Phishing Analysis: XMission

Visual Capture

Screenshot of public-xi-lemon.vercel.app

Detection Info

http://public-xi-lemon.vercel.app/

Detected Brand

XMission

Country

USA

Confidence

100%

HTTP Status

200

Report ID

88fb58b9-e50…

Analyzed

2025-12-21 00:33

Final URL (after redirects)

https://public-xi-lemon.vercel.app/

Content Hashes (HTML Similarity)

Used to detect similar phishing pages based on HTML content

Algorithm	Hash Value
CONTENT TLSH	T11181831241109C334983D5E426A5AB5B32888779C603590DF7F8876E2AE3CD8CF6B669
CONTENT ssdeep	96:4S2sUjd42eUEz1YJNPDCZ49O3X9/GmLNmLc:jUEz1kNPDk49O3X9/r

Visual Hashes (Screenshot Similarity)

Used to detect visually similar phishing pages based on screenshots

Algorithm	Hash Value
VISUAL pHash	d2c433f758a678c4
VISUAL aHash	6466666666666664
VISUAL dHash	cccccccccccccccc
VISUAL wHash	6646467676666666
VISUAL colorHash	07400038000
VISUAL cropResistant	cccccccccccccccc,6460646464686460

Code Analysis

Risk Score 90/100

Threat Level ALTO

🎣 Credential Harvester 🎣 OTP Stealer

Telegram Exfiltration

🔬 Threat Analysis Report

• Threat: Brand impersonation phishing attempt
• Target: XMission customers
• Method: Displaying the XMission logo on a fake website hosted on a free hosting platform
• Exfil: No exfiltration is evident from the image, but likely it would be used for credential harvesting on a subsequent page
• Indicators: Free hosting, brand impersonation, 'FAKE' markers in the background, domain mismatch
• Risk: HIGH - Potential for credential theft or other malicious activities