Phishing Analysis
Detailed analysis of captured phishing page
Visual Capture
Detection Info
https://authstart-terezor.github.io/
Detected Brand
Trezor
Country
International
Confidence
95%
HTTP Status
200
Report ID
6881e601-fd9…
Analyzed
2026-03-11 17:35
Content Hashes (HTML Similarity)
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T1D851952EF00D3644938183DB79D0EAFDFB8B403851952B4A29EED20DB6D47E38CB5646 |
|
CONTENT
ssdeep
|
48:ToRiuVZfXtkoYNCrSQ5ZfEV1j5Ku5auGQA1Kh8VvSslkFNn:Tosgft7YUmQ3s9Kqau9A1Kfn |
Visual Hashes (Screenshot Similarity)
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
bf1d41431e1e3a72 |
|
VISUAL
aHash
|
00fb9f9fffffffff |
|
VISUAL
dHash
|
69433333632bcbc7 |
|
VISUAL
wHash
|
00bb83839383eff3 |
|
VISUAL
colorHash
|
07008000c00 |
|
VISUAL
cropResistant
|
433333636b2bcbc7,00201669691a0000 |
Code Analysis
Threat Level
ALTO
⚠️ Phishing Confirmed
🔬 Threat Analysis Report
• Threat: Phishing
• Target: Trezor users
• Method: Impersonation via free hosting.
• Exfil: Likely wallet details
• Indicators: Free hosting, Trezor branding.
• Risk: High
📊 Risk Score Breakdown
Total Risk Score
90/100
Contributing Factors
Free Hosting
The domain is hosted on github.io, a free hosting service often used for phishing.
Impersonation
The site visually impersonates the Trezor Suite interface.
🔬 Comprehensive Threat Analysis
Threat Type
Trezor Phishing Landing Page
Target
Trezor users (International)
Attack Method
Brand impersonation
Exfiltration Channel
Form submission (backend endpoint not detected - likely JavaScript-based)
Risk Assessment
LOW - Automated credential harvesting with Form submission (backend endpoint not detected - likely JavaScript-based)
🏢 Brand Impersonation Analysis
Impersonated Brand
Trezor
Official Website
https://trezor.io/
Fake Service
Trezor Suite
⚔️ Attack Methodology
Primary Method: Credential Harvesting
The site likely attempts to steal login credentials, potentially by redirecting the user to a fake login page or by using a keylogger, if the code is injected.
Secondary Method: Malware Injection
The site could potentially inject malicious JavaScript to steal further information and compromise the user's wallet.
🌐 Infrastructure Indicators of Compromise
Domain Information
Domain
authstart-terezor.github.io
Registered
None
Registrar
None
Status
None
🤖 AI-Extracted Threat Intelligence
Similar Websites
Pages with identical visual appearance (based on perceptual hash)
Scan History for authstart-terezor.github.io
Found 2 other scans for this domain
"I Never Thought It Would Happen to Me"
That's what 2.3 million victims say every year. Don't wait to become a statistic.