EN ES PT

Phishing Analysis

Detailed analysis of captured phishing page

Back to Stats

Visual Capture

Screenshot of c2.shemaria.tech

Detection Info

http://c2.shemaria.tech
Detected Brand
Hak5 Cloud C2
Country
International
Confidence
100%
HTTP Status
200
Report ID
450e4b1e-476…
Analyzed
2026-08-18 18:09
Final URL (after redirects)
https://c2.shemaria.tech/#/login

Content Hashes (HTML Similarity)

Used to detect similar phishing pages based on HTML content

Algorithm Hash Value
CONTENT TLSH
T115C1AD609809A92F7E47A8DF49E5EF089D95D539E50202C8D39E3C8D0FCED70D19DEA2
CONTENT ssdeep
96:TiUIf9M0R0n1JnRU/cMOiPCtzyIJdRolU8gljL88utNLTtm1VI8nCRo85Y+gvfuS:VMM0R0n1JRsgiP8xsvglHsNLI19gjiOS

Visual Hashes (Screenshot Similarity)

Used to detect visually similar phishing pages based on screenshots

Algorithm Hash Value
VISUAL pHash
dc53236c99738c99
VISUAL aHash
0000181818d8ffff
VISUAL dHash
000c323232320cb1
VISUAL wHash
00001818d8ffffff
VISUAL colorHash
00003000180
VISUAL cropResistant
000c323232320cb1

Code Analysis

Risk Score 82/100
Threat Level ALTO
⚠️ Phishing Confirmed
🎣 Credential Harvester 🎣 OTP Stealer 🎣 Banking 🎣 Personal Info

🔬 Threat Analysis Report

• Threat: Credential Harvesting
• Target: Hak5 Cloud C2 users
• Method: Impersonation login portal
• Exfil: JavaScript-based submission
• Indicators: Obfuscated JS, suspicious domain
• Risk: Critical

🔒 Obfuscation Detected

  • atob
  • fromCharCode
  • hex_escape
  • unicode_escape

📡 API Calls Detected

  • https://shop.hak5.org/?utm_source=cloudc2
  • https://c2.hak5.org/#upgrade
  • https://docs.hak5.org/
  • https://hak5.org/c2-icons
  • GET

📊 Risk Score Breakdown

Total Risk Score
95/100

Contributing Factors

Impersonation
Exact replica of login UI.
Domain Analysis
TLD and domain string unrelated to brand.

🔬 Comprehensive Threat Analysis

Threat Type
Banking Credential Harvester
Target
Hak5 Cloud C2 users (International)
Attack Method
Brand impersonation + credential harvesting forms + obfuscated JavaScript
Exfiltration Channel
Form submission (backend endpoint not detected - likely JavaScript-based)
Risk Assessment
CRITICAL - Automated credential harvesting with Form submission (backend endpoint not detected - likely JavaScript-based)

⚠️ Indicators of Compromise

  • Kit types: Credential Harvester, OTP Stealer, Banking, Personal Info
  • 7779 obfuscation techniques

🏢 Brand Impersonation Analysis

Impersonated Brand
Hak5
Official Website
https://hak5.org/
Fake Service
Cloud C2 Management Portal

Fraudulent Claims

⚔️ Attack Methodology

Primary Method: Credential Harvesting

The site presents a fake login form to intercept administrative credentials for Hak5 C2 devices.

Secondary Method: JavaScript Obfuscation

Uses obfuscated scripts to hide the submission destination of the collected credentials.

🌐 Infrastructure Indicators of Compromise

Domain Information

Domain
c2.shemaria.tech
Registered
2025-05-19
Registrar
Unknown
Status
Active

🤖 AI-Extracted Threat Intelligence

Similar Websites

Pages with identical visual appearance (based on perceptual hash)

Screenshot
Unknown
https://cdn.gosafemode.com/screenshots/77aa351d2a7c.png
Aug 18, 2026
 Screenshot
Unknown
https://cdn.gosafemode.com/screenshots/384acfa1137b.png
Aug 18, 2026
 Screenshot
Unknown
https://cdn.gosafemode.com/screenshots/e056c9536900.png
Aug 18, 2026
 Screenshot
Unknown
https://cdn.gosafemode.com/screenshots/87db9d87bca8.png
Aug 18, 2026
😰
"I Never Thought It Would Happen to Me"
That's what 2.3 million victims say every year. Don't wait to become a statistic.