Phishing Analysis
Detailed analysis of captured phishing page
Visual Capture
No screenshot available
Detection Info
https://sp326487.sitebeat.crazydomains.com/
Detected Brand
Unknown
Country
Unknown
Confidence
100%
HTTP Status
200
Report ID
87a0ec2f-3e3…
Analyzed
2026-01-26 11:57
Content Hashes (HTML Similarity)
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T1F8628331F075643B011F75E0F1A6970AE2DBC30ECBA28BE4E6B892E057D9CD5AD27605 |
|
CONTENT
ssdeep
|
192:U1Yk8D/ojEvQtJVVvmdiAjtyTfpOgsKbeJOdtAojtIv1+25MqfYcJXE4vrz12eho:bwjwiJwhytbRbeJ4fE1tNJ1wNV |
Visual Hashes (Screenshot Similarity)
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
9959a42766dc9936 |
|
VISUAL
aHash
|
18181818251f1f3f |
|
VISUAL
dHash
|
d1b2303169707474 |
|
VISUAL
wHash
|
3d181818271f1fbf |
|
VISUAL
colorHash
|
070000001c0 |
|
VISUAL
cropResistant
|
d1b2303169707474 |
Code Analysis
Risk Score
76/100
🎣 Credential Harvester
🎣 OTP Stealer
🎣 Card Stealer
🎣 Personal Info
🔒 Obfuscation Detected
- fromCharCode
- unicode_escape
📡 API Calls Detected
- POST
📊 Risk Score Breakdown
Total Risk Score
100/100
Contributing Factors
Active Phishing Kit
Detected multiple kit types: Credential Harvester, OTP Stealer, Card Stealer, and Personal Info collector. Indicates a multi-stage attack framework.
Obfuscation Techniques
Two obfuscation techniques detected in JavaScript code, increasing evasion and analysis difficulty.
Malicious JavaScript
Presence of a bundled JavaScript file (bundle.js) with a non-trivial size (0.15 MB), likely containing malicious logic.
Lack of Brand Impersonation
No clear brand impersonation detected, suggesting a generic or highly targeted phishing campaign.
🔬 Comprehensive Threat Analysis
Threat Type
Banking Credential Harvester
Target
General public
Attack Method
credential harvesting forms + obfuscated JavaScript
Exfiltration Channel
Unknown
Risk Assessment
HIGH - Automated credential harvesting with Unknown
⚠️ Indicators of Compromise
- Kit types: Credential Harvester, OTP Stealer, Card Stealer, Personal Info
- 2 obfuscation techniques
🏢 Brand Impersonation Analysis
Fake Service
Unknown (No specific service or brand impersonation detected)
⚔️ Attack Methodology
Primary Method: Credential Harvesting
The phishing kit is designed to capture user credentials through form submissions. The kit likely intercepts input fields in real-time or upon submission, exfiltrating data to a remote server controlled by the attacker.
Secondary Method: OTP and Payment Data Theft
Secondary attack vectors include stealing one-time passwords (OTPs) and payment card details. This suggests the kit may dynamically present OTP or card input fields based on user interaction or pre-defined triggers.
🌐 Infrastructure Indicators of Compromise
Domain Information
Domain
sp326487.sitebeat.crazydomains.com
Registered
2001-12-10 19:06:37+00:00
Registrar
Dreamscape Networks International Pte Ltd
Status
Active (8812 days old)
🦠 Malicious Files
Main File
File Size
Bundled JavaScript file containing obfuscated code for credential harvesting and data exfiltration.
📊 Attack Flow Diagram
Here's a generic ASCII art attack flow diagram for the phishing attack:
```
┌──────────────────────────────────────────────────────────┐
│ 1. TARGET RECEIVES DECEPTIVE MESSAGE │
│ - Victim directed to fake Banking site │
└────────────────────┬─────────────────────────────────────┘
│
▼
┌──────────────────────────────────────────────────────────┐
│ 2. FAKE SITE DISPLAYED │
│ - Mimics legitimate Banking interface │
│ - Presents credential input form │
└────────────────────┬─────────────────────────────────────┘
│
▼
┌──────────────────────────────────────────────────────────┐
│ 3. CREDENTIALS ENTERED │
│ - Victim submits login details │
│ - Form appears to process normally │
└────────────────────┬─────────────────────────────────────┘
│
▼
┌──────────────────────────────────────────────────────────┐
│ 4. DATA CAPTURED │
│ - Credentials collected by attacker │
│ - Submitted via standard HTTP POST │
└──────────────────────────────────────────────────────────┘
```
🔬 JavaScript Deep Analysis
Operator Language
English (1%)
Total Code Size
156.2 KB
🔗 API Endpoints Detected
Other
16
🔐 Obfuscation Detected
- : Light
🤖 AI-Extracted Threat Intelligence
📊 Attack Flow
Here's a generic ASCII art attack flow diagram for the phishing attack:
```
┌──────────────────────────────────────────────────────────┐
│ 1. TARGET RECEIVES DECEPTIVE MESSAGE │
│ - Victim directed to fake Banking site │
└────────────────────┬─────────────────────────────────────┘
│
▼
┌──────────────────────────────────────────────────────────┐
│ 2. FAKE SITE DISPLAYED │
│ - Mimics legitimate Banking interface │
│ - Presents credential input form │
└────────────────────┬─────────────────────────────────────┘
│
▼
┌──────────────────────────────────────────────────────────┐
│ 3. CREDENTIALS ENTERED │
│ - Victim submits login details │
│ - Form appears to process normally │
└────────────────────┬─────────────────────────────────────┘
│
▼
┌──────────────────────────────────────────────────────────┐
│ 4. DATA CAPTURED │
│ - Credentials collected by attacker │
│ - Submitted via standard HTTP POST │
└──────────────────────────────────────────────────────────┘
```
🎯 Malicious Files Identified
Similar Websites
Pages with identical visual appearance (based on perceptual hash)
Scan History for sp326487.sitebeat.crazydomains.com
Found 2 other scans for this domain
"I Never Thought It Would Happen to Me"
That's what 2.3 million victims say every year. Don't wait to become a statistic.