SafeMode - Analysis: squadsanatani.github.io

Visual Capture

Detection Info

http://squadsanatani.github.io/insta-info

Detected Brand

Instagram

Country

International

Confidence

100%

HTTP Status

200

Report ID

59ee85f8-90d…

Analyzed

2025-12-30 19:52

Final URL (after redirects)

https://squadsanatani.github.io/insta-info/

Content Hashes (HTML Similarity)

Used to detect similar phishing pages based on HTML content

Algorithm	Hash Value
CONTENT TLSH	T12C427572E049DD7A04CBD5D4AAB61B3E23B6E2A8F856010DE9E5C3F54F93E68CD53041
CONTENT ssdeep	192:jAOtvdxFYEz/i/qXfHk4Wd3PYEyZhfzNxR91:jnxk/6Hkld3PYEyZhvB

Visual Hashes (Screenshot Similarity)

Used to detect visually similar phishing pages based on screenshots

Algorithm	Hash Value
VISUAL pHash	b839c7ccc3936466
VISUAL aHash	ffcfc7cfc3c3ffff
VISUAL dHash	10949e989696480c
VISUAL wHash	07070303c3c3dfc3
VISUAL colorHash	07403000040
VISUAL cropResistant	10949e989696480c

Code Analysis

Risk Score 70/100

Threat Level ALTO

⚠️ Phishing Confirmed

🎣 Credential Harvester 🎣 OTP Stealer 🎣 Personal Info

🔬 Threat Analysis Report

• Threat: Credential harvesting phishing targeting Instagram users.
• Target: Instagram users.
• Method: Fake login page hosted on free hosting to steal usernames and passwords.
• Exfil: Likely exfiltrating data to an attacker-controlled server.
• Indicators: Free hosting, Instagram logo on a non-Instagram domain.
• Risk: CRITICAL - Immediate risk of credential theft.

🔐 Credential Harvesting Forms

🎯 Kit Endpoints

http://127.0.0.1:20713//logindata
https://play.google.com/store/apps/details?id=com.instagram.android&referrer=utm_source%3Dinstagramweb%26utm_campaign%3DloginPage%26ig_mid%3DD747B7DB-EBF3-4793-89EC-7A555D089985%26utm_content%3Dlo%26utm_medium%3Dbadge
https://about.instagram.com/blog/
https://itunes.apple.com/app/instagram/id389801252?pt=428156&ct=igweb.loginPage.badge&mt=8&vt=lo