SafeMode - Analysis: srv1300486.hstgr.cloud

Visual Capture

Detection Info

http://srv1300486.hstgr.cloud/sr/

Detected Brand

YONO SBI (State Bank of India)

Country

International

Confidence

95%

HTTP Status

200

Report ID

7f56b9bb-33f…

Analyzed

2026-01-30 11:45

Final URL (after redirects)

https://srv1300486.hstgr.cloud/sr/

Content Hashes (HTML Similarity)

Used to detect similar phishing pages based on HTML content

Algorithm	Hash Value
CONTENT TLSH	T1B5618561804DA86FC2534881F627BA15A147441E8B538E963FA5C696FDCAD32DE313CE
CONTENT ssdeep	96:cSVkC3VSuNSadcadaamUadavadasBsDBSZBijB7ne:jVkCtIwcwhmUwmw7+Re

Visual Hashes (Screenshot Similarity)

Used to detect visually similar phishing pages based on screenshots

Algorithm	Hash Value
VISUAL pHash	eb79c4846b7a3826
VISUAL aHash	c2ff818181ffffff
VISUAL dHash	16d61b3b63134d0d
VISUAL wHash	c0da818101ffe7e7
VISUAL colorHash	07000400049
VISUAL cropResistant	16d61b3b63134d0d,2d2d929292d27065,66aaca4a2a2aaa66,0f3371696971310f,0f71616969696969,0f3371696971310f,33f5c4653594b567,6969713313061d3a,0000101010100800

Code Analysis

Risk Score 50/100

Threat Level ALTO

⚠️ Phishing Confirmed

🎣 Credential Harvester

🔬 Threat Analysis Report

• Threat: Phishing
• Target: YONO SBI customers
• Method: Impersonation and Social Engineering
• Exfil: Likely account credentials and potentially financial information.
• Indicators: Unrelated domain, urgency, and reward offers.
• Risk: HIGH

🎯 Kit Endpoints

https://retail.onlinesbi.com/retail/troubleloginhome.htm?bankCode=0
login.html

📊 Risk Score Breakdown

Total Risk Score

90/100

Contributing Factors

Domain mismatch

The domain `srv1300486.hstgr.cloud` is not associated with YONO SBI.

Social engineering (Urgency and Rewards)

The website uses urgency tactics ('Complete KYC Now') and offers a reward (points) to entice users.

Brand Impersonation

The website uses the YONO SBI logo and branding to mimic the legitimate site.

Poor Grammar/Spelling

Grammatical errors such as 'Aproved' and 'diposited' are red flags.

🔬 Comprehensive Threat Analysis

Threat Type

Credential Harvesting Kit

Target

YONO SBI (State Bank of India) users (International)

Attack Method

Brand impersonation

Exfiltration Channel

Form submission (backend endpoint not detected - likely JavaScript-based)

Risk Assessment

MEDIUM - Automated credential harvesting with Form submission (backend endpoint not detected - likely JavaScript-based)

⚠️ Indicators of Compromise

Kit types: Credential Harvester

🏢 Brand Impersonation Analysis

Impersonated Brand

YONO SBI

Official Website

https://www.yonosbi.sbi/

Fake Service

YONO SBI Login

Fraudulent Claims

⚔️ Attack Methodology

Primary Method: Credential Harvesting

The phishing site attempts to steal the user's login credentials by providing a fake login form that mimics the appearance of the YONO SBI login portal. Once the user enters their username and password, the attackers gain access to the account.

Secondary Method: Social Engineering

The attackers leverage social engineering techniques like the promise of rewards and the need to complete KYC to create a sense of urgency and convince users to submit their credentials.