Phishing Analysis
Detailed analysis of captured phishing page
Visual Capture
Detection Info
Content Hashes (HTML Similarity)
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T16F531AB1F220709D5673C7CAB9A2DF5DE263B48CDF22D294DEA5912E2AD1DF24C11C81 |
|
CONTENT
ssdeep
|
768:1DcQ3csuXLyGzNRUFKUYbp19ngEwAmBnoH6vJLKzHgh9LAWhf3D10XQIzIhNtami:1X3cs21Zg/mTU9uQltAH6PhWvtX5VIQ |
Visual Hashes (Screenshot Similarity)
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
b8d7c73130c6c731 |
|
VISUAL
aHash
|
feff9bc387fbfffb |
|
VISUAL
dHash
|
6c32232f1b022693 |
|
VISUAL
wHash
|
06df9bc181e3836b |
|
VISUAL
colorHash
|
07000000007 |
|
VISUAL
cropResistant
|
6c32232f1b022693 |
Code Analysis
🔒 Obfuscation Detected
- atob
- fromCharCode
- unescape
- hex_escape
- unicode_escape
- js_packer
- base64_strings
🎯 Kit Endpoints
- https://interface.gateway.uniswap.org/
📡 API Calls Detected
- logs
- .concat(Mr(M),
- proxy
- /.well-known/vercel/jwe
- stats
- /
- 0x3b3b57de
- https://raw.githubusercontent.com/Uniswap/mrkl-drop-data-chunks/final/chunks/mapping.json
- POST
- GET
- http://localhost
- account
📊 Risk Score Breakdown
Contributing Factors
🔬 Comprehensive Threat Analysis
⚠️ Indicators of Compromise
- Kit types: Credential Harvester, OTP Stealer, Card Stealer, Banking, Personal Info
- 600 obfuscation techniques
🏢 Brand Impersonation Analysis
⚔️ Attack Methodology
Primary Method: Credential Harvesting
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Secondary Method: JavaScript Obfuscation
Malicious code is obfuscated using 600 techniques to evade detection by security scanners and make reverse engineering more difficult.
Drainer supports multiple blockchain networks and checks for high-value tokens on each chain before executing drain operations.
🌐 Infrastructure Indicators of Compromise
Domain Information
Hosting Information
🤖 AI-Extracted Threat Intelligence
Similar Websites
Pages with identical visual appearance (based on perceptual hash)
Scan History for web-claude-infra-2904-okx-evm-only-solana-uniswap.vercel.app
Found 2 other scans for this domain
