Looks like their AppDynamics RUM js config is leaking their internal hostnames in the page source too.