ghco.onelogin.com Open in urlscan Pro
18.216.23.72 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://www.myworkday.com/ghc/email-universal/inst/779$9709185/rel-task/2997$4086.htmld
Effective URL:
https://ghco.onelogin.com/login2/?return=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJhcHBfaWQiOiI0NTUyMDMiLCJ1cmkiOiJodHRwczov...
Submission: On June 10 via manual (June 10th 2021, 3:05:42 pm UTC) from US

Summary HTTP 15 Redirects Links 3 Behaviour Indicators

Summary

This website contacted 7 IPs in 2 countries across 4 domains to perform 15 HTTP transactions. The main IP is 18.216.23.72, located in Columbus, United States and belongs to AMAZON-02, US. The main domain is ghco.onelogin.com.
TLS certificate: Issued by DigiCert TLS RSA SHA256 2020 CA1 on March 24th 2021. Valid for: a year.

This is the only time ghco.onelogin.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
2 3	209.177.165.18 209.177.165.18	18465 (WORKDAY-01) (WORKDAY-01)
1 1	18.216.23.71 18.216.23.71	16509 (AMAZON-02) (AMAZON-02)
2 7	18.216.23.72 18.216.23.72	16509 (AMAZON-02) (AMAZON-02)
3	52.222.174.64 52.222.174.64	16509 (AMAZON-02) (AMAZON-02)
1	2a00:1450:400... 2a00:1450:4001:82b::2004	15169 (GOOGLE) (GOOGLE)
4	2600:9000:218... 2600:9000:218c:2600:18:b15c:ee80:93a1	16509 (AMAZON-02) (AMAZON-02)
1	2a00:1450:400... 2a00:1450:4001:82a::2003	15169 (GOOGLE) (GOOGLE)
15	7

3 209.177.165.18 (United States) 2 redirects

ASN18465 (WORKDAY-01, US)

www.myworkday.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.216.23.71 (Columbus, United States) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-18-216-23-71.us-east-2.compute.amazonaws.com

app.onelogin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 18.216.23.72 (Columbus, United States) 2 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-18-216-23-72.us-east-2.compute.amazonaws.com

ghco.onelogin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 52.222.174.64 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-52-222-174-64.cdg50.r.cloudfront.net

cdn.onelogin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:82b::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2600:9000:218c:2600:18:b15c:ee80:93a1 (United States)

ASN16509 (AMAZON-02, US)

web-login-v2-cdn.onelogin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:82a::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
15	onelogin.com 3 redirects app.onelogin.com ghco.onelogin.com cdn.onelogin.com web-login-v2-cdn.onelogin.com	1 MB
3	myworkday.com 2 redirects www.myworkday.com	3 KB
1	gstatic.com www.gstatic.com	134 KB
1	google.com www.google.com	652 B
15	4

	Domain	Requested by
7	ghco.onelogin.com	2 redirects www.myworkday.com cdn.onelogin.com web-login-v2-cdn.onelogin.com
4	web-login-v2-cdn.onelogin.com	ghco.onelogin.com
3	cdn.onelogin.com	ghco.onelogin.com
3	www.myworkday.com	2 redirects
1	www.gstatic.com	www.google.com
1	www.google.com	ghco.onelogin.com
1	app.onelogin.com	1 redirects
15	7

This site contains links to these domains. Also see Links.

Domain
www.onelogin.com

Subject Issuer	Validity	Valid
*.myworkday.com GeoTrust TLS RSA CA G1	`2019-10-28` - `2021-10-27`	2 years	crt.sh
*.onelogin.com DigiCert TLS RSA SHA256 2020 CA1	`2021-03-24` - `2022-04-24`	a year	crt.sh
cdn.onelogin.com Amazon	`2021-05-02` - `2022-05-31`	a year	crt.sh
www.google.com GTS CA 1C3	`2021-05-10` - `2021-08-02`	3 months	crt.sh
*.google.com GTS CA 1O1	`2021-05-10` - `2021-08-02`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://ghco.onelogin.com/login2/?return=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJhcHBfaWQiOiI0NTUyMDMiLCJ1cmkiOiJodHRwczovL2doY28ub25lbG9naW4uY29tL3RydXN0L3NhbWwyL2h0dHAtcG9zdC9zc28vNDU1MjAzP3NhbWxfcmVxdWVzdF9wYXJhbXNfdG9rZW49Zjk3ZmI2ODA0Mi5jZmRlOWY5MWI2ZmRkODk3M2NmYjAxNGIwNmEwMWVlMWY4MzEwNDgzLjVPTGFRclJsXzI1RHhERG5KT3FmMmcyOHQ2cVdyY2tNSVJqTTJ4emhhTHclM0QiLCJhdWQiOiJBQ0NFU1MiLCJpc3MiOiJNT05PUkFJTCIsIm5vdGlmaWNhdGlvbiI6eyJtZXNzYWdlIjoiQ29ubmVjdGluZyB0byBBcHBsaWNhdGlvbiIsInZhbHVlcyI6WyJBcHBsaWNhdGlvbiJdLCJpY29uIjoiY29ubmVjdGlvbiIsInRlbXBsYXRlX2lkIjoiY29ubmVjdGluZ190b19hcHAiLCJ0eXBlIjoiaW5mbyJ9LCJleHAiOjE2MjMzMzc3MDQsInBhcmFtcyI6e30sIm1ldGhvZCI6ImdldCJ9.CC5iqMENB-ytB6Oj00LRBCuzBjlthc5joC4tEpRIyGg
Frame ID: C0BF6816D66C3B9F3F943422138C2180
Requests: 16 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://www.myworkday.com/ghc/email-universal/inst/779$9709185/rel-task/2997$4086.htmld HTTP 302
https://www.myworkday.com/ghc/d/inst/779$9709185/rel-task/2997$4086.htmld Page URL
https://www.myworkday.com/wday/authgwy/ghc/login.htmld?returnTo=%2fghc%2fd%2finst%2f779%249709185%2fre... HTTP 302
https://app.onelogin.com/trust/saml2/http-post/sso/455203 HTTP 307
https://ghco.onelogin.com/trust/saml2/http-post/sso/455203 HTTP 302
https://ghco.onelogin.com/login HTTP 302
https://ghco.onelogin.com/login2/?return=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJhcHBfaWQiOiI0NTUyMDMi... Page URL

Detected technologies

reCAPTCHA (Captchas) Expand

Overall confidence: 100%
Detected patterns

script /\/recaptcha\/api\.js/i

Page Statistics

15
Requests

100 %
HTTPS

43 %
IPv6

4
Domains

7
Subdomains

7
IPs

2
Countries

1537 kB
Transfer

3725 kB
Size

5
Cookies

3 Outgoing links

These are links going to different origins than the main page.

URL: https://www.onelogin.com/
Title: Powered by OneLogin

Search URL Search Domain Scan URL

URL: https://www.onelogin.com/terms
Title: Terms

Search URL Search Domain Scan URL

URL: https://www.onelogin.com/privacy
Title: Privacy Policy

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://www.myworkday.com/ghc/email-universal/inst/779$9709185/rel-task/2997$4086.htmld HTTP 302
https://www.myworkday.com/ghc/d/inst/779$9709185/rel-task/2997$4086.htmld Page URL
https://www.myworkday.com/wday/authgwy/ghc/login.htmld?returnTo=%2fghc%2fd%2finst%2f779%249709185%2frel-task%2f2997%244086.htmld HTTP 302
https://app.onelogin.com/trust/saml2/http-post/sso/455203 HTTP 307
https://ghco.onelogin.com/trust/saml2/http-post/sso/455203 HTTP 302
https://ghco.onelogin.com/login HTTP 302
https://ghco.onelogin.com/login2/?return=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJhcHBfaWQiOiI0NTUyMDMiLCJ1cmkiOiJodHRwczovL2doY28ub25lbG9naW4uY29tL3RydXN0L3NhbWwyL2h0dHAtcG9zdC9zc28vNDU1MjAzP3NhbWxfcmVxdWVzdF9wYXJhbXNfdG9rZW49Zjk3ZmI2ODA0Mi5jZmRlOWY5MWI2ZmRkODk3M2NmYjAxNGIwNmEwMWVlMWY4MzEwNDgzLjVPTGFRclJsXzI1RHhERG5KT3FmMmcyOHQ2cVdyY2tNSVJqTTJ4emhhTHclM0QiLCJhdWQiOiJBQ0NFU1MiLCJpc3MiOiJNT05PUkFJTCIsIm5vdGlmaWNhdGlvbiI6eyJtZXNzYWdlIjoiQ29ubmVjdGluZyB0byBBcHBsaWNhdGlvbiIsInZhbHVlcyI6WyJBcHBsaWNhdGlvbiJdLCJpY29uIjoiY29ubmVjdGlvbiIsInRlbXBsYXRlX2lkIjoiY29ubmVjdGluZ190b19hcHAiLCJ0eXBlIjoiaW5mbyJ9LCJleHAiOjE2MjMzMzc3MDQsInBhcmFtcyI6e30sIm1ldGhvZCI6ImdldCJ9.CC5iqMENB-ytB6Oj00LRBCuzBjlthc5joC4tEpRIyGg Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

https://www.myworkday.com/ghc/email-universal/inst/779$9709185/rel-task/2997$4086.htmld HTTP 302
https://www.myworkday.com/ghc/d/inst/779$9709185/rel-task/2997$4086.htmld

15 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200

Cookie set 2997$4086.htmld Show response
www.myworkday.com/ghc/d/inst/779$9709185/rel-task/
Redirect Chain

https://www.myworkday.com/ghc/email-universal/inst/779$9709185/rel-task/2997$4086.htmld
https://www.myworkday.com/ghc/d/inst/779$9709185/rel-task/2997$4086.htmld

441 B
1 KB

108ms
108ms

Document
text/html

209.177.165.18
WORKDAY-01

General

Check archive.org

Show headers Download Go to

Full URL

https://www.myworkday.com/ghc/d/inst/779$9709185/rel-task/2997$4086.htmld

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

209.177.165.18 , United States, ASN18465 (WORKDAY-01, US),

Reverse DNS

Software

Workday User Interface Service /

Resource Hash

32261100d421decac09a5b4e1c13dc97d43b42f1f6328b2d4c5211add3601ff4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Host: www.myworkday.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: none
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Cookie: wd-browser-id=f6030a2b-dcc5-411d-9a56-6e4f3f90cdee; wd-alt-sessionid=3d150b274782313761834733a0857bbda78032ef23959da8563926f6a6c9c77e.ui-server2-prod-alevv0cr.prod-ui.pr102.cust.ash.wduic; WorkdayLB_UI=4027551754.47670.0000
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Set-Cookie: JSESSIONID=DE0938419B5B07FE7E9A528B6B9E8746.ui-server2-prod-alevv0cr.prod-ui.pr102.cust.ash.wduic; Path=/; HttpOnly; SameSite=None WorkdayLB_UI=4027551754.47670.0000; path=/; Httponly; Secure; SameSite=none
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Cache-Control: no-store, no-cache
Pragma: no-cache
Content-Type: text/html;charset=UTF-8
Content-Language: en
Content-Length: 441
Date: Thu, 10 Jun 2021 15:05:19 GMT
Keep-Alive: timeout=60
Connection: keep-alive
Server: Workday User Interface Service
Strict-Transport-Security: max-age=31536000; includeSubDomains

Redirect headers

Set-Cookie: wd-browser-id=f6030a2b-dcc5-411d-9a56-6e4f3f90cdee; Path=/; Secure; HttpOnly; SameSite=None JSESSIONID=8F5F52F8ED8494DFCCD76ECD0C74565A.ui-server2-prod-alevv0cr.prod-ui.pr102.cust.ash.wduic; Path=/; HttpOnly; SameSite=None wd-alt-sessionid=3d150b274782313761834733a0857bbda78032ef23959da8563926f6a6c9c77e.ui-server2-prod-alevv0cr.prod-ui.pr102.cust.ash.wduic; Path=/; Secure; HttpOnly; SameSite=None WorkdayLB_UI=4027551754.47670.0000; path=/; Httponly; Secure; SameSite=none
Referer: /ghc/email-universal/inst/779$9709185/rel-task/2997$4086.htmld
X-FRAME-OPTIONS: SAMEORIGIN
X-XSS-Protection: 1; mode=block
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Cache-Control: no-store, no-cache
Pragma: no-cache
Location: https://www.myworkday.com/ghc/d/inst/779$9709185/rel-task/2997$4086.htmld
Content-Language: en
Content-Length: 0
Date: Thu, 10 Jun 2021 15:05:19 GMT
Keep-Alive: timeout=60
Connection: keep-alive
Server: Workday User Interface Service
Strict-Transport-Security: max-age=31536000; includeSubDomains

GET
H/1.1

200
OK

Primary Request / Show response
ghco.onelogin.com/login2/
Redirect Chain

https://www.myworkday.com/wday/authgwy/ghc/login.htmld?returnTo=%2fghc%2fd%2finst%2f779%249709185%2frel-task%2f2997%244086.htmld
https://app.onelogin.com/trust/saml2/http-post/sso/455203
https://ghco.onelogin.com/trust/saml2/http-post/sso/455203
https://ghco.onelogin.com/login
https://ghco.onelogin.com/login2/?return=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJhcHBfaWQiOiI0NTUyMDMiLCJ1cmkiOiJodHRwczovL2doY28ub25lbG9naW4uY29tL3RydXN0L3NhbWwyL2h0dHAtcG9zdC9zc28vNDU1MjAzP3NhbWx...

2 KB
2 KB

120ms
120ms

Document
text/html

18.216.23.72
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://ghco.onelogin.com/login2/?return=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJhcHBfaWQiOiI0NTUyMDMiLCJ1cmkiOiJodHRwczovL2doY28ub25lbG9naW4uY29tL3RydXN0L3NhbWwyL2h0dHAtcG9zdC9zc28vNDU1MjAzP3NhbWxfcmVxdWVzdF9wYXJhbXNfdG9rZW49Zjk3ZmI2ODA0Mi5jZmRlOWY5MWI2ZmRkODk3M2NmYjAxNGIwNmEwMWVlMWY4MzEwNDgzLjVPTGFRclJsXzI1RHhERG5KT3FmMmcyOHQ2cVdyY2tNSVJqTTJ4emhhTHclM0QiLCJhdWQiOiJBQ0NFU1MiLCJpc3MiOiJNT05PUkFJTCIsIm5vdGlmaWNhdGlvbiI6eyJtZXNzYWdlIjoiQ29ubmVjdGluZyB0byBBcHBsaWNhdGlvbiIsInZhbHVlcyI6WyJBcHBsaWNhdGlvbiJdLCJpY29uIjoiY29ubmVjdGlvbiIsInRlbXBsYXRlX2lkIjoiY29ubmVjdGluZ190b19hcHAiLCJ0eXBlIjoiaW5mbyJ9LCJleHAiOjE2MjMzMzc3MDQsInBhcmFtcyI6e30sIm1ldGhvZCI6ImdldCJ9.CC5iqMENB-ytB6Oj00LRBCuzBjlthc5joC4tEpRIyGg

Requested by

Host: www.myworkday.com
URL: https://www.myworkday.com/ghc/d/inst/779$9709185/rel-task/2997$4086.htmld

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

18.216.23.72 Columbus, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-18-216-23-72.us-east-2.compute.amazonaws.com

Software

AmazonS3 /

Resource Hash

7734e13640b53ef1c61a0b64c0034c5f98d230a5364305293119c482b8b2b56c

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains;
X-Content-Type-Options	nosniff

Request headers

Host: ghco.onelogin.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: document
Referer: https://www.myworkday.com/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Cookie: ol_custom_domain=%7B%22tenant%22%3A%22ghco%22%2C%22custom_domain%22%3A%22%22%7D; sub_session_onelogin.com=BAh7CCIfYnJvd3Nlcl92ZXJpZmljYXRpb25fdG9rZW4iRWYwOGJiZDMwZmQ3MzkyOTM2NGE3Yzc2ZTI0M2QxZDZlZjJjYTc0OTM1ZWM1NTRjN2ZiMjcwZGQyODM3N2NiYWY6D3Nlc3Npb25faWQiKWJjNzE5ODA4LWU0YzAtNGQyYS1hYTEwLTgyZmFlMmRmYjRkNjoOcmV0dXJuX3RvIgG3aHR0cHM6Ly9naGNvLm9uZWxvZ2luLmNvbS90cnVzdC9zYW1sMi9odHRwLXBvc3Qvc3NvLzQ1NTIwMz9zYW1sX3JlcXVlc3RfcGFyYW1zX3Rva2VuPWY5N2ZiNjgwNDIuY2ZkZTlmOTFiNmZkZDg5NzNjZmIwMTRiMDZhMDFlZTFmODMxMDQ4My41T0xhUXJSbF8yNUR4RERuSk9xZjJnMjh0NnFXcmNrTUlSak0yeHpoYUx3JTNE--b8edf74f8f7f369ea7927493283ff66c87402b19
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://www.myworkday.com/ghc/d/inst/779$9709185/rel-task/2997$4086.htmld

Response headers

cache-control: max-age=0
content-encoding: gzip
content-length: 870
content-type: text/html; charset=utf-8
date: Thu, 10 Jun 2021 15:05:10 GMT
etag: "65de9ffc3d6bc627c0e8fa4278023903"
last-modified: Wed, 09 Jun 2021 23:37:42 GMT
server: AmazonS3
x-amz-id-2: BiRGJjUdHL+L5hvMMUk1HeblxvTaASCGeXNpBzuyTEcu7fnvu9S0cFM+gTt7VHIyoT8F/dt56ik=
x-amz-request-id: VABVWDXD0WM6XKP5
x-amz-version-id: Ncqw_RQfWVZ6aXpGg8WmaVfTndsENjLT
set-cookie: ol_web_login_canary_0=false; path=/; httponly; secure; domain=.onelogin.com ol_web_login_proxy_5=true; path=/; domain=.onelogin.com; HttpOnly; Secure
x-ol-canary: main
strict-transport-security: max-age=63072000; includeSubDomains;
x-content-type-options: nosniff

Redirect headers

cache-control: no-cache no-store max-age=0 must-revalidate private s-maxage=0
content-security-policy: frame-ancestors 'none';
content-type: text/html; charset=utf-8
date: Thu, 10 Jun 2021 15:05:24 GMT
expires: 0
location: https://ghco.onelogin.com/login2/?return=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJhcHBfaWQiOiI0NTUyMDMiLCJ1cmkiOiJodHRwczovL2doY28ub25lbG9naW4uY29tL3RydXN0L3NhbWwyL2h0dHAtcG9zdC9zc28vNDU1MjAzP3NhbWxfcmVxdWVzdF9wYXJhbXNfdG9rZW49Zjk3ZmI2ODA0Mi5jZmRlOWY5MWI2ZmRkODk3M2NmYjAxNGIwNmEwMWVlMWY4MzEwNDgzLjVPTGFRclJsXzI1RHhERG5KT3FmMmcyOHQ2cVdyY2tNSVJqTTJ4emhhTHclM0QiLCJhdWQiOiJBQ0NFU1MiLCJpc3MiOiJNT05PUkFJTCIsIm5vdGlmaWNhdGlvbiI6eyJtZXNzYWdlIjoiQ29ubmVjdGluZyB0byBBcHBsaWNhdGlvbiIsInZhbHVlcyI6WyJBcHBsaWNhdGlvbiJdLCJpY29uIjoiY29ubmVjdGlvbiIsInRlbXBsYXRlX2lkIjoiY29ubmVjdGluZ190b19hcHAiLCJ0eXBlIjoiaW5mbyJ9LCJleHAiOjE2MjMzMzc3MDQsInBhcmFtcyI6e30sIm1ldGhvZCI6ImdldCJ9.CC5iqMENB-ytB6Oj00LRBCuzBjlthc5joC4tEpRIyGg#app=455203
p3p: CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE"
pragma: no-cache
set-cookie: ol_custom_domain=%7B%22tenant%22%3A%22ghco%22%2C%22custom_domain%22%3A%22%22%7D; domain=.onelogin.com; path=/; secure; SameSite=None sub_session_onelogin.com=BAh7CCIfYnJvd3Nlcl92ZXJpZmljYXRpb25fdG9rZW4iRWYwOGJiZDMwZmQ3MzkyOTM2NGE3Yzc2ZTI0M2QxZDZlZjJjYTc0OTM1ZWM1NTRjN2ZiMjcwZGQyODM3N2NiYWY6D3Nlc3Npb25faWQiKWJjNzE5ODA4LWU0YzAtNGQyYS1hYTEwLTgyZmFlMmRmYjRkNjoOcmV0dXJuX3RvIgG3aHR0cHM6Ly9naGNvLm9uZWxvZ2luLmNvbS90cnVzdC9zYW1sMi9odHRwLXBvc3Qvc3NvLzQ1NTIwMz9zYW1sX3JlcXVlc3RfcGFyYW1zX3Rva2VuPWY5N2ZiNjgwNDIuY2ZkZTlmOTFiNmZkZDg5NzNjZmIwMTRiMDZhMDFlZTFmODMxMDQ4My41T0xhUXJSbF8yNUR4RERuSk9xZjJnMjh0NnFXcmNrTUlSak0yeHpoYUx3JTNE--b8edf74f8f7f369ea7927493283ff66c87402b19; path=/; secure; HttpOnly; SameSite=None
status: 302 Found
x-frame-options: DENY
x-request-id: 60C22A34-59F940AB-7262-0A0901DC-01BB-D4FE-3A63
x-xss-protection: 1; mode=block
content-length: 779
strict-transport-security: max-age=63072000; includeSubDomains;
x-content-type-options: nosniff

GET
H/1.1 200
OK onelogin-vigilance.min.js Show response
cdn.onelogin.com/ 361 KB
362 KB 74ms
20ms Script
application/javascript 52.222.174.64
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.onelogin.com/onelogin-vigilance.min.js
Requested by: Host: ghco.onelogin.com
URL: https://ghco.onelogin.com/login2/?return=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJhcHBfaWQiOiI0NTUyMDMiLCJ1cmkiOiJodHRwczovL2doY28ub25lbG9naW4uY29tL3RydXN0L3NhbWwyL2h0dHAtcG9zdC9zc28vNDU1MjAzP3NhbWxfcmVxdWVzdF9wYXJhbXNfdG9rZW49Zjk3ZmI2ODA0Mi5jZmRlOWY5MWI2ZmRkODk3M2NmYjAxNGIwNmEwMWVlMWY4MzEwNDgzLjVPTGFRclJsXzI1RHhERG5KT3FmMmcyOHQ2cVdyY2tNSVJqTTJ4emhhTHclM0QiLCJhdWQiOiJBQ0NFU1MiLCJpc3MiOiJNT05PUkFJTCIsIm5vdGlmaWNhdGlvbiI6eyJtZXNzYWdlIjoiQ29ubmVjdGluZyB0byBBcHBsaWNhdGlvbiIsInZhbHVlcyI6WyJBcHBsaWNhdGlvbiJdLCJpY29uIjoiY29ubmVjdGlvbiIsInRlbXBsYXRlX2lkIjoiY29ubmVjdGluZ190b19hcHAiLCJ0eXBlIjoiaW5mbyJ9LCJleHAiOjE2MjMzMzc3MDQsInBhcmFtcyI6e30sIm1ldGhvZCI6ImdldCJ9.CC5iqMENB-ytB6Oj00LRBCuzBjlthc5joC4tEpRIyGg
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 52.222.174.64 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-222-174-64.cdg50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: e2e33adc4b4b1fd09f4385641a21d78dfca6b96629827f0e6a30829587815cde

Request headers

Referer: https://ghco.onelogin.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-amz-version-id: VTZTgPWVzkOd0o_ztJD57dK6Q_UenlY0
Via: 1.1 24e6529ea30fbe719bde2164c1fe9238.cloudfront.net (CloudFront)
Last-Modified: Thu, 16 Jan 2020 01:01:13 GMT
Server: AmazonS3
Age: 5659
ETag: "8533b895a83abc4cc8bf2fb0898c4ace"
X-Cache: Hit from cloudfront
Content-Type: application/javascript
Connection: keep-alive
Date: Thu, 10 Jun 2021 13:32:07 GMT
x-amz-replication-status: COMPLETED
X-Amz-Cf-Pop: CDG50-P2
Accept-Ranges: bytes
Content-Length: 370103
X-Amz-Cf-Id: kMF1p0l7pInDDWZFAmINNefRgxmAHV1wb8kgrr4MaCjm-lDsS4T1-A==

GET
H2 200 api.js Show response
www.google.com/recaptcha/ 850 B
652 B 29ms
27ms Script
text/javascript 2a00:1450:4001:82b::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api.js

Requested by

Host: ghco.onelogin.com
URL: https://ghco.onelogin.com/login2/?return=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJhcHBfaWQiOiI0NTUyMDMiLCJ1cmkiOiJodHRwczovL2doY28ub25lbG9naW4uY29tL3RydXN0L3NhbWwyL2h0dHAtcG9zdC9zc28vNDU1MjAzP3NhbWxfcmVxdWVzdF9wYXJhbXNfdG9rZW49Zjk3ZmI2ODA0Mi5jZmRlOWY5MWI2ZmRkODk3M2NmYjAxNGIwNmEwMWVlMWY4MzEwNDgzLjVPTGFRclJsXzI1RHhERG5KT3FmMmcyOHQ2cVdyY2tNSVJqTTJ4emhhTHclM0QiLCJhdWQiOiJBQ0NFU1MiLCJpc3MiOiJNT05PUkFJTCIsIm5vdGlmaWNhdGlvbiI6eyJtZXNzYWdlIjoiQ29ubmVjdGluZyB0byBBcHBsaWNhdGlvbiIsInZhbHVlcyI6WyJBcHBsaWNhdGlvbiJdLCJpY29uIjoiY29ubmVjdGlvbiIsInRlbXBsYXRlX2lkIjoiY29ubmVjdGluZ190b19hcHAiLCJ0eXBlIjoiaW5mbyJ9LCJleHAiOjE2MjMzMzc3MDQsInBhcmFtcyI6e30sIm1ldGhvZCI6ImdldCJ9.CC5iqMENB-ytB6Oj00LRBCuzBjlthc5joC4tEpRIyGg

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

5e0dd79e80c5c235810a628cceb4be0610acc96a33cf676abb09aa266719728e

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://ghco.onelogin.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 10 Jun 2021 15:05:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: GSE
x-frame-options: SAMEORIGIN
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=300
cross-origin-resource-policy: cross-origin
content-security-policy: frame-ancestors 'self'
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 554
x-xss-protection: 1; mode=block
expires: Thu, 10 Jun 2021 15:05:24 GMT

GET
H2 200 vendor27df3343166a5d9d6614772b538b8ae42b1418ff.js Show response
web-login-v2-cdn.onelogin.com/login2/ 177 KB
56 KB 84ms
27ms Script
application/javascript 2600:9000:218c:2600:18:b15c:ee80:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://web-login-v2-cdn.onelogin.com/login2/vendor27df3343166a5d9d6614772b538b8ae42b1418ff.js
Requested by: Host: ghco.onelogin.com
URL: https://ghco.onelogin.com/login2/?return=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJhcHBfaWQiOiI0NTUyMDMiLCJ1cmkiOiJodHRwczovL2doY28ub25lbG9naW4uY29tL3RydXN0L3NhbWwyL2h0dHAtcG9zdC9zc28vNDU1MjAzP3NhbWxfcmVxdWVzdF9wYXJhbXNfdG9rZW49Zjk3ZmI2ODA0Mi5jZmRlOWY5MWI2ZmRkODk3M2NmYjAxNGIwNmEwMWVlMWY4MzEwNDgzLjVPTGFRclJsXzI1RHhERG5KT3FmMmcyOHQ2cVdyY2tNSVJqTTJ4emhhTHclM0QiLCJhdWQiOiJBQ0NFU1MiLCJpc3MiOiJNT05PUkFJTCIsIm5vdGlmaWNhdGlvbiI6eyJtZXNzYWdlIjoiQ29ubmVjdGluZyB0byBBcHBsaWNhdGlvbiIsInZhbHVlcyI6WyJBcHBsaWNhdGlvbiJdLCJpY29uIjoiY29ubmVjdGlvbiIsInRlbXBsYXRlX2lkIjoiY29ubmVjdGluZ190b19hcHAiLCJ0eXBlIjoiaW5mbyJ9LCJleHAiOjE2MjMzMzc3MDQsInBhcmFtcyI6e30sIm1ldGhvZCI6ImdldCJ9.CC5iqMENB-ytB6Oj00LRBCuzBjlthc5joC4tEpRIyGg
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:218c:2600:18:b15c:ee80:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 8dc70bbcf67cc401d0539ae83128038b88de18e97b711e91a2102d08a80cb29e

Request headers

Referer: https://ghco.onelogin.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 09 Jun 2021 23:37:45 GMT
content-encoding: gzip
last-modified: Wed, 09 Jun 2021 23:37:42 GMT
server: AmazonS3
age: 55660
etag: "a83a20827da3ec02862c8a6ff426e6df"
x-cache: Hit from cloudfront
x-amz-version-id: bt53XdgO.pLCTphRbSXQKnkteV.HW_6d
via: 1.1 16de6e3636993b2d3f832b9ae653bd69.cloudfront.net (CloudFront)
cache-control: max-age=2592000
x-amz-cf-pop: CDG50-P1
accept-ranges: bytes
content-type: application/javascript
content-length: 56469
x-amz-cf-id: fpGTLTpphFm3BCCaE2ra7E045D-q2hmoUSzaX_ZQmfLXqxQ8IrY1UA==

GET
H2 200 intl27df3343166a5d9d6614772b538b8ae42b1418ff.js Show response
web-login-v2-cdn.onelogin.com/login2/ 44 KB
13 KB 110ms
53ms Script
application/javascript 2600:9000:218c:2600:18:b15c:ee80:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://web-login-v2-cdn.onelogin.com/login2/intl27df3343166a5d9d6614772b538b8ae42b1418ff.js
Requested by: Host: ghco.onelogin.com
URL: https://ghco.onelogin.com/login2/?return=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJhcHBfaWQiOiI0NTUyMDMiLCJ1cmkiOiJodHRwczovL2doY28ub25lbG9naW4uY29tL3RydXN0L3NhbWwyL2h0dHAtcG9zdC9zc28vNDU1MjAzP3NhbWxfcmVxdWVzdF9wYXJhbXNfdG9rZW49Zjk3ZmI2ODA0Mi5jZmRlOWY5MWI2ZmRkODk3M2NmYjAxNGIwNmEwMWVlMWY4MzEwNDgzLjVPTGFRclJsXzI1RHhERG5KT3FmMmcyOHQ2cVdyY2tNSVJqTTJ4emhhTHclM0QiLCJhdWQiOiJBQ0NFU1MiLCJpc3MiOiJNT05PUkFJTCIsIm5vdGlmaWNhdGlvbiI6eyJtZXNzYWdlIjoiQ29ubmVjdGluZyB0byBBcHBsaWNhdGlvbiIsInZhbHVlcyI6WyJBcHBsaWNhdGlvbiJdLCJpY29uIjoiY29ubmVjdGlvbiIsInRlbXBsYXRlX2lkIjoiY29ubmVjdGluZ190b19hcHAiLCJ0eXBlIjoiaW5mbyJ9LCJleHAiOjE2MjMzMzc3MDQsInBhcmFtcyI6e30sIm1ldGhvZCI6ImdldCJ9.CC5iqMENB-ytB6Oj00LRBCuzBjlthc5joC4tEpRIyGg
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:218c:2600:18:b15c:ee80:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 0d5a3b4bd0f39665707f130e9ba1179fab5c35a47fd6230e1be02a64139cf0c0

Request headers

Referer: https://ghco.onelogin.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 09 Jun 2021 23:37:45 GMT
content-encoding: gzip
last-modified: Wed, 09 Jun 2021 23:37:41 GMT
server: AmazonS3
age: 55660
etag: "aef15e259aa4afc20f7db63a1e445dee"
x-cache: Hit from cloudfront
x-amz-version-id: 7JUpE1jjO.NEspVGDJvPnwRjMMccvD8x
via: 1.1 16de6e3636993b2d3f832b9ae653bd69.cloudfront.net (CloudFront)
cache-control: max-age=2592000
x-amz-cf-pop: CDG50-P1
accept-ranges: bytes
content-type: application/javascript
content-length: 12463
x-amz-cf-id: vGHdxqqMBvSVAKiQN5r_vG81dqe54g5YIqKso6IFEYDtv8a7YbaJxQ==

GET
H2 200 app27df3343166a5d9d6614772b538b8ae42b1418ff.js Show response
web-login-v2-cdn.onelogin.com/login2/ 2 MB
567 KB 109ms
53ms Script
application/javascript 2600:9000:218c:2600:18:b15c:ee80:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://web-login-v2-cdn.onelogin.com/login2/app27df3343166a5d9d6614772b538b8ae42b1418ff.js
Requested by: Host: ghco.onelogin.com
URL: https://ghco.onelogin.com/login2/?return=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJhcHBfaWQiOiI0NTUyMDMiLCJ1cmkiOiJodHRwczovL2doY28ub25lbG9naW4uY29tL3RydXN0L3NhbWwyL2h0dHAtcG9zdC9zc28vNDU1MjAzP3NhbWxfcmVxdWVzdF9wYXJhbXNfdG9rZW49Zjk3ZmI2ODA0Mi5jZmRlOWY5MWI2ZmRkODk3M2NmYjAxNGIwNmEwMWVlMWY4MzEwNDgzLjVPTGFRclJsXzI1RHhERG5KT3FmMmcyOHQ2cVdyY2tNSVJqTTJ4emhhTHclM0QiLCJhdWQiOiJBQ0NFU1MiLCJpc3MiOiJNT05PUkFJTCIsIm5vdGlmaWNhdGlvbiI6eyJtZXNzYWdlIjoiQ29ubmVjdGluZyB0byBBcHBsaWNhdGlvbiIsInZhbHVlcyI6WyJBcHBsaWNhdGlvbiJdLCJpY29uIjoiY29ubmVjdGlvbiIsInRlbXBsYXRlX2lkIjoiY29ubmVjdGluZ190b19hcHAiLCJ0eXBlIjoiaW5mbyJ9LCJleHAiOjE2MjMzMzc3MDQsInBhcmFtcyI6e30sIm1ldGhvZCI6ImdldCJ9.CC5iqMENB-ytB6Oj00LRBCuzBjlthc5joC4tEpRIyGg
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:218c:2600:18:b15c:ee80:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 736fcfe7d0e966898c19ca764efd911a977c545c630719c85fd42a78eaa8c4c1

Request headers

Referer: https://ghco.onelogin.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 09 Jun 2021 23:37:46 GMT
content-encoding: gzip
last-modified: Wed, 09 Jun 2021 23:37:41 GMT
server: AmazonS3
age: 55659
etag: "8099cb56bbaea2572ed2b4fdaf7c652c"
x-cache: Hit from cloudfront
x-amz-version-id: X.7skWSa09NmK8xmy0DoHOmzhZVCnfxD
via: 1.1 16de6e3636993b2d3f832b9ae653bd69.cloudfront.net (CloudFront)
cache-control: max-age=2592000
x-amz-cf-pop: CDG50-P1
accept-ranges: bytes
content-type: application/javascript
content-length: 579647
x-amz-cf-id: kNsaLBmF1jMUofjJLR-d9ZVCAfVhLTK0mi3Z89B7wR7_4p5FBPjl_g==

GET
H2 200 recaptcha__en.js Show response
www.gstatic.com/recaptcha/releases/CdDdhZfPbLLrfYLBdThNS0-Y/ 341 KB
134 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:82a::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/CdDdhZfPbLLrfYLBdThNS0-Y/recaptcha__en.js

Requested by

Host: www.google.com
URL: https://www.google.com/recaptcha/api.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

734160057d9682a89035825f63793cd0f945523efa3f8d33b8bef89bd7bdef5e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://ghco.onelogin.com
Referer: https://ghco.onelogin.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 10 Jun 2021 13:10:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 6910
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 136836
x-xss-protection: 0
last-modified: Fri, 04 Jun 2021 04:42:35 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Fri, 10 Jun 2022 13:10:14 GMT

POST
H/1.1 200
OK nonce Show response
ghco.onelogin.com/access/ 128 B
742 B 282ms
281ms XHR
application/json 18.216.23.72
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://ghco.onelogin.com/access/nonce

Requested by

Host: cdn.onelogin.com
URL: https://cdn.onelogin.com/onelogin-vigilance.min.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

18.216.23.72 Columbus, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-18-216-23-72.us-east-2.compute.amazonaws.com

Software

Resource Hash

44bfd9c985e6c227abfbe5594a17d52edb03b4f6e645714927c1d4cb62d9aff2

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: cors
Origin: https://ghco.onelogin.com
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Sec-Fetch-Dest: empty
Cookie: ol_custom_domain=%7B%22tenant%22%3A%22ghco%22%2C%22custom_domain%22%3A%22%22%7D; sub_session_onelogin.com=BAh7CCIfYnJvd3Nlcl92ZXJpZmljYXRpb25fdG9rZW4iRWYwOGJiZDMwZmQ3MzkyOTM2NGE3Yzc2ZTI0M2QxZDZlZjJjYTc0OTM1ZWM1NTRjN2ZiMjcwZGQyODM3N2NiYWY6D3Nlc3Npb25faWQiKWJjNzE5ODA4LWU0YzAtNGQyYS1hYTEwLTgyZmFlMmRmYjRkNjoOcmV0dXJuX3RvIgG3aHR0cHM6Ly9naGNvLm9uZWxvZ2luLmNvbS90cnVzdC9zYW1sMi9odHRwLXBvc3Qvc3NvLzQ1NTIwMz9zYW1sX3JlcXVlc3RfcGFyYW1zX3Rva2VuPWY5N2ZiNjgwNDIuY2ZkZTlmOTFiNmZkZDg5NzNjZmIwMTRiMDZhMDFlZTFmODMxMDQ4My41T0xhUXJSbF8yNUR4RERuSk9xZjJnMjh0NnFXcmNrTUlSak0yeHpoYUx3JTNE--b8edf74f8f7f369ea7927493283ff66c87402b19; ol_web_login_canary_0=false; ol_web_login_proxy_5=true
Connection: keep-alive
Content-Length: 53
Pragma: no-cache
Host: ghco.onelogin.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: application/json;charset=UTF-8
Accept: application/json, text/plain, */*
Cache-Control: no-cache
Referer: https://ghco.onelogin.com/login2/?return=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJhcHBfaWQiOiI0NTUyMDMiLCJ1cmkiOiJodHRwczovL2doY28ub25lbG9naW4uY29tL3RydXN0L3NhbWwyL2h0dHAtcG9zdC9zc28vNDU1MjAzP3NhbWxfcmVxdWVzdF9wYXJhbXNfdG9rZW49Zjk3ZmI2ODA0Mi5jZmRlOWY5MWI2ZmRkODk3M2NmYjAxNGIwNmEwMWVlMWY4MzEwNDgzLjVPTGFRclJsXzI1RHhERG5KT3FmMmcyOHQ2cVdyY2tNSVJqTTJ4emhhTHclM0QiLCJhdWQiOiJBQ0NFU1MiLCJpc3MiOiJNT05PUkFJTCIsIm5vdGlmaWNhdGlvbiI6eyJtZXNzYWdlIjoiQ29ubmVjdGluZyB0byBBcHBsaWNhdGlvbiIsInZhbHVlcyI6WyJBcHBsaWNhdGlvbiJdLCJpY29uIjoiY29ubmVjdGlvbiIsInRlbXBsYXRlX2lkIjoiY29ubmVjdGluZ190b19hcHAiLCJ0eXBlIjoiaW5mbyJ9LCJleHAiOjE2MjMzMzc3MDQsInBhcmFtcyI6e30sIm1ldGhvZCI6ImdldCJ9.CC5iqMENB-ytB6Oj00LRBCuzBjlthc5joC4tEpRIyGg
Sec-Fetch-Site: same-origin
Accept: application/json, text/plain, */*
Referer: https://ghco.onelogin.com/login2/?return=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJhcHBfaWQiOiI0NTUyMDMiLCJ1cmkiOiJodHRwczovL2doY28ub25lbG9naW4uY29tL3RydXN0L3NhbWwyL2h0dHAtcG9zdC9zc28vNDU1MjAzP3NhbWxfcmVxdWVzdF9wYXJhbXNfdG9rZW49Zjk3ZmI2ODA0Mi5jZmRlOWY5MWI2ZmRkODk3M2NmYjAxNGIwNmEwMWVlMWY4MzEwNDgzLjVPTGFRclJsXzI1RHhERG5KT3FmMmcyOHQ2cVdyY2tNSVJqTTJ4emhhTHclM0QiLCJhdWQiOiJBQ0NFU1MiLCJpc3MiOiJNT05PUkFJTCIsIm5vdGlmaWNhdGlvbiI6eyJtZXNzYWdlIjoiQ29ubmVjdGluZyB0byBBcHBsaWNhdGlvbiIsInZhbHVlcyI6WyJBcHBsaWNhdGlvbiJdLCJpY29uIjoiY29ubmVjdGlvbiIsInRlbXBsYXRlX2lkIjoiY29ubmVjdGluZ190b19hcHAiLCJ0eXBlIjoiaW5mbyJ9LCJleHAiOjE2MjMzMzc3MDQsInBhcmFtcyI6e30sIm1ldGhvZCI6ImdldCJ9.CC5iqMENB-ytB6Oj00LRBCuzBjlthc5joC4tEpRIyGg
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: application/json;charset=UTF-8

Response headers

x-runtime: 0.163479
date: Thu, 10 Jun 2021 15:05:24 GMT
x-correlation-id: e861400e-68a3-4584-b0dc-eef189674e15
x-content-type-options: nosniff
etag: W/"7f4746cee28ff5b83b83b7db3cc4ce14"
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=63072000; includeSubDomains;
content-type: application/json; charset=utf-8
cache-control: max-age=0, private, must-revalidate
set-cookie: ol_access_service_canary_79=false; path=/; domain=.onelogin.com; HttpOnly; Secure
content-length: 128
x-xss-protection: 1; mode=block
x-request-id: 60C22A34-59F940AB-7262-0A0901DC-01BB-D562-3A63

POST
H/1.1 200
OK auth Show response
ghco.onelogin.com/access/ 1 KB
2 KB 336ms
186ms XHR
application/json 18.216.23.72
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://ghco.onelogin.com/access/auth

Requested by

Host: web-login-v2-cdn.onelogin.com
URL: https://web-login-v2-cdn.onelogin.com/login2/app27df3343166a5d9d6614772b538b8ae42b1418ff.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

18.216.23.72 Columbus, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-18-216-23-72.us-east-2.compute.amazonaws.com

Software

Resource Hash

3811a073901c0de50ace8b15f1477bdf5c0aef6157fa8c2b48c1fd451851b1f6

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: cors
Origin: https://ghco.onelogin.com
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US,en;q=1
Sec-Fetch-Dest: empty
Cookie: ol_custom_domain=%7B%22tenant%22%3A%22ghco%22%2C%22custom_domain%22%3A%22%22%7D; sub_session_onelogin.com=BAh7CCIfYnJvd3Nlcl92ZXJpZmljYXRpb25fdG9rZW4iRWYwOGJiZDMwZmQ3MzkyOTM2NGE3Yzc2ZTI0M2QxZDZlZjJjYTc0OTM1ZWM1NTRjN2ZiMjcwZGQyODM3N2NiYWY6D3Nlc3Npb25faWQiKWJjNzE5ODA4LWU0YzAtNGQyYS1hYTEwLTgyZmFlMmRmYjRkNjoOcmV0dXJuX3RvIgG3aHR0cHM6Ly9naGNvLm9uZWxvZ2luLmNvbS90cnVzdC9zYW1sMi9odHRwLXBvc3Qvc3NvLzQ1NTIwMz9zYW1sX3JlcXVlc3RfcGFyYW1zX3Rva2VuPWY5N2ZiNjgwNDIuY2ZkZTlmOTFiNmZkZDg5NzNjZmIwMTRiMDZhMDFlZTFmODMxMDQ4My41T0xhUXJSbF8yNUR4RERuSk9xZjJnMjh0NnFXcmNrTUlSak0yeHpoYUx3JTNE--b8edf74f8f7f369ea7927493283ff66c87402b19; ol_web_login_canary_0=false; ol_web_login_proxy_5=true
Connection: keep-alive
Content-Length: 687
Pragma: no-cache
Host: ghco.onelogin.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: application/json
Accept: application/json
Cache-Control: no-cache
Referer: https://ghco.onelogin.com/login2/?return=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJhcHBfaWQiOiI0NTUyMDMiLCJ1cmkiOiJodHRwczovL2doY28ub25lbG9naW4uY29tL3RydXN0L3NhbWwyL2h0dHAtcG9zdC9zc28vNDU1MjAzP3NhbWxfcmVxdWVzdF9wYXJhbXNfdG9rZW49Zjk3ZmI2ODA0Mi5jZmRlOWY5MWI2ZmRkODk3M2NmYjAxNGIwNmEwMWVlMWY4MzEwNDgzLjVPTGFRclJsXzI1RHhERG5KT3FmMmcyOHQ2cVdyY2tNSVJqTTJ4emhhTHclM0QiLCJhdWQiOiJBQ0NFU1MiLCJpc3MiOiJNT05PUkFJTCIsIm5vdGlmaWNhdGlvbiI6eyJtZXNzYWdlIjoiQ29ubmVjdGluZyB0byBBcHBsaWNhdGlvbiIsInZhbHVlcyI6WyJBcHBsaWNhdGlvbiJdLCJpY29uIjoiY29ubmVjdGlvbiIsInRlbXBsYXRlX2lkIjoiY29ubmVjdGluZ190b19hcHAiLCJ0eXBlIjoiaW5mbyJ9LCJleHAiOjE2MjMzMzc3MDQsInBhcmFtcyI6e30sIm1ldGhvZCI6ImdldCJ9.CC5iqMENB-ytB6Oj00LRBCuzBjlthc5joC4tEpRIyGg
Sec-Fetch-Site: same-origin
Accept: application/json
Referer: https://ghco.onelogin.com/login2/?return=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJhcHBfaWQiOiI0NTUyMDMiLCJ1cmkiOiJodHRwczovL2doY28ub25lbG9naW4uY29tL3RydXN0L3NhbWwyL2h0dHAtcG9zdC9zc28vNDU1MjAzP3NhbWxfcmVxdWVzdF9wYXJhbXNfdG9rZW49Zjk3ZmI2ODA0Mi5jZmRlOWY5MWI2ZmRkODk3M2NmYjAxNGIwNmEwMWVlMWY4MzEwNDgzLjVPTGFRclJsXzI1RHhERG5KT3FmMmcyOHQ2cVdyY2tNSVJqTTJ4emhhTHclM0QiLCJhdWQiOiJBQ0NFU1MiLCJpc3MiOiJNT05PUkFJTCIsIm5vdGlmaWNhdGlvbiI6eyJtZXNzYWdlIjoiQ29ubmVjdGluZyB0byBBcHBsaWNhdGlvbiIsInZhbHVlcyI6WyJBcHBsaWNhdGlvbiJdLCJpY29uIjoiY29ubmVjdGlvbiIsInRlbXBsYXRlX2lkIjoiY29ubmVjdGluZ190b19hcHAiLCJ0eXBlIjoiaW5mbyJ9LCJleHAiOjE2MjMzMzc3MDQsInBhcmFtcyI6e30sIm1ldGhvZCI6ImdldCJ9.CC5iqMENB-ytB6Oj00LRBCuzBjlthc5joC4tEpRIyGg
Accept-Language: en-US,en;q=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: application/json

Response headers

x-runtime: 0.064088
date: Thu, 10 Jun 2021 15:05:25 GMT
x-correlation-id: 82268a72-c9b4-4359-a1c2-64bd0b68eca8
x-content-type-options: nosniff
etag: W/"92207d522a7bfe41b8f872732607e8f3"
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=63072000; includeSubDomains;
content-type: application/json; charset=utf-8
cache-control: max-age=0, private, must-revalidate
set-cookie: ol_access_service_canary_79=false; path=/; domain=.onelogin.com; HttpOnly; Secure
content-length: 1288
x-xss-protection: 1; mode=block
x-request-id: 60C22A34-59F940AB-7262-0A0901DC-01BB-D58E-3A63

GET
H/1.1 200
OK branding.json Show response
ghco.onelogin.com/api/v1/ 3 KB
4 KB 568ms
351ms XHR
application/json 18.216.23.72
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://ghco.onelogin.com/api/v1/branding.json?app_id=455203

Requested by

Host: web-login-v2-cdn.onelogin.com
URL: https://web-login-v2-cdn.onelogin.com/login2/app27df3343166a5d9d6614772b538b8ae42b1418ff.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

18.216.23.72 Columbus, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-18-216-23-72.us-east-2.compute.amazonaws.com

Software

Resource Hash

2fe4db0e8d53ecb6382f3081847ccd89b4a32f160e230eb5d0d140abed84b5bb

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains;
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Pragma: no-cache
Sec-Fetch-Site: same-origin
Accept-Encoding: gzip, deflate, br
Host: ghco.onelogin.com
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Sec-Fetch-Mode: cors
Accept: application/json
Cache-Control: no-cache
Sec-Fetch-Dest: empty
Referer: https://ghco.onelogin.com/login2/?return=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJhcHBfaWQiOiI0NTUyMDMiLCJ1cmkiOiJodHRwczovL2doY28ub25lbG9naW4uY29tL3RydXN0L3NhbWwyL2h0dHAtcG9zdC9zc28vNDU1MjAzP3NhbWxfcmVxdWVzdF9wYXJhbXNfdG9rZW49Zjk3ZmI2ODA0Mi5jZmRlOWY5MWI2ZmRkODk3M2NmYjAxNGIwNmEwMWVlMWY4MzEwNDgzLjVPTGFRclJsXzI1RHhERG5KT3FmMmcyOHQ2cVdyY2tNSVJqTTJ4emhhTHclM0QiLCJhdWQiOiJBQ0NFU1MiLCJpc3MiOiJNT05PUkFJTCIsIm5vdGlmaWNhdGlvbiI6eyJtZXNzYWdlIjoiQ29ubmVjdGluZyB0byBBcHBsaWNhdGlvbiIsInZhbHVlcyI6WyJBcHBsaWNhdGlvbiJdLCJpY29uIjoiY29ubmVjdGlvbiIsInRlbXBsYXRlX2lkIjoiY29ubmVjdGluZ190b19hcHAiLCJ0eXBlIjoiaW5mbyJ9LCJleHAiOjE2MjMzMzc3MDQsInBhcmFtcyI6e30sIm1ldGhvZCI6ImdldCJ9.CC5iqMENB-ytB6Oj00LRBCuzBjlthc5joC4tEpRIyGg
Cookie: ol_custom_domain=%7B%22tenant%22%3A%22ghco%22%2C%22custom_domain%22%3A%22%22%7D; sub_session_onelogin.com=BAh7CCIfYnJvd3Nlcl92ZXJpZmljYXRpb25fdG9rZW4iRWYwOGJiZDMwZmQ3MzkyOTM2NGE3Yzc2ZTI0M2QxZDZlZjJjYTc0OTM1ZWM1NTRjN2ZiMjcwZGQyODM3N2NiYWY6D3Nlc3Npb25faWQiKWJjNzE5ODA4LWU0YzAtNGQyYS1hYTEwLTgyZmFlMmRmYjRkNjoOcmV0dXJuX3RvIgG3aHR0cHM6Ly9naGNvLm9uZWxvZ2luLmNvbS90cnVzdC9zYW1sMi9odHRwLXBvc3Qvc3NvLzQ1NTIwMz9zYW1sX3JlcXVlc3RfcGFyYW1zX3Rva2VuPWY5N2ZiNjgwNDIuY2ZkZTlmOTFiNmZkZDg5NzNjZmIwMTRiMDZhMDFlZTFmODMxMDQ4My41T0xhUXJSbF8yNUR4RERuSk9xZjJnMjh0NnFXcmNrTUlSak0yeHpoYUx3JTNE--b8edf74f8f7f369ea7927493283ff66c87402b19; ol_web_login_canary_0=false; ol_web_login_proxy_5=true
Connection: keep-alive
Accept: application/json
Referer: https://ghco.onelogin.com/login2/?return=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJhcHBfaWQiOiI0NTUyMDMiLCJ1cmkiOiJodHRwczovL2doY28ub25lbG9naW4uY29tL3RydXN0L3NhbWwyL2h0dHAtcG9zdC9zc28vNDU1MjAzP3NhbWxfcmVxdWVzdF9wYXJhbXNfdG9rZW49Zjk3ZmI2ODA0Mi5jZmRlOWY5MWI2ZmRkODk3M2NmYjAxNGIwNmEwMWVlMWY4MzEwNDgzLjVPTGFRclJsXzI1RHhERG5KT3FmMmcyOHQ2cVdyY2tNSVJqTTJ4emhhTHclM0QiLCJhdWQiOiJBQ0NFU1MiLCJpc3MiOiJNT05PUkFJTCIsIm5vdGlmaWNhdGlvbiI6eyJtZXNzYWdlIjoiQ29ubmVjdGluZyB0byBBcHBsaWNhdGlvbiIsInZhbHVlcyI6WyJBcHBsaWNhdGlvbiJdLCJpY29uIjoiY29ubmVjdGlvbiIsInRlbXBsYXRlX2lkIjoiY29ubmVjdGluZ190b19hcHAiLCJ0eXBlIjoiaW5mbyJ9LCJleHAiOjE2MjMzMzc3MDQsInBhcmFtcyI6e30sIm1ldGhvZCI6ImdldCJ9.CC5iqMENB-ytB6Oj00LRBCuzBjlthc5joC4tEpRIyGg
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 10 Jun 2021 15:05:25 GMT
x-content-type-options: nosniff
x-frame-options: DENY
etag: "bb388b22fb6ce4c09b5884b953c14907"
strict-transport-security: max-age=63072000; includeSubDomains;
p3p: CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE"
status: 200 OK
cache-control: no-cache no-store max-age=0 must-revalidate private s-maxage=0
set-cookie: sub_session_onelogin.com=BAh7CDoPc2Vzc2lvbl9pZCIpYmM3MTk4MDgtZTRjMC00ZDJhLWFhMTAtODJmYWUyZGZiNGQ2Og5yZXR1cm5fdG8iAbdodHRwczovL2doY28ub25lbG9naW4uY29tL3RydXN0L3NhbWwyL2h0dHAtcG9zdC9zc28vNDU1MjAzP3NhbWxfcmVxdWVzdF9wYXJhbXNfdG9rZW49Zjk3ZmI2ODA0Mi5jZmRlOWY5MWI2ZmRkODk3M2NmYjAxNGIwNmEwMWVlMWY4MzEwNDgzLjVPTGFRclJsXzI1RHhERG5KT3FmMmcyOHQ2cVdyY2tNSVJqTTJ4emhhTHclM0QiH2Jyb3dzZXJfdmVyaWZpY2F0aW9uX3Rva2VuIkVmMDhiYmQzMGZkNzM5MjkzNjRhN2M3NmUyNDNkMWQ2ZWYyY2E3NDkzNWVjNTU0YzdmYjI3MGRkMjgzNzdjYmFm--8a4d87095814088c8ab2678558d6db36143d0e0a; path=/; secure; HttpOnly; SameSite=None
content-type: application/json; charset=utf-8
content-length: 2778
x-xss-protection: 1; mode=block
x-request-id: 60C22A34-59F940AB-72B8-0A090339-01BB-E24B-3CA1
expires: 0

GET
H2 200 479970ffb74f2117317f9d24d9e317fe.woff2
web-login-v2-cdn.onelogin.com/login2/ 15 KB
16 KB 76ms
27ms Font
binary/octet-stream 2600:9000:218c:2600:18:b15c:ee80:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://web-login-v2-cdn.onelogin.com/login2/479970ffb74f2117317f9d24d9e317fe.woff2
Requested by: Host: ghco.onelogin.com
URL: https://ghco.onelogin.com/login2/?return=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJhcHBfaWQiOiI0NTUyMDMiLCJ1cmkiOiJodHRwczovL2doY28ub25lbG9naW4uY29tL3RydXN0L3NhbWwyL2h0dHAtcG9zdC9zc28vNDU1MjAzP3NhbWxfcmVxdWVzdF9wYXJhbXNfdG9rZW49Zjk3ZmI2ODA0Mi5jZmRlOWY5MWI2ZmRkODk3M2NmYjAxNGIwNmEwMWVlMWY4MzEwNDgzLjVPTGFRclJsXzI1RHhERG5KT3FmMmcyOHQ2cVdyY2tNSVJqTTJ4emhhTHclM0QiLCJhdWQiOiJBQ0NFU1MiLCJpc3MiOiJNT05PUkFJTCIsIm5vdGlmaWNhdGlvbiI6eyJtZXNzYWdlIjoiQ29ubmVjdGluZyB0byBBcHBsaWNhdGlvbiIsInZhbHVlcyI6WyJBcHBsaWNhdGlvbiJdLCJpY29uIjoiY29ubmVjdGlvbiIsInRlbXBsYXRlX2lkIjoiY29ubmVjdGluZ190b19hcHAiLCJ0eXBlIjoiaW5mbyJ9LCJleHAiOjE2MjMzMzc3MDQsInBhcmFtcyI6e30sIm1ldGhvZCI6ImdldCJ9.CC5iqMENB-ytB6Oj00LRBCuzBjlthc5joC4tEpRIyGg
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:218c:2600:18:b15c:ee80:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 48c3fa6f86c54f1d9bb519220713d4b0a1f8cd1a589a3c03b9fa82e98ecb13e3

Request headers

Origin: https://ghco.onelogin.com
Referer: https://ghco.onelogin.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 27 May 2021 23:25:50 GMT
content-encoding: gzip
age: 1179576
x-cache: Hit from cloudfront
content-length: 15798
access-control-allow-origin: *
last-modified: Tue, 11 May 2021 23:05:18 GMT
server: AmazonS3
etag: "00cca0d4f9f64b1b68ebd4f88f4f28e3"
access-control-max-age: 0
access-control-allow-methods: GET
x-amz-version-id: 98DYH8OKSQxuJctHvF5nVnH6erQcxXGl
via: 1.1 2ee05fc08860e6c53e732a51ce89da7c.cloudfront.net (CloudFront)
cache-control: max-age=2592000
x-amz-cf-pop: CDG50-P1
accept-ranges: bytes
content-type: binary/octet-stream
x-amz-cf-id: PlIifAK-3vYroR9NdDSURGOZLae5u4ctA1892AuCnnJ3D1ubJuluhA==

POST
H/1.1 200
OK nonce_verify Show response
ghco.onelogin.com/access/ 63 B
799 B 181ms
181ms XHR
application/json 18.216.23.72
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://ghco.onelogin.com/access/nonce_verify

Requested by

Host: cdn.onelogin.com
URL: https://cdn.onelogin.com/onelogin-vigilance.min.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

18.216.23.72 Columbus, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-18-216-23-72.us-east-2.compute.amazonaws.com

Software

Resource Hash

c36a88ad519f6f4e38270d873258c0acfb5ba6199bd5f7336a5bec8ac96ffc97

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Sec-Fetch-Mode: cors
Origin: https://ghco.onelogin.com
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Sec-Fetch-Dest: empty
Cookie: ol_custom_domain=%7B%22tenant%22%3A%22ghco%22%2C%22custom_domain%22%3A%22%22%7D; sub_session_onelogin.com=BAh7CCIfYnJvd3Nlcl92ZXJpZmljYXRpb25fdG9rZW4iRWYwOGJiZDMwZmQ3MzkyOTM2NGE3Yzc2ZTI0M2QxZDZlZjJjYTc0OTM1ZWM1NTRjN2ZiMjcwZGQyODM3N2NiYWY6D3Nlc3Npb25faWQiKWJjNzE5ODA4LWU0YzAtNGQyYS1hYTEwLTgyZmFlMmRmYjRkNjoOcmV0dXJuX3RvIgG3aHR0cHM6Ly9naGNvLm9uZWxvZ2luLmNvbS90cnVzdC9zYW1sMi9odHRwLXBvc3Qvc3NvLzQ1NTIwMz9zYW1sX3JlcXVlc3RfcGFyYW1zX3Rva2VuPWY5N2ZiNjgwNDIuY2ZkZTlmOTFiNmZkZDg5NzNjZmIwMTRiMDZhMDFlZTFmODMxMDQ4My41T0xhUXJSbF8yNUR4RERuSk9xZjJnMjh0NnFXcmNrTUlSak0yeHpoYUx3JTNE--b8edf74f8f7f369ea7927493283ff66c87402b19; ol_web_login_canary_0=false; ol_web_login_proxy_5=true; ol_access_service_canary_79=false
Connection: keep-alive
Content-Length: 190
Pragma: no-cache
Host: ghco.onelogin.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: application/json;charset=UTF-8
Accept: application/json, text/plain, */*
Cache-Control: no-cache
Referer: https://ghco.onelogin.com/login2/?return=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJhcHBfaWQiOiI0NTUyMDMiLCJ1cmkiOiJodHRwczovL2doY28ub25lbG9naW4uY29tL3RydXN0L3NhbWwyL2h0dHAtcG9zdC9zc28vNDU1MjAzP3NhbWxfcmVxdWVzdF9wYXJhbXNfdG9rZW49Zjk3ZmI2ODA0Mi5jZmRlOWY5MWI2ZmRkODk3M2NmYjAxNGIwNmEwMWVlMWY4MzEwNDgzLjVPTGFRclJsXzI1RHhERG5KT3FmMmcyOHQ2cVdyY2tNSVJqTTJ4emhhTHclM0QiLCJhdWQiOiJBQ0NFU1MiLCJpc3MiOiJNT05PUkFJTCIsIm5vdGlmaWNhdGlvbiI6eyJtZXNzYWdlIjoiQ29ubmVjdGluZyB0byBBcHBsaWNhdGlvbiIsInZhbHVlcyI6WyJBcHBsaWNhdGlvbiJdLCJpY29uIjoiY29ubmVjdGlvbiIsInRlbXBsYXRlX2lkIjoiY29ubmVjdGluZ190b19hcHAiLCJ0eXBlIjoiaW5mbyJ9LCJleHAiOjE2MjMzMzc3MDQsInBhcmFtcyI6e30sIm1ldGhvZCI6ImdldCJ9.CC5iqMENB-ytB6Oj00LRBCuzBjlthc5joC4tEpRIyGg
Sec-Fetch-Site: same-origin
Accept: application/json, text/plain, */*
Referer: https://ghco.onelogin.com/login2/?return=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJhcHBfaWQiOiI0NTUyMDMiLCJ1cmkiOiJodHRwczovL2doY28ub25lbG9naW4uY29tL3RydXN0L3NhbWwyL2h0dHAtcG9zdC9zc28vNDU1MjAzP3NhbWxfcmVxdWVzdF9wYXJhbXNfdG9rZW49Zjk3ZmI2ODA0Mi5jZmRlOWY5MWI2ZmRkODk3M2NmYjAxNGIwNmEwMWVlMWY4MzEwNDgzLjVPTGFRclJsXzI1RHhERG5KT3FmMmcyOHQ2cVdyY2tNSVJqTTJ4emhhTHclM0QiLCJhdWQiOiJBQ0NFU1MiLCJpc3MiOiJNT05PUkFJTCIsIm5vdGlmaWNhdGlvbiI6eyJtZXNzYWdlIjoiQ29ubmVjdGluZyB0byBBcHBsaWNhdGlvbiIsInZhbHVlcyI6WyJBcHBsaWNhdGlvbiJdLCJpY29uIjoiY29ubmVjdGlvbiIsInRlbXBsYXRlX2lkIjoiY29ubmVjdGluZ190b19hcHAiLCJ0eXBlIjoiaW5mbyJ9LCJleHAiOjE2MjMzMzc3MDQsInBhcmFtcyI6e30sIm1ldGhvZCI6ImdldCJ9.CC5iqMENB-ytB6Oj00LRBCuzBjlthc5joC4tEpRIyGg
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: application/json;charset=UTF-8

Response headers

x-runtime: 0.058813
date: Thu, 10 Jun 2021 15:05:25 GMT
x-correlation-id: b36153ad-fe7a-455e-a76a-1ac73d247755
x-content-type-options: nosniff
etag: W/"e43df6d8c331b6478efec37b2df20129"
x-frame-options: SAMEORIGIN
content-type: application/json; charset=utf-8
set-cookie: __tdli_fp=ce47fc6ad7028df73a8dc319a3a789fa; path=/; HttpOnly __tdli=4b4bc7691ff1323026c4fab311b1b44227891c31e5700d92ada3d213028a67d4; path=/; expires=Mon, 10 Jun 2024 15:05:25 -0000; HttpOnly
cache-control: max-age=0, private, must-revalidate
strict-transport-security: max-age=63072000; includeSubDomains;
content-length: 63
x-xss-protection: 1; mode=block
x-request-id: 60C22A35-59F940AB-7262-0A0901DC-01BB-D5B4-3A63

GET
H/1.1 200
OK 82cba08e88681d9c4eda31df749861ad3cad6bc2.jpg
cdn.onelogin.com/images/brands/backgrounds/login/ 372 KB
373 KB 20ms
20ms Image
image/jpeg 52.222.174.64
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.onelogin.com/images/brands/backgrounds/login/82cba08e88681d9c4eda31df749861ad3cad6bc2.jpg?1585883947
Requested by: Host: ghco.onelogin.com
URL: https://ghco.onelogin.com/login2/?return=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJhcHBfaWQiOiI0NTUyMDMiLCJ1cmkiOiJodHRwczovL2doY28ub25lbG9naW4uY29tL3RydXN0L3NhbWwyL2h0dHAtcG9zdC9zc28vNDU1MjAzP3NhbWxfcmVxdWVzdF9wYXJhbXNfdG9rZW49Zjk3ZmI2ODA0Mi5jZmRlOWY5MWI2ZmRkODk3M2NmYjAxNGIwNmEwMWVlMWY4MzEwNDgzLjVPTGFRclJsXzI1RHhERG5KT3FmMmcyOHQ2cVdyY2tNSVJqTTJ4emhhTHclM0QiLCJhdWQiOiJBQ0NFU1MiLCJpc3MiOiJNT05PUkFJTCIsIm5vdGlmaWNhdGlvbiI6eyJtZXNzYWdlIjoiQ29ubmVjdGluZyB0byBBcHBsaWNhdGlvbiIsInZhbHVlcyI6WyJBcHBsaWNhdGlvbiJdLCJpY29uIjoiY29ubmVjdGlvbiIsInRlbXBsYXRlX2lkIjoiY29ubmVjdGluZ190b19hcHAiLCJ0eXBlIjoiaW5mbyJ9LCJleHAiOjE2MjMzMzc3MDQsInBhcmFtcyI6e30sIm1ldGhvZCI6ImdldCJ9.CC5iqMENB-ytB6Oj00LRBCuzBjlthc5joC4tEpRIyGg
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 52.222.174.64 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-222-174-64.cdg50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: fbece90d0a4486ca7287c4b389408d5d5472a8f980bf4a1263fdb96b6152bc0b

Request headers

Referer: https://ghco.onelogin.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-amz-version-id: 5hR9xFlSWWOWVLp0w9zt1WTL8kLWhJRR
Via: 1.1 24e6529ea30fbe719bde2164c1fe9238.cloudfront.net (CloudFront)
Last-Modified: Fri, 03 Apr 2020 03:19:10 GMT
Server: AmazonS3
Age: 58336
ETag: "f20597f8aa4d0c8901004c1f556f38a5"
X-Cache: Hit from cloudfront
Content-Type: image/jpeg
Connection: keep-alive
Date: Wed, 09 Jun 2021 22:53:09 GMT
x-amz-replication-status: COMPLETED
X-Amz-Cf-Pop: CDG50-P2
Accept-Ranges: bytes
Content-Length: 380967
X-Amz-Cf-Id: JjfzS_Kdq0j8wNrc4QMUB4bB5PZBvJaf0suqgE0c1BnohUmx9a81mg==

GET
H/1.1 200
OK 52a901c3874954eb992e9882a5fa439bd205f696.png
cdn.onelogin.com/images/brands/logos/login/ 7 KB
8 KB 60ms
18ms Image
image/png 52.222.174.64
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.onelogin.com/images/brands/logos/login/52a901c3874954eb992e9882a5fa439bd205f696.png?1435492864
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 52.222.174.64 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-52-222-174-64.cdg50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: a0eca5dc696db3f308c07f4f1c2444939a9bb414a6b80229dadf75be62ff6de7

Request headers

Referer: https://ghco.onelogin.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-amz-version-id: null
Via: 1.1 ee4db0d243ceb0d1993e5f46ad6c0f01.cloudfront.net (CloudFront)
Last-Modified: Sun, 28 Jun 2015 12:01:06 GMT
Server: AmazonS3
Age: 21727
ETag: "ce80e55791c7c401f62b1fee221f423c"
X-Cache: Hit from cloudfront
Content-Type: image/png
Connection: keep-alive
Date: Thu, 10 Jun 2021 09:03:19 GMT
X-Amz-Cf-Pop: CDG50-P2
Accept-Ranges: bytes
Content-Length: 7233
X-Amz-Cf-Id: QoW98ounAVg48mq7Ta9X4SqGRM8hfTPGDtj8GIA_rH0ALls_xrQCOw==

GET
DATA 200
OK truncated
/ 2 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: eef376d9ba561b179c4d943f37c824d7453c6dd2d415ef98543234d2fedd3f37

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

Verdicts & Comments Add Verdict or Comment

29 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

5 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.onelogin.com/	1969-12-31 23:59:59	Name: ol_access_service_canary_79 Value: false
.onelogin.com/	1969-12-31 23:59:59	Name: ol_web_login_proxy_5 Value: true
.onelogin.com/	1969-12-31 23:59:59	Name: ol_web_login_canary_0 Value: false
ghco.onelogin.com/	1969-12-31 23:59:59	Name: sub_session_onelogin.com Value: BAh7CCIfYnJvd3Nlcl92ZXJpZmljYXRpb25fdG9rZW4iRWYwOGJiZDMwZmQ3MzkyOTM2NGE3Yzc2ZTI0M2QxZDZlZjJjYTc0OTM1ZWM1NTRjN2ZiMjcwZGQyODM3N2NiYWY6D3Nlc3Npb25faWQiKWJjNzE5ODA4LWU0YzAtNGQyYS1hYTEwLTgyZmFlMmRmYjRkNjoOcmV0dXJuX3RvIgG3aHR0cHM6Ly9naGNvLm9uZWxvZ2luLmNvbS90cnVzdC9zYW1sMi9odHRwLXBvc3Qvc3NvLzQ1NTIwMz9zYW1sX3JlcXVlc3RfcGFyYW1zX3Rva2VuPWY5N2ZiNjgwNDIuY2ZkZTlmOTFiNmZkZDg5NzNjZmIwMTRiMDZhMDFlZTFmODMxMDQ4My41T0xhUXJSbF8yNUR4RERuSk9xZjJnMjh0NnFXcmNrTUlSak0yeHpoYUx3JTNE--b8edf74f8f7f369ea7927493283ff66c87402b19
.onelogin.com/	1969-12-31 23:59:59	Name: ol_custom_domain Value: %7B%22tenant%22%3A%22ghco%22%2C%22custom_domain%22%3A%22%22%7D

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

app.onelogin.com
cdn.onelogin.com
ghco.onelogin.com
web-login-v2-cdn.onelogin.com
www.google.com
www.gstatic.com
www.myworkday.com
18.216.23.71
18.216.23.72
209.177.165.18
2600:9000:218c:2600:18:b15c:ee80:93a1
2a00:1450:4001:82a::2003
2a00:1450:4001:82b::2004
52.222.174.64
0d5a3b4bd0f39665707f130e9ba1179fab5c35a47fd6230e1be02a64139cf0c0
2fe4db0e8d53ecb6382f3081847ccd89b4a32f160e230eb5d0d140abed84b5bb
32261100d421decac09a5b4e1c13dc97d43b42f1f6328b2d4c5211add3601ff4
3811a073901c0de50ace8b15f1477bdf5c0aef6157fa8c2b48c1fd451851b1f6
44bfd9c985e6c227abfbe5594a17d52edb03b4f6e645714927c1d4cb62d9aff2
48c3fa6f86c54f1d9bb519220713d4b0a1f8cd1a589a3c03b9fa82e98ecb13e3
5e0dd79e80c5c235810a628cceb4be0610acc96a33cf676abb09aa266719728e
734160057d9682a89035825f63793cd0f945523efa3f8d33b8bef89bd7bdef5e
736fcfe7d0e966898c19ca764efd911a977c545c630719c85fd42a78eaa8c4c1
7734e13640b53ef1c61a0b64c0034c5f98d230a5364305293119c482b8b2b56c
8dc70bbcf67cc401d0539ae83128038b88de18e97b711e91a2102d08a80cb29e
a0eca5dc696db3f308c07f4f1c2444939a9bb414a6b80229dadf75be62ff6de7
c36a88ad519f6f4e38270d873258c0acfb5ba6199bd5f7336a5bec8ac96ffc97
e2e33adc4b4b1fd09f4385641a21d78dfca6b96629827f0e6a30829587815cde
eef376d9ba561b179c4d943f37c824d7453c6dd2d415ef98543234d2fedd3f37
fbece90d0a4486ca7287c4b389408d5d5472a8f980bf4a1263fdb96b6152bc0b

ghco.onelogin.com Open in urlscan Pro 18.216.23.72 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

15 Requests

100 %HTTPS

43 %IPv6

4 Domains

7 Subdomains

7 IPs

2 Countries

1537 kBTransfer

3725 kBSize

5 Cookies

3 Outgoing links

Page URL History

Redirected requests

15 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

29 JavaScript Global Variables

5 Cookies

Security Headers

Indicators

ghco.onelogin.com Open in urlscan Pro
18.216.23.72 Public Scan

Screenshot
Live screenshot

Full Image

15
Requests

100 %
HTTPS

43 %
IPv6

4
Domains

7
Subdomains

7
IPs

2
Countries

1537 kB
Transfer

3725 kB
Size

5
Cookies

15 HTTP transactions
1 data transactions