Phishing Analysis
Detailed analysis of captured phishing page
Visual Capture
Detection Info
https://auth-secure.me/qU3AmxUILiqopQ
Detected Brand
DP World
Country
International
Confidence
100%
HTTP Status
200
Report ID
8aeb9b04-a2eā¦
Analyzed
2026-03-19 10:02
Content Hashes (HTML Similarity)
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T1AAD1DF7160509D3B4283C7D4B3B96B9F3394C346EA87565A67F8C39C1EE3E16CC1A226 |
|
CONTENT
ssdeep
|
96:DIpkCGTHRPypyz97krwkMqFs39TbJG9KjsWsjO1k0U2gs0sjO1dOVJQ6Q6ynQjNq:ZLVk88S9TbJG9aJmVdOVJQyyQjJ6 |
Visual Hashes (Screenshot Similarity)
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
9c497326cc99d966 |
|
VISUAL
aHash
|
18001818191f0f9f |
|
VISUAL
dHash
|
7161713331727d38 |
|
VISUAL
wHash
|
191818181f1f1fff |
|
VISUAL
colorHash
|
07000000180 |
|
VISUAL
cropResistant
|
7161713331727d38 |
Code Analysis
Risk Score
70/100
Threat Level
ALTO
ā ļø Phishing Confirmed
š£ Credential Harvester
š£ OTP Stealer
š£ Personal Info
š¬ Threat Analysis Report
ā¢ Threat: Phishing
ā¢ Target: DP World users
ā¢ Method: Impersonation through a look-alike login page.
ā¢ Exfil: Credentials
ā¢ Indicators: Mismatched domain, login form, impersonation.
ā¢ Risk: HIGH
šÆ Kit Endpoints
- https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000001-0000-cff1-ce00-361370549975&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=1&msaredir=1&client-request-id=d98292e6-fa3f-ce32-3702-21bc5137cc6d&protectedtoken=true&domain_hint=dpworld.com&nonce=541387800280.ec82d3ed-b372-7cd6-3e42-fcfc13352e79&state=ZWRpLmNpb3JhbkBkcHdvcmxkLmJl#
- https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000001-0000-cff1-ce00-632589134766&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=1&msaredir=1&client-request-id=d98292e6-fa3f-ce32-8921-21bc5137cc6d&protectedtoken=true&domain_hint=dpworld.com&nonce=262106179273.ec82d3ed-b372-7cd6-3e42-fcfc13352e79&state=ZWRpLmNpb3JhbkBkcHdvcmxkLmJl#
- https://passwordreset.microsoftonline.com/?ru=https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000001-0000-cff1-ce00-868157336964&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=1&msaredir=1&client-request-id=d98292e6-fa3f-ce32-2100-21bc5137cc6d&protectedtoken=true&domain_hint=dpworld.com&nonce=372577402678.ec82d3ed-b372-7cd6-3e42-fcfc13352e79&state=ZWRpLmNpb3JhbkBkcHdvcmxkLmJl#
- https://login.microsoftonline.com/common/login#
š Risk Score Breakdown
Total Risk Score
90/100
Contributing Factors
Domain Mismatch
The domain does not belong to the brand.
Impersonation
The site mimics a login page.
Login Form
The presence of a login form on an untrusted domain.
š¬ Comprehensive Threat Analysis
Threat Type
Two-Factor Authentication Stealer
Target
DP World users (International)
Attack Method
Brand impersonation
Exfiltration Channel
Form submission (backend endpoint not detected - likely JavaScript-based)
Risk Assessment
HIGH - Automated credential harvesting with Form submission (backend endpoint not detected - likely JavaScript-based)
ā ļø Indicators of Compromise
- Kit types: Credential Harvester, OTP Stealer, Personal Info
š¢ Brand Impersonation Analysis
Impersonated Brand
DP World
Official Website
dpworld.com
Fake Service
Login
āļø Attack Methodology
Primary Method: Credential Harvesting
The attacker is using a fake login page to collect the victim's username and password.
š Infrastructure Indicators of Compromise
Domain Information
Domain
auth-secure.me
Registered
2023-05-10
Registrar
Unknown
Status
Active
š¤ AI-Extracted Threat Intelligence
Similar Websites
Pages with identical visual appearance (based on perceptual hash)
Unknown
https://cdn.gosafemode.com/screenshots/1fc7fc5abc6a.png
Apr 04, 2026
Unknown
https://cdn.gosafemode.com/screenshots/f2e9f15eb400.png
Apr 04, 2026
KLP
https://loginservice.cloud/UXYKSiMKdjxiUA
Apr 03, 2026
Microsoft
http://fnxx.info/a79613f9aj6d9a4614292687a1f799dd0c2f.html
Apr 03, 2026
Groupe Deret
https://sso-security.com/jHBwIG3w80y2
Apr 01, 2026
Scan History for auth-secure.me
Found 10 other scans for this domain
-
https://auth-secure.me/8t0G40Uc4yzL
https://auth-secure.me/FcJF1VCMe7t3p6dU
https://auth-secure.me/aHS0lPwJXIgH
https://auth-secure.me/FD6ykZKir2E
https://auth-secure.me/VUdcJNnhD7bqnLCWgw
https://auth-secure.me/QGzrBLQ5YfdCUg
https://auth-secure.me/ehtRFxyFoletQQ
https://auth-secure.me/PnAdVDt9w961P1KJfQ
https://auth-secure.me/THrkG16Tmw5DXxA
https://auth-secure.me/W9fGQN9d7MBo
"I Never Thought It Would Happen to Me"
That's what 2.3 million victims say every year. Don't wait to become a statistic.