EN ES PT

Phishing Analysis

Detailed analysis of captured phishing page

Back to Stats

Visual Capture

Screenshot of nscapp.com.ng

Detection Info

https://nscapp.com.ng/data/load/gggg/arubaaufix/web/authen.php?web/auth/arub12#/dashboard/overviewAccounts/overview/index=D1O1b2XnxM19LFedWWCrJkIzAklNDbSsrTWBYzEL2pcPw0neIMwhyWbcA62h83sqI2MlBdy84No5LuU4
Detected Brand
Aruba.it
Country
International
Confidence
95%
HTTP Status
200
Report ID
2a8461df-0cd…
Analyzed
2026-03-01 20:05

Content Hashes (HTML Similarity)

Used to detect similar phishing pages based on HTML content

Algorithm Hash Value
CONTENT TLSH
T149B1633021218FB71697D7E07A10FF9971CAA382DB138E04D2F89A6A1FC7D85CC916B1
CONTENT ssdeep
96:TqYMKIj3VME5kFgwwd/6kmxj6F0OzqfRTu2gX+8sPwK3vi:uYMKIrOExm3a

Visual Hashes (Screenshot Similarity)

Used to detect visually similar phishing pages based on screenshots

Algorithm Hash Value
VISUAL pHash
b838c6cf3832c739
VISUAL aHash
ffcf8787c3ffffff
VISUAL dHash
051e1a1b1b001a0c
VISUAL wHash
f1818181013fffe7
VISUAL colorHash
07000030040
VISUAL cropResistant
051e1a1b1b001a0c,18a4a1b9c989899b

Code Analysis

Risk Score 53/100
Threat Level ALTO
⚠️ Phishing Confirmed
🎣 Credential Harvester

🔬 Threat Analysis Report

• Threat: Phishing
• Target: Aruba.it users
• Method: Credential Harvesting
• Exfil: ../next.php (from form actions)
• Indicators: Domain mismatch, password form.
• Risk: HIGH

🔐 Credential Harvesting Forms

🔒 Obfuscation Detected

  • fromCharCode

📤 Form Action Targets

  • ../next.php

📊 Risk Score Breakdown

Total Risk Score
90/100

Contributing Factors

Domain Mismatch
The domain nscapp.com.ng is not related to Aruba.it
Form for credentials
The presence of a password field with a login attempt to Aruba.it, is very suspicious.
Obfuscation Detected
JS obfuscation detected

🔬 Comprehensive Threat Analysis

Threat Type
Credential Harvesting Kit
Target
Aruba.it users (International)
Attack Method
Brand impersonation + credential harvesting forms + obfuscated JavaScript
Exfiltration Channel
HTTP POST to backend
Risk Assessment
MEDIUM - Automated credential harvesting with HTTP POST to backend

⚠️ Indicators of Compromise

  • Kit types: Credential Harvester
  • 2 obfuscation techniques

🏢 Brand Impersonation Analysis

Impersonated Brand
Aruba.it
Official Website
https://www.aruba.it/
Fake Service
Aruba.it Webmail

⚔️ Attack Methodology

Primary Method: Credential Harvesting

The attacker is using a fake login page that closely resembles Aruba.it's webmail login to steal user credentials.

🌐 Infrastructure Indicators of Compromise

Domain Information

Domain
nscapp.com.ng
Registered
None
Registrar
None
Status
None

🤖 AI-Extracted Threat Intelligence

Similar Websites

Pages with identical visual appearance (based on perceptual hash)

Screenshot
Unknown
https://cdn.gosafemode.com/screenshots/2fe4088c4ddb.png
Jul 03, 2026
 Screenshot
Aruba.it
https://nscapp.com.ng/data/load/gggg/arubaaufix/web/authen.p...
Mar 01, 2026
 Screenshot
Aruba.it
https://nscapp.com.ng/data/load/gggg/arubaaufix/web/authen.p...
Feb 28, 2026
No screenshot
Aruba.it
https://nscapp.com.ng/data/load/gggg/arubaaufix/web/authen.p...
Feb 27, 2026
 Screenshot
Aruba.it
https://nscapp.com.ng/data/load/gggg/arubaaufix/web/authen.p...
Feb 27, 2026

Scan History for nscapp.com.ng

Found 10 other scans for this domain

😰
"I Never Thought It Would Happen to Me"
That's what 2.3 million victims say every year. Don't wait to become a statistic.