urlscan.io logo urlscan.io
SecurityTrails logo

login.costco.com Open in urlscan Pro
170.167.103.202  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: http://hub.costco.com/
Effective URL: https://login.costco.com/idp/SSO.saml2
Submission: On July 26 via manual from US — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 3 IPs in 1 countries across 1 domains to perform 8 HTTP transactions. The main IP is 170.167.103.202, located in United States and belongs to COSTCO, US. The main domain is login.costco.com. The Cisco Umbrella rank of the primary domain is 321881.
TLS certificate: Issued by DigiCert TLS RSA SHA256 2020 CA1 on June 20th 2022. Valid for: a year.
This is the only time login.costco.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
2 3 170.167.101.194 11283 (COSTCO)
1 2 170.167.101.199 11283 (COSTCO)
6 170.167.103.202 11283 (COSTCO)
8 3
Apex Domain
Subdomains		 Transfer
11 costco.com
hub.costco.com — Cisco Umbrella Rank: 580820
vendorauth.costco.com — Cisco Umbrella Rank: 693686
login.costco.com — Cisco Umbrella Rank: 321881
498 KB
8 1
Domain Requested by
6 login.costco.com login.costco.com
3 hub.costco.com 2 redirects
2 vendorauth.costco.com 1 redirects
8 3

This site contains links to these domains. Also see Links.

Domain
docs.google.com
fssts.costco.com
Subject Issuer Validity Valid
hub.costco.com
DigiCert TLS RSA SHA256 2020 CA1		 2021-08-04 -
2022-08-04		 a year crt.sh
vendorauth.costco.com
DigiCert TLS RSA SHA256 2020 CA1		 2021-08-13 -
2022-08-13		 a year crt.sh
login.costco.com
DigiCert TLS RSA SHA256 2020 CA1		 2022-06-20 -
2023-06-20		 a year crt.sh

This page contains 1 frames:

Primary Page: https://login.costco.com/idp/SSO.saml2
Frame ID: 049E731D957D185635ADC2E0BB213871
Requests: 8 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Sign In

Page URL History Show full URLs

  1. http://hub.costco.com/ HTTP 302
    https://hub.costco.com/ HTTP 302
    https://hub.costco.com/my.policy Page URL
  2. https://vendorauth.costco.com/saml/idp/profile/redirectorpost/sso HTTP 302
    https://vendorauth.costco.com/my.policy Page URL
  3. https://login.costco.com/idp/SSO.saml2 Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • <link[^>]+foundation[^>"]+css

Page Statistics

8
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

3
Subdomains

3
IPs

1
Countries

498 kB
Transfer

494 kB
Size

12
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://hub.costco.com/ HTTP 302
    https://hub.costco.com/ HTTP 302
    https://hub.costco.com/my.policy Page URL
  2. https://vendorauth.costco.com/saml/idp/profile/redirectorpost/sso HTTP 302
    https://vendorauth.costco.com/my.policy Page URL
  3. https://login.costco.com/idp/SSO.saml2 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0
  • http://hub.costco.com/ HTTP 302
  • https://hub.costco.com/ HTTP 302
  • https://hub.costco.com/my.policy
Request Chain 1
  • https://vendorauth.costco.com/saml/idp/profile/redirectorpost/sso HTTP 302
  • https://vendorauth.costco.com/my.policy

8 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
my.policy
hub.costco.com/
Redirect Chain
  • http://hub.costco.com/
  • https://hub.costco.com/
  • https://hub.costco.com/my.policy
7 KB
7 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://hub.costco.com/my.policy
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
170.167.101.194 , United States, ASN11283 (COSTCO, US),
Reverse DNS
hub.costco.com
Software
BigIP /
Resource Hash
3f3f1aa1aaf8536d6beb36d1d0f002a9c6d7f52445c7cf08eb22bd92af622299
Security Headers
Name Value
X-Frame-Options DENY

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

Accept-Ranges
bytes
Age
914
Cache-Control
no-store
Connection
close
Content-Length
7283
Content-Type
text/html; charset=ISO-8859-1
Date
Tue, 26 Jul 2022 14:47:46 GMT
Server
BigIP
X-Frame-Options
DENY

Redirect headers

Connection
close
Content-Length
0
Location
/my.policy
Server
BigIP
my.policy
vendorauth.costco.com/
Redirect Chain
  • https://vendorauth.costco.com/saml/idp/profile/redirectorpost/sso
  • https://vendorauth.costco.com/my.policy
7 KB
7 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://vendorauth.costco.com/my.policy
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
170.167.101.199 , United States, ASN11283 (COSTCO, US),
Reverse DNS
vendorauth.costco.com
Software
BigIP /
Resource Hash
392781d6b909defd882399b0ab99441b1334899a042ea86341d252a4d72eb6e7
Security Headers
Name Value
X-Frame-Options DENY

Request headers

Content-Type
application/x-www-form-urlencoded
Origin
https://hub.costco.com
Referer
https://hub.costco.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

Accept-Ranges
bytes
Age
21453
Cache-Control
no-store
Connection
close
Content-Length
7240
Content-Type
text/html; charset=ISO-8859-1
Date
Tue, 26 Jul 2022 14:47:48 GMT
Server
BigIP
X-Frame-Options
DENY

Redirect headers

Connection
close
Content-Length
0
Location
/my.policy
Server
BigIP
Primary Request SSO.saml2
login.costco.com/idp/ 		11 KB
11 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://login.costco.com/idp/SSO.saml2
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
170.167.103.202 , United States, ASN11283 (COSTCO, US),
Reverse DNS
kronosmobile.costco.com
Software
/
Resource Hash
1a689708b1b772d52a9fdfbd36ee5e74653f661e3ba7845144f37b2dffb1fc20
Security Headers
Name Value
Strict-Transport-Security max-age=16070400; includeSubDomains
X-Frame-Options SAMEORIGIN

Request headers

Content-Type
application/x-www-form-urlencoded
Origin
https://vendorauth.costco.com
Referer
https://vendorauth.costco.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

Cache-Control
no-cache, no-store
Content-Length
10790
Content-Type
text/html;charset=utf-8
Date
Tue, 26 Jul 2022 14:47:48 GMT
Expires
Thu, 01 Jan 1970 00:00:00 GMT
Pragma
no-cache
Referrer-Policy
origin
Strict-Transport-Security
max-age=16070400; includeSubDomains
X-Frame-Options
SAMEORIGIN
normalize.css
login.costco.com/assets/css/ 		8 KB
8 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://login.costco.com/assets/css/normalize.css
Requested by
Host: login.costco.com
URL: https://login.costco.com/idp/SSO.saml2
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
170.167.103.202 , United States, ASN11283 (COSTCO, US),
Reverse DNS
kronosmobile.costco.com
Software
/
Resource Hash
69fcf7682b771176634dc54deb0c412cf9ec40df931d56a0480ee51b47ed1598
Security Headers
Name Value
Strict-Transport-Security max-age=16070400; includeSubDomains
X-Frame-Options ALLOW-FROM https://login.costco.com/

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://login.costco.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

Date
Tue, 26 Jul 2022 14:47:49 GMT
Referrer-Policy
origin
Last-Modified
Mon, 04 Nov 2019 23:42:24 GMT
X-Frame-Options
ALLOW-FROM https://login.costco.com/
Content-Type
text/css
Cache-Control
max-age=0, must-revalidate
Strict-Transport-Security
max-age=16070400; includeSubDomains
Content-Length
7708
foundation.min.css
login.costco.com/assets/css/ 		161 KB
162 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://login.costco.com/assets/css/foundation.min.css
Requested by
Host: login.costco.com
URL: https://login.costco.com/idp/SSO.saml2
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
170.167.103.202 , United States, ASN11283 (COSTCO, US),
Reverse DNS
kronosmobile.costco.com
Software
/
Resource Hash
35376cedab550837a894b5336dc978e65c7880960efa135709a5f5c02d874077
Security Headers
Name Value
Strict-Transport-Security max-age=16070400; includeSubDomains
X-Frame-Options ALLOW-FROM https://login.costco.com/

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://login.costco.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

Date
Tue, 26 Jul 2022 14:47:49 GMT
Referrer-Policy
origin
Last-Modified
Mon, 04 Nov 2019 23:42:30 GMT
X-Frame-Options
ALLOW-FROM https://login.costco.com/
Content-Type
text/css
Cache-Control
max-age=0, must-revalidate
Strict-Transport-Security
max-age=16070400; includeSubDomains
Content-Length
165184
app.css
login.costco.com/assets/css/ 		7 KB
7 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://login.costco.com/assets/css/app.css
Requested by
Host: login.costco.com
URL: https://login.costco.com/idp/SSO.saml2
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
170.167.103.202 , United States, ASN11283 (COSTCO, US),
Reverse DNS
kronosmobile.costco.com
Software
/
Resource Hash
f23f7d98855496d92563c212831543384a2fc81f23f19bcaaca3c76c5eb9e8cd
Security Headers
Name Value
Strict-Transport-Security max-age=16070400; includeSubDomains
X-Frame-Options ALLOW-FROM https://login.costco.com/

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://login.costco.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

Date
Tue, 26 Jul 2022 14:47:49 GMT
Referrer-Policy
origin
Last-Modified
Fri, 04 Feb 2022 07:15:24 GMT
X-Frame-Options
ALLOW-FROM https://login.costco.com/
Content-Type
text/css
Cache-Control
max-age=0, must-revalidate
Strict-Transport-Security
max-age=16070400; includeSubDomains
Content-Length
6836
bundle.js
login.costco.com/assets/scripts/ 		285 KB
286 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://login.costco.com/assets/scripts/bundle.js
Requested by
Host: login.costco.com
URL: https://login.costco.com/idp/SSO.saml2
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
170.167.103.202 , United States, ASN11283 (COSTCO, US),
Reverse DNS
kronosmobile.costco.com
Software
/
Resource Hash
c0250b4b09c8163a31bb3b46f29432a456012597e9f535aca65a842e02e90631
Security Headers
Name Value
Strict-Transport-Security max-age=16070400; includeSubDomains
X-Frame-Options ALLOW-FROM https://login.costco.com/

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://login.costco.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

Date
Tue, 26 Jul 2022 14:47:49 GMT
Referrer-Policy
origin
Last-Modified
Sat, 25 Jan 2020 00:27:03 GMT
X-Frame-Options
ALLOW-FROM https://login.costco.com/
Content-Type
application/javascript
Cache-Control
max-age=0, must-revalidate
Strict-Transport-Security
max-age=16070400; includeSubDomains
Content-Length
292346
costco_logo_160px.png
login.costco.com/assets/images/ 		8 KB
8 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://login.costco.com/assets/images/costco_logo_160px.png
Requested by
Host: login.costco.com
URL: https://login.costco.com/idp/SSO.saml2
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
170.167.103.202 , United States, ASN11283 (COSTCO, US),
Reverse DNS
kronosmobile.costco.com
Software
/
Resource Hash
ec147ba6fc006244c0505530e092b3027eeb63d9998d776f125ff53a3a536bbb
Security Headers
Name Value
Strict-Transport-Security max-age=16070400; includeSubDomains
X-Frame-Options ALLOW-FROM https://login.costco.com/

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://login.costco.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

Date
Tue, 26 Jul 2022 14:47:50 GMT
Referrer-Policy
origin
Last-Modified
Fri, 03 Jun 2016 02:05:37 GMT
X-Frame-Options
ALLOW-FROM https://login.costco.com/
Content-Type
image/png
Cache-Control
max-age=0, must-revalidate
Strict-Transport-Security
max-age=16070400; includeSubDomains
Content-Length
7993

Verdicts & Comments Add Verdict or Comment

42 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation boolean| remember object| _internals function| iframefix function| setMobile function| getScreenWidth function| setFocus function| postOk function| postOnReturn function| isCostcoEmailAddress function| isInternalId function| hasAlreadyAcceptedTnCs function| validateUsernameField function| hasAcceptedTnCs function| tandcPostOk function| passwordProvided function| applyEnterEvent function| applyEnterEventToLink function| applySpaceBarEvent function| isMobile function| isAndroid function| checkForReturnErrors function| applyContentOverrides function| isIE11 function| ieShims object| BrowserStorage function| storageFunction function| init object| html5 object| Modernizr function| $ function| jQuery object| Foundation object| dateFns function| md5

12 Cookies

Domain/Path Name / Value
login.costco.com/assets/scripts Name: f5avraaaaaaaaaaaaaaaa_session_
Value: FPOOCLKDGKJFECNEPKMBIOMLPKHIGCDJHGEKHIDKIGIMGGIOJPBHDMGCLFEFPCOAIDNDDFDJKOABODHEHJDAKFDJEPMAAKCADMBKEEFMKNIADALGFAOINELIJPOJCNEG
login.costco.com/assets/images Name: f5avraaaaaaaaaaaaaaaa_session_
Value: CHOPKBDDEABJMNFDFOIBNDKOPBHMHKGOINOKAJIFIJNEGMMKJICNMLPIDNFONJEDDPKDELFJLONFGHFOICDAAFAPEPBIONBNFIGFBOLKHIONEKACLPJHLIPOGFMDPBOI
login.costco.com/assets/css Name: f5avraaaaaaaaaaaaaaaa_session_
Value: GEFONJPENNJFIBBJJJMJDJMAIKFNJMNOLLGFFDJKNCKAKCNFHNFIFNPHOGPGPAFBBNKDLBGIKOBEBAAOCPKAHOKAEPAEAFNFKFBPJLKGNEGHHDNFIGMNDLFCBFIBFOMG
login.costco.com/idp Name: f5avraaaaaaaaaaaaaaaa_session_
Value: KDLJIJHPHIDKPICCACPEKLGODKPNBHFPMPGNJBFAJPIDGHOAFKILCJKJLIODBGCONFIDDDGKJOLIBJCPNNNADHPGEPJFKGPNFDKOEPOOPGBFNPGMELHGEBPPKODMEFPD
login.costco.com/idp Name: f5_cspm
Value: 1234
hub.costco.com/ Name: LastMRH_Session
Value: 1afa6e0d
.costco.com/ Name: origAppUrl
Value: hub.costco.com/
hub.costco.com/ Name: MRHSession
Value: de21ab79c1d9259c0f171bb11afa6e0d
vendorauth.costco.com/ Name: LastMRH_Session
Value: 6f3416be
vendorauth.costco.com/ Name: MRHSession
Value: 39fbdd01547c45b4b16bfb226f3416be
login.costco.com/ Name: PF
Value: XyuzbTS4kJu8mGBzhUfUGU
login.costco.com/ Name: f5avr0406818168aaaaaaaaaaaaaaaa_cspm_
Value: CCHJONHOBIDHHMBCMKKCBFGODKLJNGEPDHPBGCEAIPIDGHOAFGKLFBKJLIICBGCONFICDDGKJDEKBGNNNNNADHPGAHEDGJCLPLLMCMEPPGBFNPGOPDGNIJPPKODMEFDL

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
X-Frame-Options DENY