Phishing Analysis
Detailed analysis of captured phishing page
Visual Capture
No screenshot available
Detection Info
https://filerubyfolder.sbs/
Detected Brand
Unknown
Country
International
Confidence
85%
HTTP Status
200
Report ID
71f9709e-f38…
Analyzed
2026-08-06 11:32
Content Hashes (HTML Similarity)
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T12C3143623098673B0A8782D5B673A7AC3B80C0C8E3251A0026F542CC5ED7D29CF061CB |
|
CONTENT
ssdeep
|
24:hR/ClRlMqqmRWbRWJoNLCcRCj4d0vJcki80bSpl4wAGqw5HMDWGqjaWe3I89HMBT:TiTMTXRpNtqvKpQl4Sqw5693+Bc98J |
Visual Hashes (Screenshot Similarity)
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
d7835d08dd887726 |
|
VISUAL
aHash
|
3cbd243c00000100 |
|
VISUAL
dHash
|
69694d7004000100 |
|
VISUAL
wHash
|
3cff273f0c0c0f0c |
|
VISUAL
colorHash
|
07002006000 |
|
VISUAL
cropResistant
|
69694d7004000100 |
Code Analysis
Risk Score
3/100
Threat Level
MEDIO
⚠️ Phishing Confirmed
🔬 Threat Analysis Report
• Threat: Browser Hijacker/Adware
• Target: Chrome users
• Method: Malicious extension download
• Exfil: Browser search traffic
• Indicators: Unsolicited extension promotion
• Risk: Medium
🔒 Obfuscation Detected
- unescape
📡 API Calls Detected
- POST
📊 Risk Score Breakdown
Total Risk Score
65/100
Contributing Factors
Suspicious Domain TLD
.sbs is frequently abused
Content
Promotes search hijacking extension
🔬 Comprehensive Threat Analysis
Threat Type
Unknown Threat
Target
General public
Attack Method
obfuscated JavaScript
Exfiltration Channel
Unknown
Risk Assessment
LOW - Automated credential harvesting with Unknown
⚠️ Indicators of Compromise
- 2 obfuscation techniques
🏢 Brand Impersonation Analysis
Impersonated Brand
None
Fake Service
Search Utility
Fraudulent Claims
⚔️ Attack Methodology
Primary Method: Browser Hijacking
Promotes an extension that modifies browser settings to redirect traffic to affiliate search engines.
Secondary Method: Adware Distribution
The site uses social engineering to trick users into installing software that generates ad revenue.
🌐 Infrastructure Indicators of Compromise
Domain Information
Domain
filerubyfolder.sbs
Registered
2026-05-22
Registrar
Unknown
Status
active
🤖 AI-Extracted Threat Intelligence
Similar Websites
Pages with identical visual appearance (based on perceptual hash)
Unknown
https://cdn.gosafemode.com/screenshots/3bce688d870a.png
Aug 06, 2026
Unknown
https://cdn.gosafemode.com/screenshots/74781b0694d6.png
Aug 06, 2026
Unknown
https://cdn.gosafemode.com/screenshots/58e9212741cd.png
Aug 06, 2026
Unknown
https://cdn.gosafemode.com/screenshots/41c98a4039db.png
Aug 06, 2026
Unknown
https://cdn.gosafemode.com/screenshots/f99b17bf3ce7.png
Aug 06, 2026
"I Never Thought It Would Happen to Me"
That's what 2.3 million victims say every year. Don't wait to become a statistic.