Phishing Analysis
Detailed analysis of captured phishing page
Visual Capture
Detection Info
https://royal-security-hub-profile-privacy-questions-upgrade.vograc.com/signon/lgn.php?signin_RBC=30Q0567DLQ8BVKEI98CZS2XOKSSXIGYIP7KTW6XGE2IZVLSM5ITQF9EMDEV0R6RYV86FZA7RLRGMH2R41CGEBBU1T6BANVJZFG2Q3MS0S79K249EFWIP7W6N9QJYF-8S934P76OSE280JKA41KFQ50TD7LJWYAW8PFF9N7A1LJWBXNI7QLKLL5ELQZHACLTF2113SSV5A2MXUB4XPQY205X8FSR8QJJRH8BQA6EWC9XB8
Detected Brand
Royal Bank of Canada (RBC)
Country
Unknown
Confidence
100%
HTTP Status
200
Report ID
3573bd1d-986…
Analyzed
2026-07-04 10:16
Content Hashes (HTML Similarity)
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T10C51B441A34E5C0B0A8708E4D0B2BB5E44E08795EB035F1496B823BBF3D6C84ED9B3D5 |
|
CONTENT
ssdeep
|
48:WUfquqRjOf8s5xPUom+qC/PXZWpBYzBABGmLAyq5GqQ5Ggw:W4qF801BC/vImzmfE5Q5C |
Visual Hashes (Screenshot Similarity)
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
b333313bc9c8cc4e |
|
VISUAL
aHash
|
000000ffffffffff |
|
VISUAL
dHash
|
1bfcac910d002100 |
|
VISUAL
wHash
|
000000ff00ffffff |
|
VISUAL
colorHash
|
070060000c0 |
|
VISUAL
cropResistant
|
cd9f6ae480f0c9d8,c000550d00000000,777b1bbf7d7cfc3c,0000001010100000 |
Code Analysis
Risk Score
50/100
Threat Level
ALTO
⚠️ Phishing Confirmed
🎣 Credential Harvester
🔐 Credential Harvesting Forms
📤 Form Action Targets
- quest.php?RBC-SecurityQ=1OA1T2KFYHRL0QPNA9K4I4ZR1S6HV1WA5HCYCEUQE6RLPKHSK3KWHI0=index-full=DZUL6LOHTUXV3GBL21SEU6V01RG79YC46ZXR3CU7OEPF5KH7MZCIYTSDTF7JF1DKZC10VPZZB912WDU48LHCM9FHFKMY4WSZ9HT3SXUSJSF5C4H=en_CA-782FW88U9LD77MSUC4D97UW4EOU17PG3XV02Y2Q9FJ51UOTX09F042C7P1XOFSN4NOAY278VN42PD4OJT1JV35MRPX1JDRPBU9C2Y9C9DQT28IYG99VAZM3ZRD7RYK250YDFMZG3CKW4RH0KSGV1KPL-secure=?KHCY27846TBPJEJKBNOWVBEDHCJGTN50Z8W82S76W88TV9N6WU5YEOHRPRRZU5G07UPU2O142URM4
📊 Risk Score Breakdown
Total Risk Score
70/100
Contributing Factors
Active Phishing Kit
Detected kit types: Credential Harvester
Credential Harvesting
Credential harvesting detected with 1 form(s) capturing sensitive data
🔬 Comprehensive Threat Analysis
Threat Type
Credential Harvesting Kit
Target
Royal Bank of Canada (RBC) users
Attack Method
credential harvesting forms
Exfiltration Channel
HTTP POST to backend
Risk Assessment
MEDIUM - Automated credential harvesting with HTTP POST to backend
⚠️ Indicators of Compromise
- Kit types: Credential Harvester
🏢 Brand Impersonation Analysis
Impersonated Brand
Royal Bank of Canada (RBC)
Official Website
N/A
Fake Service
Account login portal
⚔️ Attack Methodology
Primary Method: Credential Harvesting
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Secondary Method: Standard Phishing Techniques
Uses typical phishing tactics including brand impersonation, urgency tactics, and social engineering to trick victims into providing sensitive information.
🌐 Infrastructure Indicators of Compromise
Domain Information
Domain
royal-security-hub-profile-privacy-questions-upgrade.vograc.com
Registered
2021-08-17 10:45:54+00:00
Registrar
10DENCEHISPAHARD, S.L
Status
Active (older domain)
Hosting Information
Provider
10DENCEHISPAHARD, S.L
ASN
🤖 AI-Extracted Threat Intelligence
"I Never Thought It Would Happen to Me"
That's what 2.3 million victims say every year. Don't wait to become a statistic.