SafeMode - Analysis: apple.edenwee.workers.dev

Visual Capture

No screenshot available

Detection Info

https://apple.edenwee.workers.dev/

Detected Brand

Unknown

Country

Unknown

Confidence

100%

HTTP Status

200

Report ID

3271068b-cc4…

Analyzed

2026-01-25 23:49

Content Hashes (HTML Similarity)

Used to detect similar phishing pages based on HTML content

Algorithm	Hash Value
CONTENT TLSH	T1A8F3E8377225623E0317C7DEF5662A34F2E3A549CEDA51E8BEF883161392D70A42BD05
CONTENT ssdeep	1536:+cQ7uAc1S9XJdVnUY/iYZ1nGwmbdNDLHOeOptEYoFXDX7a2/B2Q7aj/B/7ak/Mt7:SG89p2FXDat/pi2Y

Visual Hashes (Screenshot Similarity)

Used to detect visually similar phishing pages based on screenshots

Algorithm	Hash Value
VISUAL pHash	80f800ff00ff1ff1
VISUAL aHash	7f7f7f7f3f3f3f3f
VISUAL dHash	808080c0c0c0c0c0
VISUAL wHash	7070707030303030
VISUAL colorHash	07000c00018
VISUAL cropResistant	808080c0c0c0c0c0

Code Analysis

Risk Score 68/100

🎣 OTP Stealer 🎣 Banking

🔐 Credential Harvesting Forms

🔒 Obfuscation Detected

base64_strings

🎯 Kit Endpoints

https://fitness.apple.com/us/studio-collection/no-shoes-workouts/1779383019?itscg=10000&itsct=afp-apl_hp-watch_now--240326
https://fitness.apple.com/us/studio-collection/trainers-feature-their-favorites/1783405899?itscg=10000&itsct=afp-apl_hp-watch_now--240326

📤 Form Action Targets

/us/search

📊 Risk Score Breakdown

Total Risk Score

100/100

Contributing Factors

Active Phishing Kit

Detected OTP stealer and Banking phishing kit with 12 form fields for credential and OTP harvesting.

High Obfuscation

276 obfuscation techniques detected, indicating deliberate evasion of analysis and security tools.

Suspicious JavaScript Files

Large JavaScript files (2.74 MB total) with no legitimate context, likely containing malicious payloads.

Domain Reputation

Domain hosted on Cloudflare Workers (edenwee.workers.dev), a common platform for phishing campaigns due to low cost and anonymity.

🔬 Comprehensive Threat Analysis

Threat Type

Banking Credential Harvester

Target

General public

Attack Method

credential harvesting forms + obfuscated JavaScript

Exfiltration Channel

HTTP POST to backend

Risk Assessment

HIGH - Automated credential harvesting with HTTP POST to backend

⚠️ Indicators of Compromise

Kit types: OTP Stealer, Banking
276 obfuscation techniques

🏢 Brand Impersonation Analysis

Fake Service

Banking or financial service login portal

⚔️ Attack Methodology

Primary Method: Credential Harvesting with OTP Interception

The phishing kit is designed to capture Banking credentials and one-time passwords (OTPs) in real-time. The 12 form fields suggest multi-stage data collection, likely simulating a bank's login and 2FA process. The OTP stealer component intercepts SMS or authenticator app codes to bypass multi-factor authentication.

Secondary Method: Session Hijacking

Post-credential capture, the kit may initiate session hijacking by injecting malicious JavaScript into the victim's browser. This allows attackers to maintain access to the victim's Banking session even after the initial phishing interaction.