Windows Analysis Report
https://identity.thoughtspotlogin.cloud/

{
    "typosquatting": true,
    "unusual_query_string": false,
    "suspicious_tld": true,
    "ip_in_url": false,
    "long_subdomain": false,
    "malicious_keywords": true,
    "encoded_characters": false,
    "redirection": false,
    "contains_email_address": false,
    "known_domain": false,
    "brand_spoofing_attempt": true,
    "third_party_hosting": true
}

URL: https://identity.thoughtspotlogin.cloud

{
    "risk_score": 4,
    "reasoning": "The provided JavaScript snippet appears to be a part of a login page implementation, likely using the Okta platform. While the code does not exhibit any high-risk indicators, it does contain some moderate-risk behaviors that warrant further review. The script loads external resources, manipulates the DOM, and interacts with third-party domains. Additionally, the use of legacy APIs like `XDomainRequest` is a low-risk indicator. Overall, the script seems to be implementing common login functionality, but the potential for data exfiltration and the use of outdated practices result in a medium-risk score."
}

  var signInSuccessCallBackFunction;
  var oktaData = {"redirectUri":"https\x3A\x2F\x2Fidentity.thoughtspotlogin.cloud","isMobileSso":false,"fromUri":"","isMobileClientLogin":false,"countryIso":"US","inactiveTab":{"elementId":"inactive\x2Dtab\x2Dmain\x2Ddiv","avoidPageRefresh":true,"enabled":false},"signIn":{"logoText":"ThoughtSpot\x20logo","features":{"emailRecovery":true,"deviceFingerprinting":true,"consent":true,"useDeviceFingerprintForSecurityImage":true,"customExpiredPassword":true,"router":true,"showPasswordToggleOnSignInPage":false,"securityImage":false,"autoPush":true,"smsRecovery":false,"idpDiscovery":false,"selfServiceUnlock":false,"webauthn":true,"showPasswordRequirementsAsHtmlList":true,"registration":false,"rememberMe":true,"callRecovery":false,"multiOptionalFactorEnroll":true},"baseUrl":"https\x3A\x2F\x2Fidentity.thoughtspotlogin.cloud","brandName":"ThoughtSpot","assets":{"baseUrl":"https\x3A\x2F\x2Fok14static.oktacdn.com\x2Fassets\x2Fjs\x2Fsdk\x2Fokta\x2Dsignin\x2Dwidget\x2F5.16.1"},"customButtons":[],"idpDiscovery":{"requestContext":""},"logo":"https\x3A\x2F\x2Fok14static.oktacdn.com\x2Fassets\x2Fimg\x2Flogos\x2Fokta\x2Dlogo.1e146cad5713da744492be95eb0f7793.png","language":"en","helpLinks":{"help":"","forgotPassword":"","unlock":"","custom":[]},"piv":{},"i18n":{"en":{"mfa.challenge.password.placeholder":"Password","help":"Help","password.forgot.email.or.username.tooltip":"Email\x20or\x20Username","needhelp":"Need\x20help\x20signing\x20in\x3F","primaryauth.username.placeholder":"Username","password.forgot.email.or.username.placeholder":"Email\x20or\x20Username","account.unlock.email.or.username.tooltip":"Email\x20or\x20Username","unlockaccount":"Unlock\x20account\x3F","account.unlock.email.or.username.placeholder":"Email\x20or\x20Username","primaryauth.password.placeholder":"Password","primaryauth.title":"Sign\x20In","forgotpassword":"Forgot\x20password\x3F"}}},"accountChooserDiscoveryUrl":"https\x3A\x2F\x2Flogin.okta.com\x2Fdiscovery\x2Fiframe.html"};

  var runLoginPage = function(fn) {
    var mainScript = document.createElement('script');
    mainScript.src = "https://ok14static.oktacdn.com/assets/js/mvc/loginpage/initLoginPage.pack.58de3be0c9b511a0fdfd7ea4f69b56fc.js";
    mainScript.integrity = "sha384-cJ4LGViZBmIttMPH+ao2RyPuN5BztKWYWIa4smbm56r1cUhkU/Dr6vTS3UoPbKTI";
    mainScript.crossOrigin = "anonymous";
    document.getElementsByTagName('head')[0].appendChild(mainScript);
    fn && mainScript.addEventListener('load', function () { setTimeout(fn, 1) });
  };

  var OktaUtil = {
    _addClass: function(el, className) {
      if(el) {
        var elementClasses = el.className.split(" ");
        if (elementClasses.indexOf(className) == -1) {
          el.className += " " + className;
        }
      }
    },

    _removeElement: function(el) {
      if(el) {
        el.parentNode.removeChild(el);
      }
    },

    _hideElement: function(el) {
      if(el) {
        el.style.display = 'none';
      }
    },

    _isDocumentVisible: function() {
      return document.visibilityState === 'visible';
    },

    addLoginContainerClass: function () {
      this._addClass(document.getElementById('okta-login-container'), 'login-container');
    },

    showUnsupportedCookieWarning: function () {
      document.getElementById('okta-sign-in').removeAttribute('style');
      document.getElementById('unsupported-cookie').removeAttribute('style');
    },

    removeUnsupportedCookieWarning: function () {
      this._removeElement(document.getElementById('okta-sign-in'));
    },

    hideOktaLoginContainer: function () {
      this._hideElement(document.getElementById('okta-login-container'));
    },

    isChromeOs:  function () {
      return /\bCrOS\b/.test(navigator.userAgent);
    },

    addChromeOSScript: function() {
      var chromeOSScript = document.createElement('script');
      chromeOSScript.src = "/js/google/users-1.0.js";
      document.getElementsByTagName('head')[0].appendChild(chromeOSScript);
    }

{
    "risk_score": 4,
    "reasoning": "The provided JavaScript snippet appears to be a login page implementation using the Okta Sign-In Widget. While it does not exhibit any high-risk behaviors, there are some moderate-risk indicators that warrant further review. The script loads external resources from Okta's CDN, which could potentially be used for data exfiltration or other malicious purposes. Additionally, the script performs aggressive DOM manipulation, which could be a sign of potential issues. However, the overall context suggests this is likely a legitimate implementation, and the risk is primarily due to poor coding practices rather than malicious intent."
}

  var signInSuccessCallBackFunction;
  var oktaData = {"redirectUri":"https\x3A\x2F\x2Fidentity.thoughtspotlogin.cloud","isMobileSso":false,"fromUri":"","isMobileClientLogin":false,"countryIso":"US","inactiveTab":{"elementId":"inactive\x2Dtab\x2Dmain\x2Ddiv","avoidPageRefresh":true,"enabled":false},"signIn":{"logoText":"ThoughtSpot\x20logo","features":{"emailRecovery":true,"deviceFingerprinting":true,"consent":true,"useDeviceFingerprintForSecurityImage":true,"customExpiredPassword":true,"router":true,"showPasswordToggleOnSignInPage":false,"securityImage":false,"autoPush":true,"smsRecovery":false,"idpDiscovery":false,"selfServiceUnlock":false,"webauthn":true,"showPasswordRequirementsAsHtmlList":true,"registration":false,"rememberMe":true,"callRecovery":false,"multiOptionalFactorEnroll":true},"baseUrl":"https\x3A\x2F\x2Fidentity.thoughtspotlogin.cloud","brandName":"ThoughtSpot","assets":{"baseUrl":"https\x3A\x2F\x2Fok14static.oktacdn.com\x2Fassets\x2Fjs\x2Fsdk\x2Fokta\x2Dsignin\x2Dwidget\x2F5.16.1"},"customButtons":[],"idpDiscovery":{"requestContext":""},"logo":"https\x3A\x2F\x2Fok14static.oktacdn.com\x2Fassets\x2Fimg\x2Flogos\x2Fokta\x2Dlogo.1e146cad5713da744492be95eb0f7793.png","language":"en","helpLinks":{"help":"","forgotPassword":"","unlock":"","custom":[]},"piv":{},"i18n":{"en":{"mfa.challenge.password.placeholder":"Password","help":"Help","password.forgot.email.or.username.tooltip":"Email\x20or\x20Username","needhelp":"Need\x20help\x20signing\x20in\x3F","primaryauth.username.placeholder":"Username","password.forgot.email.or.username.placeholder":"Email\x20or\x20Username","account.unlock.email.or.username.tooltip":"Email\x20or\x20Username","unlockaccount":"Unlock\x20account\x3F","account.unlock.email.or.username.placeholder":"Email\x20or\x20Username","primaryauth.password.placeholder":"Password","primaryauth.title":"Sign\x20In","forgotpassword":"Forgot\x20password\x3F"}}},"accountChooserDiscoveryUrl":"https\x3A\x2F\x2Flogin.okta.com\x2Fdiscovery\x2Fiframe.html"};

  var runLoginPage = function(fn) {
    var mainScript = document.createElement('script');
    mainScript.src = "https://ok14static.oktacdn.com/assets/js/mvc/loginpage/initLoginPage.pack.58de3be0c9b511a0fdfd7ea4f69b56fc.js";
    mainScript.integrity = "sha384-cJ4LGViZBmIttMPH+ao2RyPuN5BztKWYWIa4smbm56r1cUhkU/Dr6vTS3UoPbKTI";
    mainScript.crossOrigin = "anonymous";
    document.getElementsByTagName('head')[0].appendChild(mainScript);
    fn && mainScript.addEventListener('load', function () { setTimeout(fn, 1) });
  };

  var OktaUtil = {
    _addClass: function(el, className) {
      if(el) {
        var elementClasses = el.className.split(" ");
        if (elementClasses.indexOf(className) == -1) {
          el.className += " " + className;
        }
      }
    },

    _removeElement: function(el) {
      if(el) {
        el.parentNode.removeChild(el);
      }
    },

    _hideElement: function(el) {
      if(el) {
        el.style.display = 'none';
      }
    },

    _isDocumentVisible: function() {
      return document.visibilityState === 'visible';
    },

    addLoginContainerClass: function () {
      this._addClass(document.getElementById('okta-login-container'), 'login-container');
    },

    showUnsupportedCookieWarning: function () {
      document.getElementById('okta-sign-in').removeAttribute('style');
      document.getElementById('unsupported-cookie').removeAttribute('style');
    },

    removeUnsupportedCookieWarning: function () {
      this._removeElement(document.getElementById('okta-sign-in'));
    },

    hideOktaLoginContainer: function () {
      this._hideElement(document.getElementById('okta-login-container'));
    },

    isChromeOs:  function () {
      return /\bCrOS\b/.test(navigator.userAgent);
    },

    addChromeOSScript: function() {
      var chromeOSScript = document.createElement('script');
      chromeOSScript.src = "/js/google/users-1.0.js";
      document.getElementsByTagName('head')[0].appendChild(chromeOSSc

{
    "risk_score": 4,
    "reasoning": "The provided JavaScript snippet appears to be a part of a web application that handles user authentication and authorization. While it does not exhibit any high-risk behaviors, there are some moderate-risk indicators that warrant further review. The script interacts with external domains (e.g., `identity.dataplane-public.thoughtspot.cloud`) and performs various operations related to user authentication, such as retrieving configuration, handling redirects, and managing error messages. The use of legacy APIs like `XDomainRequest` and the potential for aggressive DOM manipulation (e.g., clearing `innerHTML`) contribute to the medium-risk assessment. However, the script also includes some legitimate functionality, such as analytics and custom logo handling, which mitigates the overall risk. Further investigation may be needed to ensure the proper implementation of security best practices and to verify the trustworthiness of the external domains involved."
}

    
        var config = OktaUtil.getSignInWidgetConfig();
var oktaSignIn = new OktaSignIn(config);
var identityServiceUrl =
  "https://identity.dataplane-public.thoughtspot.cloud/v1";
var requestContext = OktaUtil.getRequestContext();
var forceAuth = false;
let authentication;
let samlLoginPageRedirect = false;
let samlEnabled = false;
let publicUser = false;
let isSignInBlocked = false;
const RELOAD_INTERVAL_IN_MINS = 10;
const URL_PARAMS = {
  DOMAIN: "domain",
  DISABLE_SAML_AUTO_REDIRECT: "disableSAMLAutoRedirect",
  FORCE_SAML_AUTO_REDIRECT: "forceSAMLAutoRedirect",
};
const initialUrl = new URL(window.location.href);
const initialUrlParams = new URLSearchParams(initialUrl.search);
let domainParam = initialUrlParams.get(URL_PARAMS.DOMAIN);
let disableSAMLAutoRedirect =
  initialUrlParams.get(URL_PARAMS.DISABLE_SAML_AUTO_REDIRECT) || false;
let forceSAMLAutoRedirect =
  initialUrlParams.get(URL_PARAMS.FORCE_SAML_AUTO_REDIRECT) || false;
let mixpanelAccessToken = "";
let customLogoUrl = "";
//Error messages
var msg_10001 = "Something went wrong!!! please contact administrator.";
var msg_10023 = "Current operation is not allowed.";
var msg_10029 = "Email was not found.";
var msg_12714 = "Recipient domain is not whitelisted.";
var msg_12900 = "The User is not authorized to access ThoughtSpot.";
var msg_12920 = "Internal authentication is disabled.";
var msg_13133 = "The org id from per org url is invalid";
var msg_13134 =
  "The orgs received from jwt claim doesn't have the configured default org";
var msg_13136 = "The default org is received is invalid";
var msg_20001 = "Please use the application URL to login";
const ERROR_CODES = {
  10001: "CONNECTION_FAIL",
  10023: "FORBIDDEN",
  10029: "EMAIL_NOT_FOUND",
  12714: "NON_WHITE_LISTED_DOMAIN",
  12900: "USER_UNAUTHORIZED",
  13133: "ORG_ID_IN_PER_ORG_URL_INVALID",
  13134: "ORG_ID_INVALID_DEFAULT_ORG",
  13136: "RECEIVED_INVALID_ORG",
  20001: "TARGET_URL_NOT_FOUND",
};
const CONNECTION_TYPE = {
  OIDC: "OIDC",
  SAML2: "SAML2",
  GOOGLE: "GOOGLE",
  AMAZON: "AMAZON",
  MICROSOFT: "MICROSOFT",
};

function getCustomStyle(baseUrl) {
  jQuery.get(
    baseUrl + "/callosum/v1/file/getcustomstyle",
    function (data, status) {
      if (data) {
        const appLogoType = data["appLogoTypeToImage"][2];
        if (appLogoType) {
          customLogoUrl = `${baseUrl}/callosum/v1/file/getfile/${appLogoType.guid}`;
        }
      }
    }
  );
}

function updateCustomLogo(logoUrl) {
  if (logoUrl) {
    fetch(logoUrl, {
      mode: "cors",
    })
      .then((response) => {
        if (!response.ok) {
          throw new Error("Network response was not ok");
        }
        return response.blob(); // assuming you're fetching an image
      })
      .then((blob) => {
        const logoUrl = URL.createObjectURL(blob);

        // Apply the fetched logoUrl to the Okta sign-in logo element
        jQuery("#okta-sign-in #okta-sign-in-header-ts-logo").css({
          background: `url(${logoUrl}) no-repeat center`,
          "background-size": "233px 47px",
          "max-width": "233px",
          "max-height": "47px",
        });
      })
      .catch((error) => {
        console.error(
          "There has been a problem with your fetch operation:",
          error
        );
      });
  }
}

function getMixPanelAccessToken(mixpanelConfig = null) {
  if (!mixpanelConfig || !mixpanelConfig.enabled) {
    return null;
  }
  return mixpanelConfig.production
    ? mixpanelConfig.prodSdkKey
    : mixpanelConfig.devSdkKey;
}

(async () => {
  function getParam(name) {
    if (
      (name = new RegExp("[?&]" + encodeURIComponent(name) + "=([^&]*)").exec(
        location.search
      ))
    )
      return decodeURIComponent(name[1]);
  }
  try {
    const redirectURI =
      requestContext &&
      requestContext.authentication &&
      requestContext.authentication.request &&
      requestContext.authentication.request.redirect_uri;
    if (
      !redirectURI &&
      !requestContext &

{
  "contains_trigger_text": false,
  "trigger_text": "unknown",
  "prominent_button_name": "Sign In",
  "text_input_field_labels": [
    "Username",
    "Password"
  ],
  "pdf_icon_visible": false,
  "has_visible_captcha": false,
  "has_urgent_text": false,
  "has_visible_qrcode": false,
  "contains_chinese_text": false,
  "contains_fake_security_alerts": false
}

{
  "brands": [
    "ThoughtSpot"
  ]
}

{
  "contains_trigger_text": false,
  "trigger_text": "unknown",
  "prominent_button_name": "Sign In",
  "text_input_field_labels": [
    "Username",
    "Password"
  ],
  "pdf_icon_visible": false,
  "has_visible_captcha": false,
  "has_urgent_text": false,
  "has_visible_qrcode": false,
  "contains_chinese_text": false,
  "contains_fake_security_alerts": false
}

{
  "brands": [
    "ThoughtSpot"
  ]
}

```json{  "legit_domain": "thoughtspot.com",  "classification": "known",  "reasons": [    "The brand 'ThoughtSpot' is a known company specializing in analytics and business intelligence.",    "The URL 'thoughtspotlogin.cloud' does not match the legitimate domain 'thoughtspot.com'.",    "The use of 'login' in the domain name is a common tactic used in phishing to mimic login pages.",    "The domain extension '.cloud' is unusual for a business intelligence company and could be used to mislead users.",    "The presence of input fields for 'Username' and 'Password' on a suspicious domain increases the risk of phishing."  ],  "riskscore": 8}
Google indexed: False