![](/screenshots/fc0ce022-3d71-4c9e-a7dc-ab78b487dd29.png)
app.smartsheetgov.com
Open in
urlscan Pro
52.61.187.209
Malicious Activity!
Public Scan
Effective URL: https://app.smartsheetgov.com/b/authorize?scope=READ_USERS&response_type=code&state=eJyrVspLrShRslJQ0k8sLcnQT81LKcjPzCvRz8lPz8...
Submission: On September 24 via manual from US
Summary
TLS certificate: Issued by Amazon on August 20th 2020. Valid for: a year.
This is the only time app.smartsheetgov.com was scanned on urlscan.io!
urlscan.io Verdict: Potentially Malicious
Targeting these brands: Generic (Online)Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
3 3 | 143.204.215.26 143.204.215.26 | 16509 (AMAZON-02) (AMAZON-02) | |
2 2 | 54.235.84.20 54.235.84.20 | 14618 (AMAZON-AES) (AMAZON-AES) | |
11 | 52.61.187.209 52.61.187.209 | 8987 (AMAZON EX...) (AMAZON EXPANSION) | |
1 | 2a00:1450:400... 2a00:1450:4001:820::200e | 15169 (GOOGLE) (GOOGLE) | |
12 | 2 |
ASN16509 (AMAZON-02, US)
PTR: server-143-204-215-26.fra53.r.cloudfront.net
learn.smartsheetgov.com |
ASN14618 (AMAZON-AES, US)
PTR: ec2-54-235-84-20.compute-1.amazonaws.com
accounts.skilljar.com |
ASN8987 (AMAZON EXPANSION, GB)
PTR: ec2-52-61-187-209.us-gov-west-1.compute.amazonaws.com
app.smartsheetgov.com | |
aws.smartsheetgov.com | |
s.smartsheetgov.com |
ASN15169 (GOOGLE, US)
www.google-analytics.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
14 |
smartsheetgov.com
3 redirects
learn.smartsheetgov.com app.smartsheetgov.com aws.smartsheetgov.com s.smartsheetgov.com |
255 KB |
2 |
skilljar.com
2 redirects
accounts.skilljar.com |
2 KB |
1 |
google-analytics.com
www.google-analytics.com |
18 KB |
12 | 3 |
Domain | Requested by | |
---|---|---|
8 | app.smartsheetgov.com |
app.smartsheetgov.com
|
3 | learn.smartsheetgov.com | 3 redirects |
2 | s.smartsheetgov.com |
app.smartsheetgov.com
|
2 | accounts.skilljar.com | 2 redirects |
1 | www.google-analytics.com |
app.smartsheetgov.com
|
1 | aws.smartsheetgov.com |
app.smartsheetgov.com
|
12 | 6 |
This site contains links to these domains. Also see Links.
Domain |
---|
www.smartsheet.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
app.smartsheetgov.com Amazon |
2020-08-20 - 2021-09-19 |
a year | crt.sh |
aws.smartsheetgov.com Amazon |
2020-08-20 - 2021-09-19 |
a year | crt.sh |
s.smartsheetgov.com Amazon |
2020-08-20 - 2021-09-19 |
a year | crt.sh |
*.google.com GTS CA 1O1 |
2020-08-26 - 2020-11-18 |
3 months | crt.sh |
This page contains 1 frames:
Primary Page:
https://app.smartsheetgov.com/b/authorize?scope=READ_USERS&response_type=code&state=eJyrVspLrShRslJQ0k8sLcnQT81LKcjPzCvRz8lPz8zTL0otLs0psU-xNbQwrcoqSUwxLC0vtVAD6bFVNXJT0lFQAms2zEstKDM3MayqMM4zAYmmgEWRNYFEC4ryk1OLi0FyYPNBYmUgnkdWamRAokuRa2lYoVItABj6Lo0%3D&redirect_uri=https%3A%2F%2Faccounts.skilljar.com%2Faccounts%2F185zjtad1uwu8%2Foauth2%2Flogin%2Fcallback&client_id=wed2e0aq6sn8wldagf2
Frame ID: 11DA37E269C29D778A41AFFC8D784D6B
Requests: 12 HTTP requests in this frame
Screenshot
![](/screenshots/fc0ce022-3d71-4c9e-a7dc-ab78b487dd29.png)
Page URL History Show full URLs
-
http://learn.smartsheetgov.com/
HTTP 301
https://learn.smartsheetgov.com/ HTTP 302
https://learn.smartsheetgov.com/auth/login?next=%2F HTTP 302
https://accounts.skilljar.com/auth/endpoint/login?next=%2F&d=185zjtad1uwu8 HTTP 302
https://accounts.skilljar.com/accounts/185zjtad1uwu8/oauth2/login?d=185zjtad1uwu8&next=%2Fauth%2Fendpoint%... HTTP 302
https://app.smartsheetgov.com/b/authorize?scope=READ_USERS&response_type=code&state=eJyrVspLrShRslJQ0k8sLc... Page URL
Page Statistics
2 Outgoing links
These are links going to different origins than the main page.
Title: Don't have a login? Contact us.
Search URL Search Domain Scan URL
Title: Privacy Policy
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://learn.smartsheetgov.com/
HTTP 301
https://learn.smartsheetgov.com/ HTTP 302
https://learn.smartsheetgov.com/auth/login?next=%2F HTTP 302
https://accounts.skilljar.com/auth/endpoint/login?next=%2F&d=185zjtad1uwu8 HTTP 302
https://accounts.skilljar.com/accounts/185zjtad1uwu8/oauth2/login?d=185zjtad1uwu8&next=%2Fauth%2Fendpoint%2Flogin%2Fresult%3Fd%3D185zjtad1uwu8%26next%3D%252F HTTP 302
https://app.smartsheetgov.com/b/authorize?scope=READ_USERS&response_type=code&state=eJyrVspLrShRslJQ0k8sLcnQT81LKcjPzCvRz8lPz8zTL0otLs0psU-xNbQwrcoqSUwxLC0vtVAD6bFVNXJT0lFQAms2zEstKDM3MayqMM4zAYmmgEWRNYFEC4ryk1OLi0FyYPNBYmUgnkdWamRAokuRa2lYoVItABj6Lo0%3D&redirect_uri=https%3A%2F%2Faccounts.skilljar.com%2Faccounts%2F185zjtad1uwu8%2Foauth2%2Flogin%2Fcallback&client_id=wed2e0aq6sn8wldagf2 Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
12 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
authorize
app.smartsheetgov.com/b/ Redirect Chain
|
18 KB 5 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
fonts.2x_101.1.1.css
app.smartsheetgov.com/b/css/ |
3 KB 766 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
login.2x_101.1.1.css
app.smartsheetgov.com/b/css/ |
12 KB 3 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
core_101.1.1.js
app.smartsheetgov.com/b/javascript/ |
416 KB 100 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
login_101.1.1.js
app.smartsheetgov.com/b/javascript/ |
87 KB 31 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
b!52!6275f61d112045e8bcc5f8b9e854d3c5
aws.smartsheetgov.com/storageProxy/image/images/ |
1 KB 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
smartsheet-gov-logo-dark-text.svg
app.smartsheetgov.com/b/images/ |
18 KB 7 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
img_login_google2.2x.png
s.smartsheetgov.com/b/images/ |
4 KB 4 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
img_login_microsoft2.2x.png
s.smartsheetgov.com/b/images/ |
455 B 586 B |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
analytics.js
www.google-analytics.com/ |
45 KB 18 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
roboto-regular.woff2
app.smartsheetgov.com/b/fonts/roboto/ |
50 KB 50 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
roboto-700.woff2
app.smartsheetgov.com/b/fonts/roboto/ |
50 KB 50 KB |
Font
font/woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!
urlscan
Phishing against: Generic (Online)545 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| trustedTypes boolean| isHighDpi object| clientState object| LogActionId object| b object| HomeNavTreeControlId object| c object| MessageBarUpsellControlId object| d object| PersonalizedOnboardingControlIds object| e object| OnboardingPage object| f object| ExploreType object| g object| TemplateCallToAction object| h function| ClientEventLookup object| WalkthroughInfoTipControlId object| MoveDirection object| m object| UpsellUpgradeType object| n function| sortMentionListAscending object| CommVisibilityType object| o object| NavigationErrorType object| p object| WalkthroughType object| q object| TipType object| r object| MediaType object| s object| TipTargetType object| t object| TipTargetAlignment object| u object| TipTargetPosition object| v object| PaginationType object| w object| WalkthroughControlId object| x object| WalkthroughAutoShownId object| y object| DomainTargetState object| z object| AttachmentDocType object| A object| AttachmentExternalSource object| B object| AttachmentPanelViewMode object| C object| AttachmentParentType object| D object| AttachmentRootOwnerTypeId object| E object| AttachmentType object| F object| AttachmentUploadValidationState object| G object| ChartAxisLocation object| H object| ChartAxisScaleType object| I object| ChartAxisType object| J object| ChartDataLabelStyle object| K object| ChartLegendPosition object| L object| ChartLineType object| M object| ChartSeriesSelectionOrder object| N object| ChartSeriesType object| O object| ChartTitlePosition object| P object| ChartTooltipStyle object| Q object| ChartHorizontalAlignment object| R object| ChartFormatToolbarType object| S object| ChartFormattableElementType object| T object| ChartFontSizeAdjustDirection object| U object| ChartConfigChartType object| V object| DmAnchorType object| W object| ThreadAnchorType object| X object| CommentsViewMode object| Y object| ScrollType object| Z object| CommentsScope function| $ object| LegacyGridFormPublishStatus object| _ object| LegacyGridFormStyleType object| aa object| LegacyGridFormCompletionType object| ba object| LegacyGridFormAccessType object| ca object| LegacyGridFormFlag object| da object| LegacyGridFormFieldType object| ea object| LegacyGridFormFieldFlag object| fa object| GalleryTilePageMode function| ga object| DeleteStatus object| ha object| HomeLoadType object| ia object| HomeTabDisplayType object| ja object| HomeTabItemScope object| ka object| HomeTabTableColumnType object| la object| RootItemId object| ma object| TemplateStatus object| na object| WorkspaceType object| oa number| NEW_APPROVAL_COLUMN_ID_INCLUDED_COLUMNS object| ContainerType object| pa object| ContainerLoadLogOption object| qa object| ContainerParm object| ra object| ContainerParmID object| sa object| FilterType object| ta object| FontFamily object| ua object| FontStyle object| va object| FontWeight object| wa string| AutomaticColor object| BackgroundColors object| HomeItemType object| xa object| HorizontalAlignment object| ya object| IDType object| za object| KeyCode object| Aa object| Key object| Ba object| ConnectorType object| Ca object| ConnectorsPluginName object| TextDecoration object| Ea object| VerticalAlignment object| Fa object| ViewMode object| Ga object| DesktopType object| Ha object| Currency object| Ia object| DateFormat object| Ja object| TabType object| Ka object| NumberFormat object| La object| RightPanelID object| Ma object| UserRole object| Na object| GridDataType object| Oa object| ColumnType object| Pa object| HelpOwnerType object| Qa object| IntroTip object| Ra object| ProofingPanelViewMode object| Sa object| AccessLevel object| Ta object| DmRecurrenceFrequency object| Ua object| DmDayOfWeek object| Va object| DmDayOrdinal object| Wa object| RecurrenceFrequencyType object| Xa object| DayOfWeekValue object| Ya object| DayOfWeekLabel object| Za object| RepeatOnMonthValue object| $a object| WeekOfMonthValue object| _a object| WeekOfMonthLabel object| ab object| RepeatEveryValue object| bb object| EndPeriodFrequencyType object| cb object| DmAutomationActionType object| db object| DmAutomationRuleStatus object| eb object| DmTriggerType object| fb object| DmTriggerCriteriaType object| gb object| DmLogicalOperator object| hb object| DmConditionType object| ib object| DmCommProviderType object| jb object| DmNodeType object| kb object| RecipientType object| lb object| CommProviderType object| mb object| AutomationActionType object| nb object| AutomationRuleStatus object| ob object| TriggerType object| pb object| ChangeCriteriaType object| qb object| ConditionClauseJoinOperator object| rb object| FrequencyType object| sb object| DaysAfterValue object| tb object| DaysAfterLabels object| ub object| WorkflowTemplate object| vb object| WorkflowErrorKey object| wb object| UI_TYPE object| xb object| HomeFilter object| yb object| RouteType object| zb object| PositionType object| Ab object| OperatorType object| Bb object| RuleErrorType object| Cb object| ForegroundColors function| __assign function| __rest function| __decorate function| __param function| __metadata function| __awaiter function| __generator function| __exportStar function| __values function| __read function| __spread function| __await function| __asyncGenerator function| __asyncDelegator function| __asyncValues function| scrollToWorkflowError function| ACL function| Browser object| browser boolean| isIE boolean| isFF boolean| isSafari boolean| isChrome boolean| isEdge function| ColumnDataValidator object| formObjectHandler number| errorCount number| lastLoggedError undefined| isCancelled_mouseDown undefined| isCancelled_mouseDown_ignoreClick object| obfuscationMap function| getFormUrl function| formSubmit function| submitRequestAsDynamicForm function| submitDynamicForm function| disableFormButtons function| checkFormSubmit function| triggerFormSubmit function| confirmNavigateUrl function| checkCookieSupport function| logRequest function| parseIDKey function| removeAllChildren function| getXMLHttp function| reflowNode function| removeNode function| trimNodes function| toHtmlWithBreaks function| toHtml function| toHtmlWithLinks function| setNodeTextWithLinks function| parseLinks function| containsLink function| isLink function| toFormUrlEncoded function| getConstructorName function| getFunctionName function| undo function| redo function| obtainHTMLElement function| handleMouseOver function| handleContextMenu function| handleMouseMove function| handleMouseDown function| handleMouseUp function| handleMouseWheel function| handlePostMessage function| handleTouchStart function| handleTouchEnd function| handleTouchMove function| handleGestureStart function| handleGestureChange function| handleGestureEnd function| handleDoubleClick function| handleClick function| handleKeyDown function| handleKeyPress function| handleBlur function| handleFocus function| handleResize function| handleOrientationChange function| handleUnload function| handleBeforeUnload function| handlePaste function| handleBeforeCopy function| handleBeforeCut function| handleBeforePaste function| handleSelectStart function| handleDragStart function| handleDragEnter function| handleDragOver function| handleDragLeave function| handleDrop function| handleDragEnd function| forceHandleError function| handleError function| handleErrorDoWork function| getArguments function| getArgumentText function| parseColumnDataType function| parseBoolean function| parseString function| parseNumeric function| trim function| trimToLength function| trimToLengthForSafeJSON function| normalize function| containsWhitespace function| parseInteger function| parseFloatValue function| isNumberInRange function| setCursorPosition function| getCursorPosition function| addNewlineToTextInput function| SelectionProxy function| findPos function| findPagePos function| findCenter function| getDesktopHomeNode function| getActiveElement function| violatesBoundary function| violatesAirspace function| keepInside function| keepFormInsideDesktop function| getMappedNode function| cloneNodePreserveAbbrs function| restoreAbbrs function| getRegExpFromSearchValue function| sortMapIntoArray function| comparator_sortCache function| clearSortCache function| splitter function| createJsonArray function| getFileExtension function| formatFileSize function| toSafeJSON function| isDateChanged function| specialCaseBoldReplacement function| refreshDisplayProperties function| isEventOnScrollBar function| refreshSessionKey function| destroyAllObjectProperties function| cloneJsObject function| cloneJsArray function| setOpacity function| clearOpacity function| getCellDisplayString function| isDescendantNode function| hasAncestor function| siblingNodeCompare function| isElementFileInput function| isElementEditableText function| isElementContentEditable function| getCanvasContext function| splitTextByWidth function| getNodeMetric function| getTextMetric object| IL function| cO function| dO function| getMetricFromMeasureNode function| getMaxTextWidth function| applyTemplate function| applyDescendantAbbrs function| addStyleRule function| hasClass function| cleanClassName function| addClass function| setConditionalClass function| removeClass function| replaceClass function| getWebWorkerSupport function| isEntireNodeInWindow function| isNodeVisible function| isNodeHiddenByScroll function| showTruncatedTextHover function| showHoverIfTextIsTruncated function| showHoverIfTextIsTruncatedOnSourceNode function| isEmpty function| isArray function| isString function| isNull function| isUndefined function| isNullOrUndefined function| extendObject function| debounce function| debounceAccumulate function| bindScope function| calcOuterHeight function| pluck function| scrollToNode function| countObjectProperties function| isEqual function| filterArray function| PriorityQueue function| equals function| removeUndefinedProperties function| prependHttp function| comparator_emailByDomain function| isInFrame object| YO undefined| IP function| loadScript function| hashCode function| getTranslateTransform function| setTranslateTransform function| getUserFullName function| hexToRgbaValues function| getHexValueAsRgbaFunction function| mapToObject function| findParentWithClass undefined| startTime undefined| stopTime function| isPartOfCommentContentSection function| CookieUtil undefined| globalImageManager undefined| globalBrandManager object| LogoOverride object| mS object| LogoTextColor object| nS object| LogoImageType object| oS function| CircularBuffer function| removeObject function| pushDistinct function| contains function| wait function| GlobalBrandManager function| GlobalImageManager undefined| jW function| __extends function| GlobalLogManager undefined| jscDesktop function| JscBrand function| JspUtil function| JspUtil_initCommon function| JspUtil_initWithBrand function| JspUtil_init function| LicensingMgr function| AttachmentMaxSizeExceededMessage function| FrmReactivateAccount function| FrmTrialEnding function| AttachmentEnablingOption string| XSRF_HEADER function| loginBodyLoad function| removeKeepMeSignedIn function| invokeSignOut function| authorizeOnClickSignOut function| OAuthUtil function| OAuthRequest function| initImages function| StringUtil function| UrlUtil function| delayedLinkWithFunction function| logExternalGTMEvent function| isGovcloudMode function| getNetworkErrorMessageKey function| sendWebopRequest object| core object| __core-js_shared__ function| addPlaceholderSupport function| addPlaceholderElements function| placeholderKeyupHandler function| jQuery string| GoogleAnalyticsObject function| showTooltips function| hideTooltips function| loadLoginBody function| downloadApp object| google_tag_data object| gaplugins0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
Strict-Transport-Security | max-age=28800; includeSubDomains |
X-Frame-Options | SAMEORIGIN |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
accounts.skilljar.com
app.smartsheetgov.com
aws.smartsheetgov.com
learn.smartsheetgov.com
s.smartsheetgov.com
www.google-analytics.com
143.204.215.26
2a00:1450:4001:820::200e
52.61.187.209
54.235.84.20
174b1cf225e5d72596d3d4b62880b4950c7a0bad706ada28b797e8a706cce0da
2d7cd8f8f1b3fc7d668b9b06489397203443d93b6fb634433c5db6cd1ab80042
60863e86aa7743d1ac841da7f473a05cd57fba81d661cef658e385437f80d5ef
9864fdf995368063ea9a55fb0f6baa42cfb677c33d704f959459b0848dbda8b3
98c40e801bde5d241dc410a915a1319a8bc7c1b56755c398fbb42f4eb38f7043
a2bd17ebb6a3be8c55c593e3761125a5bb2d10b38c58b2c18fad4b6d7ad0ccca
a7bf1f115e60e0c8f3b335df66d4d77baaae4eb11d2cea2cf7c5b4693403a46f
b0bcdba29a0bbb16ae3428003159707fc1cc47a2f963f95d3e41b55b27d878e3
b8391ae452c280d035802553f50e7c3cc0ba756c2bc380f24045da5c4ab84f65
e30730250399259b78c8d02a752061b57a6c03ca13c39b0506283372298b43cc
f9a12744e2abf8aa2fab5fc0def67ac41dcc0c8cb390fda0ae34f01f64b6b5dd
fd4fe926d730cc409719bd939132a61c722092772c43aca9c1bd8a098b76c633