SafeMode - Analysis: speedrugpay.live

Visual Capture

Detection Info

https://speedrugpay.live/

Detected Brand

Unknown

Country

International

Confidence

100%

HTTP Status

200

Report ID

000db4d3-fab…

Analyzed

2026-02-20 17:29

Content Hashes (HTML Similarity)

Used to detect similar phishing pages based on HTML content

Algorithm	Hash Value
CONTENT TLSH	T1B9531AB7A1A025BB512347C36C256B0932F7617EAE3B8910D7EC86D5E7FACE4E40C850
CONTENT ssdeep	768:I/Hk7QYx5cK3DMmnVlvzmaxsBbn5c2eudp0ew5Hj2eeiD2Ki7/APhxOIRK74BRde:ZmaxsReaSewBaeei46qIRKodpoNmaxJ

Visual Hashes (Screenshot Similarity)

Used to detect visually similar phishing pages based on screenshots

Algorithm	Hash Value
VISUAL pHash	b8c932cdcc63c33a
VISUAL aHash	ffdfcfdfdbff8181
VISUAL dHash	233c3c3632320f2f
VISUAL wHash	f98f878381ff8181
VISUAL colorHash	07000000180
VISUAL cropResistant	233c3c3632320f2f,e2f09060a898b0b0,36b39d3335aca964,5926a63686c6b696

Code Analysis

Risk Score 100/100

Threat Level ALTO

⚠️ Phishing Confirmed

🎣 Credential Harvester 🎣 OTP Stealer 🎣 Banking 🎣 Personal Info

🔬 Threat Analysis Report

• Threat: Phishing
• Target: Crypto wallet users
• Method: Deception, through a fake wallet checker site
• Exfil: Unknown, likely to steal credentials or wallet data
• Indicators: Unrelated domain, obfuscation
• Risk: High

🔒 Obfuscation Detected

atob
unicode_escape
base64_strings

📡 API Calls Detected

POST

📊 Risk Score Breakdown

Total Risk Score

90/100

Contributing Factors

Domain Unrelated to Content

The domain speedrugpay.live is not related to cryptocurrency or wallet checking.

JavaScript Obfuscation

Javascript Obfuscation detected, used to hide malicious code

Suspicious Content

The site's purpose, checking crypto wallets, is in itself suspicious. The use of language related to 'scammers' and 'dirty money' aims to create urgency

🔬 Comprehensive Threat Analysis

Threat Type

Banking Credential Harvester

Target

General public

Attack Method

obfuscated JavaScript

Exfiltration Channel

Unknown

Risk Assessment

CRITICAL - Automated credential harvesting with Unknown

⚠️ Indicators of Compromise

Kit types: Credential Harvester, OTP Stealer, Banking, Personal Info
315 obfuscation techniques

🏢 Brand Impersonation Analysis

Impersonated Brand

Crypto Wallet Checker

Fake Service

Cryptocurrency wallet checker

Fraudulent Claims

⚔️ Attack Methodology

Primary Method: Credential Harvesting

The site aims to steal credentials through a fake wallet verification page, potentially redirecting the user to a page asking for wallet details. Or by downloading a harmful file.