Phishing Analysis
Detailed analysis of captured phishing page
Visual Capture
Detection Info
https://optuswebmailllogin.replit.app/
Detected Brand
Optus
Country
International
Confidence
100%
HTTP Status
200
Report ID
25636f64-e26…
Analyzed
2026-02-07 01:47
Content Hashes (HTML Similarity)
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T18412963401490C7E9113D7B4F4D5B736607BE34FEA6BC458B9B40B278BCBE99D822A64 |
|
CONTENT
ssdeep
|
192:Hh1NlMTpOq07lG5bgyzSOzePBxtB2fdHsK0b:Hzf7I5bgyzSOzePBTB2130b |
Visual Hashes (Screenshot Similarity)
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
e6664d6171594d66 |
|
VISUAL
aHash
|
00e7e7ffe7ffffff |
|
VISUAL
dHash
|
cc0c4c1c4c280000 |
|
VISUAL
wHash
|
00c0c3c3e3e3f3f3 |
|
VISUAL
colorHash
|
07000008180 |
|
VISUAL
cropResistant
|
0e4c0c4c4c200000,0000228ccccc3344 |
Code Analysis
Risk Score
71/100
Threat Level
ALTO
⚠️ Phishing Confirmed
🎣 Credential Harvester
🎣 Banking
🔬 Threat Analysis Report
• Threat: Phishing
• Target: Optus customers
• Method: Credential Harvesting
• Exfil: Unknown (likely to attacker's server)
• Indicators: Fake domain, replit.app, email/password form.
• Risk: High
🔒 Obfuscation Detected
- atob
- fromCharCode
🎯 Kit Endpoints
- https://webmail.optusnet.com.au/login
- https://reactjs.org/docs/error-decoder.html?invariant=
- https://optuswebmailllogin.replit.app/assets/index-D9oJiBmE.js
📊 Risk Score Breakdown
Total Risk Score
90/100
Contributing Factors
Domain Mismatch & Hosting
The domain is not a legitimate Optus domain, and it is hosted on a free hosting platform (replit.app).
Credential Harvesting Form
The website contains a form requesting the user's email address and password.
Obfuscation Detected
JavaScript code obfuscation detected, adding potential risk
🔬 Comprehensive Threat Analysis
Threat Type
Banking Credential Harvester
Target
Optus users (International)
Attack Method
Brand impersonation + credential harvesting forms + obfuscated JavaScript
Exfiltration Channel
Form submission (backend endpoint not detected - likely JavaScript-based)
Risk Assessment
HIGH - Automated credential harvesting with Form submission (backend endpoint not detected - likely JavaScript-based)
⚠️ Indicators of Compromise
- Kit types: Credential Harvester, Banking
- 9 obfuscation techniques
🏢 Brand Impersonation Analysis
Impersonated Brand
OptusNet
Official Website
https://www.optus.com.au/
Fake Service
OptusNet Email Login
Fraudulent Claims
⚔️ Attack Methodology
Primary Method: Credential Harvesting
The attacker creates a fake login page that mimics the appearance of a legitimate OptusNet login to steal user credentials. Users are tricked into entering their email and password, which the attacker then collects.
🌐 Infrastructure Indicators of Compromise
🦠 Malicious Files
Main File
index-D9oJiBmE.js
File Size
🔬 JavaScript Deep Analysis
Operator Language
English (1%)
Total Code Size
347.0 KB
🔗 API Endpoints Detected
Other
1
🔐 Obfuscation Detected
- : Heavy
🤖 AI-Extracted Threat Intelligence
🎯 Malicious Files Identified
Main Drainer
index-D9oJiBmE.jsFile Size
347KB
Similar Websites
Pages with identical visual appearance (based on perceptual hash)
"I Never Thought It Would Happen to Me"
That's what 2.3 million victims say every year. Don't wait to become a statistic.