EN ES PT

Phishing Analysis

Detailed analysis of captured phishing page

Back to Stats

Visual Capture

Screenshot of d26hpdecvhwn5s.cloudfront.net

Detection Info

http://d26hpdecvhwn5s.cloudfront.net/about/
Detected Brand
Capital One
Country
USA
Confidence
100%
HTTP Status
200
Report ID
4d05c85c-e95…
Analyzed
2026-03-06 08:16
Final URL (after redirects)
https://d26hpdecvhwn5s.cloudfront.net/about/

Content Hashes (HTML Similarity)

Used to detect similar phishing pages based on HTML content

Algorithm Hash Value
CONTENT TLSH
T1E8D31072B5012D7F6787BE96E5267F05F2918235F40B1784FBA9090E4FC2FE5A226324
CONTENT ssdeep
3072:BmgGFRFuzwsIEC6IX9ZFcOg3aT/ww1JUSJLKgNd5TuXY7C/2H/aVhmhuMu3Awqta:BmgGFRFuzwsIEC6IX9ZFcOg3aT/ww1tA

Visual Hashes (Screenshot Similarity)

Used to detect visually similar phishing pages based on screenshots

Algorithm Hash Value
VISUAL pHash
a206b8b833c7fccc
VISUAL aHash
ff21302061ffffdf
VISUAL dHash
1fc5e7cf8f22c51a
VISUAL wHash
ef00202001ffffcf
VISUAL colorHash
07600000080
VISUAL cropResistant
1fc5e7cf8f22c51a,4efced6dcded9cb7,456d24042e2e1b59,6100213d23a78393

Code Analysis

Risk Score 85/100
Threat Level ALTO
⚠️ Phishing Confirmed
🎣 Credential Harvester 🎣 OTP Stealer 🎣 Card Stealer 🎣 Banking 🎣 Personal Info

🔬 Threat Analysis Report

• Threat: Phishing
• Target: Capital One customers
• Method: Impersonation through a look-alike website hosted on a free platform
• Exfil: Potentially credentials or sensitive information
• Indicators: Free hosting and brand logo
• Risk: High

🔒 Obfuscation Detected

  • fromCharCode
  • unescape
  • hex_escape
  • unicode_escape
  • base64_strings

🎯 Kit Endpoints

  • https://autorefi.capitalone.com/login/
  • https://autorefi.capitalone.com/login
  • /privacy/online-privacy-policy#collecting-using-sharing-information-accordion-button-5

📡 API Calls Detected

  • GET
  • post
  • get
  • POST

📊 Risk Score Breakdown

Total Risk Score
95/100

Contributing Factors

Free Hosting + Brand Logo
The combination of these two is a very strong indicator of phishing.

🔬 Comprehensive Threat Analysis

Threat Type
Banking Credential Harvester
Target
Capital One users (USA)
Attack Method
Brand impersonation + obfuscated JavaScript
Exfiltration Channel
Form submission (backend endpoint not detected - likely JavaScript-based)
Risk Assessment
CRITICAL - Automated credential harvesting with Form submission (backend endpoint not detected - likely JavaScript-based)

⚠️ Indicators of Compromise

  • Kit types: Credential Harvester, OTP Stealer, Card Stealer, Banking, Personal Info
  • 163 obfuscation techniques

🏢 Brand Impersonation Analysis

Impersonated Brand
Capital One
Official Website
capitalone.com
Fake Service
Banking services

⚔️ Attack Methodology

Primary Method: Credential Harvesting

The attacker aims to steal user credentials (username and password) by creating a fake login page that closely resembles the legitimate Capital One website.

🌐 Infrastructure Indicators of Compromise

Domain Information

Domain
d26hpdecvhwn5s.cloudfront.net
Registered
Unknown
Registrar
Amazon.com, Inc.
Status
ACTIVE

🤖 AI-Extracted Threat Intelligence

Scan History for d26hpdecvhwn5s.cloudfront.net

Found 10 other scans for this domain

😰
"I Never Thought It Would Happen to Me"
That's what 2.3 million victims say every year. Don't wait to become a statistic.