedCertificateTimestampList": [],
"certificateTransparencyCompliance": "unknown"
},
"asn": {
"ip": "34.203.255.203",
"asn": "14618",
"country": "US",
"registrar": "arin",
"date": "2005-11-04",
"description": "AMAZON-AES, US",
"route": "34.192.0.0/12",
"name": "AMAZON-AES"
},
"geoip": {
"range": [
583532544,
584056831
],
"country": "US",
"region": "VA",
"eu": "0",
"timezone": "America/New_York",
"city": "Ashburn",
"ll": [
39.0481,
-77.4728
],

https://urlscan.io/api/v1/result/3a2c746e-192e-4901-9a5d-78b8b2ee32e3/ Page 59 of 119


03.10.2021, 14:47

"metro": 511,
"area": 1000,
"country_name": "United States"
},
"rdns": {
"ip": "34.203.255.203",
"ptr": "ec2-34-203-255-203.compute-1.amazonaws.com"
}
},
"type": "Document",
"frameId": "A7C87A170B6FF1BFF9C1519BD77B8C40",
"hasUserGesture": false
}
],
"response": {
"encodedDataLength": 5294,
"dataLength": 12088,
"requestId": "53DE0799AA0EDCD8D4539C351504D3CB",
"type": "Document",
"response": {
"url": "https://myapps.perkinscoie.com/login/login.htm?
fromURI=%2Fapp%2Fservicenow_ud%2Fexk1jsx6trpNIFLGO0h8%2Fsso%2Fsaml%3FSAMLRequest%3DnVJdb9MwFP
0rkd8TJ2aZgtVUCq0GlUoXrYUHXpAT365miW18naz796Ru0coDE%252BL1%252Btxzz4dnKPqOWV4N%252FqAf4OcA6KN
j32nk55eSDE5zI1Ah16IH5L7l2%252BrzmrMk5dYZb1rTkahCBOeV0QujcejBbcGNqoUvD%252BuSHLy3yCm14J6UxtYo
kDAmeIbE2jwnrempFqMVj5BIQ6LlJERpcWJ83e9fhLWYXNGEvWlIL1wT1fdBUjg%252BZT%252FweOud3azu1h%252Fv0
0NBEQ09mSLRnXEtBMsl2YsOgUSrZUm2m0XeNLdMvG%252F27wqWF1I2NyxrRJbnTZaLVBQTEGuBqEZ4XUUcYKXRC%252B
1LwlKWxSmL03yXFpzd8DRPWM6%252Bkai%252BhPVBaan049vJNmcQ8k%252B7XR3X99tdIBiVBLeZ0P8V6ldwGAKdLpD
5LDTMg3x3XfrbysTvpsn83yTM6PWhy1nLTy5Wy9p0qn2Jqq4zzwsHwk%252FOvBsglNQL%252F3ctWZKFiZLxPkA59EJ1
lZQOEAmdX%252B7%252B%252BbnnvwA%253D%26RelayState%3Dhttps%253A%252F%252Fperkinscoiedev.servic
e-now.com%252Fnavpage.do",
"status": 200,
"statusText": "OK",
"headers": {
"Date": "Fri, 05 Feb 2021 08:24:08 GMT",
"Server": "nginx",
"Content-Type": "text/html;charset=utf-8",
"Vary": "Accept-Encoding",
"x-okta-request-id": "YB0AqIFr8Gz2LALmqRcSLgAABQg",
"x-xss-protection": "0",
"p3p": "CP=\"HONK\"",
"x-rate-limit-limit": "850",
"x-rate-limit-remaining": "848",
"x-rate-limit-reset": "1612513508",
"expect-ct": "report-uri=\"https://oktaexpectct.report-
uri.com/r/t/ct/reportOnly\", max-age=0",
"cache-control": "no-cache, no-store",
"pragma": "no-cache",
"expires": "0",
"x-frame-options": "SAMEORIGIN",
"x-content-type-options": "nosniff",
"x-ua-compatible": "IE=edge",
"content-language": "en",
"Strict-Transport-Security": "max-age=315360000; includeSubDomains",
"X-Robots-Tag": "none",
"Content-Encoding": "gzip",
"set-cookie": "sid=\"\"; Expires=Thu, 01-Jan-1970 00:00:10 GMT;
Path=/\nJSESSIONID=D85400EFBCAE7426B942BCCCDCF085A6; Path=/; Secure; HttpOnly\nt=red-bright;
Path=/\nDT=DI04cu3jc1rRty0Cg_VBmuqag;Version=1;Path=/;Max-Age=63072000;Secure;Expires=Sun, 05
Feb 2023 08:24:08 GMT;SameSite=None\nsid=\"\"; Expires=Thu, 01-Jan-1970 00:00:10 GMT;
Path=/",
"Keep-Alive": "timeout=5, max=99",
"Connection": "Keep-Alive",
"Transfer-Encoding": "chunked"
},
"mimeType": "text/html",
"requestHeaders": {

https://urlscan.io/api/v1/result/3a2c746e-192e-4901-9a5d-78b8b2ee32e3/ Page 60 of 119


03.10.2021, 14:47

"Host": "myapps.perkinscoie.com",
"Connection": "keep-alive",
"Pragma": "no-cache",
"Cache-Control": "no-cache",
"Upgrade-Insecure-Requests": "1",
"User-Agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5)
AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36",
"Accept":
"text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q
=0.8,application/signed-exchange;v=b3;q=0.9",
"Sec-Fetch-Site": "cross-site",
"Sec-Fetch-Mode": "navigate",
"Sec-Fetch-Dest": "document",
"Accept-Encoding": "gzip, deflate, br",
"Accept-Language": "en-US"
},
"remoteIPAddress": "34.203.255.203",
"remotePort": 443,
"fromPrefetchCache": false,
"encodedDataLength": 1147,
"timing": {
"requestTime": 23727523.577774,
"proxyStart": -1,
"proxyEnd": -1,
"dnsStart": -1,
"dnsEnd": -1,
"connectStart": -1,
"connectEnd": -1,
"sslStart": -1,
"sslEnd": -1,
"workerStart": -1,
"workerReady": -1,
"workerFetchStart": -1,
"workerRespondWithSettled": -1,
"sendStart": 0.288,
"sendEnd": 0.33,
"pushStart": 0,
"pushEnd": 0,
"receiveHeadersEnd": 208.579
},
"responseTime": 1612513448644.746,
"protocol": "http/1.1",
"securityState": "secure",
"securityDetails": {
"protocol": "TLS 1.2",
"keyExchange": "ECDHE_RSA",
"keyExchangeGroup": "P-256",
"cipher": "AES_128_GCM",
"certificateId": 0,
"subjectName": "myapps.perkinscoie.com",
"sanList": [
"myapps.perkinscoie.com",
"www.myapps.perkinscoie.com"
],
"issuer": "DigiCert SHA2 Secure Server CA",
"validFrom": 1583107200,
"validTo": 1615377600,
"signedCertificateTimestampList": [],
"certificateTransparencyCompliance": "unknown"
},
"securityHeaders": [
{
"name": "Strict-Transport-Security",
"value": "max-age=315360000; includeSubDomains"
},
{

https://urlscan.io/api/v1/result/3a2c746e-192e-4901-9a5d-78b8b2ee32e3/ Page 61 of 119


03.10.2021, 14:47

"name": "X-Content-Type-Options",
"value": "nosniff"
},
{
"name": "X-Frame-Options",
"value": "SAMEORIGIN"
},
{
"name": "X-Xss-Protection",
"value": "0"
}
]
},
"hash": "3a4678a45d2a987cc89c9368ed9a9b1577fe7530a23fb3f81a71e9b6e061c89b",
"size": 12088,
"asn": {
"ip": "34.203.255.203",
"asn": "14618",
"country": "US",
"registrar": "arin",
"date": "2005-11-04",
"description": "AMAZON-AES, US",
"route": "34.192.0.0/12",
"name": "AMAZON-AES"
},
"geoip": {
"range": [
583532544,
584056831
],
"country": "US",
"region": "VA",
"eu": "0",
"timezone": "America/New_York",
"city": "Ashburn",
"ll": [
39.0481,
-77.4728
],
"metro": 511,
"area": 1000,
"country_name": "United States"
},
"rdns": {
"ip": "34.203.255.203",
"ptr": "ec2-34-203-255-203.compute-1.amazonaws.com"
}
},
"initiatorInfo": {
"url": "https://perkinscoiedev.service-now.com/auth_redirect.do?
sysparm_stack=no&sysparm_url=https%3A%2F%2Fmyapps.perkinscoie.com%2Fapp%2Fservicenow_ud%2Fexk
1jsx6trpNIFLGO0h8%2Fsso%2Fsaml%3FSAMLRequest%3DnVJdb9MwFP0rkd8TJ2aZgtVUCq0GlUoXrYUHXpAT365miW
18naz796Ru0coDE%252BL1%252Btxzz4dnKPqOWV4N%252FqAf4OcA6KNj32nk55eSDE5zI1Ah16IH5L7l2%252BrzmrM
k5dYZb1rTkahCBOeV0QujcejBbcGNqoUvD%252BuSHLy3yCm14J6UxtYokDAmeIbE2jwnrempFqMVj5BIQ6LlJERpcWJ8
3e9fhLWYXNGEvWlIL1wT1fdBUjg%252BZT%252FweOud3azu1h%252Fv00NBEQ09mSLRnXEtBMsl2YsOgUSrZUm2m0XeN
LdMvG%252F27wqWF1I2NyxrRJbnTZaLVBQTEGuBqEZ4XUUcYKXRC%252B1LwlKWxSmL03yXFpzd8DRPWM6%252Bkai%25
2BhPVBaan049vJNmcQ8k%252B7XR3X99tdIBiVBLeZ0P8V6ldwGAKdLpD5LDTMg3x3XfrbysTvpsn83yTM6PWhy1nLTy5
Wy9p0qn2Jqq4zzwsHwk%252FOvBsglNQL%252F3ctWZKFiZLxPkA59EJ1lZQOEAmdX%252B7%252B%252BbnnvwA%253D
%26RelayState%3Dhttps%253A%252F%252Fperkinscoiedev.service-now.com%252Fnavpage.do",
"host": "perkinscoiedev.service-now.com",
"type": "script"
}
},
{
"request": {
"requestId": "24819.2",

https://urlscan.io/api/v1/result/3a2c746e-192e-4901-9a5d-78b8b2ee32e3/ Page 62 of 119


03.10.2021, 14:47

"loaderId": "53DE0799AA0EDCD8D4539C351504D3CB",
"documentURL": "https://myapps.perkinscoie.com/login/login.htm?
fromURI=%2Fapp%2Fservicenow_ud%2Fexk1jsx6trpNIFLGO0h8%2Fsso%2Fsaml%3FSAMLRequest%3DnVJdb9MwFP
0rkd8TJ2aZgtVUCq0GlUoXrYUHXpAT365miW18naz796Ru0coDE%252BL1%252Btxzz4dnKPqOWV4N%252FqAf4OcA6KN
j32nk55eSDE5zI1Ah16IH5L7l2%252BrzmrMk5dYZb1rTkahCBOeV0QujcejBbcGNqoUvD%252BuSHLy3yCm14J6UxtYo
kDAmeIbE2jwnrempFqMVj5BIQ6LlJERpcWJ83e9fhLWYXNGEvWlIL1wT1fdBUjg%252BZT%252FweOud3azu1h%252Fv0
0NBEQ09mSLRnXEtBMsl2YsOgUSrZUm2m0XeNLdMvG%252F27wqWF1I2NyxrRJbnTZaLVBQTEGuBqEZ4XUUcYKXRC%252B
1LwlKWxSmL03yXFpzd8DRPWM6%252Bkai%252BhPVBaan049vJNmcQ8k%252B7XR3X99tdIBiVBLeZ0P8V6ldwGAKdLpD
5LDTMg3x3XfrbysTvpsn83yTM6PWhy1nLTy5Wy9p0qn2Jqq4zzwsHwk%252FOvBsglNQL%252F3ctWZKFiZLxPkA59EJ1
lZQOEAmdX%252B7%252B%252BbnnvwA%253D%26RelayState%3Dhttps%253A%252F%252Fperkinscoiedev.servic
e-now.com%252Fnavpage.do",
"request": {
"url": "https://ok1static.oktacdn.com/assets/js/sdk/okta-signin-
widget/3.9.2/js/okta-sign-in.min.js",
"method": "GET",
"headers": {
"Referer": "https://myapps.perkinscoie.com/login/login.htm?
fromURI=%2Fapp%2Fservicenow_ud%2Fexk1jsx6trpNIFLGO0h8%2Fsso%2Fsaml%3FSAMLRequest%3DnVJdb9MwFP
0rkd8TJ2aZgtVUCq0GlUoXrYUHXpAT365miW18naz796Ru0coDE%252BL1%252Btxzz4dnKPqOWV4N%252FqAf4OcA6KN
j32nk55eSDE5zI1Ah16IH5L7l2%252BrzmrMk5dYZb1rTkahCBOeV0QujcejBbcGNqoUvD%252BuSHLy3yCm14J6UxtYo
kDAmeIbE2jwnrempFqMVj5BIQ6LlJERpcWJ83e9fhLWYXNGEvWlIL1wT1fdBUjg%252BZT%252FweOud3azu1h%252Fv0
0NBEQ09mSLRnXEtBMsl2YsOgUSrZUm2m0XeNLdMvG%252F27wqWF1I2NyxrRJbnTZaLVBQTEGuBqEZ4XUUcYKXRC%252B
1LwlKWxSmL03yXFpzd8DRPWM6%252Bkai%252BhPVBaan049vJNmcQ8k%252B7XR3X99tdIBiVBLeZ0P8V6ldwGAKdLpD
5LDTMg3x3XfrbysTvpsn83yTM6PWhy1nLTy5Wy9p0qn2Jqq4zzwsHwk%252FOvBsglNQL%252F3ctWZKFiZLxPkA59EJ1
lZQOEAmdX%252B7%252B%252BbnnvwA%253D%26RelayState%3Dhttps%253A%252F%252Fperkinscoiedev.servic
e-now.com%252Fnavpage.do",
"User-Agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5)
AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36"
},
"mixedContentType": "none",
"initialPriority": "High",
"referrerPolicy": "no-referrer-when-downgrade"
},
"timestamp": 23727523.796219,
"wallTime": 1612513448.654678,
"initiator": {
"type": "parser",
"url": "https://myapps.perkinscoie.com/login/login.htm?
fromURI=%2Fapp%2Fservicenow_ud%2Fexk1jsx6trpNIFLGO0h8%2Fsso%2Fsaml%3FSAMLRequest%3DnVJdb9MwFP
0rkd8TJ2aZgtVUCq0GlUoXrYUHXpAT365miW18naz796Ru0coDE%252BL1%252Btxzz4dnKPqOWV4N%252FqAf4OcA6KN
j32nk55eSDE5zI1Ah16IH5L7l2%252BrzmrMk5dYZb1rTkahCBOeV0QujcejBbcGNqoUvD%252BuSHLy3yCm14J6UxtYo
kDAmeIbE2jwnrempFqMVj5BIQ6LlJERpcWJ83e9fhLWYXNGEvWlIL1wT1fdBUjg%252BZT%252FweOud3azu1h%252Fv0
0NBEQ09mSLRnXEtBMsl2YsOgUSrZUm2m0XeNLdMvG%252F27wqWF1I2NyxrRJbnTZaLVBQTEGuBqEZ4XUUcYKXRC%252B
1LwlKWxSmL03yXFpzd8DRPWM6%252Bkai%252BhPVBaan049vJNmcQ8k%252B7XR3X99tdIBiVBLeZ0P8V6ldwGAKdLpD
5LDTMg3x3XfrbysTvpsn83yTM6PWhy1nLTy5Wy9p0qn2Jqq4zzwsHwk%252FOvBsglNQL%252F3ctWZKFiZLxPkA59EJ1
lZQOEAmdX%252B7%252B%252BbnnvwA%253D%26RelayState%3Dhttps%253A%252F%252Fperkinscoiedev.servic
e-now.com%252Fnavpage.do",
"lineNumber": 10,
"columnNumber": 106
},
"type": "Script",
"frameId": "A7C87A170B6FF1BFF9C1519BD77B8C40",
"hasUserGesture": false
},
"response": {
"encodedDataLength": 357282,
"dataLength": 1058221,
"requestId": "24819.2",
"type": "Script",
"response": {
"url": "https://ok1static.oktacdn.com/assets/js/sdk/okta-signin-
widget/3.9.2/js/okta-sign-in.min.js",
"status": 200,
"statusText": "",
"headers": {
"date": "Sat, 23 Jan 2021 04:34:33 GMT",

https://urlscan.io/api/v1/result/3a2c746e-192e-4901-9a5d-78b8b2ee32e3/ Page 63 of 119


03.10.2021, 14:47

"content-encoding": "gzip",
"vary": "Accept-Encoding",
"age": "1136974",
"x-cache": "Hit from cloudfront",
"access-control-allow-origin": "*",
"last-modified": "Tue, 05 May 2020 00:01:25 GMT",
"server": "nginx",
"etag": "W/\"24226971e0903c7d7f0fb8443f68c6c1\"",
"strict-transport-security": "max-age=315360000; includeSubDomains",
"content-type": "application/javascript",
"via": "1.1 a383f82b5d4e98bbd66535c2c4b20c9e.cloudfront.net (CloudFront)",
"cache-control": "max-age=31536000, public,max-age=31536000,s-maxage=1814400",
"public-key-pins-report-only": "pin-
sha256=\"r5EfzZxQVvQpKo3AgYRaT7X2bDO/kj3ACwmxfdT2zt8=\"; pin-
sha256=\"MaqlcUgk2mvY/RFSGeSwBRkI+rZ6/dxe/DuQfBT/vnQ=\"; pin-
sha256=\"72G5IEvDEWn+EThf3qjR7/bQSWaS2ZSLqolhnO6iyJI=\"; pin-
sha256=\"rrV6CLCCvqnk89gWibYT0JO6fNQ8cCit7GGoiVTjCOg=\"; max-age=60; report-
uri=\"https://okta.report-uri.com/r/default/hpkp/reportOnly\"",
"x-amz-cf-pop": "FRA56-C1",
"x-amz-cf-id": "JMCvcGcWQgXwIjPj8KDeK5vOL_pr5wZrCeN0XjFlKgQ4fetRK73GXQ==",
"expires": "Sun, 23 Jan 2022 04:34:33 GMT"
},
"mimeType": "application/javascript",
"remoteIPAddress": "65.9.58.47",
"remotePort": 443,
"fromPrefetchCache": false,
"encodedDataLength": 768,
"timing": {
"requestTime": 23727523.796515,
"proxyStart": -1,
"proxyEnd": -1,
"dnsStart": -1,
"dnsEnd": -1,
"connectStart": -1,
"connectEnd": -1,
"sslStart": -1,
"sslEnd": -1,
"workerStart": -1,
"workerReady": -1,
"workerFetchStart": -1,
"workerRespondWithSettled": -1,
"sendStart": 83.71,
"sendEnd": 83.867,
"pushStart": 0,
"pushEnd": 0,
"receiveHeadersEnd": 149.295
},
"responseTime": 1612513448804.191,
"protocol": "h2",
"securityState": "secure",
"securityDetails": {
"protocol": "TLS 1.3",
"keyExchange": "",
"keyExchangeGroup": "X25519",
"cipher": "AES_128_GCM",
"certificateId": 0,
"subjectName": "*.oktacdn.com",
"sanList": [
"*.oktacdn.com",
"oktacdn.com"
],
"issuer": "DigiCert TLS RSA SHA256 2020 CA1",
"validFrom": 1607990400,
"validTo": 1642291199,
"signedCertificateTimestampList": [],
"certificateTransparencyCompliance": "unknown"

https://urlscan.io/api/v1/result/3a2c746e-192e-4901-9a5d-78b8b2ee32e3/ Page 64 of 119


03.10.2021, 14:47

},
"securityHeaders": [
{
"name": "Strict-Transport-Security",
"value": "max-age=315360000; includeSubDomains"
}
]
},
"hash": "f27daa844f6b3c459fdf04a0bccd7a7d1eb2e22a5211c725ddd21f6f859d7f57",
"size": 1058131,
"asn": {
"ip": "65.9.58.47",
"asn": "16509",
"country": "US",
"registrar": "arin",
"date": "2000-05-04",
"description": "AMAZON-02, US",
"route": "65.9.58.0/23",
"name": "AMAZON-02"
},
"geoip": {
"range": [
1091043328,
1091305471
],
"country": "US",
"region": "WA",
"eu": "0",
"timezone": "America/Los_Angeles",
"city": "Seattle",
"ll": [
47.54,
-122.3032
],
"metro": 819,
"area": 1000,
"country_name": "United States"
},
"rdns": {
"ip": "65.9.58.47",
"ptr": null
}
},
"initiatorInfo": {
"url": "https://myapps.perkinscoie.com/login/login.htm?
fromURI=%2Fapp%2Fservicenow_ud%2Fexk1jsx6trpNIFLGO0h8%2Fsso%2Fsaml%3FSAMLRequest%3DnVJdb9MwFP
0rkd8TJ2aZgtVUCq0GlUoXrYUHXpAT365miW18naz796Ru0coDE%252BL1%252Btxzz4dnKPqOWV4N%252FqAf4OcA6KN
j32nk55eSDE5zI1Ah16IH5L7l2%252BrzmrMk5dYZb1rTkahCBOeV0QujcejBbcGNqoUvD%252BuSHLy3yCm14J6UxtYo
kDAmeIbE2jwnrempFqMVj5BIQ6LlJERpcWJ83e9fhLWYXNGEvWlIL1wT1fdBUjg%252BZT%252FweOud3azu1h%252Fv0
0NBEQ09mSLRnXEtBMsl2YsOgUSrZUm2m0XeNLdMvG%252F27wqWF1I2NyxrRJbnTZaLVBQTEGuBqEZ4XUUcYKXRC%252B
1LwlKWxSmL03yXFpzd8DRPWM6%252Bkai%252BhPVBaan049vJNmcQ8k%252B7XR3X99tdIBiVBLeZ0P8V6ldwGAKdLpD
5LDTMg3x3XfrbysTvpsn83yTM6PWhy1nLTy5Wy9p0qn2Jqq4zzwsHwk%252FOvBsglNQL%252F3ctWZKFiZLxPkA59EJ1
lZQOEAmdX%252B7%252B%252BbnnvwA%253D%26RelayState%3Dhttps%253A%252F%252Fperkinscoiedev.servic
e-now.com%252Fnavpage.do",
"host": "myapps.perkinscoie.com",
"type": "parser"
}
},
{
"request": {
"requestId": "24819.3",
"loaderId": "53DE0799AA0EDCD8D4539C351504D3CB",
"documentURL": "https://myapps.perkinscoie.com/login/login.htm?
fromURI=%2Fapp%2Fservicenow_ud%2Fexk1jsx6trpNIFLGO0h8%2Fsso%2Fsaml%3FSAMLRequest%3DnVJdb9MwFP
0rkd8TJ2aZgtVUCq0GlUoXrYUHXpAT365miW18naz796Ru0coDE%252BL1%252Btxzz4dnKPqOWV4N%252FqAf4OcA6KN
j32nk55eSDE5zI1Ah16IH5L7l2%252BrzmrMk5dYZb1rTkahCBOeV0QujcejBbcGNqoUvD%252BuSHLy3yCm14J6UxtYo

https://urlscan.io/api/v1/result/3a2c746e-192e-4901-9a5d-78b8b2ee32e3/ Page 65 of 119


03.10.2021, 14:47

kDAmeIbE2jwnrempFqMVj5BIQ6LlJERpcWJ83e9fhLWYXNGEvWlIL1wT1fdBUjg%252BZT%252FweOud3azu1h%252Fv0
0NBEQ09mSLRnXEtBMsl2YsOgUSrZUm2m0XeNLdMvG%252F27wqWF1I2NyxrRJbnTZaLVBQTEGuBqEZ4XUUcYKXRC%252B
1LwlKWxSmL03yXFpzd8DRPWM6%252Bkai%252BhPVBaan049vJNmcQ8k%252B7XR3X99tdIBiVBLeZ0P8V6ldwGAKdLpD
5LDTMg3x3XfrbysTvpsn83yTM6PWhy1nLTy5Wy9p0qn2Jqq4zzwsHwk%252FOvBsglNQL%252F3ctWZKFiZLxPkA59EJ1
lZQOEAmdX%252B7%252B%252BbnnvwA%253D%26RelayState%3Dhttps%253A%252F%252Fperkinscoiedev.servic
e-now.com%252Fnavpage.do",
"request": {
"url": "https://ok1static.oktacdn.com/assets/js/sdk/okta-signin-
widget/3.9.2/css/okta-sign-in.min.css",
"method": "GET",
"headers": {
"Referer": "https://myapps.perkinscoie.com/login/login.htm?
fromURI=%2Fapp%2Fservicenow_ud%2Fexk1jsx6trpNIFLGO0h8%2Fsso%2Fsaml%3FSAMLRequest%3DnVJdb9MwFP
0rkd8TJ2aZgtVUCq0GlUoXrYUHXpAT365miW18naz796Ru0coDE%252BL1%252Btxzz4dnKPqOWV4N%252FqAf4OcA6KN
j32nk55eSDE5zI1Ah16IH5L7l2%252BrzmrMk5dYZb1rTkahCBOeV0QujcejBbcGNqoUvD%252BuSHLy3yCm14J6UxtYo
kDAmeIbE2jwnrempFqMVj5BIQ6LlJERpcWJ83e9fhLWYXNGEvWlIL1wT1fdBUjg%252BZT%252FweOud3azu1h%252Fv0
0NBEQ09mSLRnXEtBMsl2YsOgUSrZUm2m0XeNLdMvG%252F27wqWF1I2NyxrRJbnTZaLVBQTEGuBqEZ4XUUcYKXRC%252B
1LwlKWxSmL03yXFpzd8DRPWM6%252Bkai%252BhPVBaan049vJNmcQ8k%252B7XR3X99tdIBiVBLeZ0P8V6ldwGAKdLpD
5LDTMg3x3XfrbysTvpsn83yTM6PWhy1nLTy5Wy9p0qn2Jqq4zzwsHwk%252FOvBsglNQL%252F3ctWZKFiZLxPkA59EJ1
lZQOEAmdX%252B7%252B%252BbnnvwA%253D%26RelayState%3Dhttps%253A%252F%252Fperkinscoiedev.servic
e-now.com%252Fnavpage.do",
"User-Agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5)
AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36"
},
"mixedContentType": "none",
"initialPriority": "VeryHigh",
"referrerPolicy": "no-referrer-when-downgrade"
},
"timestamp": 23727523.7964,
"wallTime": 1612513448.654858,
"initiator": {
"type": "parser",
"url": "https://myapps.perkinscoie.com/login/login.htm?
fromURI=%2Fapp%2Fservicenow_ud%2Fexk1jsx6trpNIFLGO0h8%2Fsso%2Fsaml%3FSAMLRequest%3DnVJdb9MwFP
0rkd8TJ2aZgtVUCq0GlUoXrYUHXpAT365miW18naz796Ru0coDE%252BL1%252Btxzz4dnKPqOWV4N%252FqAf4OcA6KN
j32nk55eSDE5zI1Ah16IH5L7l2%252BrzmrMk5dYZb1rTkahCBOeV0QujcejBbcGNqoUvD%252BuSHLy3yCm14J6UxtYo
kDAmeIbE2jwnrempFqMVj5BIQ6LlJERpcWJ83e9fhLWYXNGEvWlIL1wT1fdBUjg%252BZT%252FweOud3azu1h%252Fv0
0NBEQ09mSLRnXEtBMsl2YsOgUSrZUm2m0XeNLdMvG%252F27wqWF1I2NyxrRJbnTZaLVBQTEGuBqEZ4XUUcYKXRC%252B
1LwlKWxSmL03yXFpzd8DRPWM6%252Bkai%252BhPVBaan049vJNmcQ8k%252B7XR3X99tdIBiVBLeZ0P8V6ldwGAKdLpD
5LDTMg3x3XfrbysTvpsn83yTM6PWhy1nLTy5Wy9p0qn2Jqq4zzwsHwk%252FOvBsglNQL%252F3ctWZKFiZLxPkA59EJ1
lZQOEAmdX%252B7%252B%252BbnnvwA%253D%26RelayState%3Dhttps%253A%252F%252Fperkinscoiedev.servic
e-now.com%252Fnavpage.do",
"lineNumber": 13,
"columnNumber": 107
},
"type": "Stylesheet",
"frameId": "A7C87A170B6FF1BFF9C1519BD77B8C40",
"hasUserGesture": false
},
"response": {
"encodedDataLength": 33043,
"dataLength": 185838,
"requestId": "24819.3",
"type": "Stylesheet",
"response": {
"url": "https://ok1static.oktacdn.com/assets/js/sdk/okta-signin-
widget/3.9.2/css/okta-sign-in.min.css",
"status": 200,
"statusText": "",
"headers": {
"date": "Sat, 23 Jan 2021 04:34:34 GMT",
"content-encoding": "gzip",
"vary": "Accept-Encoding",
"age": "1136974",
"x-cache": "Hit from cloudfront",
"access-control-allow-origin": "*",

https://urlscan.io/api/v1/result/3a2c746e-192e-4901-9a5d-78b8b2ee32e3/ Page 66 of 119


03.10.2021, 14:47

"last-modified": "Tue, 05 May 2020 00:01:14 GMT",


"server": "nginx",
"etag": "W/\"ec3aabb09a523e499e64ec432f326976\"",
"strict-transport-security": "max-age=315360000; includeSubDomains",
"content-type": "text/css",
"via": "1.1 a383f82b5d4e98bbd66535c2c4b20c9e.cloudfront.net (CloudFront)",
"cache-control": "max-age=31536000, public,max-age=31536000,s-maxage=1814400",
"public-key-pins-report-only": "pin-
sha256=\"r5EfzZxQVvQpKo3AgYRaT7X2bDO/kj3ACwmxfdT2zt8=\"; pin-
sha256=\"MaqlcUgk2mvY/RFSGeSwBRkI+rZ6/dxe/DuQfBT/vnQ=\"; pin-
sha256=\"72G5IEvDEWn+EThf3qjR7/bQSWaS2ZSLqolhnO6iyJI=\"; pin-
sha256=\"rrV6CLCCvqnk89gWibYT0JO6fNQ8cCit7GGoiVTjCOg=\"; max-age=60; report-
uri=\"https://okta.report-uri.com/r/default/hpkp/reportOnly\"",
"x-amz-cf-pop": "FRA56-C1",
"x-amz-cf-id": "X_V9S-zBxtIqI_3YdUi0vlFGa0PvPhnvHl4ggzuBf3Y82Q9k3PV5Mw==",
"expires": "Sun, 23 Jan 2022 04:34:34 GMT"
},
"mimeType": "text/css",
"remoteIPAddress": "65.9.58.47",
"remotePort": 443,
"fromPrefetchCache": false,
"encodedDataLength": 757,
"timing": {
"requestTime": 23727523.796698,
"proxyStart": -1,
"proxyEnd": -1,
"dnsStart": 0.345,
"dnsEnd": 16.257,
"connectStart": 16.257,
"connectEnd": 82.885,
"sslStart": 33.407,
"sslEnd": 82.879,
"workerStart": -1,
"workerReady": -1,
"workerFetchStart": -1,
"workerRespondWithSettled": -1,
"sendStart": 83.426,
"sendEnd": 83.68,
"pushStart": 0,
"pushEnd": 0,
"receiveHeadersEnd": 132.249
},
"responseTime": 1612513448787.338,
"protocol": "h2",
"securityState": "secure",
"securityDetails": {
"protocol": "TLS 1.3",
"keyExchange": "",
"keyExchangeGroup": "X25519",
"cipher": "AES_128_GCM",
"certificateId": 0,
"subjectName": "*.oktacdn.com",
"sanList": [
"*.oktacdn.com",
"oktacdn.com"
],
"issuer": "DigiCert TLS RSA SHA256 2020 CA1",
"validFrom": 1607990400,
"validTo": 1642291199,
"signedCertificateTimestampList": [],
"certificateTransparencyCompliance": "unknown"
},
"securityHeaders": [
{
"name": "Strict-Transport-Security",
"value": "max-age=315360000; includeSubDomains"

https://urlscan.io/api/v1/result/3a2c746e-192e-4901-9a5d-78b8b2ee32e3/ Page 67 of 119


03.10.2021, 14:47

}
]
},
"hash": "ea529b703d4233c8502c032419c0b5238ec604bf77f3f9425db9ae0a8bc17aea",
"size": 185838,
"asn": {
"ip": "65.9.58.47",
"asn": "16509",
"country": "US",
"registrar": "arin",
"date": "2000-05-04",
"description": "AMAZON-02, US",
"route": "65.9.58.0/23",
"name": "AMAZON-02"
},
"geoip": {
"range": [
1091043328,
1091305471
],
"country": "US",
"region": "WA",
"eu": "0",
"timezone": "America/Los_Angeles",
"city": "Seattle",
"ll": [
47.54,
-122.3032
],
"metro": 819,
"area": 1000,
"country_name": "United States"
},
"rdns": {
"ip": "65.9.58.47",
"ptr": null
}
},
"initiatorInfo": {
"url": "https://myapps.perkinscoie.com/login/login.htm?
fromURI=%2Fapp%2Fservicenow_ud%2Fexk1jsx6trpNIFLGO0h8%2Fsso%2Fsaml%3FSAMLRequest%3DnVJdb9MwFP
0rkd8TJ2aZgtVUCq0GlUoXrYUHXpAT365miW18naz796Ru0coDE%252BL1%252Btxzz4dnKPqOWV4N%252FqAf4OcA6KN
j32nk55eSDE5zI1Ah16IH5L7l2%252BrzmrMk5dYZb1rTkahCBOeV0QujcejBbcGNqoUvD%252BuSHLy3yCm14J6UxtYo
kDAmeIbE2jwnrempFqMVj5BIQ6LlJERpcWJ83e9fhLWYXNGEvWlIL1wT1fdBUjg%252BZT%252FweOud3azu1h%252Fv0
0NBEQ09mSLRnXEtBMsl2YsOgUSrZUm2m0XeNLdMvG%252F27wqWF1I2NyxrRJbnTZaLVBQTEGuBqEZ4XUUcYKXRC%252B
1LwlKWxSmL03yXFpzd8DRPWM6%252Bkai%252BhPVBaan049vJNmcQ8k%252B7XR3X99tdIBiVBLeZ0P8V6ldwGAKdLpD
5LDTMg3x3XfrbysTvpsn83yTM6PWhy1nLTy5Wy9p0qn2Jqq4zzwsHwk%252FOvBsglNQL%252F3ctWZKFiZLxPkA59EJ1
lZQOEAmdX%252B7%252B%252BbnnvwA%253D%26RelayState%3Dhttps%253A%252F%252Fperkinscoiedev.servic
e-now.com%252Fnavpage.do",
"host": "myapps.perkinscoie.com",
"type": "parser"
}
},
{
"request": {
"requestId": "24819.4",
"loaderId": "53DE0799AA0EDCD8D4539C351504D3CB",
"documentURL": "https://myapps.perkinscoie.com/login/login.htm?
fromURI=%2Fapp%2Fservicenow_ud%2Fexk1jsx6trpNIFLGO0h8%2Fsso%2Fsaml%3FSAMLRequest%3DnVJdb9MwFP
0rkd8TJ2aZgtVUCq0GlUoXrYUHXpAT365miW18naz796Ru0coDE%252BL1%252Btxzz4dnKPqOWV4N%252FqAf4OcA6KN
j32nk55eSDE5zI1Ah16IH5L7l2%252BrzmrMk5dYZb1rTkahCBOeV0QujcejBbcGNqoUvD%252BuSHLy3yCm14J6UxtYo
kDAmeIbE2jwnrempFqMVj5BIQ6LlJERpcWJ83e9fhLWYXNGEvWlIL1wT1fdBUjg%252BZT%252FweOud3azu1h%252Fv0
0NBEQ09mSLRnXEtBMsl2YsOgUSrZUm2m0XeNLdMvG%252F27wqWF1I2NyxrRJbnTZaLVBQTEGuBqEZ4XUUcYKXRC%252B
1LwlKWxSmL03yXFpzd8DRPWM6%252Bkai%252BhPVBaan049vJNmcQ8k%252B7XR3X99tdIBiVBLeZ0P8V6ldwGAKdLpD
5LDTMg3x3XfrbysTvpsn83yTM6PWhy1nLTy5Wy9p0qn2Jqq4zzwsHwk%252FOvBsglNQL%252F3ctWZKFiZLxPkA59EJ1
lZQOEAmdX%252B7%252B%252BbnnvwA%253D%26RelayState%3Dhttps%253A%252F%252Fperkinscoiedev.servic

https://urlscan.io/api/v1/result/3a2c746e-192e-4901-9a5d-78b8b2ee32e3/ Page 68 of 119


03.10.2021, 14:47

e-now.com%252Fnavpage.do",
"request": {
"url": "https://ok1static.oktacdn.com/assets/loginpage/css/custom-
signin.bb8f4ce4363dd17160adb27f2ab5f478.css",
"method": "GET",
"headers": {
"Referer": "https://myapps.perkinscoie.com/login/login.htm?
fromURI=%2Fapp%2Fservicenow_ud%2Fexk1jsx6trpNIFLGO0h8%2Fsso%2Fsaml%3FSAMLRequest%3DnVJdb9MwFP
0rkd8TJ2aZgtVUCq0GlUoXrYUHXpAT365miW18naz796Ru0coDE%252BL1%252Btxzz4dnKPqOWV4N%252FqAf4OcA6KN
j32nk55eSDE5zI1Ah16IH5L7l2%252BrzmrMk5dYZb1rTkahCBOeV0QujcejBbcGNqoUvD%252BuSHLy3yCm14J6UxtYo
kDAmeIbE2jwnrempFqMVj5BIQ6LlJERpcWJ83e9fhLWYXNGEvWlIL1wT1fdBUjg%252BZT%252FweOud3azu1h%252Fv0
0NBEQ09mSLRnXEtBMsl2YsOgUSrZUm2m0XeNLdMvG%252F27wqWF1I2NyxrRJbnTZaLVBQTEGuBqEZ4XUUcYKXRC%252B
1LwlKWxSmL03yXFpzd8DRPWM6%252Bkai%252BhPVBaan049vJNmcQ8k%252B7XR3X99tdIBiVBLeZ0P8V6ldwGAKdLpD
5LDTMg3x3XfrbysTvpsn83yTM6PWhy1nLTy5Wy9p0qn2Jqq4zzwsHwk%252FOvBsglNQL%252F3ctWZKFiZLxPkA59EJ1
lZQOEAmdX%252B7%252B%252BbnnvwA%253D%26RelayState%3Dhttps%253A%252F%252Fperkinscoiedev.servic
e-now.com%252Fnavpage.do",
"User-Agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5)
AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36"
},
"mixedContentType": "none",
"initialPriority": "VeryHigh",
"referrerPolicy": "no-referrer-when-downgrade"
},
"timestamp": 23727523.796549,
"wallTime": 1612513448.655007,
"initiator": {
"type": "parser",
"url": "https://myapps.perkinscoie.com/login/login.htm?
fromURI=%2Fapp%2Fservicenow_ud%2Fexk1jsx6trpNIFLGO0h8%2Fsso%2Fsaml%3FSAMLRequest%3DnVJdb9MwFP
0rkd8TJ2aZgtVUCq0GlUoXrYUHXpAT365miW18naz796Ru0coDE%252BL1%252Btxzz4dnKPqOWV4N%252FqAf4OcA6KN
j32nk55eSDE5zI1Ah16IH5L7l2%252BrzmrMk5dYZb1rTkahCBOeV0QujcejBbcGNqoUvD%252BuSHLy3yCm14J6UxtYo
kDAmeIbE2jwnrempFqMVj5BIQ6LlJERpcWJ83e9fhLWYXNGEvWlIL1wT1fdBUjg%252BZT%252FweOud3azu1h%252Fv0
0NBEQ09mSLRnXEtBMsl2YsOgUSrZUm2m0XeNLdMvG%252F27wqWF1I2NyxrRJbnTZaLVBQTEGuBqEZ4XUUcYKXRC%252B
1LwlKWxSmL03yXFpzd8DRPWM6%252Bkai%252BhPVBaan049vJNmcQ8k%252B7XR3X99tdIBiVBLeZ0P8V6ldwGAKdLpD
5LDTMg3x3XfrbysTvpsn83yTM6PWhy1nLTy5Wy9p0qn2Jqq4zzwsHwk%252FOvBsglNQL%252F3ctWZKFiZLxPkA59EJ1
lZQOEAmdX%252B7%252B%252BbnnvwA%253D%26RelayState%3Dhttps%253A%252F%252Fperkinscoiedev.servic
e-now.com%252Fnavpage.do",
"lineNumber": 20,
"columnNumber": 148
},
"type": "Stylesheet",
"frameId": "A7C87A170B6FF1BFF9C1519BD77B8C40",
"hasUserGesture": false
},
"response": {
"encodedDataLength": 1220,
"dataLength": 1076,
"requestId": "24819.4",
"type": "Stylesheet",
"response": {
"url": "https://ok1static.oktacdn.com/assets/loginpage/css/custom-
signin.bb8f4ce4363dd17160adb27f2ab5f478.css",
"status": 200,
"statusText": "",
"headers": {
"date": "Sat, 23 Jan 2021 04:34:34 GMT",
"content-encoding": "gzip",
"vary": "Accept-Encoding",
"age": "1136974",
"x-cache": "Hit from cloudfront",
"access-control-allow-origin": "*",
"last-modified": "Tue, 18 Feb 2020 23:58:14 GMT",
"server": "nginx",
"etag": "W/\"bb8f4ce4363dd17160adb27f2ab5f478\"",
"strict-transport-security": "max-age=315360000; includeSubDomains",
"content-type": "text/css",

https://urlscan.io/api/v1/result/3a2c746e-192e-4901-9a5d-78b8b2ee32e3/ Page 69 of 119


03.10.2021, 14:47

"via": "1.1 a383f82b5d4e98bbd66535c2c4b20c9e.cloudfront.net (CloudFront)",


"cache-control": "max-age=31536000, public,max-age=31536000,s-maxage=1814400",
"public-key-pins-report-only": "pin-
sha256=\"r5EfzZxQVvQpKo3AgYRaT7X2bDO/kj3ACwmxfdT2zt8=\"; pin-
sha256=\"MaqlcUgk2mvY/RFSGeSwBRkI+rZ6/dxe/DuQfBT/vnQ=\"; pin-
sha256=\"72G5IEvDEWn+EThf3qjR7/bQSWaS2ZSLqolhnO6iyJI=\"; pin-
sha256=\"rrV6CLCCvqnk89gWibYT0JO6fNQ8cCit7GGoiVTjCOg=\"; max-age=60; report-
uri=\"https://okta.report-uri.com/r/default/hpkp/reportOnly\"",
"x-amz-cf-pop": "FRA56-C1",
"x-amz-cf-id": "OLUK5hRlH8sXW2_ApIu5vN2JIPPBNow4HeQGRkk_UHBajDC876-lfA==",
"expires": "Sun, 23 Jan 2022 04:34:34 GMT"
},
"mimeType": "text/css",
"remoteIPAddress": "65.9.58.47",
"remotePort": 443,
"fromPrefetchCache": false,
"encodedDataLength": 758,
"timing": {
"requestTime": 23727523.796858,
"proxyStart": -1,
"proxyEnd": -1,
"dnsStart": -1,
"dnsEnd": -1,
"connectStart": -1,
"connectEnd": -1,
"sslStart": -1,
"sslEnd": -1,
"workerStart": -1,
"workerReady": -1,
"workerFetchStart": -1,
"workerRespondWithSettled": -1,
"sendStart": 83.327,
"sendEnd": 83.522,
"pushStart": 0,
"pushEnd": 0,
"receiveHeadersEnd": 140.136
},
"responseTime": 1612513448795.398,
"protocol": "h2",
"securityState": "secure",
"securityDetails": {
"protocol": "TLS 1.3",
"keyExchange": "",
"keyExchangeGroup": "X25519",
"cipher": "AES_128_GCM",
"certificateId": 0,
"subjectName": "*.oktacdn.com",
"sanList": [
"*.oktacdn.com",
"oktacdn.com"
],
"issuer": "DigiCert TLS RSA SHA256 2020 CA1",
"validFrom": 1607990400,
"validTo": 1642291199,
"signedCertificateTimestampList": [],
"certificateTransparencyCompliance": "unknown"
},
"securityHeaders": [
{
"name": "Strict-Transport-Security",
"value": "max-age=315360000; includeSubDomains"
}
]
},
"hash": "6ad0ad11086d50749bb41cf96cf712c1e61f458b4f6844f36f4ba21960417250",
"size": 1076,

https://urlscan.io/api/v1/result/3a2c746e-192e-4901-9a5d-78b8b2ee32e3/ Page 70 of 119


03.10.2021, 14:47

"asn": {
"ip": "65.9.58.47",
"asn": "16509",
"country": "US",
"registrar": "arin",
"date": "2000-05-04",
"description": "AMAZON-02, US",
"route": "65.9.58.0/23",
"name": "AMAZON-02"
},
"geoip": {
"range": [
1091043328,
1091305471
],
"country": "US",
"region": "WA",
"eu": "0",
"timezone": "America/Los_Angeles",
"city": "Seattle",
"ll": [
47.54,
-122.3032
],
"metro": 819,
"area": 1000,
"country_name": "United States"
},
"rdns": {
"ip": "65.9.58.47",
"ptr": null
}
},
"initiatorInfo": {
"url": "https://myapps.perkinscoie.com/login/login.htm?
fromURI=%2Fapp%2Fservicenow_ud%2Fexk1jsx6trpNIFLGO0h8%2Fsso%2Fsaml%3FSAMLRequest%3DnVJdb9MwFP
0rkd8TJ2aZgtVUCq0GlUoXrYUHXpAT365miW18naz796Ru0coDE%252BL1%252Btxzz4dnKPqOWV4N%252FqAf4OcA6KN
j32nk55eSDE5zI1Ah16IH5L7l2%252BrzmrMk5dYZb1rTkahCBOeV0QujcejBbcGNqoUvD%252BuSHLy3yCm14J6UxtYo
kDAmeIbE2jwnrempFqMVj5BIQ6LlJERpcWJ83e9fhLWYXNGEvWlIL1wT1fdBUjg%252BZT%252FweOud3azu1h%252Fv0
0NBEQ09mSLRnXEtBMsl2YsOgUSrZUm2m0XeNLdMvG%252F27wqWF1I2NyxrRJbnTZaLVBQTEGuBqEZ4XUUcYKXRC%252B
1LwlKWxSmL03yXFpzd8DRPWM6%252Bkai%252BhPVBaan049vJNmcQ8k%252B7XR3X99tdIBiVBLeZ0P8V6ldwGAKdLpD
5LDTMg3x3XfrbysTvpsn83yTM6PWhy1nLTy5Wy9p0qn2Jqq4zzwsHwk%252FOvBsglNQL%252F3ctWZKFiZLxPkA59EJ1
lZQOEAmdX%252B7%252B%252BbnnvwA%253D%26RelayState%3Dhttps%253A%252F%252Fperkinscoiedev.servic
e-now.com%252Fnavpage.do",
"host": "myapps.perkinscoie.com",
"type": "parser"
}
},
{
"request": {
"requestId": "24819.5",
"loaderId": "53DE0799AA0EDCD8D4539C351504D3CB",
"documentURL": "https://myapps.perkinscoie.com/login/login.htm?
fromURI=%2Fapp%2Fservicenow_ud%2Fexk1jsx6trpNIFLGO0h8%2Fsso%2Fsaml%3FSAMLRequest%3DnVJdb9MwFP
0rkd8TJ2aZgtVUCq0GlUoXrYUHXpAT365miW18naz796Ru0coDE%252BL1%252Btxzz4dnKPqOWV4N%252FqAf4OcA6KN
j32nk55eSDE5zI1Ah16IH5L7l2%252BrzmrMk5dYZb1rTkahCBOeV0QujcejBbcGNqoUvD%252BuSHLy3yCm14J6UxtYo
kDAmeIbE2jwnrempFqMVj5BIQ6LlJERpcWJ83e9fhLWYXNGEvWlIL1wT1fdBUjg%252BZT%252FweOud3azu1h%252Fv0
0NBEQ09mSLRnXEtBMsl2YsOgUSrZUm2m0XeNLdMvG%252F27wqWF1I2NyxrRJbnTZaLVBQTEGuBqEZ4XUUcYKXRC%252B
1LwlKWxSmL03yXFpzd8DRPWM6%252Bkai%252BhPVBaan049vJNmcQ8k%252B7XR3X99tdIBiVBLeZ0P8V6ldwGAKdLpD
5LDTMg3x3XfrbysTvpsn83yTM6PWhy1nLTy5Wy9p0qn2Jqq4zzwsHwk%252FOvBsglNQL%252F3ctWZKFiZLxPkA59EJ1
lZQOEAmdX%252B7%252B%252BbnnvwA%253D%26RelayState%3Dhttps%253A%252F%252Fperkinscoiedev.servic
e-now.com%252Fnavpage.do",
"request": {
"url": "https://ok1static.oktacdn.com/fs/bcg/4/gfs1hm4esj7HGVjcK0h8",
"method": "GET",
"headers": {

https://urlscan.io/api/v1/result/3a2c746e-192e-4901-9a5d-78b8b2ee32e3/ Page 71 of 119


03.10.2021, 14:47

"Referer": "https://myapps.perkinscoie.com/login/login.htm?
fromURI=%2Fapp%2Fservicenow_ud%2Fexk1jsx6trpNIFLGO0h8%2Fsso%2Fsaml%3FSAMLRequest%3DnVJdb9MwFP
0rkd8TJ2aZgtVUCq0GlUoXrYUHXpAT365miW18naz796Ru0coDE%252BL1%252Btxzz4dnKPqOWV4N%252FqAf4OcA6KN
j32nk55eSDE5zI1Ah16IH5L7l2%252BrzmrMk5dYZb1rTkahCBOeV0QujcejBbcGNqoUvD%252BuSHLy3yCm14J6UxtYo
kDAmeIbE2jwnrempFqMVj5BIQ6LlJERpcWJ83e9fhLWYXNGEvWlIL1wT1fdBUjg%252BZT%252FweOud3azu1h%252Fv0
0NBEQ09mSLRnXEtBMsl2YsOgUSrZUm2m0XeNLdMvG%252F27wqWF1I2NyxrRJbnTZaLVBQTEGuBqEZ4XUUcYKXRC%252B
1LwlKWxSmL03yXFpzd8DRPWM6%252Bkai%252BhPVBaan049vJNmcQ8k%252B7XR3X99tdIBiVBLeZ0P8V6ldwGAKdLpD
5LDTMg3x3XfrbysTvpsn83yTM6PWhy1nLTy5Wy9p0qn2Jqq4zzwsHwk%252FOvBsglNQL%252F3ctWZKFiZLxPkA59EJ1
lZQOEAmdX%252B7%252B%252BbnnvwA%253D%26RelayState%3Dhttps%253A%252F%252Fperkinscoiedev.servic
e-now.com%252Fnavpage.do",
"User-Agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5)
AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36"
},
"mixedContentType": "none",
"initialPriority": "Low",
"referrerPolicy": "no-referrer-when-downgrade"
},
"timestamp": 23727523.796702,
"wallTime": 1612513448.655161,
"initiator": {
"type": "parser",
"url": "https://myapps.perkinscoie.com/login/login.htm?
fromURI=%2Fapp%2Fservicenow_ud%2Fexk1jsx6trpNIFLGO0h8%2Fsso%2Fsaml%3FSAMLRequest%3DnVJdb9MwFP
0rkd8TJ2aZgtVUCq0GlUoXrYUHXpAT365miW18naz796Ru0coDE%252BL1%252Btxzz4dnKPqOWV4N%252FqAf4OcA6KN
j32nk55eSDE5zI1Ah16IH5L7l2%252BrzmrMk5dYZb1rTkahCBOeV0QujcejBbcGNqoUvD%252BuSHLy3yCm14J6UxtYo
kDAmeIbE2jwnrempFqMVj5BIQ6LlJERpcWJ83e9fhLWYXNGEvWlIL1wT1fdBUjg%252BZT%252FweOud3azu1h%252Fv0
0NBEQ09mSLRnXEtBMsl2YsOgUSrZUm2m0XeNLdMvG%252F27wqWF1I2NyxrRJbnTZaLVBQTEGuBqEZ4XUUcYKXRC%252B
1LwlKWxSmL03yXFpzd8DRPWM6%252Bkai%252BhPVBaan049vJNmcQ8k%252B7XR3X99tdIBiVBLeZ0P8V6ldwGAKdLpD
5LDTMg3x3XfrbysTvpsn83yTM6PWhy1nLTy5Wy9p0qn2Jqq4zzwsHwk%252FOvBsglNQL%252F3ctWZKFiZLxPkA59EJ1
lZQOEAmdX%252B7%252B%252BbnnvwA%253D%26RelayState%3Dhttps%253A%252F%252Fperkinscoiedev.servic
e-now.com%252Fnavpage.do",
"lineNumber": 39,
"columnNumber": 165
},
"type": "Image",
"frameId": "A7C87A170B6FF1BFF9C1519BD77B8C40",
"hasUserGesture": false
},
"response": {
"encodedDataLength": 3411,
"dataLength": 2649,
"requestId": "24819.5",
"type": "Image",
"response": {
"url": "https://ok1static.oktacdn.com/fs/bcg/4/gfs1hm4esj7HGVjcK0h8",
"status": 200,
"statusText": "",
"headers": {
"date": "Thu, 28 Jan 2021 05:12:20 GMT",
"via": "1.1 a383f82b5d4e98bbd66535c2c4b20c9e.cloudfront.net (CloudFront)",
"age": "702708",
"x-cache": "Hit from cloudfront",
"content-length": "2649",
"last-modified": "Thu, 26 Sep 2019 23:23:28 GMT",
"server": "nginx",
"etag": "\"e989769236c478d76c894b0612ccb1d6\"",
"strict-transport-security": "max-age=315360000; includeSubDomains",
"public-key-pins-report-only": "pin-
sha256=\"r5EfzZxQVvQpKo3AgYRaT7X2bDO/kj3ACwmxfdT2zt8=\"; pin-
sha256=\"MaqlcUgk2mvY/RFSGeSwBRkI+rZ6/dxe/DuQfBT/vnQ=\"; pin-
sha256=\"72G5IEvDEWn+EThf3qjR7/bQSWaS2ZSLqolhnO6iyJI=\"; pin-
sha256=\"rrV6CLCCvqnk89gWibYT0JO6fNQ8cCit7GGoiVTjCOg=\"; max-age=60; report-
uri=\"https://okta.report-uri.com/r/default/hpkp/reportOnly\"",
"access-control-allow-origin": "*",
"cache-control": "max-age=31536000, public,max-age=31536000,s-maxage=1814400",
"x-amz-cf-pop": "FRA56-C1",

https://urlscan.io/api/v1/result/3a2c746e-192e-4901-9a5d-78b8b2ee32e3/ Page 72 of 119


03.10.2021, 14:47

"accept-ranges": "bytes",
"content-type": "image/png",
"x-amz-cf-id": "8NE9ZeuFe3SPHgmDFoNRgs8QFY3-v6mZDQanJw4oEnugkFmQhqua4g==",
"expires": "Fri, 28 Jan 2022 05:12:20 GMT"
},
"mimeType": "image/png",
"remoteIPAddress": "65.9.58.47",
"remotePort": 443,
"fromPrefetchCache": false,
"encodedDataLength": 744,
"timing": {
"requestTime": 23727523.938289,
"proxyStart": -1,
"proxyEnd": -1,
"dnsStart": -1,
"dnsEnd": -1,
"connectStart": -1,
"connectEnd": -1,
"sslStart": -1,
"sslEnd": -1,
"workerStart": -1,
"workerReady": -1,
"workerFetchStart": -1,
"workerRespondWithSettled": -1,
"sendStart": 0.2,
"sendEnd": 0.264,
"pushStart": 0,
"pushEnd": 0,
"receiveHeadersEnd": 57.014
},
"responseTime": 1612513448853.66,
"protocol": "h2",
"securityState": "secure",
"securityDetails": {
"protocol": "TLS 1.3",
"keyExchange": "",
"keyExchangeGroup": "X25519",
"cipher": "AES_128_GCM",
"certificateId": 0,
"subjectName": "*.oktacdn.com",
"sanList": [
"*.oktacdn.com",
"oktacdn.com"
],
"issuer": "DigiCert TLS RSA SHA256 2020 CA1",
"validFrom": 1607990400,
"validTo": 1642291199,
"signedCertificateTimestampList": [],
"certificateTransparencyCompliance": "unknown"
},
"securityHeaders": [
{
"name": "Strict-Transport-Security",
"value": "max-age=315360000; includeSubDomains"
}
]
},
"hash": "c3cdd8101180fc4a31639d72986cfce5471f95a73e7f7b52c37b11361a048d8e",
"size": 3532,
"asn": {
"ip": "65.9.58.47",
"asn": "16509",
"country": "US",
"registrar": "arin",
"date": "2000-05-04",
"description": "AMAZON-02, US",

https://urlscan.io/api/v1/result/3a2c746e-192e-4901-9a5d-78b8b2ee32e3/ Page 73 of 119


03.10.2021, 14:47

"route": "65.9.58.0/23",
"name": "AMAZON-02"
},
"geoip": {
"range": [
1091043328,
1091305471
],
"country": "US",
"region": "WA",
"eu": "0",
"timezone": "America/Los_Angeles",
"city": "Seattle",
"ll": [
47.54,
-122.3032
],
"metro": 819,
"area": 1000,
"country_name": "United States"
},
"rdns": {
"ip": "65.9.58.47",
"ptr": null
}
},
"initiatorInfo": {
"url": "https://myapps.perkinscoie.com/login/login.htm?
fromURI=%2Fapp%2Fservicenow_ud%2Fexk1jsx6trpNIFLGO0h8%2Fsso%2Fsaml%3FSAMLRequest%3DnVJdb9MwFP
0rkd8TJ2aZgtVUCq0GlUoXrYUHXpAT365miW18naz796Ru0coDE%252BL1%252Btxzz4dnKPqOWV4N%252FqAf4OcA6KN
j32nk55eSDE5zI1Ah16IH5L7l2%252BrzmrMk5dYZb1rTkahCBOeV0QujcejBbcGNqoUvD%252BuSHLy3yCm14J6UxtYo
kDAmeIbE2jwnrempFqMVj5BIQ6LlJERpcWJ83e9fhLWYXNGEvWlIL1wT1fdBUjg%252BZT%252FweOud3azu1h%252Fv0
0NBEQ09mSLRnXEtBMsl2YsOgUSrZUm2m0XeNLdMvG%252F27wqWF1I2NyxrRJbnTZaLVBQTEGuBqEZ4XUUcYKXRC%252B
1LwlKWxSmL03yXFpzd8DRPWM6%252Bkai%252BhPVBaan049vJNmcQ8k%252B7XR3X99tdIBiVBLeZ0P8V6ldwGAKdLpD
5LDTMg3x3XfrbysTvpsn83yTM6PWhy1nLTy5Wy9p0qn2Jqq4zzwsHwk%252FOvBsglNQL%252F3ctWZKFiZLxPkA59EJ1
lZQOEAmdX%252B7%252B%252BbnnvwA%253D%26RelayState%3Dhttps%253A%252F%252Fperkinscoiedev.servic
e-now.com%252Fnavpage.do",
"host": "myapps.perkinscoie.com",
"type": "parser"
}
},
{
"request": {
"requestId": "24819.10",
"loaderId": "53DE0799AA0EDCD8D4539C351504D3CB",
"documentURL": "https://myapps.perkinscoie.com/login/login.htm?
fromURI=%2Fapp%2Fservicenow_ud%2Fexk1jsx6trpNIFLGO0h8%2Fsso%2Fsaml%3FSAMLRequest%3DnVJdb9MwFP
0rkd8TJ2aZgtVUCq0GlUoXrYUHXpAT365miW18naz796Ru0coDE%252BL1%252Btxzz4dnKPqOWV4N%252FqAf4OcA6KN
j32nk55eSDE5zI1Ah16IH5L7l2%252BrzmrMk5dYZb1rTkahCBOeV0QujcejBbcGNqoUvD%252BuSHLy3yCm14J6UxtYo
kDAmeIbE2jwnrempFqMVj5BIQ6LlJERpcWJ83e9fhLWYXNGEvWlIL1wT1fdBUjg%252BZT%252FweOud3azu1h%252Fv0
0NBEQ09mSLRnXEtBMsl2YsOgUSrZUm2m0XeNLdMvG%252F27wqWF1I2NyxrRJbnTZaLVBQTEGuBqEZ4XUUcYKXRC%252B
1LwlKWxSmL03yXFpzd8DRPWM6%252Bkai%252BhPVBaan049vJNmcQ8k%252B7XR3X99tdIBiVBLeZ0P8V6ldwGAKdLpD
5LDTMg3x3XfrbysTvpsn83yTM6PWhy1nLTy5Wy9p0qn2Jqq4zzwsHwk%252FOvBsglNQL%252F3ctWZKFiZLxPkA59EJ1
lZQOEAmdX%252B7%252B%252BbnnvwA%253D%26RelayState%3Dhttps%253A%252F%252Fperkinscoiedev.servic
e-now.com%252Fnavpage.do",
"request": {
"url":
"https://ok1static.oktacdn.com/assets/js/mvc/loginpage/initLoginPage.pack.bb0aa11a63d230e8b13
5b92ba459ee7e.js",
"method": "GET",
"headers": {
"Referer": "https://myapps.perkinscoie.com/login/login.htm?
fromURI=%2Fapp%2Fservicenow_ud%2Fexk1jsx6trpNIFLGO0h8%2Fsso%2Fsaml%3FSAMLRequest%3DnVJdb9MwFP
0rkd8TJ2aZgtVUCq0GlUoXrYUHXpAT365miW18naz796Ru0coDE%252BL1%252Btxzz4dnKPqOWV4N%252FqAf4OcA6KN
j32nk55eSDE5zI1Ah16IH5L7l2%252BrzmrMk5dYZb1rTkahCBOeV0QujcejBbcGNqoUvD%252BuSHLy3yCm14J6UxtYo
kDAmeIbE2jwnrempFqMVj5BIQ6LlJERpcWJ83e9fhLWYXNGEvWlIL1wT1fdBUjg%252BZT%252FweOud3azu1h%252Fv0

https://urlscan.io/api/v1/result/3a2c746e-192e-4901-9a5d-78b8b2ee32e3/ Page 74 of 119


03.10.2021, 14:47

0NBEQ09mSLRnXEtBMsl2YsOgUSrZUm2m0XeNLdMvG%252F27wqWF1I2NyxrRJbnTZaLVBQTEGuBqEZ4XUUcYKXRC%252B
1LwlKWxSmL03yXFpzd8DRPWM6%252Bkai%252BhPVBaan049vJNmcQ8k%252B7XR3X99tdIBiVBLeZ0P8V6ldwGAKdLpD
5LDTMg3x3XfrbysTvpsn83yTM6PWhy1nLTy5Wy9p0qn2Jqq4zzwsHwk%252FOvBsglNQL%252F3ctWZKFiZLxPkA59EJ1
lZQOEAmdX%252B7%252B%252BbnnvwA%253D%26RelayState%3Dhttps%253A%252F%252Fperkinscoiedev.servic
e-now.com%252Fnavpage.do",
"User-Agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5)
AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36"
},
"mixedContentType": "none",
"initialPriority": "Low",
"referrerPolicy": "no-referrer-when-downgrade"
},
"timestamp": 23727524.101878,
"wallTime": 1612513448.960336,
"initiator": {
"type": "script",
"stack": {
"callFrames": [
{
"functionName": "runLoginPage",
"scriptId": "5",
"url": "OktaUtil.js",
"lineNumber": 63,
"columnNumber": 45
}
]
}
},
"type": "Script",
"frameId": "A7C87A170B6FF1BFF9C1519BD77B8C40",
"hasUserGesture": false
},
"response": {
"encodedDataLength": 97725,
"dataLength": 305661,
"requestId": "24819.10",
"type": "Script",
"response": {
"url":
"https://ok1static.oktacdn.com/assets/js/mvc/loginpage/initLoginPage.pack.bb0aa11a63d230e8b13
5b92ba459ee7e.js",
"status": 200,
"statusText": "",
"headers": {
"date": "Thu, 21 Jan 2021 01:59:21 GMT",
"content-encoding": "gzip",
"vary": "Accept-Encoding",
"age": "1319087",
"x-cache": "Hit from cloudfront",
"access-control-allow-origin": "*",
"last-modified": "Mon, 11 Jan 2021 23:30:55 GMT",
"server": "nginx",
"etag": "W/\"bb0aa11a63d230e8b135b92ba459ee7e\"",
"strict-transport-security": "max-age=315360000; includeSubDomains",
"content-type": "application/javascript",
"via": "1.1 a383f82b5d4e98bbd66535c2c4b20c9e.cloudfront.net (CloudFront)",
"cache-control": "max-age=31536000, public,max-age=31536000,s-maxage=1814400",
"public-key-pins-report-only": "pin-
sha256=\"r5EfzZxQVvQpKo3AgYRaT7X2bDO/kj3ACwmxfdT2zt8=\"; pin-
sha256=\"MaqlcUgk2mvY/RFSGeSwBRkI+rZ6/dxe/DuQfBT/vnQ=\"; pin-
sha256=\"72G5IEvDEWn+EThf3qjR7/bQSWaS2ZSLqolhnO6iyJI=\"; pin-
sha256=\"rrV6CLCCvqnk89gWibYT0JO6fNQ8cCit7GGoiVTjCOg=\"; max-age=60; report-
uri=\"https://okta.report-uri.com/r/default/hpkp/reportOnly\"",
"x-amz-cf-pop": "FRA56-C1",
"x-amz-cf-id": "NJi6N7yOZAMlh4x_XozEYb0cPcfzh5-7G27LN3LY9V-wHesAvE8awg==",
"expires": "Fri, 21 Jan 2022 01:59:21 GMT"

https://urlscan.io/api/v1/result/3a2c746e-192e-4901-9a5d-78b8b2ee32e3/ Page 75 of 119


03.10.2021, 14:47

},
"mimeType": "application/javascript",
"remoteIPAddress": "65.9.58.47",
"remotePort": 443,
"fromPrefetchCache": false,
"encodedDataLength": 767,
"timing": {
"requestTime": 23727524.102163,
"proxyStart": -1,
"proxyEnd": -1,
"dnsStart": -1,
"dnsEnd": -1,
"connectStart": -1,
"connectEnd": -1,
"sslStart": -1,
"sslEnd": -1,
"workerStart": -1,
"workerReady": -1,
"workerFetchStart": -1,
"workerRespondWithSettled": -1,
"sendStart": 0.28,
"sendEnd": 0.38,
"pushStart": 0,
"pushEnd": 0,
"receiveHeadersEnd": 34.663
},
"responseTime": 1612513448995.206,
"protocol": "h2",
"securityState": "secure",
"securityDetails": {
"protocol": "TLS 1.3",
"keyExchange": "",
"keyExchangeGroup": "X25519",
"cipher": "AES_128_GCM",
"certificateId": 0,
"subjectName": "*.oktacdn.com",
"sanList": [
"*.oktacdn.com",
"oktacdn.com"
],
"issuer": "DigiCert TLS RSA SHA256 2020 CA1",
"validFrom": 1607990400,
"validTo": 1642291199,
"signedCertificateTimestampList": [],
"certificateTransparencyCompliance": "unknown"
},
"securityHeaders": [
{
"name": "Strict-Transport-Security",
"value": "max-age=315360000; includeSubDomains"
}
]
},
"hash": "47bd2f905d18fb5e6eb3f16e823aeb8fa150bddcef3eb2926f9da00b75787a69",
"size": 305661,
"asn": {
"ip": "65.9.58.47",
"asn": "16509",
"country": "US",
"registrar": "arin",
"date": "2000-05-04",
"description": "AMAZON-02, US",
"route": "65.9.58.0/23",
"name": "AMAZON-02"
},
"geoip": {

https://urlscan.io/api/v1/result/3a2c746e-192e-4901-9a5d-78b8b2ee32e3/ Page 76 of 119


03.10.2021, 14:47

"range": [
1091043328,
1091305471
],
"country": "US",
"region": "WA",
"eu": "0",
"timezone": "America/Los_Angeles",
"city": "Seattle",
"ll": [
47.54,
-122.3032
],
"metro": 819,
"area": 1000,
"country_name": "United States"
},
"rdns": {
"ip": "65.9.58.47",
"ptr": null
}
},
"initiatorInfo": {
"url": "OktaUtil.js",
"host": null,
"type": "script"
}
},
{
"request": {
"requestId": "24819.11",
"loaderId": "53DE0799AA0EDCD8D4539C351504D3CB",
"documentURL": "https://myapps.perkinscoie.com/login/login.htm?
fromURI=%2Fapp%2Fservicenow_ud%2Fexk1jsx6trpNIFLGO0h8%2Fsso%2Fsaml%3FSAMLRequest%3DnVJdb9MwFP
0rkd8TJ2aZgtVUCq0GlUoXrYUHXpAT365miW18naz796Ru0coDE%252BL1%252Btxzz4dnKPqOWV4N%252FqAf4OcA6KN
j32nk55eSDE5zI1Ah16IH5L7l2%252BrzmrMk5dYZb1rTkahCBOeV0QujcejBbcGNqoUvD%252BuSHLy3yCm14J6UxtYo
kDAmeIbE2jwnrempFqMVj5BIQ6LlJERpcWJ83e9fhLWYXNGEvWlIL1wT1fdBUjg%252BZT%252FweOud3azu1h%252Fv0
0NBEQ09mSLRnXEtBMsl2YsOgUSrZUm2m0XeNLdMvG%252F27wqWF1I2NyxrRJbnTZaLVBQTEGuBqEZ4XUUcYKXRC%252B
1LwlKWxSmL03yXFpzd8DRPWM6%252Bkai%252BhPVBaan049vJNmcQ8k%252B7XR3X99tdIBiVBLeZ0P8V6ldwGAKdLpD
5LDTMg3x3XfrbysTvpsn83yTM6PWhy1nLTy5Wy9p0qn2Jqq4zzwsHwk%252FOvBsglNQL%252F3ctWZKFiZLxPkA59EJ1
lZQOEAmdX%252B7%252B%252BbnnvwA%253D%26RelayState%3Dhttps%253A%252F%252Fperkinscoiedev.servic
e-now.com%252Fnavpage.do",
"request": {
"url": "https://myapps.perkinscoie.com/api/v1/authn/introspect",
"method": "POST",
"headers": {
"accept": "application/json",
"Referer": "https://myapps.perkinscoie.com/login/login.htm?
fromURI=%2Fapp%2Fservicenow_ud%2Fexk1jsx6trpNIFLGO0h8%2Fsso%2Fsaml%3FSAMLRequest%3DnVJdb9MwFP
0rkd8TJ2aZgtVUCq0GlUoXrYUHXpAT365miW18naz796Ru0coDE%252BL1%252Btxzz4dnKPqOWV4N%252FqAf4OcA6KN
j32nk55eSDE5zI1Ah16IH5L7l2%252BrzmrMk5dYZb1rTkahCBOeV0QujcejBbcGNqoUvD%252BuSHLy3yCm14J6UxtYo
kDAmeIbE2jwnrempFqMVj5BIQ6LlJERpcWJ83e9fhLWYXNGEvWlIL1wT1fdBUjg%252BZT%252FweOud3azu1h%252Fv0
0NBEQ09mSLRnXEtBMsl2YsOgUSrZUm2m0XeNLdMvG%252F27wqWF1I2NyxrRJbnTZaLVBQTEGuBqEZ4XUUcYKXRC%252B
1LwlKWxSmL03yXFpzd8DRPWM6%252Bkai%252BhPVBaan049vJNmcQ8k%252B7XR3X99tdIBiVBLeZ0P8V6ldwGAKdLpD
5LDTMg3x3XfrbysTvpsn83yTM6PWhy1nLTy5Wy9p0qn2Jqq4zzwsHwk%252FOvBsglNQL%252F3ctWZKFiZLxPkA59EJ1
lZQOEAmdX%252B7%252B%252BbnnvwA%253D%26RelayState%3Dhttps%253A%252F%252Fperkinscoiedev.servic
e-now.com%252Fnavpage.do",
"x-okta-user-agent-extended": "okta-signin-widget-3.9.2",
"User-Agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5)
AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36",
"content-type": "application/json"
},
"postData": "{\"stateToken\":\"0092k7SZO_sI0msHBu1msUefLY1srhqSNRgF5cuHVh\"}",
"hasPostData": true,
"postDataEntries": [
{

https://urlscan.io/api/v1/result/3a2c746e-192e-4901-9a5d-78b8b2ee32e3/ Page 77 of 119


03.10.2021, 14:47

"bytes":
"eyJzdGF0ZVRva2VuIjoiMDA5Mms3U1pPX3NJMG1zSEJ1MW1zVWVmTFkxc3JocVNOUmdGNWN1SFZoIn0="
}
],
"mixedContentType": "none",
"initialPriority": "High",
"referrerPolicy": "no-referrer-when-downgrade"
},
"timestamp": 23727524.108281,
"wallTime": 1612513448.966739,
"initiator": {
"type": "script",
"stack": {
"callFrames": [
{
"functionName": "",
"scriptId": "3",
"url": "https://ok1static.oktacdn.com/assets/js/sdk/okta-signin-
widget/3.9.2/js/okta-sign-in.min.js",
"lineNumber": 196,
"columnNumber": 31285
}
]
}
},
"type": "XHR",
"frameId": "A7C87A170B6FF1BFF9C1519BD77B8C40",
"hasUserGesture": false
},
"response": {
"encodedDataLength": 1987,
"dataLength": 713,
"requestId": "24819.11",
"type": "XHR",
"response": {
"url": "https://myapps.perkinscoie.com/api/v1/authn/introspect",
"status": 200,
"statusText": "OK",
"headers": {
"x-okta-request-id": "YB0AqYFr8Gz2LALmqRcSLwAABQg",
"Date": "Fri, 05 Feb 2021 08:24:09 GMT",
"Content-Encoding": "gzip",
"x-rate-limit-limit": "600",
"x-rate-limit-remaining": "599",
"Transfer-Encoding": "chunked",
"p3p": "CP=\"HONK\"",
"Connection": "Keep-Alive",
"Vary": "Accept-Encoding,Origin",
"x-xss-protection": "0",
"pragma": "no-cache",
"access-control-allow-headers": "Content-Type",
"Server": "nginx",
"expect-ct": "report-uri=\"https://oktaexpectct.report-
uri.com/r/t/ct/reportOnly\", max-age=0",
"Strict-Transport-Security": "max-age=315360000; includeSubDomains",
"Content-Type": "application/json;charset=UTF-8",
"access-control-allow-origin": "https://myapps.perkinscoie.com",
"cache-control": "no-cache, no-store",
"access-control-allow-credentials": "true",
"x-rate-limit-reset": "1612513509",
"Keep-Alive": "timeout=5, max=98",
"x-content-type-options": "nosniff",
"expires": "0"
},
"mimeType": "application/json",
"remoteIPAddress": "34.203.255.203",

https://urlscan.io/api/v1/result/3a2c746e-192e-4901-9a5d-78b8b2ee32e3/ Page 78 of 119


03.10.2021, 14:47

"remotePort": 443,
"fromPrefetchCache": false,
"encodedDataLength": 1521,
"timing": {
"requestTime": 23727524.108536,
"proxyStart": -1,
"proxyEnd": -1,
"dnsStart": -1,
"dnsEnd": -1,
"connectStart": -1,
"connectEnd": -1,
"sslStart": -1,
"sslEnd": -1,
"workerStart": -1,
"workerReady": -1,
"workerFetchStart": -1,
"workerRespondWithSettled": -1,
"sendStart": 0.129,
"sendEnd": 0.197,
"pushStart": 0,
"pushEnd": 0,
"receiveHeadersEnd": 167.005
},
"responseTime": 1612513449133.926,
"protocol": "http/1.1",
"securityState": "secure",
"securityDetails": {
"protocol": "TLS 1.2",
"keyExchange": "ECDHE_RSA",
"keyExchangeGroup": "P-256",
"cipher": "AES_128_GCM",
"certificateId": 0,
"subjectName": "myapps.perkinscoie.com",
"sanList": [
"myapps.perkinscoie.com",
"www.myapps.perkinscoie.com"
],
"issuer": "DigiCert SHA2 Secure Server CA",
"validFrom": 1583107200,
"validTo": 1615377600,
"signedCertificateTimestampList": [],
"certificateTransparencyCompliance": "unknown"
},
"securityHeaders": [
{
"name": "Strict-Transport-Security",
"value": "max-age=315360000; includeSubDomains"
},
{
"name": "X-Content-Type-Options",
"value": "nosniff"
},
{
"name": "X-Xss-Protection",
"value": "0"
}
]
},
"hash": "358d109ba71eeb7b10fa34cad606eeb388130ae3113d3e333dab6f1bfeb412a9",
"size": 713,
"asn": {
"ip": "34.203.255.203",
"asn": "14618",
"country": "US",
"registrar": "arin",
"date": "2005-11-04",

https://urlscan.io/api/v1/result/3a2c746e-192e-4901-9a5d-78b8b2ee32e3/ Page 79 of 119


03.10.2021, 14:47

"description": "AMAZON-AES, US",


"route": "34.192.0.0/12",
"name": "AMAZON-AES"
},
"geoip": {
"range": [
583532544,
584056831
],
"country": "US",
"region": "VA",
"eu": "0",
"timezone": "America/New_York",
"city": "Ashburn",
"ll": [
39.0481,
-77.4728
],
"metro": 511,
"area": 1000,
"country_name": "United States"
},
"rdns": {
"ip": "34.203.255.203",
"ptr": "ec2-34-203-255-203.compute-1.amazonaws.com"
}
},
"initiatorInfo": {
"url": "https://ok1static.oktacdn.com/assets/js/sdk/okta-signin-
widget/3.9.2/js/okta-sign-in.min.js",
"host": "ok1static.oktacdn.com",
"type": "script"
}
},
{
"request": {
"requestId": "24819.18",
"loaderId": "53DE0799AA0EDCD8D4539C351504D3CB",
"documentURL": "https://myapps.perkinscoie.com/login/login.htm?
fromURI=%2Fapp%2Fservicenow_ud%2Fexk1jsx6trpNIFLGO0h8%2Fsso%2Fsaml%3FSAMLRequest%3DnVJdb9MwFP
0rkd8TJ2aZgtVUCq0GlUoXrYUHXpAT365miW18naz796Ru0coDE%252BL1%252Btxzz4dnKPqOWV4N%252FqAf4OcA6KN
j32nk55eSDE5zI1Ah16IH5L7l2%252BrzmrMk5dYZb1rTkahCBOeV0QujcejBbcGNqoUvD%252BuSHLy3yCm14J6UxtYo
kDAmeIbE2jwnrempFqMVj5BIQ6LlJERpcWJ83e9fhLWYXNGEvWlIL1wT1fdBUjg%252BZT%252FweOud3azu1h%252Fv0
0NBEQ09mSLRnXEtBMsl2YsOgUSrZUm2m0XeNLdMvG%252F27wqWF1I2NyxrRJbnTZaLVBQTEGuBqEZ4XUUcYKXRC%252B
1LwlKWxSmL03yXFpzd8DRPWM6%252Bkai%252BhPVBaan049vJNmcQ8k%252B7XR3X99tdIBiVBLeZ0P8V6ldwGAKdLpD
5LDTMg3x3XfrbysTvpsn83yTM6PWhy1nLTy5Wy9p0qn2Jqq4zzwsHwk%252FOvBsglNQL%252F3ctWZKFiZLxPkA59EJ1
lZQOEAmdX%252B7%252B%252BbnnvwA%253D%26RelayState%3Dhttps%253A%252F%252Fperkinscoiedev.servic
e-now.com%252Fnavpage.do",
"request": {
"url": "https://ok1static.oktacdn.com/fs/bco/7/fs01ieb69o8PIjgUJ0h8",
"method": "GET",
"headers": {
"Referer": "https://myapps.perkinscoie.com/login/login.htm?
fromURI=%2Fapp%2Fservicenow_ud%2Fexk1jsx6trpNIFLGO0h8%2Fsso%2Fsaml%3FSAMLRequest%3DnVJdb9MwFP
0rkd8TJ2aZgtVUCq0GlUoXrYUHXpAT365miW18naz796Ru0coDE%252BL1%252Btxzz4dnKPqOWV4N%252FqAf4OcA6KN
j32nk55eSDE5zI1Ah16IH5L7l2%252BrzmrMk5dYZb1rTkahCBOeV0QujcejBbcGNqoUvD%252BuSHLy3yCm14J6UxtYo
kDAmeIbE2jwnrempFqMVj5BIQ6LlJERpcWJ83e9fhLWYXNGEvWlIL1wT1fdBUjg%252BZT%252FweOud3azu1h%252Fv0
0NBEQ09mSLRnXEtBMsl2YsOgUSrZUm2m0XeNLdMvG%252F27wqWF1I2NyxrRJbnTZaLVBQTEGuBqEZ4XUUcYKXRC%252B
1LwlKWxSmL03yXFpzd8DRPWM6%252Bkai%252BhPVBaan049vJNmcQ8k%252B7XR3X99tdIBiVBLeZ0P8V6ldwGAKdLpD
5LDTMg3x3XfrbysTvpsn83yTM6PWhy1nLTy5Wy9p0qn2Jqq4zzwsHwk%252FOvBsglNQL%252F3ctWZKFiZLxPkA59EJ1
lZQOEAmdX%252B7%252B%252BbnnvwA%253D%26RelayState%3Dhttps%253A%252F%252Fperkinscoiedev.servic
e-now.com%252Fnavpage.do",
"User-Agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5)
AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36"
},
"mixedContentType": "none",

https://urlscan.io/api/v1/result/3a2c746e-192e-4901-9a5d-78b8b2ee32e3/ Page 80 of 119


03.10.2021, 14:47

"initialPriority": "Low",
"referrerPolicy": "no-referrer-when-downgrade"
},
"timestamp": 23727524.110683,
"wallTime": 1612513448.969141,
"initiator": {
"type": "parser",
"url": "https://myapps.perkinscoie.com/login/login.htm?
fromURI=%2Fapp%2Fservicenow_ud%2Fexk1jsx6trpNIFLGO0h8%2Fsso%2Fsaml%3FSAMLRequest%3DnVJdb9MwFP
0rkd8TJ2aZgtVUCq0GlUoXrYUHXpAT365miW18naz796Ru0coDE%252BL1%252Btxzz4dnKPqOWV4N%252FqAf4OcA6KN
j32nk55eSDE5zI1Ah16IH5L7l2%252BrzmrMk5dYZb1rTkahCBOeV0QujcejBbcGNqoUvD%252BuSHLy3yCm14J6UxtYo
kDAmeIbE2jwnrempFqMVj5BIQ6LlJERpcWJ83e9fhLWYXNGEvWlIL1wT1fdBUjg%252BZT%252FweOud3azu1h%252Fv0
0NBEQ09mSLRnXEtBMsl2YsOgUSrZUm2m0XeNLdMvG%252F27wqWF1I2NyxrRJbnTZaLVBQTEGuBqEZ4XUUcYKXRC%252B
1LwlKWxSmL03yXFpzd8DRPWM6%252Bkai%252BhPVBaan049vJNmcQ8k%252B7XR3X99tdIBiVBLeZ0P8V6ldwGAKdLpD
5LDTMg3x3XfrbysTvpsn83yTM6PWhy1nLTy5Wy9p0qn2Jqq4zzwsHwk%252FOvBsglNQL%252F3ctWZKFiZLxPkA59EJ1
lZQOEAmdX%252B7%252B%252BbnnvwA%253D%26RelayState%3Dhttps%253A%252F%252Fperkinscoiedev.servic
e-now.com%252Fnavpage.do"
},
"type": "Image",
"frameId": "A7C87A170B6FF1BFF9C1519BD77B8C40",
"hasUserGesture": false
},
"response": {
"encodedDataLength": 1768006,
"dataLength": 1765071,
"requestId": "24819.18",
"type": "Image",
"response": {
"url": "https://ok1static.oktacdn.com/fs/bco/7/fs01ieb69o8PIjgUJ0h8",
"status": 200,
"statusText": "",
"headers": {
"date": "Mon, 25 Jan 2021 21:50:29 GMT",
"via": "1.1 a383f82b5d4e98bbd66535c2c4b20c9e.cloudfront.net (CloudFront)",
"age": "902019",
"x-cache": "Hit from cloudfront",
"content-length": "1765071",
"last-modified": "Thu, 05 Mar 2020 23:59:37 GMT",
"server": "nginx",
"etag": "\"88146dd92307a659ca8c7946859e263b\"",
"strict-transport-security": "max-age=315360000; includeSubDomains",
"public-key-pins-report-only": "pin-
sha256=\"r5EfzZxQVvQpKo3AgYRaT7X2bDO/kj3ACwmxfdT2zt8=\"; pin-
sha256=\"MaqlcUgk2mvY/RFSGeSwBRkI+rZ6/dxe/DuQfBT/vnQ=\"; pin-
sha256=\"72G5IEvDEWn+EThf3qjR7/bQSWaS2ZSLqolhnO6iyJI=\"; pin-
sha256=\"rrV6CLCCvqnk89gWibYT0JO6fNQ8cCit7GGoiVTjCOg=\"; max-age=60; report-
uri=\"https://okta.report-uri.com/r/default/hpkp/reportOnly\"",
"access-control-allow-origin": "*",
"cache-control": "max-age=31536000, public,max-age=31536000,s-maxage=1814400",
"x-amz-cf-pop": "FRA56-C1",
"accept-ranges": "bytes",
"content-type": "image/jpeg",
"x-amz-cf-id": "TZHH1FyHXDVr4lgkEQh7lJQLq6_rajCtVuNWfF2SfcIE2xvRU7VWWA==",
"expires": "Tue, 25 Jan 2022 21:50:29 GMT"
},
"mimeType": "image/jpeg",
"remoteIPAddress": "65.9.58.47",
"remotePort": 443,
"fromPrefetchCache": false,
"encodedDataLength": 748,
"timing": {
"requestTime": 23727524.11092,
"proxyStart": -1,
"proxyEnd": -1,
"dnsStart": -1,
"dnsEnd": -1,

https://urlscan.io/api/v1/result/3a2c746e-192e-4901-9a5d-78b8b2ee32e3/ Page 81 of 119


03.10.2021, 14:47

"connectStart": -1,
"connectEnd": -1,
"sslStart": -1,
"sslEnd": -1,
"workerStart": -1,
"workerReady": -1,
"workerFetchStart": -1,
"workerRespondWithSettled": -1,
"sendStart": 0.216,
"sendEnd": 0.289,
"pushStart": 0,
"pushEnd": 0,
"receiveHeadersEnd": 38.217
},
"responseTime": 1612513449007.48,
"protocol": "h2",
"securityState": "secure",
"securityDetails": {
"protocol": "TLS 1.3",
"keyExchange": "",
"keyExchangeGroup": "X25519",
"cipher": "AES_128_GCM",
"certificateId": 0,
"subjectName": "*.oktacdn.com",
"sanList": [
"*.oktacdn.com",
"oktacdn.com"
],
"issuer": "DigiCert TLS RSA SHA256 2020 CA1",
"validFrom": 1607990400,
"validTo": 1642291199,
"signedCertificateTimestampList": [],
"certificateTransparencyCompliance": "unknown"
},
"securityHeaders": [
{
"name": "Strict-Transport-Security",
"value": "max-age=315360000; includeSubDomains"
}
]
},
"hash": "aa5c8f3eedfa726e22ccd038be4dc67360e052a09d7306d31317612e75ada0bc",
"size": 2353428,
"asn": {
"ip": "65.9.58.47",
"asn": "16509",
"country": "US",
"registrar": "arin",
"date": "2000-05-04",
"description": "AMAZON-02, US",
"route": "65.9.58.0/23",
"name": "AMAZON-02"
},
"geoip": {
"range": [
1091043328,
1091305471
],
"country": "US",
"region": "WA",
"eu": "0",
"timezone": "America/Los_Angeles",
"city": "Seattle",
"ll": [
47.54,
-122.3032

https://urlscan.io/api/v1/result/3a2c746e-192e-4901-9a5d-78b8b2ee32e3/ Page 82 of 119


03.10.2021, 14:47

],
"metro": 819,
"area": 1000,
"country_name": "United States"
},
"rdns": {
"ip": "65.9.58.47",
"ptr": null
}
},
"initiatorInfo": {
"url": "https://myapps.perkinscoie.com/login/login.htm?
fromURI=%2Fapp%2Fservicenow_ud%2Fexk1jsx6trpNIFLGO0h8%2Fsso%2Fsaml%3FSAMLRequest%3DnVJdb9MwFP
0rkd8TJ2aZgtVUCq0GlUoXrYUHXpAT365miW18naz796Ru0coDE%252BL1%252Btxzz4dnKPqOWV4N%252FqAf4OcA6KN
j32nk55eSDE5zI1Ah16IH5L7l2%252BrzmrMk5dYZb1rTkahCBOeV0QujcejBbcGNqoUvD%252BuSHLy3yCm14J6UxtYo
kDAmeIbE2jwnrempFqMVj5BIQ6LlJERpcWJ83e9fhLWYXNGEvWlIL1wT1fdBUjg%252BZT%252FweOud3azu1h%252Fv0
0NBEQ09mSLRnXEtBMsl2YsOgUSrZUm2m0XeNLdMvG%252F27wqWF1I2NyxrRJbnTZaLVBQTEGuBqEZ4XUUcYKXRC%252B
1LwlKWxSmL03yXFpzd8DRPWM6%252Bkai%252BhPVBaan049vJNmcQ8k%252B7XR3X99tdIBiVBLeZ0P8V6ldwGAKdLpD
5LDTMg3x3XfrbysTvpsn83yTM6PWhy1nLTy5Wy9p0qn2Jqq4zzwsHwk%252FOvBsglNQL%252F3ctWZKFiZLxPkA59EJ1
lZQOEAmdX%252B7%252B%252BbnnvwA%253D%26RelayState%3Dhttps%253A%252F%252Fperkinscoiedev.servic
e-now.com%252Fnavpage.do",
"host": "myapps.perkinscoie.com",
"type": "parser"
}
},
{
"request": {
"requestId": "E735B8C67BD38FC2C19F78655AED2159",
"loaderId": "E735B8C67BD38FC2C19F78655AED2159",
"documentURL": "https://login.okta.com/discovery/iframe.html",
"request": {
"url": "https://login.okta.com/discovery/iframe.html",
"method": "GET",
"headers": {
"Upgrade-Insecure-Requests": "1",
"User-Agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5)
AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36",
"Referer": "https://myapps.perkinscoie.com/login/login.htm?
fromURI=%2Fapp%2Fservicenow_ud%2Fexk1jsx6trpNIFLGO0h8%2Fsso%2Fsaml%3FSAMLRequest%3DnVJdb9MwFP
0rkd8TJ2aZgtVUCq0GlUoXrYUHXpAT365miW18naz796Ru0coDE%252BL1%252Btxzz4dnKPqOWV4N%252FqAf4OcA6KN
j32nk55eSDE5zI1Ah16IH5L7l2%252BrzmrMk5dYZb1rTkahCBOeV0QujcejBbcGNqoUvD%252BuSHLy3yCm14J6UxtYo
kDAmeIbE2jwnrempFqMVj5BIQ6LlJERpcWJ83e9fhLWYXNGEvWlIL1wT1fdBUjg%252BZT%252FweOud3azu1h%252Fv0
0NBEQ09mSLRnXEtBMsl2YsOgUSrZUm2m0XeNLdMvG%252F27wqWF1I2NyxrRJbnTZaLVBQTEGuBqEZ4XUUcYKXRC%252B
1LwlKWxSmL03yXFpzd8DRPWM6%252Bkai%252BhPVBaan049vJNmcQ8k%252B7XR3X99tdIBiVBLeZ0P8V6ldwGAKdLpD
5LDTMg3x3XfrbysTvpsn83yTM6PWhy1nLTy5Wy9p0qn2Jqq4zzwsHwk%252FOvBsglNQL%252F3ctWZKFiZLxPkA59EJ1
lZQOEAmdX%252B7%252B%252BbnnvwA%253D%26RelayState%3Dhttps%253A%252F%252Fperkinscoiedev.servic
e-now.com%252Fnavpage.do"
},
"mixedContentType": "none",
"initialPriority": "VeryHigh",
"referrerPolicy": "no-referrer-when-downgrade"
},
"timestamp": 23727524.1767,
"wallTime": 1612513449.035187,
"initiator": {
"type": "script",
"stack": {
"callFrames": [
{
"functionName": "",
"scriptId": "7",
"url":
"https://ok1static.oktacdn.com/assets/js/mvc/loginpage/initLoginPage.pack.bb0aa11a63d230e8b13
5b92ba459ee7e.js",
"lineNumber": 23,
"columnNumber": 66080

https://urlscan.io/api/v1/result/3a2c746e-192e-4901-9a5d-78b8b2ee32e3/ Page 83 of 119


03.10.2021, 14:47

}
]
}
},
"type": "Document",
"frameId": "8420DD08B7860B40514D93060135C2B8",
"hasUserGesture": false
},
"response": {
"encodedDataLength": 0,
"dataLength": 0,
"requestId": "E735B8C67BD38FC2C19F78655AED2159",
"type": "Document",
"response": {
"url": "https://login.okta.com/discovery/iframe.html",
"status": 200,
"statusText": "OK",
"headers": {
"Content-Type": "text/html",
"Content-Length": "546",
"Connection": "keep-alive",
"Date": "Thu, 04 Feb 2021 17:22:08 GMT",
"Last-Modified": "Thu, 10 Dec 2020 22:11:04 GMT",
"ETag": "\"953e10853c650e0e1662b7e24256ad76\"",
"Server": "AmazonS3",
"X-Cache": "Hit from cloudfront",
"Via": "1.1 b44e2902bb3501d47514e51618f1bda5.cloudfront.net (CloudFront)",
"X-Amz-Cf-Pop": "FRA50-C1",
"X-Amz-Cf-Id": "XO5W-0tOaucMCBBDBT61kcVCRCJYtvQDNRwSPqAghPv0nfnpZEw5rQ==",
"Age": "54122"
},
"mimeType": "text/html",
"requestHeaders": {
"Host": "login.okta.com",
"Connection": "keep-alive",
"Pragma": "no-cache",
"Cache-Control": "no-cache",
"Upgrade-Insecure-Requests": "1",
"User-Agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5)
AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36",
"Accept":
"text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q
=0.8,application/signed-exchange;v=b3;q=0.9",
"Sec-Fetch-Site": "cross-site",
"Sec-Fetch-Mode": "navigate",
"Sec-Fetch-Dest": "iframe",
"Referer": "https://myapps.perkinscoie.com/login/login.htm?
fromURI=%2Fapp%2Fservicenow_ud%2Fexk1jsx6trpNIFLGO0h8%2Fsso%2Fsaml%3FSAMLRequest%3DnVJdb9MwFP
0rkd8TJ2aZgtVUCq0GlUoXrYUHXpAT365miW18naz796Ru0coDE%252BL1%252Btxzz4dnKPqOWV4N%252FqAf4OcA6KN
j32nk55eSDE5zI1Ah16IH5L7l2%252BrzmrMk5dYZb1rTkahCBOeV0QujcejBbcGNqoUvD%252BuSHLy3yCm14J6UxtYo
kDAmeIbE2jwnrempFqMVj5BIQ6LlJERpcWJ83e9fhLWYXNGEvWlIL1wT1fdBUjg%252BZT%252FweOud3azu1h%252Fv0
0NBEQ09mSLRnXEtBMsl2YsOgUSrZUm2m0XeNLdMvG%252F27wqWF1I2NyxrRJbnTZaLVBQTEGuBqEZ4XUUcYKXRC%252B
1LwlKWxSmL03yXFpzd8DRPWM6%252Bkai%252BhPVBaan049vJNmcQ8k%252B7XR3X99tdIBiVBLeZ0P8V6ldwGAKdLpD
5LDTMg3x3XfrbysTvpsn83yTM6PWhy1nLTy5Wy9p0qn2Jqq4zzwsHwk%252FOvBsglNQL%252F3ctWZKFiZLxPkA59EJ1
lZQOEAmdX%252B7%252B%252BbnnvwA%253D%26RelayState%3Dhttps%253A%252F%252Fperkinscoiedev.servic
e-now.com%252Fnavpage.do",
"Accept-Encoding": "gzip, deflate, br",
"Accept-Language": "en-US"
},
"remoteIPAddress": "143.204.93.105",
"remotePort": 443,
"fromPrefetchCache": false,
"encodedDataLength": 440,
"timing": {
"requestTime": 23727524.17729,
"proxyStart": -1,

https://urlscan.io/api/v1/result/3a2c746e-192e-4901-9a5d-78b8b2ee32e3/ Page 84 of 119


03.10.2021, 14:47

"proxyEnd": -1,
"dnsStart": 0.272,
"dnsEnd": 14.651,
"connectStart": 14.651,
"connectEnd": 80.172,
"sslStart": 31.882,
"sslEnd": 80.168,
"workerStart": -1,
"workerReady": -1,
"workerFetchStart": -1,
"workerRespondWithSettled": -1,
"sendStart": 80.207,
"sendEnd": 80.252,
"pushStart": 0,
"pushEnd": 0,
"receiveHeadersEnd": 112.141
},
"responseTime": 1612513449147.829,
"protocol": "http/1.1",
"securityState": "secure",
"securityDetails": {
"protocol": "TLS 1.3",
"keyExchange": "",
"keyExchangeGroup": "X25519",
"cipher": "AES_128_GCM",
"certificateId": 0,
"subjectName": "accounts.okta.com",
"sanList": [
"accounts.okta.com",
"login.okta.com"
],
"issuer": "DigiCert SHA2 High Assurance Server CA",
"validFrom": 1564358400,
"validTo": 1627560000,
"signedCertificateTimestampList": [],
"certificateTransparencyCompliance": "unknown"
}
},
"asn": {
"ip": "143.204.93.105",
"asn": "16509",
"country": "US",
"registrar": "arin",
"date": "2000-05-04",
"description": "AMAZON-02, US",
"route": "143.204.92.0/22",
"name": "AMAZON-02"
},
"geoip": {
"range": [
2412511232,
2412576767
],
"country": "US",
"region": "WA",
"eu": "0",
"timezone": "America/Los_Angeles",
"city": "Seattle",
"ll": [
47.6348,
-122.3451
],
"metro": 819,
"area": 1000,
"country_name": "United States"
},

https://urlscan.io/api/v1/result/3a2c746e-192e-4901-9a5d-78b8b2ee32e3/ Page 85 of 119


03.10.2021, 14:47

"rdns": {
"ip": "143.204.93.105",
"ptr": "server-143-204-93-105.fra50.r.cloudfront.net"
}
},
"initiatorInfo": {
"url":
"https://ok1static.oktacdn.com/assets/js/mvc/loginpage/initLoginPage.pack.bb0aa11a63d230e8b13
5b92ba459ee7e.js",
"host": "ok1static.oktacdn.com",
"type": "script"
}
},
{
"request": {
"requestId": "24819.19",
"loaderId": "53DE0799AA0EDCD8D4539C351504D3CB",
"documentURL": "https://myapps.perkinscoie.com/signin/refresh-auth-
state/0092k7SZO_sI0msHBu1msUefLY1srhqSNRgF5cuHVh",
"request": {
"url": "https://ok1static.oktacdn.com/assets/js/sdk/okta-signin-
widget/3.9.2/img/security/default.png",
"method": "GET",
"headers": {
"Referer": "https://ok1static.oktacdn.com/assets/js/sdk/okta-signin-
widget/3.9.2/css/okta-sign-in.min.css",
"User-Agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5)
AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36"
},
"mixedContentType": "none",
"initialPriority": "Low",
"referrerPolicy": "no-referrer-when-downgrade"
},
"timestamp": 23727524.310651,
"wallTime": 1612513449.16911,
"initiator": {
"type": "parser",
"url": "https://ok1static.oktacdn.com/assets/js/sdk/okta-signin-
widget/3.9.2/css/okta-sign-in.min.css"
},
"type": "Image",
"frameId": "A7C87A170B6FF1BFF9C1519BD77B8C40",
"hasUserGesture": false
},
"response": {
"encodedDataLength": 2561,
"dataLength": 1800,
"requestId": "24819.19",
"type": "Image",
"response": {
"url": "https://ok1static.oktacdn.com/assets/js/sdk/okta-signin-
widget/3.9.2/img/security/default.png",
"status": 200,
"statusText": "",
"headers": {
"date": "Sat, 30 Jan 2021 07:44:40 GMT",
"via": "1.1 a383f82b5d4e98bbd66535c2c4b20c9e.cloudfront.net (CloudFront)",
"age": "520769",
"x-cache": "Hit from cloudfront",
"content-length": "1800",
"last-modified": "Tue, 05 May 2020 00:01:23 GMT",
"server": "nginx",
"etag": "\"04eeeba5b3538c4524d8e6828ba2c405\"",
"strict-transport-security": "max-age=315360000; includeSubDomains",
"public-key-pins-report-only": "pin-
sha256=\"r5EfzZxQVvQpKo3AgYRaT7X2bDO/kj3ACwmxfdT2zt8=\"; pin-

https://urlscan.io/api/v1/result/3a2c746e-192e-4901-9a5d-78b8b2ee32e3/ Page 86 of 119


03.10.2021, 14:47

sha256=\"MaqlcUgk2mvY/RFSGeSwBRkI+rZ6/dxe/DuQfBT/vnQ=\"; pin-
sha256=\"72G5IEvDEWn+EThf3qjR7/bQSWaS2ZSLqolhnO6iyJI=\"; pin-
sha256=\"rrV6CLCCvqnk89gWibYT0JO6fNQ8cCit7GGoiVTjCOg=\"; max-age=60; report-
uri=\"https://okta.report-uri.com/r/default/hpkp/reportOnly\"",
"access-control-allow-origin": "*",
"cache-control": "max-age=31536000, public,max-age=31536000,s-maxage=1814400",
"x-amz-cf-pop": "FRA56-C1",
"accept-ranges": "bytes",
"content-type": "image/png",
"x-amz-cf-id": "CbIkc1Axg9lYJv_VzT49ykC8UfEUpPyrOwtkahidmv49MrcDZJh17w==",
"expires": "Sun, 30 Jan 2022 07:44:40 GMT"
},
"mimeType": "image/png",
"remoteIPAddress": "65.9.58.47",
"remotePort": 443,
"fromPrefetchCache": false,
"encodedDataLength": 743,
"timing": {
"requestTime": 23727524.310894,
"proxyStart": -1,
"proxyEnd": -1,
"dnsStart": -1,
"dnsEnd": -1,
"connectStart": -1,
"connectEnd": -1,
"sslStart": -1,
"sslEnd": -1,
"workerStart": -1,
"workerReady": -1,
"workerFetchStart": -1,
"workerRespondWithSettled": -1,
"sendStart": 0.218,
"sendEnd": 0.329,
"pushStart": 0,
"pushEnd": 0,
"receiveHeadersEnd": 34.379
},
"responseTime": 1612513449203.644,
"protocol": "h2",
"securityState": "secure",
"securityDetails": {
"protocol": "TLS 1.3",
"keyExchange": "",
"keyExchangeGroup": "X25519",
"cipher": "AES_128_GCM",
"certificateId": 0,
"subjectName": "*.oktacdn.com",
"sanList": [
"*.oktacdn.com",
"oktacdn.com"
],
"issuer": "DigiCert TLS RSA SHA256 2020 CA1",
"validFrom": 1607990400,
"validTo": 1642291199,
"signedCertificateTimestampList": [],
"certificateTransparencyCompliance": "unknown"
},
"securityHeaders": [
{
"name": "Strict-Transport-Security",
"value": "max-age=315360000; includeSubDomains"
}
]
},
"hash": "da75c3f3ce27c081541dfb59edd7e756fefe054a9e0e976356c4b0d3778bb434",
"size": 2400,

https://urlscan.io/api/v1/result/3a2c746e-192e-4901-9a5d-78b8b2ee32e3/ Page 87 of 119


03.10.2021, 14:47

"asn": {
"ip": "65.9.58.47",
"asn": "16509",
"country": "US",
"registrar": "arin",
"date": "2000-05-04",
"description": "AMAZON-02, US",
"route": "65.9.58.0/23",
"name": "AMAZON-02"
},
"geoip": {
"range": [
1091043328,
1091305471
],
"country": "US",
"region": "WA",
"eu": "0",
"timezone": "America/Los_Angeles",
"city": "Seattle",
"ll": [
47.54,
-122.3032
],
"metro": 819,
"area": 1000,
"country_name": "United States"
},
"rdns": {
"ip": "65.9.58.47",
"ptr": null
}
},
"initiatorInfo": {
"url": "https://ok1static.oktacdn.com/assets/js/sdk/okta-signin-
widget/3.9.2/css/okta-sign-in.min.css",
"host": "ok1static.oktacdn.com",
"type": "parser"
}
},
{
"request": {
"requestId": "24819.20",
"loaderId": "53DE0799AA0EDCD8D4539C351504D3CB",
"documentURL": "https://myapps.perkinscoie.com/",
"request": {
"url": "https://ok1static.oktacdn.com/assets/js/sdk/okta-signin-
widget/3.9.2/img/ui/forms/checkbox-sign-in-widget.png",
"method": "GET",
"headers": {
"Referer": "https://ok1static.oktacdn.com/assets/js/sdk/okta-signin-
widget/3.9.2/css/okta-sign-in.min.css",
"User-Agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5)
AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36"
},
"mixedContentType": "none",
"initialPriority": "Low",
"referrerPolicy": "no-referrer-when-downgrade"
},
"timestamp": 23727524.356163,
"wallTime": 1612513449.214622,
"initiator": {
"type": "parser",
"url": "https://ok1static.oktacdn.com/assets/js/sdk/okta-signin-
widget/3.9.2/css/okta-sign-in.min.css"
},

https://urlscan.io/api/v1/result/3a2c746e-192e-4901-9a5d-78b8b2ee32e3/ Page 88 of 119


03.10.2021, 14:47

"type": "Image",
"frameId": "A7C87A170B6FF1BFF9C1519BD77B8C40",
"hasUserGesture": false
},
"response": {
"encodedDataLength": 3903,
"dataLength": 3141,
"requestId": "24819.20",
"type": "Image",
"response": {
"url": "https://ok1static.oktacdn.com/assets/js/sdk/okta-signin-
widget/3.9.2/img/ui/forms/checkbox-sign-in-widget.png",
"status": 200,
"statusText": "",
"headers": {
"date": "Mon, 01 Feb 2021 07:55:32 GMT",
"via": "1.1 a383f82b5d4e98bbd66535c2c4b20c9e.cloudfront.net (CloudFront)",
"age": "347317",
"x-cache": "Hit from cloudfront",
"content-length": "3141",
"last-modified": "Tue, 05 May 2020 00:01:23 GMT",
"server": "nginx",
"etag": "\"7846b2f8c6d0a7ca69fdd3d3c294e92d\"",
"strict-transport-security": "max-age=315360000; includeSubDomains",
"public-key-pins-report-only": "pin-
sha256=\"r5EfzZxQVvQpKo3AgYRaT7X2bDO/kj3ACwmxfdT2zt8=\"; pin-
sha256=\"MaqlcUgk2mvY/RFSGeSwBRkI+rZ6/dxe/DuQfBT/vnQ=\"; pin-
sha256=\"72G5IEvDEWn+EThf3qjR7/bQSWaS2ZSLqolhnO6iyJI=\"; pin-
sha256=\"rrV6CLCCvqnk89gWibYT0JO6fNQ8cCit7GGoiVTjCOg=\"; max-age=60; report-
uri=\"https://okta.report-uri.com/r/default/hpkp/reportOnly\"",
"access-control-allow-origin": "*",
"cache-control": "max-age=31536000, public,max-age=31536000,s-maxage=1814400",
"x-amz-cf-pop": "FRA56-C1",
"accept-ranges": "bytes",
"content-type": "image/png",
"x-amz-cf-id": "F-jsnVDkL17wbyHqfi0kHmHTyaSwdhLGLhVy6zreVxym90FzYOAuag==",
"expires": "Tue, 01 Feb 2022 07:55:32 GMT"
},
"mimeType": "image/png",
"remoteIPAddress": "65.9.58.47",
"remotePort": 443,
"fromPrefetchCache": false,
"encodedDataLength": 744,
"timing": {
"requestTime": 23727524.356425,
"proxyStart": -1,
"proxyEnd": -1,
"dnsStart": -1,
"dnsEnd": -1,
"connectStart": -1,
"connectEnd": -1,
"sslStart": -1,
"sslEnd": -1,
"workerStart": -1,
"workerReady": -1,
"workerFetchStart": -1,
"workerRespondWithSettled": -1,
"sendStart": 0.183,
"sendEnd": 0.263,
"pushStart": 0,
"pushEnd": 0,
"receiveHeadersEnd": 32.805
},
"responseTime": 1612513449247.615,
"protocol": "h2",
"securityState": "secure",

https://urlscan.io/api/v1/result/3a2c746e-192e-4901-9a5d-78b8b2ee32e3/ Page 89 of 119


03.10.2021, 14:47

"securityDetails": {
"protocol": "TLS 1.3",
"keyExchange": "",
"keyExchangeGroup": "X25519",
"cipher": "AES_128_GCM",
"certificateId": 0,
"subjectName": "*.oktacdn.com",
"sanList": [
"*.oktacdn.com",
"oktacdn.com"
],
"issuer": "DigiCert TLS RSA SHA256 2020 CA1",
"validFrom": 1607990400,
"validTo": 1642291199,
"signedCertificateTimestampList": [],
"certificateTransparencyCompliance": "unknown"
},
"securityHeaders": [
{
"name": "Strict-Transport-Security",
"value": "max-age=315360000; includeSubDomains"
}
]
},
"hash": "40810b0318131f9ba52c83a17e633a0ac476ade66ea8a914d6c4980571397665",
"size": 4188,
"asn": {
"ip": "65.9.58.47",
"asn": "16509",
"country": "US",
"registrar": "arin",
"date": "2000-05-04",
"description": "AMAZON-02, US",
"route": "65.9.58.0/23",
"name": "AMAZON-02"
},
"geoip": {
"range": [
1091043328,
1091305471
],
"country": "US",
"region": "WA",
"eu": "0",
"timezone": "America/Los_Angeles",
"city": "Seattle",
"ll": [
47.54,
-122.3032
],
"metro": 819,
"area": 1000,
"country_name": "United States"
},
"rdns": {
"ip": "65.9.58.47",
"ptr": null
}
},
"initiatorInfo": {
"url": "https://ok1static.oktacdn.com/assets/js/sdk/okta-signin-
widget/3.9.2/css/okta-sign-in.min.css",
"host": "ok1static.oktacdn.com",
"type": "parser"
}
},

https://urlscan.io/api/v1/result/3a2c746e-192e-4901-9a5d-78b8b2ee32e3/ Page 90 of 119


03.10.2021, 14:47

{
"request": {
"requestId": "24819.12",
"loaderId": "53DE0799AA0EDCD8D4539C351504D3CB",
"documentURL": "https://myapps.perkinscoie.com/",
"request": {
"url": "https://ok1static.oktacdn.com/assets/js/sdk/okta-signin-
widget/3.9.2/font/montserrat-light-webfont.woff",
"method": "GET",
"headers": {
"Origin": "https://myapps.perkinscoie.com",
"Referer": "https://ok1static.oktacdn.com/assets/js/sdk/okta-signin-
widget/3.9.2/css/okta-sign-in.min.css",
"User-Agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5)
AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36"
},
"mixedContentType": "none",
"initialPriority": "VeryHigh",
"referrerPolicy": "no-referrer-when-downgrade"
},
"timestamp": 23727524.356704,
"wallTime": 1612513449.215163,
"initiator": {
"type": "parser",
"url": "https://ok1static.oktacdn.com/assets/js/sdk/okta-signin-
widget/3.9.2/css/okta-sign-in.min.css"
},
"type": "Font",
"frameId": "A7C87A170B6FF1BFF9C1519BD77B8C40",
"hasUserGesture": false
},
"response": {
"encodedDataLength": 22901,
"dataLength": 22112,
"requestId": "24819.12",
"type": "Font",
"response": {
"url": "https://ok1static.oktacdn.com/assets/js/sdk/okta-signin-
widget/3.9.2/font/montserrat-light-webfont.woff",
"status": 200,
"statusText": "",
"headers": {
"date": "Sat, 23 Jan 2021 23:43:47 GMT",
"via": "1.1 58c21e16c9e093deb494fbb4de260efa.cloudfront.net (CloudFront)",
"age": "1068022",
"x-cache": "Hit from cloudfront",
"content-length": "22112",
"last-modified": "Tue, 05 May 2020 00:01:15 GMT",
"server": "nginx",
"etag": "\"6225f3ca44b83090833064727a09cc95\"",
"strict-transport-security": "max-age=315360000; includeSubDomains",
"public-key-pins-report-only": "pin-
sha256=\"r5EfzZxQVvQpKo3AgYRaT7X2bDO/kj3ACwmxfdT2zt8=\"; pin-
sha256=\"MaqlcUgk2mvY/RFSGeSwBRkI+rZ6/dxe/DuQfBT/vnQ=\"; pin-
sha256=\"72G5IEvDEWn+EThf3qjR7/bQSWaS2ZSLqolhnO6iyJI=\"; pin-
sha256=\"rrV6CLCCvqnk89gWibYT0JO6fNQ8cCit7GGoiVTjCOg=\"; max-age=60; report-
uri=\"https://okta.report-uri.com/r/default/hpkp/reportOnly\"",
"access-control-allow-origin": "*",
"cache-control": "max-age=31536000, public,max-age=31536000,s-maxage=1814400",
"x-amz-cf-pop": "FRA56-C1",
"accept-ranges": "bytes",
"content-type": "application/font-woff",
"x-amz-cf-id": "HyOzi8a20tUETgxZYKGIXee0ATp37d8xZQPgF9FKSOmKEKqkOhAUtQ==",
"expires": "Sun, 23 Jan 2022 23:43:47 GMT"
},
"mimeType": "application/font-woff",

https://urlscan.io/api/v1/result/3a2c746e-192e-4901-9a5d-78b8b2ee32e3/ Page 91 of 119


03.10.2021, 14:47

"remoteIPAddress": "65.9.58.47",
"remotePort": 443,
"fromPrefetchCache": false,
"encodedDataLength": 753,
"timing": {
"requestTime": 23727524.356913,
"proxyStart": -1,
"proxyEnd": -1,
"dnsStart": 0.347,
"dnsEnd": 0.354,
"connectStart": 0.354,
"connectEnd": 65.905,
"sslStart": 17.589,
"sslEnd": 65.898,
"workerStart": -1,
"workerReady": -1,
"workerFetchStart": -1,
"workerRespondWithSettled": -1,
"sendStart": 66.01,
"sendEnd": 66.181,
"pushStart": 0,
"pushEnd": 0,
"receiveHeadersEnd": 105.048
},
"responseTime": 1612513449320.301,
"protocol": "h2",
"securityState": "secure",
"securityDetails": {
"protocol": "TLS 1.3",
"keyExchange": "",
"keyExchangeGroup": "X25519",
"cipher": "AES_128_GCM",
"certificateId": 0,
"subjectName": "*.oktacdn.com",
"sanList": [
"*.oktacdn.com",
"oktacdn.com"
],
"issuer": "DigiCert TLS RSA SHA256 2020 CA1",
"validFrom": 1607990400,
"validTo": 1642291199,
"signedCertificateTimestampList": [],
"certificateTransparencyCompliance": "unknown"
},
"securityHeaders": [
{
"name": "Strict-Transport-Security",
"value": "max-age=315360000; includeSubDomains"
}
]
},
"hash": "feb177fb563f478cb8ecade71caea5df5ad318ca161c71875114e504ce304ace",
"size": 29484,
"asn": {
"ip": "65.9.58.47",
"asn": "16509",
"country": "US",
"registrar": "arin",
"date": "2000-05-04",
"description": "AMAZON-02, US",
"route": "65.9.58.0/23",
"name": "AMAZON-02"
},
"geoip": {
"range": [
1091043328,

https://urlscan.io/api/v1/result/3a2c746e-192e-4901-9a5d-78b8b2ee32e3/ Page 92 of 119


03.10.2021, 14:47

1091305471
],
"country": "US",
"region": "WA",
"eu": "0",
"timezone": "America/Los_Angeles",
"city": "Seattle",
"ll": [
47.54,
-122.3032
],
"metro": 819,
"area": 1000,
"country_name": "United States"
},
"rdns": {
"ip": "65.9.58.47",
"ptr": null
}
},
"initiatorInfo": {
"url": "https://ok1static.oktacdn.com/assets/js/sdk/okta-signin-
widget/3.9.2/css/okta-sign-in.min.css",
"host": "ok1static.oktacdn.com",
"type": "parser"
}
},
{
"request": {
"requestId": "24819.14",
"loaderId": "53DE0799AA0EDCD8D4539C351504D3CB",
"documentURL": "https://myapps.perkinscoie.com/",
"request": {
"url": "https://ok1static.oktacdn.com/assets/js/sdk/okta-signin-
widget/3.9.2/font/montserrat-regular-webfont.woff",
"method": "GET",
"headers": {
"Origin": "https://myapps.perkinscoie.com",
"Referer": "https://ok1static.oktacdn.com/assets/js/sdk/okta-signin-
widget/3.9.2/css/okta-sign-in.min.css",
"User-Agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5)
AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36"
},
"mixedContentType": "none",
"initialPriority": "VeryHigh",
"referrerPolicy": "no-referrer-when-downgrade"
},
"timestamp": 23727524.356817,
"wallTime": 1612513449.215275,
"initiator": {
"type": "parser",
"url": "https://ok1static.oktacdn.com/assets/js/sdk/okta-signin-
widget/3.9.2/css/okta-sign-in.min.css"
},
"type": "Font",
"frameId": "A7C87A170B6FF1BFF9C1519BD77B8C40",
"hasUserGesture": false
},
"response": {
"encodedDataLength": 22768,
"dataLength": 21980,
"requestId": "24819.14",
"type": "Font",
"response": {
"url": "https://ok1static.oktacdn.com/assets/js/sdk/okta-signin-
widget/3.9.2/font/montserrat-regular-webfont.woff",

https://urlscan.io/api/v1/result/3a2c746e-192e-4901-9a5d-78b8b2ee32e3/ Page 93 of 119


03.10.2021, 14:47

"status": 200,
"statusText": "",
"headers": {
"date": "Fri, 22 Jan 2021 07:07:56 GMT",
"via": "1.1 58c21e16c9e093deb494fbb4de260efa.cloudfront.net (CloudFront)",
"age": "1214173",
"x-cache": "Hit from cloudfront",
"content-length": "21980",
"last-modified": "Tue, 05 May 2020 00:01:15 GMT",
"server": "nginx",
"etag": "\"8f2822b73b5f9c106c6f2e0db820bcbb\"",
"strict-transport-security": "max-age=315360000; includeSubDomains",
"public-key-pins-report-only": "pin-
sha256=\"r5EfzZxQVvQpKo3AgYRaT7X2bDO/kj3ACwmxfdT2zt8=\"; pin-
sha256=\"MaqlcUgk2mvY/RFSGeSwBRkI+rZ6/dxe/DuQfBT/vnQ=\"; pin-
sha256=\"72G5IEvDEWn+EThf3qjR7/bQSWaS2ZSLqolhnO6iyJI=\"; pin-
sha256=\"rrV6CLCCvqnk89gWibYT0JO6fNQ8cCit7GGoiVTjCOg=\"; max-age=60; report-
uri=\"https://okta.report-uri.com/r/default/hpkp/reportOnly\"",
"access-control-allow-origin": "*",
"cache-control": "max-age=31536000, public,max-age=31536000,s-maxage=1814400",
"x-amz-cf-pop": "FRA56-C1",
"accept-ranges": "bytes",
"content-type": "application/font-woff",
"x-amz-cf-id": "bWw_vPJ_GW79vEACF-GE_g1vkrJz4MAWfIAfGU0pBGci3LSUvoa8zg==",
"expires": "Sat, 22 Jan 2022 07:07:56 GMT"
},
"mimeType": "application/font-woff",
"remoteIPAddress": "65.9.58.47",
"remotePort": 443,
"fromPrefetchCache": false,
"encodedDataLength": 752,
"timing": {
"requestTime": 23727524.357076,
"proxyStart": -1,
"proxyEnd": -1,
"dnsStart": -1,
"dnsEnd": -1,
"connectStart": -1,
"connectEnd": -1,
"sslStart": -1,
"sslEnd": -1,
"workerStart": -1,
"workerReady": -1,
"workerFetchStart": -1,
"workerRespondWithSettled": -1,
"sendStart": 65.9,
"sendEnd": 66.02,
"pushStart": 0,
"pushEnd": 0,
"receiveHeadersEnd": 123.387
},
"responseTime": 1612513449338.812,
"protocol": "h2",
"securityState": "secure",
"securityDetails": {
"protocol": "TLS 1.3",
"keyExchange": "",
"keyExchangeGroup": "X25519",
"cipher": "AES_128_GCM",
"certificateId": 0,
"subjectName": "*.oktacdn.com",
"sanList": [
"*.oktacdn.com",
"oktacdn.com"
],
"issuer": "DigiCert TLS RSA SHA256 2020 CA1",

https://urlscan.io/api/v1/result/3a2c746e-192e-4901-9a5d-78b8b2ee32e3/ Page 94 of 119


03.10.2021, 14:47

"validFrom": 1607990400,
"validTo": 1642291199,
"signedCertificateTimestampList": [],
"certificateTransparencyCompliance": "unknown"
},
"securityHeaders": [
{
"name": "Strict-Transport-Security",
"value": "max-age=315360000; includeSubDomains"
}
]
},
"hash": "1d5325892ecf2dc3abd0caf2a1ef4eabf2477e2937c9a372760fd2acae8fddf3",
"size": 29308,
"asn": {
"ip": "65.9.58.47",
"asn": "16509",
"country": "US",
"registrar": "arin",
"date": "2000-05-04",
"description": "AMAZON-02, US",
"route": "65.9.58.0/23",
"name": "AMAZON-02"
},
"geoip": {
"range": [
1091043328,
1091305471
],
"country": "US",
"region": "WA",
"eu": "0",
"timezone": "America/Los_Angeles",
"city": "Seattle",
"ll": [
47.54,
-122.3032
],
"metro": 819,
"area": 1000,
"country_name": "United States"
},
"rdns": {
"ip": "65.9.58.47",
"ptr": null
}
},
"initiatorInfo": {
"url": "https://ok1static.oktacdn.com/assets/js/sdk/okta-signin-
widget/3.9.2/css/okta-sign-in.min.css",
"host": "ok1static.oktacdn.com",
"type": "parser"
}
},
{
"request": {
"requestId": "24819.21",
"loaderId": "53DE0799AA0EDCD8D4539C351504D3CB",
"documentURL": "https://myapps.perkinscoie.com/",
"request": {
"url": "https://ok1static.oktacdn.com/fs/bco/1/fs01ibwgxzcQyuroG0h8",
"method": "GET",
"headers": {
"Referer": "https://myapps.perkinscoie.com/",
"User-Agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5)
AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36"

https://urlscan.io/api/v1/result/3a2c746e-192e-4901-9a5d-78b8b2ee32e3/ Page 95 of 119


03.10.2021, 14:47

},
"mixedContentType": "none",
"initialPriority": "Low",
"referrerPolicy": "no-referrer-when-downgrade"
},
"timestamp": 23727524.386911,
"wallTime": 1612513449.24537,
"initiator": {
"type": "parser",
"url": "https://myapps.perkinscoie.com/",
"lineNumber": 0,
"columnNumber": 0
},
"type": "Image",
"frameId": "A7C87A170B6FF1BFF9C1519BD77B8C40",
"hasUserGesture": false
},
"response": {
"encodedDataLength": 7715,
"dataLength": 6955,
"requestId": "24819.21",
"type": "Image",
"response": {
"url": "https://ok1static.oktacdn.com/fs/bco/1/fs01ibwgxzcQyuroG0h8",
"status": 200,
"statusText": "",
"headers": {
"date": "Thu, 04 Feb 2021 04:16:08 GMT",
"via": "1.1 a383f82b5d4e98bbd66535c2c4b20c9e.cloudfront.net (CloudFront)",
"age": "101281",
"x-cache": "Hit from cloudfront",
"content-length": "6955",
"last-modified": "Thu, 20 Feb 2020 17:56:00 GMT",
"server": "nginx",
"etag": "\"2c120955134413d55d9909de5ccd3517\"",
"strict-transport-security": "max-age=315360000; includeSubDomains",
"public-key-pins-report-only": "pin-
sha256=\"r5EfzZxQVvQpKo3AgYRaT7X2bDO/kj3ACwmxfdT2zt8=\"; pin-
sha256=\"MaqlcUgk2mvY/RFSGeSwBRkI+rZ6/dxe/DuQfBT/vnQ=\"; pin-
sha256=\"72G5IEvDEWn+EThf3qjR7/bQSWaS2ZSLqolhnO6iyJI=\"; pin-
sha256=\"rrV6CLCCvqnk89gWibYT0JO6fNQ8cCit7GGoiVTjCOg=\"; max-age=60; report-
uri=\"https://okta.report-uri.com/r/default/hpkp/reportOnly\"",
"access-control-allow-origin": "*",
"cache-control": "max-age=31536000, public,max-age=31536000,s-maxage=1814400",
"x-amz-cf-pop": "FRA56-C1",
"accept-ranges": "bytes",
"content-type": "image/png",
"x-amz-cf-id": "WT0h3dDLSOpe2xxeJTFha4sPOUPwO_bF1z4TrWZtgnRPJV1iURisFQ==",
"expires": "Fri, 04 Feb 2022 04:16:08 GMT"
},
"mimeType": "image/png",
"remoteIPAddress": "65.9.58.47",
"remotePort": 443,
"fromPrefetchCache": false,
"encodedDataLength": 742,
"timing": {
"requestTime": 23727524.3872,
"proxyStart": -1,
"proxyEnd": -1,
"dnsStart": -1,
"dnsEnd": -1,
"connectStart": -1,
"connectEnd": -1,
"sslStart": -1,
"sslEnd": -1,
"workerStart": -1,

https://urlscan.io/api/v1/result/3a2c746e-192e-4901-9a5d-78b8b2ee32e3/ Page 96 of 119


03.10.2021, 14:47

"workerReady": -1,
"workerFetchStart": -1,
"workerRespondWithSettled": -1,
"sendStart": 0.255,
"sendEnd": 0.344,
"pushStart": 0,
"pushEnd": 0,
"receiveHeadersEnd": 36.77
},
"responseTime": 1612513449282.361,
"protocol": "h2",
"securityState": "secure",
"securityDetails": {
"protocol": "TLS 1.3",
"keyExchange": "",
"keyExchangeGroup": "X25519",
"cipher": "AES_128_GCM",
"certificateId": 0,
"subjectName": "*.oktacdn.com",
"sanList": [
"*.oktacdn.com",
"oktacdn.com"
],
"issuer": "DigiCert TLS RSA SHA256 2020 CA1",
"validFrom": 1607990400,
"validTo": 1642291199,
"signedCertificateTimestampList": [],
"certificateTransparencyCompliance": "unknown"
},
"securityHeaders": [
{
"name": "Strict-Transport-Security",
"value": "max-age=315360000; includeSubDomains"
}
]
},
"hash": "034071ac082f8a91a891990b168a3a62460102de977130ff08b3b0d4cbb1d864",
"size": 9276,
"asn": {
"ip": "65.9.58.47",
"asn": "16509",
"country": "US",
"registrar": "arin",
"date": "2000-05-04",
"description": "AMAZON-02, US",
"route": "65.9.58.0/23",
"name": "AMAZON-02"
},
"geoip": {
"range": [
1091043328,
1091305471
],
"country": "US",
"region": "WA",
"eu": "0",
"timezone": "America/Los_Angeles",
"city": "Seattle",
"ll": [
47.54,
-122.3032
],
"metro": 819,
"area": 1000,
"country_name": "United States"
},

https://urlscan.io/api/v1/result/3a2c746e-192e-4901-9a5d-78b8b2ee32e3/ Page 97 of 119


03.10.2021, 14:47

"rdns": {
"ip": "65.9.58.47",
"ptr": null
}
},
"initiatorInfo": {
"url": "https://myapps.perkinscoie.com/",
"host": "myapps.perkinscoie.com",
"type": "parser"
}
}
],
"cookies": [
{
"name": "oktaStateToken",
"value": "0092k7SZO_sI0msHBu1msUefLY1srhqSNRgF5cuHVh",
"domain": "myapps.perkinscoie.com",
"path": "/",
"expires": 1612517049,
"size": 56,
"httpOnly": false,
"secure": false,
"session": false,
"priority": "Medium"
},
{
"name": "ADRUM_BTa",
"value": "\"R:815|g:963168f9-7c74-4155-abcc-bb3396f7113a|n:Okta_6d5b1e30-d05a-4894-
a37b-81b5f6c60e0e\"",
"domain": "myapps.perkinscoie.com",
"path": "/",
"expires": 1612513479.134038,
"size": 99,
"httpOnly": false,
"secure": false,
"session": false,
"priority": "Medium"
},
{
"name": "DT",
"value": "DI04cu3jc1rRty0Cg_VBmuqag",
"domain": "myapps.perkinscoie.com",
"path": "/",
"expires": 1675585448.644859,
"size": 27,
"httpOnly": false,
"secure": true,
"session": false,
"sameSite": "None",
"priority": "Medium"
},
{
"name": "JSESSIONID",
"value": "A0698C1F9CC57A2625544204CD8BAB30",
"domain": "myapps.perkinscoie.com",
"path": "/",
"expires": -1,
"size": 42,
"httpOnly": true,
"secure": true,
"session": true,
"priority": "Medium"
},
{
"name": "ADRUM_BT1",
"value": "\"R:815|i:14630|e:273\"",

https://urlscan.io/api/v1/result/3a2c746e-192e-4901-9a5d-78b8b2ee32e3/ Page 98 of 119


03.10.2021, 14:47

"domain": "myapps.perkinscoie.com",
"path": "/",
"expires": 1612513479.134057,
"size": 30,
"httpOnly": false,
"secure": false,
"session": false,
"priority": "Medium"
},
{
"name": "t",
"value": "red-bright",
"domain": "myapps.perkinscoie.com",
"path": "/",
"expires": -1,
"size": 11,
"httpOnly": false,
"secure": false,
"session": true,
"priority": "Medium"
}
],
"console": [
{
"message": {
"source": "console-api",
"level": "log",
"text": "running inline scripts, count: 0",
"url": "https://perkinscoiedev.service-
now.com/scripts/doctype/js_includes_doctype.jsx?v=12-09-
2020_1945&lp=Thu_Feb_04_13_15_24_PST_2021&c=9_108",
"line": 846,
"column": 9
}
},
{
"message": {
"source": "console-api",
"level": "log",
"text": "runBeforeRender",
"url": "https://perkinscoiedev.service-
now.com/scripts/doctype/js_includes_doctype.jsx?v=12-09-
2020_1945&lp=Thu_Feb_04_13_15_24_PST_2021&c=9_108",
"line": 846,
"column": 9
}
},
{
"message": {
"source": "console-api",
"level": "log",
"text": "runAfterAllLoaded, functions: 7",
"url": "https://perkinscoiedev.service-
now.com/scripts/doctype/js_includes_doctype.jsx?v=12-09-
2020_1945&lp=Thu_Feb_04_13_15_24_PST_2021&c=9_108",
"line": 846,
"column": 9
}
},
{
"message": {
"source": "console-api",
"level": "log",
"text": "fireAllChangeHandlers start",
"url": "https://perkinscoiedev.service-
now.com/scripts/doctype/js_includes_doctype.jsx?v=12-09-

https://urlscan.io/api/v1/result/3a2c746e-192e-4901-9a5d-78b8b2ee32e3/ Page 99 of 119


03.10.2021, 14:47

2020_1945&lp=Thu_Feb_04_13_15_24_PST_2021&c=9_108",
"line": 846,
"column": 9
}
},
{
"message": {
"source": "console-api",
"level": "log",
"text": "fireAllChangeHandlers end",
"url": "https://perkinscoiedev.service-
now.com/scripts/doctype/js_includes_doctype.jsx?v=12-09-
2020_1945&lp=Thu_Feb_04_13_15_24_PST_2021&c=9_108",
"line": 846,
"column": 9
}
},
{
"message": {
"source": "console-api",
"level": "log",
"text": "late load functions: 4",
"url": "https://perkinscoiedev.service-
now.com/scripts/doctype/js_includes_doctype.jsx?v=12-09-
2020_1945&lp=Thu_Feb_04_13_15_24_PST_2021&c=9_108",
"line": 846,
"column": 9
}
},
{
"message": {
"source": "console-api",
"level": "log",
"text": "Clearing event handlers reference cache",
"url": "https://perkinscoiedev.service-
now.com/scripts/doctype/js_includes_doctype.jsx?v=12-09-
2020_1945&lp=Thu_Feb_04_13_15_24_PST_2021&c=9_108",
"line": 846,
"column": 9
}
},
{
"message": {
"source": "console-api",
"level": "log",
"text": "[00:00:00.002] runAfterAllLoaded finished",
"url": "https://perkinscoiedev.service-
now.com/scripts/doctype/js_includes_doctype.jsx?v=12-09-
2020_1945&lp=Thu_Feb_04_13_15_24_PST_2021&c=9_108",
"line": 846,
"column": 9
}
},
{
"message": {
"source": "console-api",
"level": "log",
"text": "+-- Parse times",
"url": "https://perkinscoiedev.service-now.com/auth_redirect.do?
sysparm_stack=no&sysparm_url=https%3A%2F%2Fmyapps.perkinscoie.com%2Fapp%2Fservicenow_ud%2Fexk
1jsx6trpNIFLGO0h8%2Fsso%2Fsaml%3FSAMLRequest%3DnVJdb9MwFP0rkd8TJ2aZgtVUCq0GlUoXrYUHXpAT365miW
18naz796Ru0coDE%252BL1%252Btxzz4dnKPqOWV4N%252FqAf4OcA6KNj32nk55eSDE5zI1Ah16IH5L7l2%252BrzmrM
k5dYZb1rTkahCBOeV0QujcejBbcGNqoUvD%252BuSHLy3yCm14J6UxtYokDAmeIbE2jwnrempFqMVj5BIQ6LlJERpcWJ8
3e9fhLWYXNGEvWlIL1wT1fdBUjg%252BZT%252FweOud3azu1h%252Fv00NBEQ09mSLRnXEtBMsl2YsOgUSrZUm2m0XeN
LdMvG%252F27wqWF1I2NyxrRJbnTZaLVBQTEGuBqEZ4XUUcYKXRC%252B1LwlKWxSmL03yXFpzd8DRPWM6%252Bkai%25
2BhPVBaan049vJNmcQ8k%252B7XR3X99tdIBiVBLeZ0P8V6ldwGAKdLpD5LDTMg3x3XfrbysTvpsn83yTM6PWhy1nLTy5

https://urlscan.io/api/v1/result/3a2c746e-192e-4901-9a5d-78b8b2ee32e3/ Page 100 of 119


03.10.2021, 14:47

Wy9p0qn2Jqq4zzwsHwk%252FOvBsglNQL%252F3ctWZKFiZLxPkA59EJ1lZQOEAmdX%252B7%252B%252BbnnvwA%253D
%26RelayState%3Dhttps%253A%252F%252Fperkinscoiedev.service-now.com%252Fnavpage.do",
"line": 156,
"column": 15
}
},
{
"message": {
"source": "console-api",
"level": "log",
"text": "| CSS parse: 280.3400009870529",
"url": "https://perkinscoiedev.service-now.com/auth_redirect.do?
sysparm_stack=no&sysparm_url=https%3A%2F%2Fmyapps.perkinscoie.com%2Fapp%2Fservicenow_ud%2Fexk
1jsx6trpNIFLGO0h8%2Fsso%2Fsaml%3FSAMLRequest%3DnVJdb9MwFP0rkd8TJ2aZgtVUCq0GlUoXrYUHXpAT365miW
18naz796Ru0coDE%252BL1%252Btxzz4dnKPqOWV4N%252FqAf4OcA6KNj32nk55eSDE5zI1Ah16IH5L7l2%252BrzmrM
k5dYZb1rTkahCBOeV0QujcejBbcGNqoUvD%252BuSHLy3yCm14J6UxtYokDAmeIbE2jwnrempFqMVj5BIQ6LlJERpcWJ8
3e9fhLWYXNGEvWlIL1wT1fdBUjg%252BZT%252FweOud3azu1h%252Fv00NBEQ09mSLRnXEtBMsl2YsOgUSrZUm2m0XeN
LdMvG%252F27wqWF1I2NyxrRJbnTZaLVBQTEGuBqEZ4XUUcYKXRC%252B1LwlKWxSmL03yXFpzd8DRPWM6%252Bkai%25
2BhPVBaan049vJNmcQ8k%252B7XR3X99tdIBiVBLeZ0P8V6ldwGAKdLpD5LDTMg3x3XfrbysTvpsn83yTM6PWhy1nLTy5
Wy9p0qn2Jqq4zzwsHwk%252FOvBsglNQL%252F3ctWZKFiZLxPkA59EJ1lZQOEAmdX%252B7%252B%252BbnnvwA%253D
%26RelayState%3Dhttps%253A%252F%252Fperkinscoiedev.service-now.com%252Fnavpage.do",
"line": 157,
"column": 15
}
},
{
"message": {
"source": "console-api",
"level": "log",
"text": "| JS doctype: 765.4099985957146",
"url": "https://perkinscoiedev.service-now.com/auth_redirect.do?
sysparm_stack=no&sysparm_url=https%3A%2F%2Fmyapps.perkinscoie.com%2Fapp%2Fservicenow_ud%2Fexk
1jsx6trpNIFLGO0h8%2Fsso%2Fsaml%3FSAMLRequest%3DnVJdb9MwFP0rkd8TJ2aZgtVUCq0GlUoXrYUHXpAT365miW
18naz796Ru0coDE%252BL1%252Btxzz4dnKPqOWV4N%252FqAf4OcA6KNj32nk55eSDE5zI1Ah16IH5L7l2%252BrzmrM
k5dYZb1rTkahCBOeV0QujcejBbcGNqoUvD%252BuSHLy3yCm14J6UxtYokDAmeIbE2jwnrempFqMVj5BIQ6LlJERpcWJ8
3e9fhLWYXNGEvWlIL1wT1fdBUjg%252BZT%252FweOud3azu1h%252Fv00NBEQ09mSLRnXEtBMsl2YsOgUSrZUm2m0XeN
LdMvG%252F27wqWF1I2NyxrRJbnTZaLVBQTEGuBqEZ4XUUcYKXRC%252B1LwlKWxSmL03yXFpzd8DRPWM6%252Bkai%25
2BhPVBaan049vJNmcQ8k%252B7XR3X99tdIBiVBLeZ0P8V6ldwGAKdLpD5LDTMg3x3XfrbysTvpsn83yTM6PWhy1nLTy5
Wy9p0qn2Jqq4zzwsHwk%252FOvBsglNQL%252F3ctWZKFiZLxPkA59EJ1lZQOEAmdX%252B7%252B%252BbnnvwA%253D
%26RelayState%3Dhttps%253A%252F%252Fperkinscoiedev.service-now.com%252Fnavpage.do",
"line": 158,
"column": 15
}
},
{
"message": {
"source": "console-api",
"level": "log",
"text": "| JS at end of page: 14.720000326633453",
"url": "https://perkinscoiedev.service-now.com/auth_redirect.do?
sysparm_stack=no&sysparm_url=https%3A%2F%2Fmyapps.perkinscoie.com%2Fapp%2Fservicenow_ud%2Fexk
1jsx6trpNIFLGO0h8%2Fsso%2Fsaml%3FSAMLRequest%3DnVJdb9MwFP0rkd8TJ2aZgtVUCq0GlUoXrYUHXpAT365miW
18naz796Ru0coDE%252BL1%252Btxzz4dnKPqOWV4N%252FqAf4OcA6KNj32nk55eSDE5zI1Ah16IH5L7l2%252BrzmrM
k5dYZb1rTkahCBOeV0QujcejBbcGNqoUvD%252BuSHLy3yCm14J6UxtYokDAmeIbE2jwnrempFqMVj5BIQ6LlJERpcWJ8
3e9fhLWYXNGEvWlIL1wT1fdBUjg%252BZT%252FweOud3azu1h%252Fv00NBEQ09mSLRnXEtBMsl2YsOgUSrZUm2m0XeN
LdMvG%252F27wqWF1I2NyxrRJbnTZaLVBQTEGuBqEZ4XUUcYKXRC%252B1LwlKWxSmL03yXFpzd8DRPWM6%252Bkai%25
2BhPVBaan049vJNmcQ8k%252B7XR3X99tdIBiVBLeZ0P8V6ldwGAKdLpD5LDTMg3x3XfrbysTvpsn83yTM6PWhy1nLTy5
Wy9p0qn2Jqq4zzwsHwk%252FOvBsglNQL%252F3ctWZKFiZLxPkA59EJ1lZQOEAmdX%252B7%252B%252BbnnvwA%253D
%26RelayState%3Dhttps%253A%252F%252Fperkinscoiedev.service-now.com%252Fnavpage.do",
"line": 159,
"column": 15
}
},
{
"message": {
"source": "console-api",

https://urlscan.io/api/v1/result/3a2c746e-192e-4901-9a5d-78b8b2ee32e3/ Page 101 of 119


03.10.2021, 14:47

"level": "log",
"text": "+-- All parsing: 1060.5150014162064",
"url": "https://perkinscoiedev.service-now.com/auth_redirect.do?
sysparm_stack=no&sysparm_url=https%3A%2F%2Fmyapps.perkinscoie.com%2Fapp%2Fservicenow_ud%2Fexk
1jsx6trpNIFLGO0h8%2Fsso%2Fsaml%3FSAMLRequest%3DnVJdb9MwFP0rkd8TJ2aZgtVUCq0GlUoXrYUHXpAT365miW
18naz796Ru0coDE%252BL1%252Btxzz4dnKPqOWV4N%252FqAf4OcA6KNj32nk55eSDE5zI1Ah16IH5L7l2%252BrzmrM
k5dYZb1rTkahCBOeV0QujcejBbcGNqoUvD%252BuSHLy3yCm14J6UxtYokDAmeIbE2jwnrempFqMVj5BIQ6LlJERpcWJ8
3e9fhLWYXNGEvWlIL1wT1fdBUjg%252BZT%252FweOud3azu1h%252Fv00NBEQ09mSLRnXEtBMsl2YsOgUSrZUm2m0XeN
LdMvG%252F27wqWF1I2NyxrRJbnTZaLVBQTEGuBqEZ4XUUcYKXRC%252B1LwlKWxSmL03yXFpzd8DRPWM6%252Bkai%25
2BhPVBaan049vJNmcQ8k%252B7XR3X99tdIBiVBLeZ0P8V6ldwGAKdLpD5LDTMg3x3XfrbysTvpsn83yTM6PWhy1nLTy5
Wy9p0qn2Jqq4zzwsHwk%252FOvBsglNQL%252F3ctWZKFiZLxPkA59EJ1lZQOEAmdX%252B7%252B%252BbnnvwA%253D
%26RelayState%3Dhttps%253A%252F%252Fperkinscoiedev.service-now.com%252Fnavpage.do",
"line": 160,
"column": 15
}
},
{
"message": {
"source": "console-api",
"level": "log",
"text": "after page loaded starting",
"url": "https://perkinscoiedev.service-
now.com/scripts/doctype/js_includes_doctype.jsx?v=12-09-
2020_1945&lp=Thu_Feb_04_13_15_24_PST_2021&c=9_108",
"line": 846,
"column": 9
}
},
{
"message": {
"source": "console-api",
"level": "log",
"text": "[00:00:00.000] after page loaded complete, functions called: 5",
"url": "https://perkinscoiedev.service-
now.com/scripts/doctype/js_includes_doctype.jsx?v=12-09-
2020_1945&lp=Thu_Feb_04_13_15_24_PST_2021&c=9_108",
"line": 846,
"column": 9
}
}
],
"links": [
{
"href":
"https://perkinscoie.universitysite.com/UniversitySitePerkinsCoie/learner/resourceviewer?
rid=558&mode=i",
"text": "Need help enrolling?"
},
{
"href": "https://www.perkinscoie.com/en/privacy-policy.html",
"text": "Privacy Policy"
}
],
"timing": {
"beginNavigation": "2021-02-05T08:24:04.174Z",
"frameStartedLoading": "2021-02-05T08:24:09.144Z",
"frameNavigated": "2021-02-05T08:24:08.650Z",
"domContentEventFired": "2021-02-05T08:24:08.984Z",
"frameStoppedLoading": "2021-02-05T08:24:09.415Z",
"loadEventFired": "2021-02-05T08:24:09.414Z"
},
"globals": [
{
"prop": "0",
"type": "object"
},

https://urlscan.io/api/v1/result/3a2c746e-192e-4901-9a5d-78b8b2ee32e3/ Page 102 of 119


03.10.2021, 14:47

{
"prop": "ontransitionrun",
"type": "object"
},
{
"prop": "ontransitionstart",
"type": "object"
},
{
"prop": "ontransitioncancel",
"type": "object"
},
{
"prop": "cookieStore",
"type": "object"
},
{
"prop": "showDirectoryPicker",
"type": "function"
},
{
"prop": "showOpenFilePicker",
"type": "function"
},
{
"prop": "showSaveFilePicker",
"type": "function"
},
{
"prop": "trustedTypes",
"type": "object"
},
{
"prop": "crossOriginIsolated",
"type": "boolean"
},
{
"prop": "__core-js_shared__",
"type": "object"
},
{
"prop": "core",
"type": "object"
},
{
"prop": "global",
"type": "object"
},
{
"prop": "System",
"type": "object"
},
{
"prop": "asap",
"type": "function"
},
{
"prop": "Observable",
"type": "function"
},
{
"prop": "setImmediate",
"type": "function"
},
{
"prop": "clearImmediate",

https://urlscan.io/api/v1/result/3a2c746e-192e-4901-9a5d-78b8b2ee32e3/ Page 103 of 119


03.10.2021, 14:47

"type": "function"
},
{
"prop": "regeneratorRuntime",
"type": "object"
},
{
"prop": "_babelPolyfill",
"type": "boolean"
},
{
"prop": "Backbone",
"type": "object"
},
{
"prop": "jQueryCourage",
"type": "function"
},
{
"prop": "OktaSignIn",
"type": "function"
},
{
"prop": "signInSuccessCallBackFunction",
"type": "function"
},
{
"prop": "oktaData",
"type": "object"
},
{
"prop": "runLoginPage",
"type": "function"
},
{
"prop": "OktaUtil",
"type": "object"
},
{
"prop": "config",
"type": "object"
},
{
"prop": "oktaSignIn",
"type": "object"
},
{
"prop": "OktaLogin",
"type": "object"
},
{
"prop": "jQBrowser",
"type": "object"
}
]
},
"stats": {
"resourceStats": [
{
"count": 12,
"size": 3292830,
"encodedSize": 945947,
"latency": 0,
"countries": [
"US"
],

https://urlscan.io/api/v1/result/3a2c746e-192e-4901-9a5d-78b8b2ee32e3/ Page 104 of 119


03.10.2021, 14:47

"ips": [
"149.96.248.4",
"65.9.58.47"
],
"type": "Script",
"compression": "3.5",
"percentage": 38
},
{
"count": 5,
"size": 1779616,
"encodedSize": 1785596,
"latency": 0,
"countries": [
"US"
],
"ips": [
"65.9.58.47"
],
"type": "Image",
"compression": "1.0",
"percentage": 16
},
{
"count": 5,
"size": 723487,
"encodedSize": 118249,
"latency": 0,
"countries": [
"US"
],
"ips": [
"149.96.248.4",
"65.9.58.47"
],
"type": "Stylesheet",
"compression": "6.1",
"percentage": 16
},
{
"count": 4,
"size": 233307,
"encodedSize": 104471,
"latency": 0,
"countries": [
"US"
],
"ips": [
"149.96.248.4",
"65.9.58.47"
],
"type": "Font",
"compression": "2.2",
"percentage": 12
},
{
"count": 3,
"size": 38625,
"encodedSize": 14082,
"latency": 0,
"countries": [
"US"
],
"ips": [
"149.96.248.4",
"34.203.255.203",

https://urlscan.io/api/v1/result/3a2c746e-192e-4901-9a5d-78b8b2ee32e3/ Page 105 of 119


03.10.2021, 14:47

"143.204.93.105"
],
"type": "Document",
"compression": "2.7",
"percentage": 9
},
{
"count": 2,
"size": 12639,
"encodedSize": 4330,
"latency": 0,
"countries": [
"US"
],
"ips": [
"149.96.248.4",
"34.203.255.203"
],
"type": "XHR",
"compression": "2.9",
"percentage": 6
}
],
"protocolStats": [
{
"count": 20,
"size": 2706000,
"encodedSize": 652140,
"ips": [
"149.96.248.4",
"34.203.255.203",
"143.204.93.105"
],
"countries": [
"US"
],
"securityState": {},
"protocol": "http/1.1"
},
{
"count": 11,
"size": 3374504,
"encodedSize": 2320535,
"ips": [
"65.9.58.47"
],
"countries": [
"US"
],
"securityState": {},
"protocol": "h2"
}
],
"tlsStats": [
{
"count": 31,
"size": 6080504,
"encodedSize": 2972675,
"ips": [
"149.96.248.4",
"34.203.255.203",
"65.9.58.47",
"143.204.93.105"
],
"countries": [
"US"

https://urlscan.io/api/v1/result/3a2c746e-192e-4901-9a5d-78b8b2ee32e3/ Page 106 of 119


03.10.2021, 14:47

],
"protocols": {
"TLS 1.2 / ECDHE_RSA / AES_128_GCM": 19,
"TLS 1.3 / / AES_128_GCM": 12
},
"securityState": "secure"
}
],
"serverStats": [
{
"count": 17,
"size": 2693199,
"encodedSize": 644859,
"ips": [
"149.96.248.4"
],
"countries": [
"US"
],
"server": "ServiceNow"
},
{
"count": 13,
"size": 3387305,
"encodedSize": 2327816,
"ips": [
"34.203.255.203",
"65.9.58.47"
],
"countries": [
"US"
],
"server": "nginx"
},
{
"count": 1,
"size": 0,
"encodedSize": 0,
"ips": [
"143.204.93.105"
],
"countries": [
"US"
],
"server": "AmazonS3"
}
],
"domainStats": [
{
"count": 19,
"ips": [
"149.96.248.4"
],
"domain": "perkinscoiedev.service-now.com",
"size": 2693199,
"encodedSize": 646717,
"countries": [
"US"
],
"index": 0,
"initiators": [
"perkinscoiedev.service-now.com"
],
"redirects": 2
},
{

https://urlscan.io/api/v1/result/3a2c746e-192e-4901-9a5d-78b8b2ee32e3/ Page 107 of 119


03.10.2021, 14:47

"count": 11,
"ips": [
"65.9.58.47"
],
"domain": "ok1static.oktacdn.com",
"size": 3374504,
"encodedSize": 2320535,
"countries": [
"US"
],
"index": 21,
"initiators": [
"myapps.perkinscoie.com",
"ok1static.oktacdn.com"
],
"redirects": 0
},
{
"count": 3,
"ips": [
"34.203.255.203"
],
"domain": "myapps.perkinscoie.com",
"size": 12801,
"encodedSize": 8516,
"countries": [
"US"
],
"index": 19,
"initiators": [
"perkinscoiedev.service-now.com",
"ok1static.oktacdn.com"
],
"redirects": 1
},
{
"count": 1,
"ips": [
"143.204.93.105"
],
"domain": "login.okta.com",
"size": 0,
"encodedSize": 0,
"countries": [
"US"
],
"index": 28,
"initiators": [
"ok1static.oktacdn.com"
],
"redirects": 0
}
],
"regDomainStats": [
{
"count": 19,
"ips": [
"149.96.248.4"
],
"regDomain": "service-now.com",
"size": 2693199,
"encodedSize": 646717,
"countries": [],
"index": 0,
"subDomains": [
{

https://urlscan.io/api/v1/result/3a2c746e-192e-4901-9a5d-78b8b2ee32e3/ Page 108 of 119


03.10.2021, 14:47

"domain": "perkinscoiedev",
"country": "US"
}
],
"redirects": 2
},
{
"count": 11,
"ips": [
"65.9.58.47"
],
"regDomain": "oktacdn.com",
"size": 3374504,
"encodedSize": 2320535,
"countries": [],
"index": 21,
"subDomains": [
{
"domain": "ok1static",
"country": "US"
}
],
"redirects": 0
},
{
"count": 3,
"ips": [
"34.203.255.203"
],
"regDomain": "perkinscoie.com",
"size": 12801,
"encodedSize": 8516,
"countries": [],
"index": 19,
"subDomains": [
{
"domain": "myapps",
"country": "US"
}
],
"redirects": 1
},
{
"count": 1,
"ips": [
"143.204.93.105"
],
"regDomain": "okta.com",
"size": 0,
"encodedSize": 0,
"countries": [],
"index": 28,
"subDomains": [
{
"domain": "login",
"country": "US"
}
],
"redirects": 0
}
],
"secureRequests": 31,
"securePercentage": 100,
"IPv6Percentage": 0,
"uniqCountries": 1,
"totalLinks": 2,

https://urlscan.io/api/v1/result/3a2c746e-192e-4901-9a5d-78b8b2ee32e3/ Page 109 of 119


03.10.2021, 14:47

"malicious": 0,
"adBlocked": 0,
"ipStats": [
{
"requests": 19,
"domains": [
"perkinscoiedev.service-now.com"
],
"ip": "149.96.248.4",
"asn": {
"ip": "149.96.248.4",
"asn": "16839",
"country": "US",
"registrar": "arin",
"date": "2010-12-16",
"description": "SNC, US",
"route": "149.96.240.0/20",
"name": "SNC"
},
"dns": {},
"geoip": {
"range": [
2506096640,
2506162175
],
"country": "US",
"region": "",
"eu": "0",
"timezone": "America/Chicago",
"city": "",
"ll": [
37.751,
-97.822
],
"metro": 0,
"area": 1000,
"country_name": "United States"
},
"size": 2693199,
"encodedSize": 646717,
"countries": [
"US"
],
"index": 0,
"ipv6": false,
"redirects": 2,
"count": null,
"rdns": {
"ip": "149.96.248.4",
"ptr": "vip-149-96-248-4.cust.service-now.com"
}
},
{
"requests": 3,
"domains": [
"myapps.perkinscoie.com"
],
"ip": "34.203.255.203",
"asn": {
"ip": "34.203.255.203",
"asn": "14618",
"country": "US",
"registrar": "arin",
"date": "2005-11-04",
"description": "AMAZON-AES, US",
"route": "34.192.0.0/12",

https://urlscan.io/api/v1/result/3a2c746e-192e-4901-9a5d-78b8b2ee32e3/ Page 110 of 119


03.10.2021, 14:47

"name": "AMAZON-AES"
},
"dns": {},
"geoip": {
"range": [
583532544,
584056831
],
"country": "US",
"region": "VA",
"eu": "0",
"timezone": "America/New_York",
"city": "Ashburn",
"ll": [
39.0481,
-77.4728
],
"metro": 511,
"area": 1000,
"country_name": "United States"
},
"size": 12801,
"encodedSize": 8516,
"countries": [
"US"
],
"index": 19,
"ipv6": false,
"redirects": 1,
"count": null,
"rdns": {
"ip": "34.203.255.203",
"ptr": "ec2-34-203-255-203.compute-1.amazonaws.com"
}
},
{
"requests": 11,
"domains": [
"ok1static.oktacdn.com"
],
"ip": "65.9.58.47",
"asn": {
"ip": "65.9.58.47",
"asn": "16509",
"country": "US",
"registrar": "arin",
"date": "2000-05-04",
"description": "AMAZON-02, US",
"route": "65.9.58.0/23",
"name": "AMAZON-02"
},
"dns": {},
"geoip": {
"range": [
1091043328,
1091305471
],
"country": "US",
"region": "WA",
"eu": "0",
"timezone": "America/Los_Angeles",
"city": "Seattle",
"ll": [
47.54,
-122.3032
],

https://urlscan.io/api/v1/result/3a2c746e-192e-4901-9a5d-78b8b2ee32e3/ Page 111 of 119


03.10.2021, 14:47

"metro": 819,
"area": 1000,
"country_name": "United States"
},
"size": 3374504,
"encodedSize": 2320535,
"countries": [
"US"
],
"index": 21,
"ipv6": false,
"redirects": 0,
"count": null,
"rdns": {
"ip": "65.9.58.47",
"ptr": null
}
},
{
"requests": 1,
"domains": [
"login.okta.com"
],
"ip": "143.204.93.105",
"asn": {
"ip": "143.204.93.105",
"asn": "16509",
"country": "US",
"registrar": "arin",
"date": "2000-05-04",
"description": "AMAZON-02, US",
"route": "143.204.92.0/22",
"name": "AMAZON-02"
},
"dns": {},
"geoip": {
"range": [
2412511232,
2412576767
],
"country": "US",
"region": "WA",
"eu": "0",
"timezone": "America/Los_Angeles",
"city": "Seattle",
"ll": [
47.6348,
-122.3451
],
"metro": 819,
"area": 1000,
"country_name": "United States"
},
"size": 0,
"encodedSize": 0,
"countries": [
"US"
],
"index": 28,
"ipv6": false,
"redirects": 0,
"count": null,
"rdns": {
"ip": "143.204.93.105",
"ptr": "server-143-204-93-105.fra50.r.cloudfront.net"
}

https://urlscan.io/api/v1/result/3a2c746e-192e-4901-9a5d-78b8b2ee32e3/ Page 112 of 119


03.10.2021, 14:47

}
]
},
"meta": {
"processors": {
"geoip": {
"state": "done",
"data": [
{
"ip": "149.96.248.4",
"geoip": {
"range": [
2506096640,
2506162175
],
"country": "US",
"region": "",
"eu": "0",
"timezone": "America/Chicago",
"city": "",
"ll": [
37.751,
-97.822
],
"metro": 0,
"area": 1000,
"country_name": "United States"
}
},
{
"ip": "34.203.255.203",
"geoip": {
"range": [
583532544,
584056831
],
"country": "US",
"region": "VA",
"eu": "0",
"timezone": "America/New_York",
"city": "Ashburn",
"ll": [
39.0481,
-77.4728
],
"metro": 511,
"area": 1000,
"country_name": "United States"
}
},
{
"ip": "65.9.58.47",
"geoip": {
"range": [
1091043328,
1091305471
],
"country": "US",
"region": "WA",
"eu": "0",
"timezone": "America/Los_Angeles",
"city": "Seattle",
"ll": [
47.54,
-122.3032
],

https://urlscan.io/api/v1/result/3a2c746e-192e-4901-9a5d-78b8b2ee32e3/ Page 113 of 119


03.10.2021, 14:47

"metro": 819,
"area": 1000,
"country_name": "United States"
}
},
{
"ip": "143.204.93.105",
"geoip": {
"range": [
2412511232,
2412576767
],
"country": "US",
"region": "WA",
"eu": "0",
"timezone": "America/Los_Angeles",
"city": "Seattle",
"ll": [
47.6348,
-122.3451
],
"metro": 819,
"area": 1000,
"country_name": "United States"
}
}
]
},
"rdns": {
"state": "done",
"data": [
{
"ip": "149.96.248.4",
"ptr": "vip-149-96-248-4.cust.service-now.com"
},
{
"ip": "34.203.255.203",
"ptr": "ec2-34-203-255-203.compute-1.amazonaws.com"
},
{
"ip": "65.9.58.47",
"ptr": null
},
{
"ip": "143.204.93.105",
"ptr": "server-143-204-93-105.fra50.r.cloudfront.net"
}
]
},
"wappa": {
"state": "done",
"data": []
},
"asn": {
"state": "done",
"data": [
{
"ip": "149.96.248.4",
"asn": "16839",
"country": "US",
"registrar": "arin",
"date": "2010-12-16",
"description": "SNC, US",
"route": "149.96.240.0/20",
"name": "SNC"
},

https://urlscan.io/api/v1/result/3a2c746e-192e-4901-9a5d-78b8b2ee32e3/ Page 114 of 119


03.10.2021, 14:47

{
"ip": "34.203.255.203",
"asn": "14618",
"country": "US",
"registrar": "arin",
"date": "2005-11-04",
"description": "AMAZON-AES, US",
"route": "34.192.0.0/12",
"name": "AMAZON-AES"
},
{
"ip": "65.9.58.47",
"asn": "16509",
"country": "US",
"registrar": "arin",
"date": "2000-05-04",
"description": "AMAZON-02, US",
"route": "65.9.58.0/23",
"name": "AMAZON-02"
},
{
"ip": "143.204.93.105",
"asn": "16509",
"country": "US",
"registrar": "arin",
"date": "2000-05-04",
"description": "AMAZON-02, US",
"route": "143.204.92.0/22",
"name": "AMAZON-02"
}
]
},
"done": {
"state": "done",
"data": {
"state": "done"
}
}
}
},
"task": {
"uuid": "3a2c746e-192e-4901-9a5d-78b8b2ee32e3",
"time": "2021-02-05T08:24:04.031Z",
"url": "http://perkinscoiedev.service-now.com",
"visibility": "public",
"options": {
"useragent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36
(KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36"
},
"method": "manual",
"source": "web",
"tags": [],
"userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML,
like Gecko) Chrome/83.0.4103.61 Safari/537.36",
"reportURL": "https://urlscan.io/result/3a2c746e-192e-4901-9a5d-78b8b2ee32e3/",
"screenshotURL": "https://urlscan.io/screenshots/3a2c746e-192e-4901-9a5d-
78b8b2ee32e3.png",
"domURL": "https://urlscan.io/dom/3a2c746e-192e-4901-9a5d-78b8b2ee32e3/"
},
"page": {
"url": "https://myapps.perkinscoie.com/login/login.htm?
fromURI=%2Fapp%2Fservicenow_ud%2Fexk1jsx6trpNIFLGO0h8%2Fsso%2Fsaml%3FSAMLRequest%3DnVJdb9MwFP
0rkd8TJ2aZgtVUCq0GlUoXrYUHXpAT365miW18naz796Ru0coDE%252BL1%252Btxzz4dnKPqOWV4N%252FqAf4OcA6KN
j32nk55eSDE5zI1Ah16IH5L7l2%252BrzmrMk5dYZb1rTkahCBOeV0QujcejBbcGNqoUvD%252BuSHLy3yCm14J6UxtYo
kDAmeIbE2jwnrempFqMVj5BIQ6LlJERpcWJ83e9fhLWYXNGEvWlIL1wT1fdBUjg%252BZT%252FweOud3azu1h%252Fv0
0NBEQ09mSLRnXEtBMsl2YsOgUSrZUm2m0XeNLdMvG%252F27wqWF1I2NyxrRJbnTZaLVBQTEGuBqEZ4XUUcYKXRC%252B

https://urlscan.io/api/v1/result/3a2c746e-192e-4901-9a5d-78b8b2ee32e3/ Page 115 of 119


03.10.2021, 14:47

1LwlKWxSmL03yXFpzd8DRPWM6%252Bkai%252BhPVBaan049vJNmcQ8k%252B7XR3X99tdIBiVBLeZ0P8V6ldwGAKdLpD
5LDTMg3x3XfrbysTvpsn83yTM6PWhy1nLTy5Wy9p0qn2Jqq4zzwsHwk%252FOvBsglNQL%252F3ctWZKFiZLxPkA59EJ1
lZQOEAmdX%252B7%252B%252BbnnvwA%253D%26RelayState%3Dhttps%253A%252F%252Fperkinscoiedev.servic
e-now.com%252Fnavpage.do",
"domain": "myapps.perkinscoie.com",
"country": "US",
"city": "Ashburn",
"server": "nginx",
"ip": "34.203.255.203",
"ptr": "ec2-34-203-255-203.compute-1.amazonaws.com",
"asn": "AS14618",
"asnname": "AMAZON-AES, US"
},
"lists": {
"ips": [
"143.204.93.105",
"65.9.58.47",
"34.203.255.203",
"149.96.248.4"
],
"countries": [
"US"
],
"asns": [
"16509",
"16509",
"14618",
"16839"
],
"domains": [
"perkinscoiedev.service-now.com",
"ok1static.oktacdn.com",
"myapps.perkinscoie.com",
"login.okta.com"
],
"servers": [
"ServiceNow",
"nginx",
"AmazonS3"
],
"urls": [
"https://perkinscoiedev.service-now.com/auth_redirect.do?
sysparm_stack=no&sysparm_url=https%3A%2F%2Fmyapps.perkinscoie.com%2Fapp%2Fservicenow_ud%2Fexk
1jsx6trpNIFLGO0h8%2Fsso%2Fsaml%3FSAMLRequest%3DnVJdb9MwFP0rkd8TJ2aZgtVUCq0GlUoXrYUHXpAT365miW
18naz796Ru0coDE%252BL1%252Btxzz4dnKPqOWV4N%252FqAf4OcA6KNj32nk55eSDE5zI1Ah16IH5L7l2%252BrzmrM
k5dYZb1rTkahCBOeV0QujcejBbcGNqoUvD%252BuSHLy3yCm14J6UxtYokDAmeIbE2jwnrempFqMVj5BIQ6LlJERpcWJ8
3e9fhLWYXNGEvWlIL1wT1fdBUjg%252BZT%252FweOud3azu1h%252Fv00NBEQ09mSLRnXEtBMsl2YsOgUSrZUm2m0XeN
LdMvG%252F27wqWF1I2NyxrRJbnTZaLVBQTEGuBqEZ4XUUcYKXRC%252B1LwlKWxSmL03yXFpzd8DRPWM6%252Bkai%25
2BhPVBaan049vJNmcQ8k%252B7XR3X99tdIBiVBLeZ0P8V6ldwGAKdLpD5LDTMg3x3XfrbysTvpsn83yTM6PWhy1nLTy5
Wy9p0qn2Jqq4zzwsHwk%252FOvBsglNQL%252F3ctWZKFiZLxPkA59EJ1lZQOEAmdX%252B7%252B%252BbnnvwA%253D
%26RelayState%3Dhttps%253A%252F%252Fperkinscoiedev.service-now.com%252Fnavpage.do",
"http://perkinscoiedev.service-now.com/",
"https://perkinscoiedev.service-now.com/",
"https://perkinscoiedev.service-now.com/ConditionalFocus.jsdbx?v=12-09-
2020_1945&c=9_108",
"https://perkinscoiedev.service-now.com/styles/css_includes_doctype.cssx?v=12-09-
2020_1945&c=2020-06-08_10:09:13_8ebad68fdb4aa0106a80464e13961950&theme=system",
"https://perkinscoiedev.service-now.com/styles/heisenberg/source_sans_pro.cssx?v=12-09-
2020_1945&c=2020-06-08_10:09:13_8ebad68fdb4aa0106a80464e13961950&theme=system",
"https://perkinscoiedev.service-now.com/styles/heisenberg/heisenberg_all.cssx?v=12-09-
2020_1945&c=2020-06-08_10:09:13_8ebad68fdb4aa0106a80464e13961950&theme=system",
"https://perkinscoiedev.service-now.com/scripts/doctype/js_includes_doctype.jsx?v=12-
09-2020_1945&lp=Thu_Feb_04_13_15_24_PST_2021&c=9_108",
"https://perkinscoiedev.service-now.com/scripts/js_includes_customer.jsx?v=12-09-
2020_1945&lp=Thu_Feb_04_13_15_24_PST_2021&c=9_108",
"https://perkinscoiedev.service-now.com/scripts/doctype/js_includes_legacy.jsx?v=12-09-

https://urlscan.io/api/v1/result/3a2c746e-192e-4901-9a5d-78b8b2ee32e3/ Page 116 of 119


03.10.2021, 14:47

2020_1945&lp=Thu_Feb_04_13_15_24_PST_2021&c=9_108",
"https://perkinscoiedev.service-
now.com/scripts/app.guided_tours/js_guided_tours_includes.jsx?v=12-09-2020_1945",
"https://perkinscoiedev.service-now.com/scripts/doctype/js_includes_last_doctype.jsx?
v=12-09-2020_1945&lp=Thu_Feb_04_13_15_24_PST_2021&c=9_108",
"https://perkinscoiedev.service-now.com/scripts/heisenberg/heisenberg_all.jsx?v=12-09-
2020_1945",
"https://perkinscoiedev.service-now.com/scripts/js_includes_list_edit_doctype.jsx?v=12-
09-2020_1945&lp=Thu_Feb_04_13_15_24_PST_2021&c=9_108",
"https://perkinscoiedev.service-now.com/scripts/transaction_scope_includes.jsx?v=12-09-
2020_1945",
"https://perkinscoiedev.service-now.com/scripts/doctype/z_last_include.jsx?v=12-09-
2020_1945",
"https://perkinscoiedev.service-now.com/api/now/ui/date_time/legacy",
"https://perkinscoiedev.service-now.com/styles/fonts/source-sans-pro/SourceSansPro-
Regular.otf.woff",
"https://perkinscoiedev.service-now.com/styles/retina_icons/retina_icons.woff?
66761fc96b7c554a5daacdbed174fa9c",
"https://myapps.perkinscoie.com/login/login.htm?
fromURI=%2Fapp%2Fservicenow_ud%2Fexk1jsx6trpNIFLGO0h8%2Fsso%2Fsaml%3FSAMLRequest%3DnVJdb9MwFP
0rkd8TJ2aZgtVUCq0GlUoXrYUHXpAT365miW18naz796Ru0coDE%252BL1%252Btxzz4dnKPqOWV4N%252FqAf4OcA6KN
j32nk55eSDE5zI1Ah16IH5L7l2%252BrzmrMk5dYZb1rTkahCBOeV0QujcejBbcGNqoUvD%252BuSHLy3yCm14J6UxtYo
kDAmeIbE2jwnrempFqMVj5BIQ6LlJERpcWJ83e9fhLWYXNGEvWlIL1wT1fdBUjg%252BZT%252FweOud3azu1h%252Fv0
0NBEQ09mSLRnXEtBMsl2YsOgUSrZUm2m0XeNLdMvG%252F27wqWF1I2NyxrRJbnTZaLVBQTEGuBqEZ4XUUcYKXRC%252B
1LwlKWxSmL03yXFpzd8DRPWM6%252Bkai%252BhPVBaan049vJNmcQ8k%252B7XR3X99tdIBiVBLeZ0P8V6ldwGAKdLpD
5LDTMg3x3XfrbysTvpsn83yTM6PWhy1nLTy5Wy9p0qn2Jqq4zzwsHwk%252FOvBsglNQL%252F3ctWZKFiZLxPkA59EJ1
lZQOEAmdX%252B7%252B%252BbnnvwA%253D%26RelayState%3Dhttps%253A%252F%252Fperkinscoiedev.servic
e-now.com%252Fnavpage.do",
"https://myapps.perkinscoie.com/app/servicenow_ud/exk1jsx6trpNIFLGO0h8/sso/saml?
SAMLRequest=nVJdb9MwFP0rkd8TJ2aZgtVUCq0GlUoXrYUHXpAT365miW18naz796Ru0coDE%2BL1%2Btxzz4dnKPqOW
V4N%2FqAf4OcA6KNj32nk55eSDE5zI1Ah16IH5L7l2%2BrzmrMk5dYZb1rTkahCBOeV0QujcejBbcGNqoUvD%2BuSHLy3
yCm14J6UxtYokDAmeIbE2jwnrempFqMVj5BIQ6LlJERpcWJ83e9fhLWYXNGEvWlIL1wT1fdBUjg%2BZT%2FweOud3azu1
h%2Fv00NBEQ09mSLRnXEtBMsl2YsOgUSrZUm2m0XeNLdMvG%2F27wqWF1I2NyxrRJbnTZaLVBQTEGuBqEZ4XUUcYKXRC%
2B1LwlKWxSmL03yXFpzd8DRPWM6%2Bkai%2BhPVBaan049vJNmcQ8k%2B7XR3X99tdIBiVBLeZ0P8V6ldwGAKdLpD5LDT
Mg3x3XfrbysTvpsn83yTM6PWhy1nLTy5Wy9p0qn2Jqq4zzwsHwk%2FOvBsglNQL%2F3ctWZKFiZLxPkA59EJ1lZQOEAmd
X%2B7%2B%2BbnnvwA%3D&RelayState=https%3A%2F%2Fperkinscoiedev.service-now.com%2Fnavpage.do",
"https://ok1static.oktacdn.com/assets/js/sdk/okta-signin-widget/3.9.2/js/okta-sign-
in.min.js",
"https://ok1static.oktacdn.com/assets/js/sdk/okta-signin-widget/3.9.2/css/okta-sign-
in.min.css",
"https://ok1static.oktacdn.com/assets/loginpage/css/custom-
signin.bb8f4ce4363dd17160adb27f2ab5f478.css",
"https://ok1static.oktacdn.com/fs/bcg/4/gfs1hm4esj7HGVjcK0h8",

"https://ok1static.oktacdn.com/assets/js/mvc/loginpage/initLoginPage.pack.bb0aa11a63d230e8b13
5b92ba459ee7e.js",
"https://myapps.perkinscoie.com/api/v1/authn/introspect",
"https://ok1static.oktacdn.com/fs/bco/7/fs01ieb69o8PIjgUJ0h8",
"https://login.okta.com/discovery/iframe.html",
"https://ok1static.oktacdn.com/assets/js/sdk/okta-signin-
widget/3.9.2/img/security/default.png",
"https://ok1static.oktacdn.com/assets/js/sdk/okta-signin-
widget/3.9.2/img/ui/forms/checkbox-sign-in-widget.png",
"https://ok1static.oktacdn.com/assets/js/sdk/okta-signin-widget/3.9.2/font/montserrat-
light-webfont.woff",
"https://ok1static.oktacdn.com/assets/js/sdk/okta-signin-widget/3.9.2/font/montserrat-
regular-webfont.woff",
"https://ok1static.oktacdn.com/fs/bco/1/fs01ibwgxzcQyuroG0h8"
],
"linkDomains": [
"perkinscoie.universitysite.com",
"www.perkinscoie.com"
],
"certificates": [
{
"subjectName": "*.service-now.com",

https://urlscan.io/api/v1/result/3a2c746e-192e-4901-9a5d-78b8b2ee32e3/ Page 117 of 119


03.10.2021, 14:47

"issuer": "Entrust Certification Authority - L1K",


"validFrom": 1595462153,
"validTo": 1617321353
},
{
"subjectName": "myapps.perkinscoie.com",
"issuer": "DigiCert SHA2 Secure Server CA",
"validFrom": 1583107200,
"validTo": 1615377600
},
{
"subjectName": "*.oktacdn.com",
"issuer": "DigiCert TLS RSA SHA256 2020 CA1",
"validFrom": 1607990400,
"validTo": 1642291199
},
{
"subjectName": "accounts.okta.com",
"issuer": "DigiCert SHA2 High Assurance Server CA",
"validFrom": 1564358400,
"validTo": 1627560000
}
],
"hashes": [
"30240ebbbe23fcad1de859bdb45c4c80a2f40e0d235a1b6b787c77a1bfc649d4",
"35a86319d80b941df7db498279450d00c7aaff7f890b8c0779a8536a2a51ebef",
"ede95d2a25d48b7f00ba0b0c914de1c235b6e7bad938d206e829e68ef7633bdd",
"e74b813f0c8790db2120c41289144f7cd781b1a0fae2361c931d605c928cdf61",
"1de37f7f59ec0714a26cb9307aba10d73fb0d30952f9f5e9b7b49b0aa5177ff6",
"8bfc49880c042ad3da265a5a57976497ff5f6ca2023a41609745c8d674bf42e6",
"c43736cbdbbd7eeb20ae469367f46e2aa1e222b46fccfaab0dd73320a95683f7",
"ce599ff875bc9d13cf4dbeaa88de17dd5b548754a4a264e30692604883b4832f",
"c95c95b3297ae7bc1607137f1c38ee0ebdb52e8af8bc9de50486c9bebf16c24e",
"af9ab3ff73d3afdfb911aba755b01d5b853c518c5bb07dddb281b1dd421d278f",
"9fd51b6ee9aec10ed2fca5fe110b2d9c528b1dd7327bf518f9489b95dfd49531",
"e342c45a3d715aebb66b238766a80327d66baa2182d0fa541f4d60df84ae42c6",
"5a82f71dc61d033dc7a9832aa2c44b7d0b25705c268d6cf6a6cbbd687fe7ab10",
"2771e4e74822121736662c759a072d6d4fe24276074f2724aea0ca8d0a864566",
"3a4678a45d2a987cc89c9368ed9a9b1577fe7530a23fb3f81a71e9b6e061c89b",
"f27daa844f6b3c459fdf04a0bccd7a7d1eb2e22a5211c725ddd21f6f859d7f57",
"ea529b703d4233c8502c032419c0b5238ec604bf77f3f9425db9ae0a8bc17aea",
"6ad0ad11086d50749bb41cf96cf712c1e61f458b4f6844f36f4ba21960417250",
"c3cdd8101180fc4a31639d72986cfce5471f95a73e7f7b52c37b11361a048d8e",
"47bd2f905d18fb5e6eb3f16e823aeb8fa150bddcef3eb2926f9da00b75787a69",
"358d109ba71eeb7b10fa34cad606eeb388130ae3113d3e333dab6f1bfeb412a9",
"aa5c8f3eedfa726e22ccd038be4dc67360e052a09d7306d31317612e75ada0bc",
"da75c3f3ce27c081541dfb59edd7e756fefe054a9e0e976356c4b0d3778bb434",
"40810b0318131f9ba52c83a17e633a0ac476ade66ea8a914d6c4980571397665",
"feb177fb563f478cb8ecade71caea5df5ad318ca161c71875114e504ce304ace",
"1d5325892ecf2dc3abd0caf2a1ef4eabf2477e2937c9a372760fd2acae8fddf3",
"034071ac082f8a91a891990b168a3a62460102de977130ff08b3b0d4cbb1d864"
]
},
"verdicts": {
"overall": {
"score": 0,
"categories": [],
"brands": [],
"tags": [],
"malicious": false,
"hasVerdicts": 0
},
"urlscan": {
"score": 0,
"categories": [],
"brands": [],

https://urlscan.io/api/v1/result/3a2c746e-192e-4901-9a5d-78b8b2ee32e3/ Page 118 of 119


03.10.2021, 14:47

"tags": [],
"detectionDetails": [],
"malicious": false
},
"engines": {
"score": 0,
"malicious": [],
"benign": [],
"maliciousTotal": 0,
"benignTotal": 0,
"verdicts": [],
"enginesTotal": 0
},
"community": {
"score": 0,
"votes": [],
"votesTotal": 0,
"votesMalicious": 0,
"votesBenign": 0,
"tags": [],
"categories": []
}
},
"submitter": {
"country": "US"
}
}

https://urlscan.io/api/v1/result/3a2c746e-192e-4901-9a5d-78b8b2ee32e3/ Page 119 of 119

You might also like