urlscan.io logo urlscan.io
SecurityTrails logo

discovercoastalvacations.com Open in urlscan Pro
69.73.170.122  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: http://discovercoastalvacations.com/NottinghamForest/
Submission: On September 05 via api from TW
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 3 IPs in 1 countries across 2 domains to perform 10 HTTP transactions. The main IP is 69.73.170.122, located in Spring, United States and belongs to NTHL, US. The main domain is discovercoastalvacations.com.
This is the only time discovercoastalvacations.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Smartsheets (Online) Generic (Online)

Domain & IP information

IP Address AS Autonomous System
1 69.73.170.122 11042 (NTHL)
6 34.200.47.152 14618 (AMAZON-AES)
3 2600:9000:21f... 16509 (AMAZON-02)
10 3
Domain Requested by
6 app.smartsheet.com discovercoastalvacations.com
3 s.smartsheet.com discovercoastalvacations.com
1 discovercoastalvacations.com
10 3

This site contains no links.

Subject Issuer Validity Valid
app.smartsheet.com
DigiCert SHA2 Secure Server CA		 2019-07-31 -
2021-08-04		 2 years crt.sh
s.smartsheet.com
DigiCert SHA2 Secure Server CA		 2019-10-13 -
2020-10-16		 a year crt.sh

This page contains 2 frames:

Primary Page: http://discovercoastalvacations.com/NottinghamForest/
Frame ID: 1D2C7BCCB2A23BCBDF441C51D4C56CB0
Requests: 9 HTTP requests in this frame

Frame: https://s.smartsheet.com/b/htmlSandbox/gtm-iframe_v2.html?http%3A%2F%2Fdiscovercoastalvacations.com&GTM-5GPPFG&eventObject=login%20screen&eventNoun=Form%20-%20Login
Frame ID: ACA2761C1296AACC6C3BDC3CD833DD2B
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i

Page Statistics

10
Requests

90 %
HTTPS

33 %
IPv6

2
Domains

3
Subdomains

3
IPs

1
Countries

58 kB
Transfer

56 kB
Size

0
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

10 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
discovercoastalvacations.com/NottinghamForest/ 		11 KB
12 KB 		Document
General
Check archive.org
Download Go to
Full URL
http://discovercoastalvacations.com/NottinghamForest/
Protocol
HTTP/1.1
Server
69.73.170.122 Spring, United States, ASN11042 (NTHL, US),
Reverse DNS
static-122-170-73-69.nocdirect.com
Software
Apache / PHP/5.6.40
Resource Hash
f031ae4a49334f2e93d100c49ee4cf4cd53a823cda7f0b0274a5a6be0142d02e

Request headers

Host
discovercoastalvacations.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding
gzip, deflate
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Sat, 05 Sep 2020 00:19:43 GMT
Server
Apache
X-Powered-By
PHP/5.6.40
Keep-Alive
timeout=5, max=100
Connection
Keep-Alive
Transfer-Encoding
chunked
Content-Type
text/html; charset=UTF-8
login.2x_59.2.3.css
app.smartsheet.com/b/css/ 		0
0 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://app.smartsheet.com/b/css/login.2x_59.2.3.css
Requested by
Host: discovercoastalvacations.com
URL: http://discovercoastalvacations.com/NottinghamForest/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.200.47.152 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-34-200-47-152.compute-1.amazonaws.com
Software
/
Resource Hash

Request headers

Referer
http://discovercoastalvacations.com/NottinghamForest/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers
1_59.2.3.js
app.smartsheet.com/b/javascript/ 		0
0 		Script
General
Check archive.org
Download Go to
Full URL
https://app.smartsheet.com/b/javascript/1_59.2.3.js
Requested by
Host: discovercoastalvacations.com
URL: http://discovercoastalvacations.com/NottinghamForest/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.200.47.152 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-34-200-47-152.compute-1.amazonaws.com
Software
/
Resource Hash

Request headers

Referer
http://discovercoastalvacations.com/NottinghamForest/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers
LG_59.2.3.js
app.smartsheet.com/b/javascript/ 		0
0 		Script
General
Check archive.org
Download Go to
Full URL
https://app.smartsheet.com/b/javascript/LG_59.2.3.js
Requested by
Host: discovercoastalvacations.com
URL: http://discovercoastalvacations.com/NottinghamForest/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.200.47.152 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-34-200-47-152.compute-1.amazonaws.com
Software
/
Resource Hash

Request headers

Referer
http://discovercoastalvacations.com/NottinghamForest/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers
img_logoAndName_white2.2x.png
app.smartsheet.com/b/images/ 		24 KB
24 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://app.smartsheet.com/b/images/img_logoAndName_white2.2x.png
Requested by
Host: discovercoastalvacations.com
URL: http://discovercoastalvacations.com/NottinghamForest/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.200.47.152 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-34-200-47-152.compute-1.amazonaws.com
Software
nginx /
Resource Hash
fecc828829da6210bb82420a178e0da7d341e0393c126f07f4165a26e22fb4b3

Request headers

Referer
http://discovercoastalvacations.com/NottinghamForest/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 05 Sep 2020 00:19:42 GMT
last-modified
Wed, 26 Aug 2020 22:57:02 GMT
server
nginx
etag
"5f46e8be-600c"
content-type
image/png
status
200
cache-control
max-age=7776000
accept-ranges
bytes
content-length
24588
expires
Fri, 04 Dec 2020 00:19:42 GMT
img_login_google2.2x.png
s.smartsheet.com/b/images/ 		4 KB
4 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s.smartsheet.com/b/images/img_login_google2.2x.png
Requested by
Host: discovercoastalvacations.com
URL: http://discovercoastalvacations.com/NottinghamForest/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:21f3:9a00:5:944f:ee00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx /
Resource Hash
174b1cf225e5d72596d3d4b62880b4950c7a0bad706ada28b797e8a706cce0da

Request headers

Referer
http://discovercoastalvacations.com/NottinghamForest/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 05 Sep 2020 00:16:20 GMT
via
1.1 1bf129b8787cf2e96d3bce725554e4d5.cloudfront.net (CloudFront)
last-modified
Wed, 26 Aug 2020 22:57:00 GMT
server
nginx
age
202
etag
"5f46e8bc-e8b"
x-cache
Hit from cloudfront
content-type
image/png
status
200
cache-control
max-age=7776000
x-amz-cf-pop
FRA2-C2
accept-ranges
bytes
content-length
3723
x-amz-cf-id
-uoDE9C35wOmelDU9gq9Q1KlM7yyIInTTY-QWy3d90_3u2kq43zGHg==
expires
Fri, 04 Dec 2020 00:16:20 GMT
img_login_microsoft2.2x.png
s.smartsheet.com/b/images/ 		455 B
817 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s.smartsheet.com/b/images/img_login_microsoft2.2x.png
Requested by
Host: discovercoastalvacations.com
URL: http://discovercoastalvacations.com/NottinghamForest/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:21f3:9a00:5:944f:ee00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx /
Resource Hash
9864fdf995368063ea9a55fb0f6baa42cfb677c33d704f959459b0848dbda8b3

Request headers

Referer
http://discovercoastalvacations.com/NottinghamForest/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 01 Sep 2020 04:58:06 GMT
via
1.1 1bf129b8787cf2e96d3bce725554e4d5.cloudfront.net (CloudFront)
last-modified
Wed, 26 Aug 2020 22:57:00 GMT
server
nginx
age
328896
etag
"5f46e8bc-1c7"
x-cache
Hit from cloudfront
content-type
image/png
status
200
cache-control
max-age=7776000
x-amz-cf-pop
FRA2-C2
accept-ranges
bytes
content-length
455
x-amz-cf-id
MxdYI292g5hJLg2Yi9DPR2JW5k0CTIs6r2nHNkhVHHH3XZYIJ4V74Q==
expires
Mon, 30 Nov 2020 04:58:06 GMT
img_badge_appstore.2x.png
app.smartsheet.com/b/images/ 		8 KB
9 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://app.smartsheet.com/b/images/img_badge_appstore.2x.png
Requested by
Host: discovercoastalvacations.com
URL: http://discovercoastalvacations.com/NottinghamForest/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.200.47.152 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-34-200-47-152.compute-1.amazonaws.com
Software
nginx /
Resource Hash
4b4fdacb0ec7419861b412032c6189e8253822499077b3f47536040ca6f02e0a

Request headers

Referer
http://discovercoastalvacations.com/NottinghamForest/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 05 Sep 2020 00:19:42 GMT
last-modified
Wed, 26 Aug 2020 22:57:00 GMT
server
nginx
etag
"5f46e8bc-21e1"
content-type
image/png
status
200
cache-control
max-age=7776000
accept-ranges
bytes
content-length
8673
expires
Fri, 04 Dec 2020 00:19:42 GMT
img_badge_googleplay.2x.png
app.smartsheet.com/b/images/ 		8 KB
8 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://app.smartsheet.com/b/images/img_badge_googleplay.2x.png
Requested by
Host: discovercoastalvacations.com
URL: http://discovercoastalvacations.com/NottinghamForest/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.200.47.152 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-34-200-47-152.compute-1.amazonaws.com
Software
nginx /
Resource Hash
36b9efcdd7af5cc78420da58ef4d789c5cba2dd66ed9de39fd9d444d4a797ca6

Request headers

Referer
http://discovercoastalvacations.com/NottinghamForest/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Sat, 05 Sep 2020 00:19:42 GMT
last-modified
Wed, 26 Aug 2020 22:57:00 GMT
server
nginx
etag
"5f46e8bc-1fbb"
content-type
image/png
status
200
cache-control
max-age=7776000
accept-ranges
bytes
content-length
8123
expires
Fri, 04 Dec 2020 00:19:42 GMT
gtm-iframe_v2.html
s.smartsheet.com/b/htmlSandbox/ Frame ACA2 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://s.smartsheet.com/b/htmlSandbox/gtm-iframe_v2.html?http%3A%2F%2Fdiscovercoastalvacations.com&GTM-5GPPFG&eventObject=login%20screen&eventNoun=Form%20-%20Login
Requested by
Host: discovercoastalvacations.com
URL: http://discovercoastalvacations.com/NottinghamForest/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:21f3:9a00:5:944f:ee00:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx /
Resource Hash

Request headers

:method
GET
:authority
s.smartsheet.com
:scheme
https
:path
/b/htmlSandbox/gtm-iframe_v2.html?http%3A%2F%2Fdiscovercoastalvacations.com&GTM-5GPPFG&eventObject=login%20screen&eventNoun=Form%20-%20Login
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
http://discovercoastalvacations.com/NottinghamForest/
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
http://discovercoastalvacations.com/NottinghamForest/

Response headers

status
200
content-type
text/html
content-length
3351
date
Fri, 04 Sep 2020 01:58:45 GMT
server
nginx
last-modified
Wed, 26 Aug 2020 22:57:02 GMT
etag
"5f46e8be-d17"
accept-ranges
bytes
x-cache
Hit from cloudfront
via
1.1 1bf129b8787cf2e96d3bce725554e4d5.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA2-C2
x-amz-cf-id
AUrWQKSePXkMcavIVIcrkPbPWfF1jCcIJgOFy_PLkjwmsjuYbk2zMw==
age
80457

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Smartsheets (Online) Generic (Online)

8 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| trustedTypes object| ZQ function| showTooltips function| hideTooltips function| loadLoginBody function| downloadApp function| loggedFailures object| frame

0 Cookies