sso.show.corelight.io Open in urlscan Pro
3.1.157.18 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://splunk.bhusa24.show.corelight.io/
Effective URL:
https://sso.show.corelight.io/if/flow/welcome-to-tme-show/?next=%2Fapplication%2Fsaml%2Fsplunk-cloud%2Fsso%2Fbinding%2Fpost%2F
Submission: On August 02 via api (August 2nd 2024, 6:19:34 am UTC) from US — Scanned from DE

Summary HTTP 19 Redirects Behaviour Indicators

Summary

This website contacted 3 IPs in 2 countries across 1 domains to perform 19 HTTP transactions. The main IP is 3.1.157.18, located in Singapore, Singapore and belongs to AMAZON-02, US. The main domain is sso.show.corelight.io.
TLS certificate: Issued by R11 on July 31st 2024. Valid for: 3 months.

This is the only time sso.show.corelight.io was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
3 6	54.244.7.62 54.244.7.62	16509 (AMAZON-02) (AMAZON-02)
2 17	3.1.157.18 3.1.157.18	16509 (AMAZON-02) (AMAZON-02)
19	3

6 54.244.7.62 (Boardman, United States) 3 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-54-244-7-62.us-west-2.compute.amazonaws.com

splunk.bhusa24.show.corelight.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

17 3.1.157.18 (Singapore, Singapore) 2 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-3-1-157-18.ap-southeast-1.compute.amazonaws.com

sso.show.corelight.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
23	corelight.io 5 redirects splunk.bhusa24.show.corelight.io sso.show.corelight.io	362 KB
19	1

	Domain	Requested by
17	sso.show.corelight.io	2 redirects sso.show.corelight.io splunk.bhusa24.show.corelight.io
6	splunk.bhusa24.show.corelight.io	3 redirects splunk.bhusa24.show.corelight.io
19	2

This site contains no links.

Subject Issuer	Validity	Valid
splunk.bhusa24.show.corelight.io E5	`2024-07-30` - `2024-10-28`	3 months	crt.sh
sso.show.corelight.io R11	`2024-07-31` - `2024-10-29`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://sso.show.corelight.io/if/flow/welcome-to-tme-show/?next=%2Fapplication%2Fsaml%2Fsplunk-cloud%2Fsso%2Fbinding%2Fpost%2F
Frame ID: C197204490B8D7B4081B761B1AA53ADE
Requests: 19 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Show

Page URL History Show full URLs

https://splunk.bhusa24.show.corelight.io/ HTTP 303
https://splunk.bhusa24.show.corelight.io/de-DE/ HTTP 303
https://splunk.bhusa24.show.corelight.io/de-DE/account/login?return_to=%2Fde-DE%2F Page URL
https://sso.show.corelight.io/application/saml/splunk-cloud/sso/binding/post/ HTTP 302
https://sso.show.corelight.io/flows/-/default/authentication/?next=/application/saml/splunk-cloud/sso/bind... HTTP 302
https://sso.show.corelight.io/if/flow/welcome-to-tme-show/?next=%2Fapplication%2Fsaml%2Fsplunk-cloud%2Fsso... Page URL

Page Statistics

19
Requests

89 %
HTTPS

0 %
IPv6

1
Domains

2
Subdomains

3
IPs

2
Countries

360 kB
Transfer

2697 kB
Size

3
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://splunk.bhusa24.show.corelight.io/ HTTP 303
https://splunk.bhusa24.show.corelight.io/de-DE/ HTTP 303
https://splunk.bhusa24.show.corelight.io/de-DE/account/login?return_to=%2Fde-DE%2F Page URL
https://sso.show.corelight.io/application/saml/splunk-cloud/sso/binding/post/ HTTP 302
https://sso.show.corelight.io/flows/-/default/authentication/?next=/application/saml/splunk-cloud/sso/binding/post/ HTTP 302
https://sso.show.corelight.io/if/flow/welcome-to-tme-show/?next=%2Fapplication%2Fsaml%2Fsplunk-cloud%2Fsso%2Fbinding%2Fpost%2F Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

https://splunk.bhusa24.show.corelight.io/ HTTP 303
https://splunk.bhusa24.show.corelight.io/de-DE/ HTTP 303
https://splunk.bhusa24.show.corelight.io/de-DE/account/login?return_to=%2Fde-DE%2F

Request Chain 2

https://splunk.bhusa24.show.corelight.io/favicon.ico HTTP 303
https://splunk.bhusa24.show.corelight.io/de-DE/favicon.ico

19 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

https://splunk.bhusa24.show.corelight.io/
https://splunk.bhusa24.show.corelight.io/de-DE/
https://splunk.bhusa24.show.corelight.io/de-DE/account/login?return_to=%2Fde-DE%2F

1 KB
948 B

199ms
198ms

Document
text/html

54.244.7.62
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://splunk.bhusa24.show.corelight.io/de-DE/account/login?return_to=%2Fde-DE%2F

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

54.244.7.62 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-54-244-7-62.us-west-2.compute.amazonaws.com

Software

Caddy Splunkd /

Resource Hash

f1b7d9c9999597e259466adef4740d9c81f6a751e89b827e3ffe82db0b122465

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000
cache-control: no-store, no-cache, must-revalidate, max-age=0
content-encoding: gzip
content-length: 844
content-type: text/html; charset=UTF-8
date: Fri, 02 Aug 2024 06:19:26 GMT
expires: Thu, 26 Oct 1978 00:00:00 GMT
server: Caddy Splunkd
vary: Accept-Encoding
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN

Redirect headers

alt-svc: h3=":443"; ma=2592000
content-encoding: gzip
content-length: 137
content-type: text/html;charset=utf-8
date: Fri, 02 Aug 2024 06:19:26 GMT
location: https://splunk.bhusa24.show.corelight.io/de-DE/account/login?return_to=%2Fde-DE%2F
server: Caddy Splunkd
vary: Accept-Encoding, Cookie
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN

GET
H2 200 progress-bar-animation.gif
splunk.bhusa24.show.corelight.io/de-DE/static/@5/img/splunk/ 7 KB
7 KB 204ms
203ms Image
image/gif 54.244.7.62
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://splunk.bhusa24.show.corelight.io/de-DE/static/@5/img/splunk/progress-bar-animation.gif

Requested by

Host: splunk.bhusa24.show.corelight.io
URL: https://splunk.bhusa24.show.corelight.io/de-DE/account/login?return_to=%2Fde-DE%2F

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

54.244.7.62 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-54-244-7-62.us-west-2.compute.amazonaws.com

Software

Caddy, Splunkd /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://splunk.bhusa24.show.corelight.io/de-DE/account/login?return_to=%2Fde-DE%2F
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Fri, 02 Aug 2024 06:19:26 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 05 Dec 2023 16:56:52 GMT
server: Caddy, Splunkd
etag: "12914D7F37F38CC8120E48C0B6123B1BB39B5E73"
vary: Accept-Encoding
content-type: image/gif
cache-control: public, max-age=31536000
alt-svc: h3=":443"; ma=2592000
content-length: 6933
expires: Fri, 02 Aug 2025 06:19:26 GMT

GET
H2

200

Primary Request / Show response
sso.show.corelight.io/if/flow/welcome-to-tme-show/
Redirect Chain

https://sso.show.corelight.io/application/saml/splunk-cloud/sso/binding/post/
https://sso.show.corelight.io/flows/-/default/authentication/?next=/application/saml/splunk-cloud/sso/binding/post/
https://sso.show.corelight.io/if/flow/welcome-to-tme-show/?next=%2Fapplication%2Fsaml%2Fsplunk-cloud%2Fsso%2Fbinding%2Fpost%2F

3 KB
1 KB

358ms
357ms

Document
text/html

3.1.157.18
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://sso.show.corelight.io/if/flow/welcome-to-tme-show/?next=%2Fapplication%2Fsaml%2Fsplunk-cloud%2Fsso%2Fbinding%2Fpost%2F

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.1.157.18 Singapore, Singapore, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-1-157-18.ap-southeast-1.compute.amazonaws.com

Software

Caddy / authentik

Resource Hash

f1bca3fb9859fc5fa981f698a9f60bb1580e749679bb1fb8c0f8043584e210dc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Content-Type: application/x-www-form-urlencoded
Origin: https://splunk.bhusa24.show.corelight.io
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

content-encoding: gzip
content-length: 1152
content-type: text/html; charset=utf-8
date: Fri, 02 Aug 2024 06:19:28 GMT
referrer-policy: same-origin
server: Caddy
vary: Accept-Encoding Cookie
x-authentik-id: 76835faaa9844e4ea18c21c15a6ea6cc
x-content-type-options: nosniff
x-frame-options: DENY
x-powered-by: authentik

Redirect headers

content-encoding: gzip
content-length: 23
content-type: text/html; charset=utf-8
date: Fri, 02 Aug 2024 06:19:27 GMT
location: /if/flow/welcome-to-tme-show/?next=%2Fapplication%2Fsaml%2Fsplunk-cloud%2Fsso%2Fbinding%2Fpost%2F
referrer-policy: same-origin
server: Caddy
vary: Accept-Encoding Cookie
x-authentik-id: 7e2bccf748074d28945ebb14563c7796
x-content-type-options: nosniff
x-frame-options: DENY
x-powered-by: authentik

GET
H2

200

favicon.ico
splunk.bhusa24.show.corelight.io/de-DE/
Redirect Chain

https://splunk.bhusa24.show.corelight.io/favicon.ico
https://splunk.bhusa24.show.corelight.io/de-DE/favicon.ico

21 KB
21 KB

198ms
198ms

Other
image/x-icon

54.244.7.62
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://splunk.bhusa24.show.corelight.io/de-DE/favicon.ico

Protocol

Server

54.244.7.62 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-54-244-7-62.us-west-2.compute.amazonaws.com

Software

Caddy, Splunkd /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://splunk.bhusa24.show.corelight.io/de-DE/account/login?return_to=%2Fde-DE%2F
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Fri, 02 Aug 2024 06:19:27 GMT
x-content-type-options: nosniff
last-modified: Tue, 05 Dec 2023 16:56:52 GMT
server: Caddy, Splunkd
vary: Accept-Encoding, Cookie
content-type: image/x-icon;charset=utf-8
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000
content-length: 21386

Redirect headers

date: Fri, 02 Aug 2024 06:19:27 GMT
x-content-type-options: nosniff
server: Caddy, Splunkd
vary: Accept-Language
x-frame-options: SAMEORIGIN
content-type: text/html; charset=UTF-8
location: https://splunk.bhusa24.show.corelight.io/de-DE/favicon.ico
alt-svc: h3=":443"; ma=2592000
content-length: 391

GET
H2 200 authentik.css
sso.show.corelight.io/static/dist/ 3 KB
1 KB 278ms
275ms Stylesheet
text/css 3.1.157.18
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://sso.show.corelight.io/static/dist/authentik.css
Requested by: Host: sso.show.corelight.io
URL: https://sso.show.corelight.io/if/flow/welcome-to-tme-show/?next=%2Fapplication%2Fsaml%2Fsplunk-cloud%2Fsso%2Fbinding%2Fpost%2F
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.1.157.18 Singapore, Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-1-157-18.ap-southeast-1.compute.amazonaws.com
Software: Caddy /
Resource Hash: 509f646c6170c4e29341e0b0b29f2514f9d237196ee9f0fa02fe306c59fee06f

Request headers

Referer: https://sso.show.corelight.io/if/flow/welcome-to-tme-show/?next=%2Fapplication%2Fsaml%2Fsplunk-cloud%2Fsso%2Fbinding%2Fpost%2F
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Fri, 02 Aug 2024 06:19:28 GMT
content-encoding: gzip
x-authentik-version: 2024.2.2
last-modified: Mon, 04 Mar 2024 19:41:14 GMT
server: Caddy
etag: 3526-c29559b457a3e2f3e84cb49f1fccb8c252ada393
vary: X-authentik-version, Etag
content-type: text/css; charset=utf-8
cache-control: public, no-transform
accept-ranges: bytes
content-length: 1189

GET
H2 200 custom.css
sso.show.corelight.io/static/dist/ 24 B
217 B 276ms
274ms Stylesheet
text/css 3.1.157.18
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://sso.show.corelight.io/static/dist/custom.css
Requested by: Host: sso.show.corelight.io
URL: https://sso.show.corelight.io/if/flow/welcome-to-tme-show/?next=%2Fapplication%2Fsaml%2Fsplunk-cloud%2Fsso%2Fbinding%2Fpost%2F
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.1.157.18 Singapore, Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-1-157-18.ap-southeast-1.compute.amazonaws.com
Software: Caddy /
Resource Hash: ec152d608ecdd5afadd070737507b7fea15b71094cd4e7339cb2bc39ad06f2bb

Request headers

Referer: https://sso.show.corelight.io/if/flow/welcome-to-tme-show/?next=%2Fapplication%2Fsaml%2Fsplunk-cloud%2Fsso%2Fbinding%2Fpost%2F
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Fri, 02 Aug 2024 06:19:28 GMT
content-encoding: gzip
x-authentik-version: 2024.2.2
last-modified: Mon, 04 Mar 2024 19:41:14 GMT
server: Caddy
etag: 24-bbee6a961baff52fe71d733786b39fa448084061
vary: X-authentik-version, Etag
content-type: text/css; charset=utf-8
cache-control: public, no-transform
accept-ranges: bytes
content-length: 48

GET
H2 200 poly.js Show response
sso.show.corelight.io/static/dist/ 392 KB
132 KB 547ms
546ms Script
text/javascript 3.1.157.18
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://sso.show.corelight.io/static/dist/poly.js?version=2024.2.2
Requested by: Host: sso.show.corelight.io
URL: https://sso.show.corelight.io/if/flow/welcome-to-tme-show/?next=%2Fapplication%2Fsaml%2Fsplunk-cloud%2Fsso%2Fbinding%2Fpost%2F
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.1.157.18 Singapore, Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-1-157-18.ap-southeast-1.compute.amazonaws.com
Software: Caddy /
Resource Hash: f275e712f8c8dd4c67def1d546d9cc7b132cb34310de8e3b69568235bfdb34d0

Request headers

Referer: https://sso.show.corelight.io/if/flow/welcome-to-tme-show/?next=%2Fapplication%2Fsaml%2Fsplunk-cloud%2Fsso%2Fbinding%2Fpost%2F
Origin: https://sso.show.corelight.io
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Fri, 02 Aug 2024 06:19:28 GMT
content-encoding: gzip
x-authentik-version: 2024.2.2
last-modified: Mon, 04 Mar 2024 19:41:23 GMT
server: Caddy
etag: 400919-d626f4b0043d7fa4d2dfc727b3882956f2431417
vary: X-authentik-version, Etag
content-type: text/javascript; charset=utf-8
cache-control: public, no-transform
accept-ranges: bytes

GET
H2 200 index.js Show response
sso.show.corelight.io/static/dist/standalone/loading/ 47 KB
9 KB 286ms
285ms Script
text/javascript 3.1.157.18
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://sso.show.corelight.io/static/dist/standalone/loading/index.js?version=2024.2.2
Requested by: Host: sso.show.corelight.io
URL: https://sso.show.corelight.io/if/flow/welcome-to-tme-show/?next=%2Fapplication%2Fsaml%2Fsplunk-cloud%2Fsso%2Fbinding%2Fpost%2F
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.1.157.18 Singapore, Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-1-157-18.ap-southeast-1.compute.amazonaws.com
Software: Caddy /
Resource Hash: 0141b78b34c2ce9dba8440c755e18b153fff062e2b6a37b2dab9052ab497d891

Request headers

Referer: https://sso.show.corelight.io/if/flow/welcome-to-tme-show/?next=%2Fapplication%2Fsaml%2Fsplunk-cloud%2Fsso%2Fbinding%2Fpost%2F
Origin: https://sso.show.corelight.io
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Fri, 02 Aug 2024 06:19:28 GMT
content-encoding: gzip
x-authentik-version: 2024.2.2
last-modified: Mon, 04 Mar 2024 19:42:03 GMT
server: Caddy
etag: 48354-f4492cf865076ebe1bac45412d51db081dde33aa
vary: X-authentik-version, Etag
content-type: text/javascript; charset=utf-8
cache-control: public, no-transform
accept-ranges: bytes

GET
H2 200 FlowInterface.js Show response
sso.show.corelight.io/static/dist/flow/ 166 B
235 B 546ms
545ms Script
text/javascript 3.1.157.18
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://sso.show.corelight.io/static/dist/flow/FlowInterface.js?version=2024.2.2
Requested by: Host: sso.show.corelight.io
URL: https://sso.show.corelight.io/if/flow/welcome-to-tme-show/?next=%2Fapplication%2Fsaml%2Fsplunk-cloud%2Fsso%2Fbinding%2Fpost%2F
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.1.157.18 Singapore, Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-1-157-18.ap-southeast-1.compute.amazonaws.com
Software: Caddy /
Resource Hash: 521cd6ee482e39f24f51e68c82868c6feb54670ad7164e68a1fa60dfa1625858

Request headers

Referer: https://sso.show.corelight.io/if/flow/welcome-to-tme-show/?next=%2Fapplication%2Fsaml%2Fsplunk-cloud%2Fsso%2Fbinding%2Fpost%2F
Origin: https://sso.show.corelight.io
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Fri, 02 Aug 2024 06:19:28 GMT
content-encoding: gzip
x-authentik-version: 2024.2.2
last-modified: Mon, 04 Mar 2024 19:42:31 GMT
server: Caddy
etag: 166-9894c3335572c55af067223360d88798d71569f9
vary: X-authentik-version, Etag
content-type: text/javascript; charset=utf-8
cache-control: public, no-transform
accept-ranges: bytes
content-length: 145

GET
H2 200 corelight-youtube-bkg_streaming-data.jpg
sso.show.corelight.io/media/public/flow-backgrounds/ 0
0 782ms
781ms Other
image/jpeg 3.1.157.18
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://sso.show.corelight.io/media/public/flow-backgrounds/corelight-youtube-bkg_streaming-data.jpg
Requested by: Host: sso.show.corelight.io
URL: https://sso.show.corelight.io/if/flow/welcome-to-tme-show/?next=%2Fapplication%2Fsaml%2Fsplunk-cloud%2Fsso%2Fbinding%2Fpost%2F
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.1.157.18 Singapore, Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-1-157-18.ap-southeast-1.compute.amazonaws.com
Software: Caddy /
Resource Hash

Request headers

Referer: https://sso.show.corelight.io/if/flow/welcome-to-tme-show/?next=%2Fapplication%2Fsaml%2Fsplunk-cloud%2Fsso%2Fbinding%2Fpost%2F
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Fri, 02 Aug 2024 06:19:28 GMT
content-encoding: gzip
x-authentik-version: 2024.2.2
last-modified: Fri, 16 Feb 2024 13:56:25 GMT
server: Caddy
etag: 248223-5a27ed056660eb58bf011747b84dd483082e2113
vary: X-authentik-version, Etag
content-type: image/jpeg
cache-control: public, no-transform
accept-ranges: bytes

GET
H2 200 FlowInterface-rAdB7lO9.js Show response
sso.show.corelight.io/static/dist/flow/ 325 KB
38 KB 812ms
811ms Script
text/javascript 3.1.157.18
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://sso.show.corelight.io/static/dist/flow/FlowInterface-rAdB7lO9.js
Requested by: Host: splunk.bhusa24.show.corelight.io
URL: https://splunk.bhusa24.show.corelight.io/de-DE/account/login?return_to=%2Fde-DE%2F
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.1.157.18 Singapore, Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-1-157-18.ap-southeast-1.compute.amazonaws.com
Software: Caddy /
Resource Hash: 167e89c434fae9e6d4902cde619d8377a4fc2e057fe138a139899e690d3559ba

Request headers

Referer: https://sso.show.corelight.io/static/dist/flow/FlowInterface.js?version=2024.2.2
Origin: https://sso.show.corelight.io
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Fri, 02 Aug 2024 06:19:29 GMT
content-encoding: gzip
x-authentik-version: 2024.2.2
last-modified: Mon, 04 Mar 2024 19:42:31 GMT
server: Caddy
etag: 333196-937d045f09e34d279567a9e74ce0e6dc1848a8f0
vary: X-authentik-version, Etag
content-type: text/javascript; charset=utf-8
cache-control: public, no-transform
accept-ranges: bytes

GET
H2 200 vendor-DrRUEw1U.js
sso.show.corelight.io/static/dist/flow/ 1 MB
0 812ms
811ms Script
text/javascript 3.1.157.18
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://sso.show.corelight.io/static/dist/flow/vendor-DrRUEw1U.js
Requested by: Host: splunk.bhusa24.show.corelight.io
URL: https://splunk.bhusa24.show.corelight.io/de-DE/account/login?return_to=%2Fde-DE%2F
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.1.157.18 Singapore, Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-1-157-18.ap-southeast-1.compute.amazonaws.com
Software: Caddy /
Resource Hash

Request headers

Referer: https://sso.show.corelight.io/static/dist/flow/FlowInterface.js?version=2024.2.2
Origin: https://sso.show.corelight.io
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Fri, 02 Aug 2024 06:19:29 GMT
content-encoding: gzip
x-authentik-version: 2024.2.2
last-modified: Mon, 04 Mar 2024 19:42:31 GMT
server: Caddy
etag: 1599729-9db248d2d6eac6eda165a30fe75371bb417eb279
vary: X-authentik-version, Etag
content-type: text/javascript; charset=utf-8
cache-control: public, no-transform
accept-ranges: bytes

GET
H2 200 api-BHvZxMjI.js Show response
sso.show.corelight.io/static/dist/flow/ 332 KB
28 KB 812ms
812ms Script
text/javascript 3.1.157.18
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://sso.show.corelight.io/static/dist/flow/api-BHvZxMjI.js
Requested by: Host: splunk.bhusa24.show.corelight.io
URL: https://splunk.bhusa24.show.corelight.io/de-DE/account/login?return_to=%2Fde-DE%2F
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.1.157.18 Singapore, Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-1-157-18.ap-southeast-1.compute.amazonaws.com
Software: Caddy /
Resource Hash: fbc840442d474a7c1ea87f87b277eb20bdda918d35704bd24fcffa91a2c051de

Request headers

Referer: https://sso.show.corelight.io/static/dist/flow/FlowInterface.js?version=2024.2.2
Origin: https://sso.show.corelight.io
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Fri, 02 Aug 2024 06:19:29 GMT
content-encoding: gzip
x-authentik-version: 2024.2.2
last-modified: Mon, 04 Mar 2024 19:42:31 GMT
server: Caddy
etag: 339537-501d2f003d73cba2013f1e7a039cdcdb416b267f
vary: X-authentik-version, Etag
content-type: text/javascript; charset=utf-8
cache-control: public, no-transform
accept-ranges: bytes

GET
H2 200 locale-en-DooEh9Zz.js Show response
sso.show.corelight.io/static/dist/flow/ 95 KB
41 KB 812ms
812ms Script
text/javascript 3.1.157.18
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://sso.show.corelight.io/static/dist/flow/locale-en-DooEh9Zz.js
Requested by: Host: splunk.bhusa24.show.corelight.io
URL: https://splunk.bhusa24.show.corelight.io/de-DE/account/login?return_to=%2Fde-DE%2F
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.1.157.18 Singapore, Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-1-157-18.ap-southeast-1.compute.amazonaws.com
Software: Caddy /
Resource Hash: 092c436f4eedecdb58fa8e5c441813b163b6c0bf43da8607db42c2ec0bf2f261

Request headers

Referer: https://sso.show.corelight.io/static/dist/flow/FlowInterface.js?version=2024.2.2
Origin: https://sso.show.corelight.io
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Fri, 02 Aug 2024 06:19:29 GMT
content-encoding: gzip
x-authentik-version: 2024.2.2
last-modified: Mon, 04 Mar 2024 19:42:31 GMT
server: Caddy
etag: 97372-401b7b2c6e36ee9cf01bc838eebaf8920e356ff7
vary: X-authentik-version, Etag
content-type: text/javascript; charset=utf-8
cache-control: public, no-transform
accept-ranges: bytes

GET
H2 200 vendor-Biglt-kt.js Show response
sso.show.corelight.io/static/dist/standalone/loading/ 211 KB
36 KB 812ms
811ms Script
text/javascript 3.1.157.18
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://sso.show.corelight.io/static/dist/standalone/loading/vendor-Biglt-kt.js
Requested by: Host: splunk.bhusa24.show.corelight.io
URL: https://splunk.bhusa24.show.corelight.io/de-DE/account/login?return_to=%2Fde-DE%2F
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.1.157.18 Singapore, Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-1-157-18.ap-southeast-1.compute.amazonaws.com
Software: Caddy /
Resource Hash: 9ca2c15c24ee37b44f7459ef674fa20d92e2de112f15be9cd39a066203ae9c77

Request headers

Referer: https://sso.show.corelight.io/static/dist/standalone/loading/index.js?version=2024.2.2
Origin: https://sso.show.corelight.io
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Fri, 02 Aug 2024 06:19:29 GMT
content-encoding: gzip
x-authentik-version: 2024.2.2
last-modified: Mon, 04 Mar 2024 19:42:03 GMT
server: Caddy
etag: 215895-acbbbd9def52b0e217ae76b5305638666070a30a
vary: X-authentik-version, Etag
content-type: text/javascript; charset=utf-8
cache-control: public, no-transform
accept-ranges: bytes

GET
H2 200 api-tBS34Xuf.js Show response
sso.show.corelight.io/static/dist/standalone/loading/ 77 KB
9 KB 812ms
812ms Script
text/javascript 3.1.157.18
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://sso.show.corelight.io/static/dist/standalone/loading/api-tBS34Xuf.js
Requested by: Host: splunk.bhusa24.show.corelight.io
URL: https://splunk.bhusa24.show.corelight.io/de-DE/account/login?return_to=%2Fde-DE%2F
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.1.157.18 Singapore, Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-1-157-18.ap-southeast-1.compute.amazonaws.com
Software: Caddy /
Resource Hash: 80150dd17b8656783f3d8cb20832bc51c60188aeaffc2d3b340927e527936e80

Request headers

Referer: https://sso.show.corelight.io/static/dist/standalone/loading/index.js?version=2024.2.2
Origin: https://sso.show.corelight.io
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Fri, 02 Aug 2024 06:19:29 GMT
content-encoding: gzip
x-authentik-version: 2024.2.2
last-modified: Mon, 04 Mar 2024 19:42:03 GMT
server: Caddy
etag: 78411-b9c87004b5961ea35a32f04a7017728f215b20e8
vary: X-authentik-version, Etag
content-type: text/javascript; charset=utf-8
cache-control: public, no-transform
accept-ranges: bytes

GET
H2 200 custom.css Show response
sso.show.corelight.io/static/dist/ 24 B
0 0ms
0ms Fetch
text/css 3.1.157.18
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://sso.show.corelight.io/static/dist/custom.css
Requested by: Host: sso.show.corelight.io
URL: https://sso.show.corelight.io/static/dist/standalone/loading/index.js?version=2024.2.2
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.1.157.18 Singapore, Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-1-157-18.ap-southeast-1.compute.amazonaws.com
Software: Caddy /
Resource Hash: ec152d608ecdd5afadd070737507b7fea15b71094cd4e7339cb2bc39ad06f2bb

Request headers

Referer: https://sso.show.corelight.io/if/flow/welcome-to-tme-show/?next=%2Fapplication%2Fsaml%2Fsplunk-cloud%2Fsso%2Fbinding%2Fpost%2F
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Fri, 02 Aug 2024 06:19:28 GMT
content-encoding: gzip
x-authentik-version: 2024.2.2
last-modified: Mon, 04 Mar 2024 19:41:14 GMT
server: Caddy
etag: 24-bbee6a961baff52fe71d733786b39fa448084061
vary: X-authentik-version, Etag
content-type: text/css; charset=utf-8
cache-control: public, no-transform
accept-ranges: bytes
content-length: 48

GET RedHatText-Regular.woff2
sso.show.corelight.io/if/flow/welcome-to-tme-show/assets/fonts/RedHatText/ 0
0

GET
H2 200 RedHatText-Regular.woff
sso.show.corelight.io/if/flow/welcome-to-tme-show/assets/fonts/RedHatText/ 35 KB
35 KB 276ms
275ms Font
font/woff 3.1.157.18
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://sso.show.corelight.io/if/flow/welcome-to-tme-show/assets/fonts/RedHatText/RedHatText-Regular.woff
Requested by: Host: sso.show.corelight.io
URL: https://sso.show.corelight.io/if/flow/welcome-to-tme-show/?next=%2Fapplication%2Fsaml%2Fsplunk-cloud%2Fsso%2Fbinding%2Fpost%2F
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.1.157.18 Singapore, Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-1-157-18.ap-southeast-1.compute.amazonaws.com
Software: Caddy /
Resource Hash: df36d7d048d973a8990a2218f3c425ffbb077c8676fd8260178a3769fb34e76e

Request headers

Referer: https://sso.show.corelight.io/if/flow/welcome-to-tme-show/?next=%2Fapplication%2Fsaml%2Fsplunk-cloud%2Fsso%2Fbinding%2Fpost%2F
Origin: https://sso.show.corelight.io
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

date: Fri, 02 Aug 2024 06:19:30 GMT
content-encoding: gzip
x-authentik-version: 2024.2.2
last-modified: Mon, 04 Mar 2024 19:41:14 GMT
server: Caddy
etag: 35980-e1f2ae7876ff378f32fb17090eb2ff3672ee1fee
vary: X-authentik-version, Etag
content-type: font/woff
cache-control: public, no-transform
accept-ranges: bytes

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: sso.show.corelight.io
URL: https://sso.show.corelight.io/if/flow/welcome-to-tme-show/assets/fonts/RedHatText/RedHatText-Regular.woff2

Verdicts & Comments Add Verdict or Comment

13 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

3 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
splunk.bhusa24.show.corelight.io/	1970-01-20 22:29:43	Name: session_id_8000 Value: 0e2d115fa66f98cc22c3f4428cda9f1ef492bff0
sso.show.corelight.io/	1969-12-31 23:59:59	Name: authentik_session Value: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzaWQiOiJrZWJxbzh1Y2kwb2drcGl3dTBwMXQ1OXFzMnRmdW1qayIsImlzcyI6ImF1dGhlbnRpayIsInN1YiI6ImFub255bW91cyIsImF1dGhlbnRpY2F0ZWQiOmZhbHNlLCJhY3IiOiJnb2F1dGhlbnRpay5pby9jb3JlL2RlZmF1bHQifQ.61zJddH407ZX_o6iwmWoUMQErsRCJk1RZWC1sx9Pr6I
sso.show.corelight.io/	1970-01-21 07:13:49	Name: authentik_csrf Value: S3oVzSZkykjUS8MBvtSOOGIZfFAeeR0s

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

splunk.bhusa24.show.corelight.io
sso.show.corelight.io
sso.show.corelight.io
3.1.157.18
54.244.7.62
0141b78b34c2ce9dba8440c755e18b153fff062e2b6a37b2dab9052ab497d891
092c436f4eedecdb58fa8e5c441813b163b6c0bf43da8607db42c2ec0bf2f261
167e89c434fae9e6d4902cde619d8377a4fc2e057fe138a139899e690d3559ba
509f646c6170c4e29341e0b0b29f2514f9d237196ee9f0fa02fe306c59fee06f
521cd6ee482e39f24f51e68c82868c6feb54670ad7164e68a1fa60dfa1625858
80150dd17b8656783f3d8cb20832bc51c60188aeaffc2d3b340927e527936e80
9ca2c15c24ee37b44f7459ef674fa20d92e2de112f15be9cd39a066203ae9c77
df36d7d048d973a8990a2218f3c425ffbb077c8676fd8260178a3769fb34e76e
ec152d608ecdd5afadd070737507b7fea15b71094cd4e7339cb2bc39ad06f2bb
f1b7d9c9999597e259466adef4740d9c81f6a751e89b827e3ffe82db0b122465
f1bca3fb9859fc5fa981f698a9f60bb1580e749679bb1fb8c0f8043584e210dc
f275e712f8c8dd4c67def1d546d9cc7b132cb34310de8e3b69568235bfdb34d0
fbc840442d474a7c1ea87f87b277eb20bdda918d35704bd24fcffa91a2c051de

sso.show.corelight.io Open in urlscan Pro 3.1.157.18 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Page Statistics

19 Requests

89 %HTTPS

0 %IPv6

1 Domains

2 Subdomains

3 IPs

2 Countries

360 kBTransfer

2697 kBSize

3 Cookies

0 Outgoing links

Page URL History

Redirected requests

19 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

13 JavaScript Global Variables

3 Cookies

Security Headers

Indicators

sso.show.corelight.io Open in urlscan Pro
3.1.157.18 Public Scan

Screenshot
Live screenshot

Full Image

19
Requests

89 %
HTTPS

0 %
IPv6

1
Domains

2
Subdomains

3
IPs

2
Countries

360 kB
Transfer

2697 kB
Size

3
Cookies

19 HTTP transactions
0 data transactions