Phishing Analysis
Detailed analysis of captured phishing page
Visual Capture
Detection Info
http://netflix-71f05.web.app/
Detected Brand
Netflix
Country
International
Confidence
100%
HTTP Status
200
Report ID
680129bd-7a3…
Analyzed
2026-02-05 12:16
Final URL (after redirects)
https://netflix-71f05.web.app/
Content Hashes (HTML Similarity)
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T135F121796585207B573785C5B217E70E72A3C02AE5076C783BF8CA5A4FE9F0ACAA1181 |
|
CONTENT
ssdeep
|
96:nG9NmsElK1H6bC9EZWaVonoaIPUU/flSU1xfkUVhtk8aMfjUkfwUb2Ln1HjwysJ5:G9NjP6RWIme4U29jwnJsGxg1JS |
Visual Hashes (Screenshot Similarity)
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
9a6c13258e9a6db3 |
|
VISUAL
aHash
|
0000d8ffff000c2c |
|
VISUAL
dHash
|
06b43361a58758c9 |
|
VISUAL
wHash
|
8210ffffff000c2c |
|
VISUAL
colorHash
|
32602000001 |
|
VISUAL
cropResistant
|
90808262628200b2,e1680c8686e46464,06b43361a58758c9 |
Code Analysis
Risk Score
79/100
Threat Level
ALTO
⚠️ Phishing Confirmed
🎣 Credential Harvester
🎣 OTP Stealer
🎣 Banking
🎣 Personal Info
🔥 Firebase Backend
🔬 Threat Analysis Report
• Threat: Phishing
• Target: Netflix users
• Method: Impersonation through a fake login page.
• Exfil: Likely collecting email addresses
• Indicators: Free hosting, brand logo, form for email.
• Risk: High
🔒 Obfuscation Detected
- atob
- fromCharCode
- base64_strings
📡 API Calls Detected
- firebaseLocalStorageDb
☁️ Cloud Backend
- Firebase: netflix-71f05.firebaseapp.com
📊 Risk Score Breakdown
Total Risk Score
90/100
Contributing Factors
Free hosting with brand logo
This is a key indicator of phishing. The site is hosted on a free platform (netflix-71f05.web.app) and uses the Netflix logo, suggesting the purpose of this website is to steal user data.
🔬 Comprehensive Threat Analysis
Threat Type
Banking Credential Harvester
Target
Netflix users (International)
Attack Method
Brand impersonation + obfuscated JavaScript
Exfiltration Channel
Firebase Database
Risk Assessment
HIGH - Automated credential harvesting with Firebase Database
⚠️ Indicators of Compromise
- Kit types: Credential Harvester, OTP Stealer, Banking, Personal Info
- 57 obfuscation techniques
🏢 Brand Impersonation Analysis
Impersonated Brand
Netflix
Official Website
https://www.netflix.com/
Fake Service
Netflix streaming service
⚔️ Attack Methodology
Primary Method: Credential Harvesting
The attacker creates a fake login page that closely resembles the legitimate Netflix website. The user is tricked into entering their credentials, which are then harvested by the attacker.
🌐 Infrastructure Indicators of Compromise
Domain Information
Domain
netflix-71f05.web.app
Registered
None
Registrar
None
Status
None
🔬 JavaScript Deep Analysis
Operator Language
English (1%)
Total Code Size
749.6 KB
🔗 API Endpoints Detected
Other
8
🔐 Obfuscation Detected
- : Heavy
- : Light
🤖 AI-Extracted Threat Intelligence
Similar Websites
Pages with identical visual appearance (based on perceptual hash)
Scan History for netflix-71f05.web.app
Found 1 other scan for this domain
"I Never Thought It Would Happen to Me"
That's what 2.3 million victims say every year. Don't wait to become a statistic.