Phishing Analysis
Detailed analysis of captured phishing page
Visual Capture
Detection Info
https://sexy-whatsapp.blogspot.com/
Detected Brand
WhatsApp
Country
Unknown
Confidence
100%
HTTP Status
200
Report ID
708d0116-2bb…
Analyzed
2026-07-16 22:18
Content Hashes (HTML Similarity)
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T196D243B1A15565370767D3CD2E907B29FBC2429ECD874E0592E8D39D4FCAE92ED0120E |
|
CONTENT
ssdeep
|
768:ldF8g88kF0iJhTnXDtJD8dD94De6DC2DBhDY+//CrJT0e:Wg88kdJ9nXDtJD8dD94De6DC2DBhDdCl |
Visual Hashes (Screenshot Similarity)
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
b8e7b638c99292c9 |
|
VISUAL
aHash
|
ff83dfdf999f9f9f |
|
VISUAL
dHash
|
f016b0b033303438 |
|
VISUAL
wHash
|
3e801e1e991e1e9f |
|
VISUAL
colorHash
|
07206008000 |
|
VISUAL
cropResistant
|
f016b0b033303438,4555456969554545,59c5090101010101,4181010101010101 |
Code Analysis
Risk Score
85/100
Threat Level
ALTO
⚠️ Phishing Confirmed
🎣 Credential Harvester
🎣 OTP Stealer
🎣 Personal Info
🔐 Credential Harvesting Forms
🔒 Obfuscation Detected
- eval
- fromCharCode
- unescape
- document.write
- hex_escape
- unicode_escape
🎯 Kit Endpoints
- https://sexy-whatsapp.blogspot.com/2016/
- https://www.blogger.com/post-edit.g?blogID=8242038761287692003&postID=2729557640868080060&from=pencil
- https://sexy-whatsapp.blogspot.com/2016/10/136-2016.html
- https://www.blogger.com/post-edit.g?blogID=8242038761287692003&postID=245875784253286845&from=pencil
- https://sexy-whatsapp.blogspot.com/2016/10/139-2016-arab-hot-dance.html
- https://sexy-whatsapp.blogspot.com/2016/10/128-very-hot-arab-dance-2016.html
- https://sexy-whatsapp.blogspot.com/2016/10/2.html#more
- https://sexy-whatsapp.blogspot.com/2016/10/2.html#comment-form
- https://sexy-whatsapp.blogspot.com/2016/10/133.html
- https://sexy-whatsapp.blogspot.com/2016/10/125-2016.html
- https://sexy-whatsapp.blogspot.com/2016/10/3-2017-hot-dance.html#more
- https://sexy-whatsapp.blogspot.com/2016/10/138-2016.html#comment-form
- https://sexy-whatsapp.blogspot.com/2016/10/136-2016.html#more
- http://www.blogger.com/openid-server.g
- /search?updated-max=2016-10-24T06%3A35%3A00-07%3A00&max-results=6
- http://www.blogger.com/feeds/8242038761287692003/posts/default
- https://sexy-whatsapp.blogspot.com/2016/10/3-2017-hot-dance.html#comment-form
- https://www.blogger.com
- https://sexy-whatsapp.blogspot.com/2016/10/2017-hot-dance.html#more
- https://sexy-whatsapp.blogspot.com/feeds/posts/default?alt=rss
- https://sexy-whatsapp.blogspot.com/2016/10/139-2016-arab-hot-dance.html#comment-form
- /feeds/posts/summary?alt=json-in-script&callback=pageNavi&max-results=99999
- https://www.blogger.com/post-edit.g?blogID=8242038761287692003&postID=5896126091448189280&from=pencil
- https://sexy-whatsapp.blogspot.com/2016/10/
- https://sexy-whatsapp.blogspot.com/2016/10/33-2016.html
- https://sexy-whatsapp.blogspot.com/feeds/posts/default
- https://sexy-whatsapp.blogspot.com/2016/10/138-2016.html
- https://www.blogger.com/post-edit.g?blogID=8242038761287692003&postID=4424948592019706494&from=pencil
- https://sexy-whatsapp.blogspot.com/2016/10/139-2016-arab-hot-dance.html#more
- https://sexy-whatsapp.blogspot.com/2016/10/2.html
- https://sexy-whatsapp.blogspot.com/
- /feeds/posts/summary?alt=json-in-script&callback=pageNavi&max-results=99999
- https://www.blogger.com/post-edit.g?blogID=8242038761287692003&postID=6121890000342412208&from=pencil
- https://sexy-whatsapp.blogspot.com/2016/10/3-2017-hot-dance.html
- //www.blogger.com/
- https://sexy-whatsapp.blogspot.com/2016/10/136-2016.html#comment-form
- https://www.blogger.com/dyn-css/authorization.css?targetBlogID=8242038761287692003&zx=e8e62355-cfee-443f-b213-2e9a5e42c5ea
- https://www.blogger.com/post-edit.g?blogID=8242038761287692003&postID=2554885995114636560&from=pencil
- https://sexy-whatsapp.blogspot.com/2016/10/138-2016.html#more
- https://www.blogger.com/navbar/8242038761287692003?origin=https://sexy-whatsapp.blogspot.com&usegapi=1&jsh=m%3B%2F_%2Fscs%2Fabc-static%2F_%2Fjs%2Fk%3Dgapi.lb.en.9vdPKhB0RUg.O%2Fd%3D1%2Frs%3DAHpOoo97anj7zZ432JcN58tqJJp_A6WeOw%2Fm%3D__features__#id=navbar-iframe&_gfid=navbar-iframe&parent=https%3A%2F%2Fsexy-whatsapp.blogspot.com&pfname=&rpctoken=24398566
- https://sexy-whatsapp.blogspot.com/2016/10/133.html#comment-form
- https://sexy-whatsapp.blogspot.com/2016/10/2017-hot-dance.html
- https://sexy-whatsapp.blogspot.com/2016/10/2017-hot-dance.html#comment-form
- https://lh3.googleusercontent.com/blogger_img_proxy/AEn0k_tgryg3_PrBARxUOCqSnxLfUUDdVrQPFYJt6Nh6MXl2957BsySfhhEIiTKuAUkeUrQRYoqrFfERjUbn3KZ6SY96pdOCS5LM8uAayMN28bMNRxo
- https://www.blogger.com/post-edit.g?blogID=8242038761287692003&postID=6831034224524523147&from=pencil
- http://arlinadesign.blogspot.com
- https://sexy-whatsapp.blogspot.com/2016/10/133.html#more
📡 API Calls Detected
- post
📤 Form Action Targets
- /search
📊 Risk Score Breakdown
Total Risk Score
100/100
Contributing Factors
Active Phishing Kit
Detected kit types: Credential Harvester, OTP Stealer, Personal Info
Credential Harvesting
Credential harvesting detected with 2 form(s) capturing sensitive data
Code Obfuscation
JavaScript code obfuscated using 31 technique(s) to evade detection
🔬 Comprehensive Threat Analysis
Threat Type
Two-Factor Authentication Stealer
Target
WhatsApp users
Attack Method
credential harvesting forms + obfuscated JavaScript
Exfiltration Channel
HTTP POST to backend
Risk Assessment
CRITICAL - Automated credential harvesting with HTTP POST to backend
⚠️ Indicators of Compromise
- Kit types: Credential Harvester, OTP Stealer, Personal Info
- 31 obfuscation techniques
🏢 Brand Impersonation Analysis
Impersonated Brand
WhatsApp
Official Website
https://www.whatsapp.com
Fake Service
Credential harvesting service
⚔️ Attack Methodology
Primary Method: Credential Harvesting
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Secondary Method: JavaScript Obfuscation
Malicious code is obfuscated using 31 techniques to evade detection by security scanners and make reverse engineering more difficult.
🌐 Infrastructure Indicators of Compromise
Domain Information
Domain
sexy-whatsapp.blogspot.com
Registered
Unknown
Registrar
None
Status
Age unknown
Hosting Information
Provider
Unknown
ASN
🤖 AI-Extracted Threat Intelligence
"I Never Thought It Would Happen to Me"
That's what 2.3 million victims say every year. Don't wait to become a statistic.