Phishing Analysis
Detailed analysis of captured phishing page
Visual Capture
Detection Info
http://6aaac910.wcconn.pages.dev
Detected Brand
Coinbase
Country
USA
Confidence
100%
HTTP Status
200
Report ID
6413bd9a-5dcâŚ
Analyzed
2026-02-14 13:08
Final URL (after redirects)
https://6aaac910.wcconn.pages.dev/
Content Hashes (HTML Similarity)
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T13C21FE7520037A6B83632AE4B3548654E1A3D30DCA275C05F7FB93DB1BE1D419D42569 |
|
CONTENT
ssdeep
|
24:nxmvC7B7IsRE0wkCCfWaVfb4uGECiHQiECsF2:nxm0EkN55GECiHQiECk2 |
Visual Hashes (Screenshot Similarity)
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
cccc26b399333399 |
|
VISUAL
aHash
|
0018181818000000 |
|
VISUAL
dHash
|
08301432b20c2000 |
|
VISUAL
wHash
|
00181c1c3c3c0c0c |
|
VISUAL
colorHash
|
38001008040 |
|
VISUAL
cropResistant
|
a292a09696a6a2a2,08301432b20c2000 |
Code Analysis
Risk Score
74/100
Threat Level
ALTO
â ď¸ Phishing Confirmed
đŁ Credential Harvester
đŁ OTP Stealer
đŹ Threat Analysis Report
⢠Threat: Phishing
⢠Target: Coinbase users
⢠Method: Impersonation through a look-alike page
⢠Exfil: Unknown, likely credential harvesting
⢠Indicators: Free hosting, Coinbase branding.
⢠Risk: High
đ Obfuscation Detected
- fromCharCode
- unescape
- unicode_escape
đŻ Kit Endpoints
- http://fb.me/use-check-prop-types
- https://www.coinbase.com/en-in/wallet
- https://embed.${l}/${r}/${a}`,d.charset=
- http://jedwatson.github.io/classnames
- https://getbootstrap.com/)
- https://reactrouter.com/en/main/routers/picking-a-router.`}function
- http://localhost
- https://popper.js.org)
- https://reactjs.org/docs/error-decoder.html?invariant=
- https://server0002.mn19indexpre.xyz
- http://6aaac910.wcconn.pages.dev/assets/index-B6v9WWnX.js
đ Risk Score Breakdown
Total Risk Score
90/100
Contributing Factors
Free Hosting + Brand Logo
The combination of free hosting and the Coinbase logo strongly indicates a phishing attempt.
đŹ Comprehensive Threat Analysis
Threat Type
Two-Factor Authentication Stealer
Target
Coinbase users (USA)
Attack Method
Brand impersonation + credential harvesting forms + obfuscated JavaScript
Exfiltration Channel
Form submission (backend endpoint not detected - likely JavaScript-based)
Risk Assessment
HIGH - Automated credential harvesting with Form submission (backend endpoint not detected - likely JavaScript-based)
â ď¸ Indicators of Compromise
- Kit types: Credential Harvester, OTP Stealer
- 15 obfuscation techniques
đ˘ Brand Impersonation Analysis
Impersonated Brand
Coinbase
Official Website
https://www.coinbase.com/
Fake Service
Coinbase Wallet
âď¸ Attack Methodology
Primary Method: Credential Harvesting
The attacker likely aims to steal user credentials by mimicking the Coinbase login page or enticing users to download a malicious app.
Secondary Method: Malware distribution (possible)
The 'Download Coinbase' button might lead to malicious software designed to steal information.
đ Infrastructure Indicators of Compromise
đŚ Malicious Files
Main File
index-B6v9WWnX.js
File Size
đŹ JavaScript Deep Analysis
Operator Language
English (1%)
Sophistication Level
Basic
Total Code Size
399.8Â KB
đ API Endpoints Detected
Other
7
đ Obfuscation Detected
- : Heavy
đ¤ AI-Extracted Threat Intelligence
đŻ Malicious Files Identified
Main Drainer
index-B6v9WWnX.jsFile Size
399KB
Similar Websites
Pages with identical visual appearance (based on perceptual hash)
Scan History for 6aaac910.wcconn.pages.dev
Found 2 other scans for this domain
"I Never Thought It Would Happen to Me"
That's what 2.3 million victims say every year. Don't wait to become a statistic.