Phishing Analysis
Detailed analysis of captured phishing page
Visual Capture
Detection Info
https://formssation.life/pages/5d65bc62-91ed-4057-977a-d356377f40b5/84bc49718c66a64a8a561e35d453ef484b53e95980a06fae81ce648caa314def627f5f63f77904d53231d4249b1c7e71544e55b1d39a69b7254a2a48f5fd3d34
Detected Brand
DHL
Country
International
Confidence
95%
HTTP Status
200
Report ID
12b91578-e0eā¦
Analyzed
2026-02-08 02:41
Content Hashes (HTML Similarity)
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T1250496B6A1F6133F483EB396F1E2371566A7871B83421BE35AFC16941F88B8E2D07544 |
|
CONTENT
ssdeep
|
3072:rqsHE3TRFWeXVUF3MQ4orPqfmDeLWpy++Kl8zKvAWWjs6cAQzAZOHZqyRMXn6PX5:esHE3TRFWeXVUF3MQ4orPqfmDeLWpy+T |
Visual Hashes (Screenshot Similarity)
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
9010edef453cba4b |
|
VISUAL
aHash
|
ff0d040400ffffff |
|
VISUAL
dHash
|
22999dbcc8218800 |
|
VISUAL
wHash
|
c30c040400ffffff |
|
VISUAL
colorHash
|
07041010000 |
|
VISUAL
cropResistant
|
3a22d9999dbd9ccc,c8e2313844000000,d9999d9dbc9cccea |
Code Analysis
Risk Score
50/100
Threat Level
ALTO
ā ļø Phishing Confirmed
š£ Credential Harvester
š¬ Threat Analysis Report
ā¢ Threat: Phishing
ā¢ Target: DHL customers
ā¢ Method: Impersonation through a fake login page.
ā¢ Exfil: /pages/4919fca7-004d-458a-b3a2-0233482154e3/84bc49718c66a64a8a561e35d453ef484b53e95980a06fae81ce648caa314def627f5f63f77904d53231d4249b1c7e71544e55b1d39a69b7254a2a48f5fd3d34
ā¢ Indicators: Unrelated domain, login form
ā¢ Risk: HIGH
š Credential Harvesting Forms
š¤ Form Action Targets
- /pages/4919fca7-004d-458a-b3a2-0233482154e3/84bc49718c66a64a8a561e35d453ef484b53e95980a06fae81ce648caa314def627f5f63f77904d53231d4249b1c7e71544e55b1d39a69b7254a2a48f5fd3d34
š Risk Score Breakdown
Total Risk Score
90/100
Contributing Factors
Suspicious Domain
The domain is unrelated to the target brand.
Login Form
The presence of a login form on an untrusted domain strongly suggests phishing.
JavaScript Form Submission
Javascript is used for form submission increasing the risk
š¬ Comprehensive Threat Analysis
Threat Type
Credential Harvesting Kit
Target
DHL users (International)
Attack Method
Brand impersonation + credential harvesting forms
Exfiltration Channel
HTTP POST to backend
Risk Assessment
MEDIUM - Automated credential harvesting with HTTP POST to backend
ā ļø Indicators of Compromise
- Kit types: Credential Harvester
š¢ Brand Impersonation Analysis
Impersonated Brand
DHL
Official Website
https://www.dhl.com/
Fake Service
MyDHL+ login
āļø Attack Methodology
Primary Method: Credential Harvesting
The attacker is attempting to steal user credentials (email and password) by presenting a fake login form that mimics the appearance of the legitimate DHL website.
š Infrastructure Indicators of Compromise
Domain Information
Domain
formssation.life
Registered
None
Registrar
None
Status
Unknown
š¤ AI-Extracted Threat Intelligence
Similar Websites
Pages with identical visual appearance (based on perceptual hash)
DHL
http://www.solutionfun.info/landingpage/939c66c5-a2e6-4d48-9...
Mar 13, 2026
DHL
https://www.solutionfun.info/landingpage/939c66c5-a2e6-4d48-...
Feb 11, 2026
DHL Express
https://luxeavenue.boutique/pages/6c3d4209-0b3c-4a66-8505-3f...
Jan 16, 2026
DHL
https://www.webfun.website/landingpages/939c66c5-a2e6-4d48-9...
Jan 05, 2026
DHL
https://www.solutionfun.info/landingpage/939c66c5-a2e6-4d48-...
Jan 05, 2026
Scan History for formssation.life
Found 4 other scans for this domain
"I Never Thought It Would Happen to Me"
That's what 2.3 million victims say every year. Don't wait to become a statistic.