SafeMode - Analysis: pub-9e2030303d9b43ffaedcde988f24645c.r2.dev

Visual Capture

Screenshot of pub-9e2030303d9b43ffaedcde988f24645c.r2.dev

Detection Info

https://pub-9e2030303d9b43ffaedcde988f24645c.r2.dev/index.html?baf543ff2ba7db6aba5e3df64d588c

Detected Brand

Microsoft

Country

International

Confidence

100%

HTTP Status

200

Report ID

540ea626-c66…

Analyzed

2025-12-30 23:45

Content Hashes (HTML Similarity)

Used to detect similar phishing pages based on HTML content

Algorithm	Hash Value
CONTENT TLSH	T1C1C57DD47365703647DB9096507A0542F33A74A91808842CFA2CE8EB7BA9C4972FFFB5
CONTENT ssdeep	49152:JkTdPIWCh9abrhOqG4k9e6AhWTaHDt3MPsq9FjTxDIsL4tgJSs89CqqqeK:5LaHKPsqPjTxXy

Visual Hashes (Screenshot Similarity)

Used to detect visually similar phishing pages based on screenshots

Algorithm	Hash Value
VISUAL pHash	8bb320ccc6779999
VISUAL aHash	ffffffe718180000
VISUAL dHash	00002a2ab2b20c10
VISUAL wHash	ffffffc618180000
VISUAL colorHash	07001280000
VISUAL cropResistant	00002a2ab2b20c10

Code Analysis

Risk Score 95/100

Threat Level ALTO

⚠️ Phishing Confirmed

🎣 Credential Harvester 🎣 OTP Stealer 🎣 Card Stealer 🎣 Banking 🎣 Personal Info

🔬 Threat Analysis Report

• Threat: Phishing attack impersonating Microsoft.
• Target: Microsoft users.
• Method: Displays a fake security check page to potentially harvest credentials in a later step.
• Exfil: Unknown at this stage but likely designed to redirect to a credential harvesting page.
• Indicators: Mismatched domain, r2.dev hosting.
• Risk: HIGH - Potential credential theft and account compromise.