SafeMode - Analysis: sajsofjjdjs.weebly.com

Visual Capture

No screenshot available

Detection Info

https://sajsofjjdjs.weebly.com/

Detected Brand

Unknown

Country

Unknown

Confidence

100%

HTTP Status

200

Report ID

3564c9cf-7f3…

Analyzed

2026-01-25 02:11

Content Hashes (HTML Similarity)

Used to detect similar phishing pages based on HTML content

Algorithm	Hash Value
CONTENT TLSH	T140E131F0D044ED37431386D9A7F96B0BB291C349CF47164453F883AB5BDACA0CB1669A
CONTENT ssdeep	96:nk2ynbzD71tDlt8v67McddtcnhwvFYehXbHFi8e9XXHF48ecjeXJX/nq2J:kTnbzD715lt8iIGd4GZ4xubcjGXfqw

Visual Hashes (Screenshot Similarity)

Used to detect visually similar phishing pages based on screenshots

Algorithm	Hash Value
VISUAL pHash	bc3cc33c38c3c33c
VISUAL aHash	df9f9fcf9f9fffff
VISUAL dHash	2030303030300000
VISUAL wHash	d0d0c0c0c0f0f0f0
VISUAL colorHash	070000001c0
VISUAL cropResistant	2030303030300000

Code Analysis

Risk Score 100/100

🎣 Credential Harvester 🎣 OTP Stealer 🎣 Card Stealer 🎣 Banking 🎣 Personal Info

🔐 Credential Harvesting Forms

🔒 Obfuscation Detected

atob
eval
fromCharCode
unescape
hex_escape
unicode_escape
base64_strings

🎯 Kit Endpoints

https://google.com/recaptcha/admin/migrate

📡 API Calls Detected

GET
POST

📤 Form Action Targets

https://sajsofjjdjs.weebly.com/ajax/apps/formSubmitAjax.php

📊 Risk Score Breakdown

Total Risk Score

100/100

Contributing Factors

Active Phishing Kit

Detected multiple kit types: Credential Harvester, OTP Stealer, Card Stealer, Banking, Personal Info with 9 forms for data collection

Obfuscation Techniques

115 obfuscation techniques detected, indicating heavy evasion of static analysis

Malicious JavaScript Files

Presence of suspicious JS files: MutationObserver.js, templateArtifacts.js, plugins.js, commonly used in phishing kits for dynamic content manipulation and data exfiltration

High-Risk Domain

Domain hosted on Weebly, a free website builder frequently abused for phishing campaigns

🔬 Comprehensive Threat Analysis

Threat Type

Banking Credential Harvester

Target

General public

Attack Method

credential harvesting forms + obfuscated JavaScript

Exfiltration Channel

HTTP POST to backend

Risk Assessment

CRITICAL - Automated credential harvesting with HTTP POST to backend

⚠️ Indicators of Compromise

Kit types: Credential Harvester, OTP Stealer, Card Stealer, Banking, Personal Info
115 obfuscation techniques

🏢 Brand Impersonation Analysis

Fake Service

Generic credential and personal information harvesting

⚔️ Attack Methodology

Primary Method: Credential Harvesting

The phishing kit employs form-based credential harvesting to capture user inputs in real-time. It uses JavaScript event listeners to intercept form submissions and exfiltrate data to a remote server. The presence of 9 forms suggests multi-stage data collection, likely targeting usernames, passwords, and personal information.

Secondary Method: OTP and Card Stealing

Secondary attack vectors include OTP interception and card stealing. The kit likely simulates Banking or service login pages to capture one-time passwords (OTPs) and credit card details, which are then transmitted to the attacker's infrastructure for immediate exploitation.