Phishing Analysis
Detailed analysis of captured phishing page
Visual Capture
Detection Info
https://accounts-fe50ccd9.jkhjkjk.workers.dev/fe50ccd906034827
Detected Brand
Microsoft Office
Country
Unknown
Confidence
100%
HTTP Status
200
Report ID
8100cd1c-fbd…
Analyzed
2026-08-15 10:12
Final URL (after redirects)
https://accounts-fe50ccd9.jkhjkjk.workers.dev/fe50ccd906034827?sid=dA255VxbngzmU6LDzlTOaYRdAJiuzHLmjiPVwewcgGnZurNYrnjpQVBown1LwM4OtSiHDk4XKoEC8ZmUgYtHHTzOIlnzaSamAYu58KritmgiXZhoY3autiyCo43BLSvrhVR3RRYPRMpfzrIelxbMi7U9RvqUcF9VJ4jhtrg7QAQQ0f3LtlAU3KD1ghoyTrD3fL3sgtglm70seZr9hN9KFE20GMRRrDw9BzAJ2sSs04yLCbUrw3k0gXba6OhqRLaeh7dUTFMvirr6u5s9sy3PTUfuB2AOayGUtcWEO9ZQgg9spNnXL7dubGOBVC5JDGu45WNyBRNHxXikMWBPlNl7meXTjifnzq9FkLMsxyAG3tvZqbEe2NSQIQeYhaZe1teFLRYQKzVZtnvtbZrrzZo3jmS58qn163uq0fiZ7CVkjJyouVUNpopMx6iRCgXaVId9zQ3WjhdV5vSTfAmdt18gNDrVrlzILasEVEttbrvfuURu6TCLgP4GRAbk3vTLt4hHgLrZLOUnFeDfHjZlhaFDWD3k0ahOE9Qd3nr0tjzy4CdmDefzNAS5xvoQSghb6f1Z4WGsh5TZRltKxKrKoiiLPJc31pj4pxVUSP2WZn7DQ9A8sAZaGrXaUl080NKZI3Xp4t1bp6bDI4&rid=bJrlh4HQQm8EdrJB39lB0aOB3FnLKv7gKtHGCkhDvjKskppCcYGel6NFZzBHf9hzE3z7ZCkrvG5m2TjuFuURQXirvszVOhPFfDSuRL5WNULPsi6LfSbPa9PhFi52I3RDX3TBRpdeCVmalKGA7uAnDCSTCUbBhM8pHmmzo2z6KhxihNn9Hiwo7T7LVFTt6ULQDGwEA2Wu7LRbJy3p0TwcDygxEEcl4cuo4HmsC22SapiATbl3EZLWABhXI8ejOEQbj30jbb0Tq63gTXtpOxlJTMcod5ZiRxVtKLW5skxrTppud3nOSxENG0bK5ATpLsYWG2qUaGChke7eIeq4LOpjd20Css5qZTptan7KcHT1NXXRZyc3py2z9eusH63vcssAETjQcM2nxqPWlisklDw41QBD0DwQTfJGkZoYFdWvCkmoQaXbQVPRIYkq973kKQNQ8uvM9CDOCDRkLsWyUCAZIsR0sYVDcWMgLsA8FsoqZbu1wpcQUGSzvSc5HW2z8d5pIoEktdtBVs9aNiOubnCMP8NyAdrXDxn8vpRrAtXagOxflrTz7ZgXtVTxndrwRvVUIxvSuxK6rAIK3eWb3kgcyWHeKbiR8SrPsQEdH5GeKjwb4FX6kcOlwW23YiC24N7f5b65AgXw6I
Content Hashes (HTML Similarity)
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T15A41357162611A2F92034DD9B59433D630AEC24ECBCA040097FD23FE9BE9C86FD55179 |
|
CONTENT
ssdeep
|
48:luMYvGnV3IlHZmk/yidgO2THKpD4hb+vYz2/:lZYvuIlHZl/yiCOXpskv |
Visual Hashes (Screenshot Similarity)
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
9966669999666693 |
|
VISUAL
aHash
|
0018001818180000 |
|
VISUAL
dHash
|
08304cb2b2281400 |
|
VISUAL
wHash
|
0c0c243cd8d8f0f0 |
|
VISUAL
colorHash
|
07000000e00 |
|
VISUAL
cropResistant
|
08304cb2b2281400 |
Code Analysis
Risk Score
91/100
Threat Level
ALTO
⚠️ Phishing Confirmed
🎣 Credential Harvester
🎣 OTP Stealer
🎣 Banking
⚡ Supabase Backend
🔒 Obfuscation Detected
- atob
- base64_strings
☁️ Cloud Backend
- Supabase: qctazjekftdaugwaxwyc.supabase.co
📊 Risk Score Breakdown
Total Risk Score
100/100
Contributing Factors
Active Phishing Kit
Detected kit types: Credential Harvester, OTP Stealer, Banking
Code Obfuscation
JavaScript code obfuscated using 2 technique(s) to evade detection
🔬 Comprehensive Threat Analysis
Threat Type
Banking Credential Harvester
Target
Microsoft Office users
Attack Method
obfuscated JavaScript
Exfiltration Channel
Supabase Database
Risk Assessment
CRITICAL - Automated credential harvesting with Supabase Database
⚠️ Indicators of Compromise
- Kit types: Credential Harvester, OTP Stealer, Banking
- 2 obfuscation techniques
🏢 Brand Impersonation Analysis
Impersonated Brand
Microsoft Office
Official Website
N/A
Fake Service
Banking/payment service
⚔️ Attack Methodology
Primary Method: Credential Harvesting
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Secondary Method: JavaScript Obfuscation
Malicious code is obfuscated using 2 techniques to evade detection by security scanners and make reverse engineering more difficult.
Target Blockchain
Multiple blockchains
Whitelist Bypass
YES
Drainer supports multiple blockchain networks and checks for high-value tokens on each chain before executing drain operations.
🌐 Infrastructure Indicators of Compromise
Domain Information
Domain
accounts-fe50ccd9.jkhjkjk.workers.dev
Registered
Unknown
Registrar
Unknown
Status
Age unknown
Hosting Information
Provider
Unknown
ASN
🤖 AI-Extracted Threat Intelligence
Similar Websites
Pages with identical visual appearance (based on perceptual hash)
Scan History for accounts-fe50ccd9.jkhjkjk.workers.dev
Found 1 other scan for this domain
"I Never Thought It Would Happen to Me"
That's what 2.3 million victims say every year. Don't wait to become a statistic.