nordstrom.okta.service-now.cascoenterprise.com Open in urlscan Pro
216.246.46.37  Malicious Activity! Public Scan

4 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

12 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request / Show response nordstrom.okta.service-now.cascoenterprise.com/home/UserHome/	17 KB 6 KB	2776ms 339ms	Document text/html	216.246.46.37 SERVERCENTRAL
General Check archive.org Show headers Download Go to Full URL http://nordstrom.okta.service-now.cascoenterprise.com/home/UserHome/ Protocol HTTP/1.1 Server 216.246.46.37 Chicago, United States, ASN23352 (SERVERCENTRAL, US), Reverse DNS priva230.spindns.com Software / Resource Hash b61102164de70e83e098dadb48ba5596cf692937a54051aadfe7c1a067cf3123 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.102 Safari/537.36 accept-language en-AU,en;q=0.9 Response headers Connection Keep-Alive Keep-Alive timeout=5, max=100 accept-ranges bytes content-encoding gzip content-length 5498 content-type text/html date Tue, 25 Jul 2023 19:00:29 GMT last-modified Thu, 28 Jan 2021 17:10:10 GMT vary Accept-Encoding
GET H2	200	okta-sign-in.min.js Show response ok3static.oktacdn.com/assets/js/sdk/okta-signin-widget/4.5.1/js/	1 MB 394 KB	1986ms 1342ms	Script application/javascript	13.224.249.110 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://ok3static.oktacdn.com/assets/js/sdk/okta-signin-widget/4.5.1/js/okta-sign-in.min.js Requested by Host: nordstrom.okta.service-now.cascoenterprise.com URL: http://nordstrom.okta.service-now.cascoenterprise.com/home/UserHome/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 13.224.249.110 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-224-249-110.sin52.r.cloudfront.net Software nginx / Resource Hash 976d97e25fc4e18765ea00409bde55568473af3af80afed08cf6a4097dafefde Security Headers Name Value Strict-Transport-Security max-age=315360000; includeSubDomains Request headers accept-language en-AU,en;q=0.9 Referer http://nordstrom.okta.service-now.cascoenterprise.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.102 Safari/537.36 Response headers date Tue, 25 Jul 2023 19:00:33 GMT strict-transport-security max-age=315360000; includeSubDomains content-encoding gzip via 1.1 61cb5f44fd6bd171993a4c81d63d8cd4.cloudfront.net (CloudFront) x-amz-cf-pop SIN52-C2 x-cache Miss from cloudfront last-modified Tue, 20 Oct 2020 20:31:34 GMT server nginx etag W/"d10e6f90c2e3f9cbbbf40dcd6456d5eb" vary Accept-Encoding content-type application/javascript public-key-pins-report-only pin-sha256="r5EfzZxQVvQpKo3AgYRaT7X2bDO/kj3ACwmxfdT2zt8="; pin-sha256="MaqlcUgk2mvY/RFSGeSwBRkI+rZ6/dxe/DuQfBT/vnQ="; pin-sha256="72G5IEvDEWn+EThf3qjR7/bQSWaS2ZSLqolhnO6iyJI="; pin-sha256="rrV6CLCCvqnk89gWibYT0JO6fNQ8cCit7GGoiVTjCOg="; max-age=60; report-uri="https://okta.report-uri.com/r/default/hpkp/reportOnly" access-control-allow-origin * cache-control max-age=31536000, public,max-age=31536000,s-maxage=1814400 x-amz-cf-id 0EdL4tzehiOtkCpSZSI5AkN3epKxqeAmDqXdQX1tKsQAte4uLOC-rw== expires Wed, 24 Jul 2024 19:00:33 GMT
GET H2	200	okta-sign-in.min.css ok3static.oktacdn.com/assets/js/sdk/okta-signin-widget/4.5.1/css/	191 KB 34 KB	1813ms 1169ms	Stylesheet text/css	13.224.249.110 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://ok3static.oktacdn.com/assets/js/sdk/okta-signin-widget/4.5.1/css/okta-sign-in.min.css Requested by Host: nordstrom.okta.service-now.cascoenterprise.com URL: http://nordstrom.okta.service-now.cascoenterprise.com/home/UserHome/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 13.224.249.110 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-224-249-110.sin52.r.cloudfront.net Software nginx / Resource Hash c39d078797265514dd92453bbf005eb4023fd97be240de15fa2b0a2f06502e7d Security Headers Name Value Strict-Transport-Security max-age=315360000; includeSubDomains Request headers accept-language en-AU,en;q=0.9 Referer http://nordstrom.okta.service-now.cascoenterprise.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.102 Safari/537.36 Response headers date Tue, 25 Jul 2023 19:00:33 GMT strict-transport-security max-age=315360000; includeSubDomains content-encoding gzip via 1.1 61cb5f44fd6bd171993a4c81d63d8cd4.cloudfront.net (CloudFront) x-amz-cf-pop SIN52-C2 x-cache Miss from cloudfront last-modified Tue, 20 Oct 2020 20:31:23 GMT server nginx etag W/"da950f0640177df2289efdce11791b9c" vary Accept-Encoding content-type text/css public-key-pins-report-only pin-sha256="r5EfzZxQVvQpKo3AgYRaT7X2bDO/kj3ACwmxfdT2zt8="; pin-sha256="MaqlcUgk2mvY/RFSGeSwBRkI+rZ6/dxe/DuQfBT/vnQ="; pin-sha256="72G5IEvDEWn+EThf3qjR7/bQSWaS2ZSLqolhnO6iyJI="; pin-sha256="rrV6CLCCvqnk89gWibYT0JO6fNQ8cCit7GGoiVTjCOg="; max-age=60; report-uri="https://okta.report-uri.com/r/default/hpkp/reportOnly" access-control-allow-origin * cache-control max-age=31536000, public,max-age=31536000,s-maxage=1814400 x-amz-cf-id i3GWcpmwfap0W8agPQWst1ZLCyCoR3oAfCkqxAubaRujS5sLAMB7dw== expires Wed, 24 Jul 2024 19:00:33 GMT
GET H2	200	loginpage-theme.7138a0eb969c6a25c2d39004ad54df8a.css ok2static.oktacdn.com/assets/loginpage/css/	2 KB 2 KB	1937ms 1194ms	Stylesheet text/css	65.8.11.102 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://ok2static.oktacdn.com/assets/loginpage/css/loginpage-theme.7138a0eb969c6a25c2d39004ad54df8a.css Requested by Host: nordstrom.okta.service-now.cascoenterprise.com URL: http://nordstrom.okta.service-now.cascoenterprise.com/home/UserHome/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 65.8.11.102 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-65-8-11-102.kul50.r.cloudfront.net Software nginx / Resource Hash f785f5556c21cf194c575f6e70688fdf527de0efdba9aed9c004f2f40010b2b3 Security Headers Name Value Strict-Transport-Security max-age=315360000; includeSubDomains Request headers accept-language en-AU,en;q=0.9 Referer http://nordstrom.okta.service-now.cascoenterprise.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.102 Safari/537.36 Response headers date Tue, 25 Jul 2023 19:00:33 GMT strict-transport-security max-age=315360000; includeSubDomains content-encoding gzip via 1.1 5a8a006e6753b9532a43c807b70fb134.cloudfront.net (CloudFront) x-amz-cf-pop KUL50-C2 x-cache Miss from cloudfront last-modified Tue, 12 Nov 2019 22:30:30 GMT server nginx etag W/"7138a0eb969c6a25c2d39004ad54df8a" vary Accept-Encoding content-type text/css public-key-pins-report-only pin-sha256="r5EfzZxQVvQpKo3AgYRaT7X2bDO/kj3ACwmxfdT2zt8="; pin-sha256="MaqlcUgk2mvY/RFSGeSwBRkI+rZ6/dxe/DuQfBT/vnQ="; pin-sha256="72G5IEvDEWn+EThf3qjR7/bQSWaS2ZSLqolhnO6iyJI="; pin-sha256="rrV6CLCCvqnk89gWibYT0JO6fNQ8cCit7GGoiVTjCOg="; max-age=60; report-uri="https://okta.report-uri.com/r/default/hpkp/reportOnly" access-control-allow-origin * cache-control max-age=31536000, public,max-age=31536000,s-maxage=1814400 x-amz-cf-id zm7_-06W86IYEvSbp7qV_DtKznTL-JnZ-OlW4XnQbEozZqEayYrRFg== expires Wed, 24 Jul 2024 19:00:33 GMT
GET H/1.1	404 Not Found	initLoginPage.pack.007ca6bc5d1951a8780fd28c60794b98.js nordstrom.okta.service-now.cascoenterprise.com/home/UserHome/files/	0 0	331ms 331ms	Script text/html	216.246.46.37 SERVERCENTRAL
General Check archive.org Show headers Download Go to Full URL http://nordstrom.okta.service-now.cascoenterprise.com/home/UserHome/files/initLoginPage.pack.007ca6bc5d1951a8780fd28c60794b98.js Requested by Host: nordstrom.okta.service-now.cascoenterprise.com URL: http://nordstrom.okta.service-now.cascoenterprise.com/home/UserHome/ Protocol HTTP/1.1 Server 216.246.46.37 Chicago, United States, ASN23352 (SERVERCENTRAL, US), Reverse DNS priva230.spindns.com Software / Resource Hash Request headers Referer http://nordstrom.okta.service-now.cascoenterprise.com/home/UserHome/ Origin http://nordstrom.okta.service-now.cascoenterprise.com accept-language en-AU,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.102 Safari/537.36 Response headers pragma no-cache date Tue, 25 Jul 2023 19:00:30 GMT cache-control private, no-cache, no-store, must-revalidate, max-age=0 Connection Keep-Alive Keep-Alive timeout=5, max=100 content-length 708 content-type text/html
GET H2	200	fs057b5c9yZyDY3N32p7 ok6static.oktacdn.com/fs/bco/1/	5 KB 6 KB	626ms 192ms	Image image/png	52.84.251.53 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://ok6static.oktacdn.com/fs/bco/1/fs057b5c9yZyDY3N32p7 Requested by Host: nordstrom.okta.service-now.cascoenterprise.com URL: http://nordstrom.okta.service-now.cascoenterprise.com/home/UserHome/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 52.84.251.53 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-52-84-251-53.sin5.r.cloudfront.net Software nginx / Resource Hash 19d20c363953ec52f2a0fa995bf5ae3451cff3f2048931cee8be86dec8d6fed0 Security Headers Name Value Strict-Transport-Security max-age=315360000; includeSubDomains Request headers accept-language en-AU,en;q=0.9 Referer http://nordstrom.okta.service-now.cascoenterprise.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.102 Safari/537.36 Response headers strict-transport-security max-age=315360000; includeSubDomains date Tue, 25 Jul 2023 17:58:58 GMT via 1.1 4bc700d87dc12c5b9fe83b91ddd63bea.cloudfront.net (CloudFront) x-amz-cf-pop SIN5-C1 age 1528751 x-cache Hit from cloudfront content-length 5493 last-modified Mon, 07 Oct 2019 22:07:55 GMT server nginx etag "d9e37e4c755cb903f8a31fd2bf1d0e12" content-type image/png access-control-allow-origin * public-key-pins-report-only pin-sha256="r5EfzZxQVvQpKo3AgYRaT7X2bDO/kj3ACwmxfdT2zt8="; pin-sha256="MaqlcUgk2mvY/RFSGeSwBRkI+rZ6/dxe/DuQfBT/vnQ="; pin-sha256="72G5IEvDEWn+EThf3qjR7/bQSWaS2ZSLqolhnO6iyJI="; pin-sha256="rrV6CLCCvqnk89gWibYT0JO6fNQ8cCit7GGoiVTjCOg="; max-age=60; report-uri="https://okta.report-uri.com/r/default/hpkp/reportOnly" cache-control max-age=31536000, public,max-age=31536000,s-maxage=1814400 accept-ranges bytes x-amz-cf-id 532rYxtlZsbY-txTcRIAa3BDgOc0OmIPuzZhglu1OIrK7QN4ixgxkg== expires Sun, 07 Jul 2024 02:21:22 GMT
GET H/1.1	404 Not Found	iframe.html Show response nordstrom.okta.service-now.cascoenterprise.com/home/UserHome/files/ Frame 8787	708 B 963 B	331ms 331ms	Document text/html	216.246.46.37 SERVERCENTRAL
General Check archive.org Show headers Download Go to Full URL http://nordstrom.okta.service-now.cascoenterprise.com/home/UserHome/files/iframe.html Requested by Host: nordstrom.okta.service-now.cascoenterprise.com URL: http://nordstrom.okta.service-now.cascoenterprise.com/home/UserHome/ Protocol HTTP/1.1 Server 216.246.46.37 Chicago, United States, ASN23352 (SERVERCENTRAL, US), Reverse DNS priva230.spindns.com Software / Resource Hash 37a4e56c497e170de6e152bc479624eb8d7ccb35bad5a190f2fdb17ac699cffa Request headers Referer http://nordstrom.okta.service-now.cascoenterprise.com/home/UserHome/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.102 Safari/537.36 accept-language en-AU,en;q=0.9 Response headers Connection Keep-Alive Keep-Alive timeout=5, max=100 cache-control private, no-cache, no-store, must-revalidate, max-age=0 content-length 708 content-type text/html date Tue, 25 Jul 2023 19:00:33 GMT pragma no-cache
GET H2	200	default.png ok3static.oktacdn.com/assets/js/sdk/okta-signin-widget/4.5.1/img/security/	2 KB 2 KB	1257ms 1256ms	Image image/png	13.224.249.110 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://ok3static.oktacdn.com/assets/js/sdk/okta-signin-widget/4.5.1/img/security/default.png Requested by Host: ok3static.oktacdn.com URL: https://ok3static.oktacdn.com/assets/js/sdk/okta-signin-widget/4.5.1/css/okta-sign-in.min.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 13.224.249.110 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-224-249-110.sin52.r.cloudfront.net Software nginx / Resource Hash da75c3f3ce27c081541dfb59edd7e756fefe054a9e0e976356c4b0d3778bb434 Security Headers Name Value Strict-Transport-Security max-age=315360000; includeSubDomains Request headers accept-language en-AU,en;q=0.9 Referer https://ok3static.oktacdn.com/assets/js/sdk/okta-signin-widget/4.5.1/css/okta-sign-in.min.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.102 Safari/537.36 Response headers date Tue, 25 Jul 2023 19:00:35 GMT strict-transport-security max-age=315360000; includeSubDomains via 1.1 61cb5f44fd6bd171993a4c81d63d8cd4.cloudfront.net (CloudFront) x-amz-cf-pop SIN52-C2 x-cache Miss from cloudfront content-length 1800 last-modified Tue, 20 Oct 2020 20:31:32 GMT server nginx etag "04eeeba5b3538c4524d8e6828ba2c405" public-key-pins-report-only pin-sha256="r5EfzZxQVvQpKo3AgYRaT7X2bDO/kj3ACwmxfdT2zt8="; pin-sha256="MaqlcUgk2mvY/RFSGeSwBRkI+rZ6/dxe/DuQfBT/vnQ="; pin-sha256="72G5IEvDEWn+EThf3qjR7/bQSWaS2ZSLqolhnO6iyJI="; pin-sha256="rrV6CLCCvqnk89gWibYT0JO6fNQ8cCit7GGoiVTjCOg="; max-age=60; report-uri="https://okta.report-uri.com/r/default/hpkp/reportOnly" content-type image/png access-control-allow-origin * cache-control max-age=31536000, public,max-age=31536000,s-maxage=1814400 accept-ranges bytes x-amz-cf-id sE8pCxFGz3KMzln05vAuCjJqtzNmDMqdSDa6jCDNgdk26jJIm9PskQ== expires Wed, 24 Jul 2024 19:00:35 GMT
GET H2	200	checkbox-sign-in-widget.png ok3static.oktacdn.com/assets/js/sdk/okta-signin-widget/4.5.1/img/ui/forms/	3 KB 4 KB	552ms 552ms	Image image/png	13.224.249.110 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://ok3static.oktacdn.com/assets/js/sdk/okta-signin-widget/4.5.1/img/ui/forms/checkbox-sign-in-widget.png Requested by Host: ok3static.oktacdn.com URL: https://ok3static.oktacdn.com/assets/js/sdk/okta-signin-widget/4.5.1/css/okta-sign-in.min.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 13.224.249.110 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-224-249-110.sin52.r.cloudfront.net Software nginx / Resource Hash 40810b0318131f9ba52c83a17e633a0ac476ade66ea8a914d6c4980571397665 Security Headers Name Value Strict-Transport-Security max-age=315360000; includeSubDomains Request headers accept-language en-AU,en;q=0.9 Referer https://ok3static.oktacdn.com/assets/js/sdk/okta-signin-widget/4.5.1/css/okta-sign-in.min.css User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.102 Safari/537.36 Response headers date Tue, 25 Jul 2023 19:00:34 GMT strict-transport-security max-age=315360000; includeSubDomains via 1.1 61cb5f44fd6bd171993a4c81d63d8cd4.cloudfront.net (CloudFront) x-amz-cf-pop SIN52-C2 x-cache Miss from cloudfront content-length 3141 last-modified Tue, 20 Oct 2020 20:31:25 GMT server nginx etag "7846b2f8c6d0a7ca69fdd3d3c294e92d" public-key-pins-report-only pin-sha256="r5EfzZxQVvQpKo3AgYRaT7X2bDO/kj3ACwmxfdT2zt8="; pin-sha256="MaqlcUgk2mvY/RFSGeSwBRkI+rZ6/dxe/DuQfBT/vnQ="; pin-sha256="72G5IEvDEWn+EThf3qjR7/bQSWaS2ZSLqolhnO6iyJI="; pin-sha256="rrV6CLCCvqnk89gWibYT0JO6fNQ8cCit7GGoiVTjCOg="; max-age=60; report-uri="https://okta.report-uri.com/r/default/hpkp/reportOnly" content-type image/png access-control-allow-origin * cache-control max-age=31536000, public,max-age=31536000,s-maxage=1814400 accept-ranges bytes x-amz-cf-id YaVHldq4V6q0TDNuCxpXWXz6SVVjmHcOlQU20EDyLDZKMVsDdvHuAQ== expires Wed, 24 Jul 2024 19:00:34 GMT
GET H2	200	montserrat-light-webfont.woff ok3static.oktacdn.com/assets/js/sdk/okta-signin-widget/4.5.1/font/	22 KB 22 KB	857ms 483ms	Font application/font-woff	13.224.249.110 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://ok3static.oktacdn.com/assets/js/sdk/okta-signin-widget/4.5.1/font/montserrat-light-webfont.woff Requested by Host: ok3static.oktacdn.com URL: https://ok3static.oktacdn.com/assets/js/sdk/okta-signin-widget/4.5.1/css/okta-sign-in.min.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 13.224.249.110 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-224-249-110.sin52.r.cloudfront.net Software nginx / Resource Hash feb177fb563f478cb8ecade71caea5df5ad318ca161c71875114e504ce304ace Security Headers Name Value Strict-Transport-Security max-age=315360000; includeSubDomains Request headers Referer https://ok3static.oktacdn.com/assets/js/sdk/okta-signin-widget/4.5.1/css/okta-sign-in.min.css Origin http://nordstrom.okta.service-now.cascoenterprise.com accept-language en-AU,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.102 Safari/537.36 Response headers date Tue, 25 Jul 2023 19:00:34 GMT strict-transport-security max-age=315360000; includeSubDomains via 1.1 dd4a48a0e8cf2c09aa1d20a6d7a69f70.cloudfront.net (CloudFront) x-amz-cf-pop SIN52-C2 x-cache Miss from cloudfront content-length 22112 last-modified Tue, 20 Oct 2020 20:31:24 GMT server nginx etag "6225f3ca44b83090833064727a09cc95" public-key-pins-report-only pin-sha256="r5EfzZxQVvQpKo3AgYRaT7X2bDO/kj3ACwmxfdT2zt8="; pin-sha256="MaqlcUgk2mvY/RFSGeSwBRkI+rZ6/dxe/DuQfBT/vnQ="; pin-sha256="72G5IEvDEWn+EThf3qjR7/bQSWaS2ZSLqolhnO6iyJI="; pin-sha256="rrV6CLCCvqnk89gWibYT0JO6fNQ8cCit7GGoiVTjCOg="; max-age=60; report-uri="https://okta.report-uri.com/r/default/hpkp/reportOnly" content-type application/font-woff access-control-allow-origin * cache-control max-age=31536000, public,max-age=31536000,s-maxage=1814400 accept-ranges bytes x-amz-cf-id 3QUQURtpKY13127O8GoE1iKZiuEEOUeNYz52Fm8Ml3K-jMa45Oi2gw== expires Wed, 24 Jul 2024 19:00:34 GMT
GET H2	200	montserrat-regular-webfont.woff ok3static.oktacdn.com/assets/js/sdk/okta-signin-widget/4.5.1/font/	21 KB 22 KB	1456ms 1084ms	Font application/font-woff	13.224.249.110 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://ok3static.oktacdn.com/assets/js/sdk/okta-signin-widget/4.5.1/font/montserrat-regular-webfont.woff Requested by Host: ok3static.oktacdn.com URL: https://ok3static.oktacdn.com/assets/js/sdk/okta-signin-widget/4.5.1/css/okta-sign-in.min.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 13.224.249.110 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-224-249-110.sin52.r.cloudfront.net Software nginx / Resource Hash 1d5325892ecf2dc3abd0caf2a1ef4eabf2477e2937c9a372760fd2acae8fddf3 Security Headers Name Value Strict-Transport-Security max-age=315360000; includeSubDomains Request headers Referer https://ok3static.oktacdn.com/assets/js/sdk/okta-signin-widget/4.5.1/css/okta-sign-in.min.css Origin http://nordstrom.okta.service-now.cascoenterprise.com accept-language en-AU,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.102 Safari/537.36 Response headers date Tue, 25 Jul 2023 19:00:35 GMT strict-transport-security max-age=315360000; includeSubDomains via 1.1 dd4a48a0e8cf2c09aa1d20a6d7a69f70.cloudfront.net (CloudFront) x-amz-cf-pop SIN52-C2 x-cache Miss from cloudfront content-length 21980 last-modified Tue, 20 Oct 2020 20:31:24 GMT server nginx etag "8f2822b73b5f9c106c6f2e0db820bcbb" public-key-pins-report-only pin-sha256="r5EfzZxQVvQpKo3AgYRaT7X2bDO/kj3ACwmxfdT2zt8="; pin-sha256="MaqlcUgk2mvY/RFSGeSwBRkI+rZ6/dxe/DuQfBT/vnQ="; pin-sha256="72G5IEvDEWn+EThf3qjR7/bQSWaS2ZSLqolhnO6iyJI="; pin-sha256="rrV6CLCCvqnk89gWibYT0JO6fNQ8cCit7GGoiVTjCOg="; max-age=60; report-uri="https://okta.report-uri.com/r/default/hpkp/reportOnly" content-type application/font-woff access-control-allow-origin * cache-control max-age=31536000, public,max-age=31536000,s-maxage=1814400 accept-ranges bytes x-amz-cf-id hjUcwceIzKktoObyNqP9hYO5Mqsw8ULkwcs-GmRj32mIPEcDx3OBoQ== expires Wed, 24 Jul 2024 19:00:35 GMT
GET H2	200	fs08te75o64x5ueBz2p7 ok6static.oktacdn.com/fs/bco/7/	405 KB 406 KB	217ms 217ms	Image image/jpeg	52.84.251.53 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://ok6static.oktacdn.com/fs/bco/7/fs08te75o64x5ueBz2p7 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 52.84.251.53 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-52-84-251-53.sin5.r.cloudfront.net Software nginx / Resource Hash c48d8ad55f87fe6ca099eb0f87ccead4b5df27011a56c0cf9faa7df627d4ced9 Security Headers Name Value Strict-Transport-Security max-age=315360000; includeSubDomains Request headers accept-language en-AU,en;q=0.9 Referer http://nordstrom.okta.service-now.cascoenterprise.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.102 Safari/537.36 Response headers date Mon, 17 Jul 2023 07:00:43 GMT strict-transport-security max-age=315360000; includeSubDomains via 1.1 4bc700d87dc12c5b9fe83b91ddd63bea.cloudfront.net (CloudFront) x-amz-cf-pop SIN5-C1 age 734392 x-cache Hit from cloudfront content-length 414948 last-modified Mon, 09 Nov 2020 23:13:31 GMT server nginx etag "20063fb86282914d5ff8d219e1efd71a" public-key-pins-report-only pin-sha256="r5EfzZxQVvQpKo3AgYRaT7X2bDO/kj3ACwmxfdT2zt8="; pin-sha256="MaqlcUgk2mvY/RFSGeSwBRkI+rZ6/dxe/DuQfBT/vnQ="; pin-sha256="72G5IEvDEWn+EThf3qjR7/bQSWaS2ZSLqolhnO6iyJI="; pin-sha256="rrV6CLCCvqnk89gWibYT0JO6fNQ8cCit7GGoiVTjCOg="; max-age=60; report-uri="https://okta.report-uri.com/r/default/hpkp/reportOnly" content-type image/jpeg access-control-allow-origin * cache-control max-age=31536000, public,max-age=31536000,s-maxage=1814400 accept-ranges bytes x-amz-cf-id IzMXzJI6MmTfQZqiEODiJBdZ8HB2G7BoSfOeoeY_y98MDCLPzdqnYQ== expires Tue, 16 Jul 2024 07:00:43 GMT

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Nordstrom (Fashion)

13 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| __core-js_shared__ object| core function| setImmediate function| clearImmediate object| regeneratorRuntime boolean| _babelPolyfill object| Backbone function| jQueryCourage object| u2f function| OktaSignIn object| okta function| runLoginPage

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: http://nordstrom.okta.service-now.cascoenterprise.com/home/UserHome/files/initLoginPage.pack.007ca6bc5d1951a8780fd28c60794b98.js Message: Failed to load resource: the server responded with a status of 404 (Not Found)
network	error	URL: http://nordstrom.okta.service-now.cascoenterprise.com/home/UserHome/files/iframe.html Message: Failed to load resource: the server responded with a status of 404 (Not Found)

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

nordstrom.okta.service-now.cascoenterprise.com
ok2static.oktacdn.com
ok3static.oktacdn.com
ok6static.oktacdn.com
13.224.249.110
216.246.46.37
52.84.251.53
65.8.11.102
19d20c363953ec52f2a0fa995bf5ae3451cff3f2048931cee8be86dec8d6fed0
1d5325892ecf2dc3abd0caf2a1ef4eabf2477e2937c9a372760fd2acae8fddf3
37a4e56c497e170de6e152bc479624eb8d7ccb35bad5a190f2fdb17ac699cffa
40810b0318131f9ba52c83a17e633a0ac476ade66ea8a914d6c4980571397665
976d97e25fc4e18765ea00409bde55568473af3af80afed08cf6a4097dafefde
b61102164de70e83e098dadb48ba5596cf692937a54051aadfe7c1a067cf3123
c39d078797265514dd92453bbf005eb4023fd97be240de15fa2b0a2f06502e7d
c48d8ad55f87fe6ca099eb0f87ccead4b5df27011a56c0cf9faa7df627d4ced9
da75c3f3ce27c081541dfb59edd7e756fefe054a9e0e976356c4b0d3778bb434
f785f5556c21cf194c575f6e70688fdf527de0efdba9aed9c004f2f40010b2b3
feb177fb563f478cb8ecade71caea5df5ad318ca161c71875114e504ce304ace