EN ES PT

Phishing Analysis

Detailed analysis of captured phishing page

Back to Stats

Visual Capture

No screenshot available

Detection Info

http://bnpparibas.mitarbeitervorteile.de
Detected Brand
BNP Paribas
Country
International
Confidence
100%
HTTP Status
200
Report ID
348567c0-88dā€¦
Analyzed
2025-12-21 06:00
Final URL (after redirects)
https://bnpparibas.mitarbeitervorteile.de/login-input.action

Content Hashes (HTML Similarity)

Used to detect similar phishing pages based on HTML content

Algorithm Hash Value
CONTENT TLSH
T1D752C97251C1793B474381C291237B5EF2C2C128DB921850EAF887EA9BDECF1D969227
CONTENT ssdeep
384:+9tiaFsfsvCI5CPnYAfNBTxsJEJuvSf6F93L8k:+HiaFsfsKI52YOxsqGF93L8k

Visual Hashes (Screenshot Similarity)

Used to detect visually similar phishing pages based on screenshots

Algorithm Hash Value
VISUAL pHash
a887359bd3b1c730
VISUAL aHash
2f9377ffff3d0000
VISUAL dHash
dd26e6f9e9611f1f
VISUAL wHash
0f0377ffff3c0000
VISUAL colorHash
07c00000000
VISUAL cropResistant
dd36e6f9b961399f,9733397c7e7efebe,693f9f9f1f1fc934

Code Analysis

Risk Score 100/100
Threat Level ALTO
šŸŽ£ Credential Harvester šŸŽ£ OTP Stealer šŸŽ£ Card Stealer šŸŽ£ Banking šŸŽ£ Personal Info

šŸ”¬ Threat Analysis Report

ā€¢ Threat: Credential harvesting phishing attack
ā€¢ Target: BNP Paribas employees
ā€¢ Method: Fake login page to steal employee credentials
ā€¢ Exfil: Likely to a malicious server
ā€¢ Indicators: Domain mismatch (bnpparibas.mitarbeitervorteile.de vs bnp.paribas), login form, cookie prompt overlay
ā€¢ Risk: HIGH - Real-time credential theft.

šŸ” Credential Harvesting Forms

šŸŽÆ Kit Endpoints

  • https://bnpparibas.mitarbeitervorteile.de/switch-locale.action?locale=de&ref=https%3A%2F%2Fbnpparibas.mitarbeitervorteile.de%2Flogin-input.action
  • https://bnpparibas.mitarbeitervorteile.de/login-input.action
  • https://google.com/recaptcha/admin/migrate
  • https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LclSy8pAAAAAGUfvc_vYSfxLGaz2uiQf3GgDGRh&co=aHR0cHM6Ly9ibnBwYXJpYmFzLm1pdGFyYmVpdGVydm9ydGVpbGUuZGU6NDQz&hl=en&v=7gg7H51Q-naNfhmCP3_R47ho&size=invisible&sa=login&anchor-ms=20000&execute-ms=30000&cb=udv53d3fem1y
  • login
  • login.action
  • https://bnpparibas.mitarbeitervorteile.de/switch-locale.action?locale=en&ref=https%3A%2F%2Fbnpparibas.mitarbeitervorteile.de%2Flogin-input.action

šŸ“” API Calls Detected

  • json/web-tour-operations.action

šŸ“¤ Form Action Targets

  • password-recovery.action
  • login.action

Similar Websites

Pages with identical visual appearance (based on perceptual hash)

Screenshot
Unknown
https://cdn.gosafemode.com/screenshots/ec55616c77ed.png
Jul 30, 2026
 Screenshot
Unknown
https://cdn.gosafemode.com/screenshots/5ea2ba6ad3af.png
Jul 30, 2026

Scan History for bnpparibas.mitarbeitervorteile.de

Found 2 other scans for this domain

šŸ˜°
"I Never Thought It Would Happen to Me"
That's what 2.3 million victims say every year. Don't wait to become a statistic.