149.96.126.140
Intelligence analysis identified IP 149.96.126.140 as infrastructure owned by SERVICENOW, INC. (ASN 16839). The asset operated as a web server with TCP ports 80 and 443 active, resolving to `vip-149-96-126-140.cust.service-now.com`. TLS certificates were issued by DigiCert Inc for the `service-now.com` domain. DNS hygiene scores were excellent, with valid SPF and DMARC configurations in place.
Threat assessment returned a Low Risk score of 25. The address showed no association with known attacker campaigns, spam sources, or abuse indicators. Behavioral monitoring recorded zero honeypot hits or enumeration strikes. However, a contradiction existed in geolocation validation where the RTT measurement (101ms) did not align with the minimum possible RTT (152.5ms) for the claimed distance. Consequently, the geoPlausible flag was marked false.
The recommendation was Monitor due to signal contradictions. The asset was first observed on 2026-09-03 and last seen on 2026-09-11.
This summary was generated by AI and may contain inaccuracies. Verify critical details independently.
🏢 Ownership & Registration
| Organization | SERVICENOW, INC. |
| ASN | AS16839 |
| Network Name | SERVICENOW-NET1 |
| CIDR Block | 149.96.0.0/16 |
| RIR | ARIN |
| Country | United States |
| Abuse Contact | Available via RDAP |
🌐 DNS Intelligence
| PTR | vip-149-96-126-140.cust.service-now.com |
| Forward Confirmed | Yes — FCrDNS verified |
| Forward Hostnames | vip-149-96-126-140.cust.service-now.com |
🔐 DNS Hygiene
| Hygiene Score | 80% (Excellent) |
| SPF | 2/2 domains |
| DMARC | 2/2 domains |
| FCrDNS | Verified |
| DNSSEC | Not signed |
| CAA | Present |
| Domains Checked | 2 domains |
☁️ Network Classification
| Infrastructure | Unknown |
| Service Purpose | Web Server |
| Network Tier | Unknown — Insufficient routing data to classify |
🔌 Services & Open Ports
| Port | Service | Protocol | Banner |
|---|---|---|---|
| 80 | http | tcp | — |
| 443 | https | tcp | — |
| Closed Ports | 22, 25, 3389, 8080, 8443 (2 open / 7 scanned) | ||
| Server | snow_adc |
| HTTP Title | — |
🔐 TLS Certificate
| SANs | *.service-now.comservice-now.com*.static.service-now.comstatic.service-now.com |
| Valid From | 2026-02-12T00:00:00+00:00 |
| Valid Until | 2026-11-13T23:59:59+00:00 |
| TLS Protocol | Tls13 |
| Cipher Suite | TLS_AES_256_GCM_SHA384 |
| Signature Algorithm | sha384ECDSA |
| Validity Period | 274 days |
| Serial Number | 014D95634DF544A7266C36F7954AB29D |
| Thumbprint | 8E17E81D33382661D5BF9C7F659F8F6B842A2F9C |
🎯 Confidence Breakdown
Per-dimension confidence scores based on source diversity and data freshness
| Dimension | Score | Sources | Observations |
|---|---|---|---|
| threat | 38% | 2 | 5 |
| routing | 13% | 1 | 1 |
| services | 27% | 2 | 4 |
| ownership | 27% | 2 | 3 |
| reputation | 28% | 1 | 3 |
| geolocation | 38% | 2 | 5 |
| Overall | 28% | 10 | 21 |
| Data Coherence | Mostly Consistent (80%) — 1 contradiction(s) |
| Attribution | Moderate (55%) |
| OwnershipFCrDNSGeo ConsensusGeo PlausibleIRR MatchRPKI Valid |
📅 Observation Timeline 🔄 Live
| First Seen | 2026-09-03 19:04:23 UTC |
| Last Seen | 2026-09-21 12:05:20 UTC |
| Profile Built | 2026-09-21 12:15:59 UTC |
| Data Freshness | Live |
| Signal Types | 25 |
| Total Observations | 43 |
Full dossier details are available via our API.