Phishing Analysis
Detailed analysis of captured phishing page
Visual Capture
Detection Info
Content Hashes (HTML Similarity)
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T14CB1FB23A35C33370B81817A77A50389D6DF601D7391478C21B421FD27EDE684A726F6 |
|
CONTENT
ssdeep
|
96:hrAjBPy47k/oV+5VqtV6ViVY7Aj+B/112PmMWrFGRkHDJW2MZC5pKcegE:FAjBPpggVoVqtV6ViV8AjW1s2URW6EpW |
Visual Hashes (Screenshot Similarity)
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
be8dc1993ec1c127 |
|
VISUAL
aHash
|
ff9fff8383ffe7e7 |
|
VISUAL
dHash
|
3377462e2f820e8e |
|
VISUAL
wHash
|
1b03338383ffc3c3 |
|
VISUAL
colorHash
|
07001000600 |
|
VISUAL
cropResistant
|
3377462e2f820e8e,83989caeae989c6c,039bd89c8c985661,ada7868e9a998b16,829c8c8c8c3cdc5b |
Code Analysis
🔒 Obfuscation Detected
- fromCharCode
📊 Risk Score Breakdown
Contributing Factors
🔬 Comprehensive Threat Analysis
🏢 Brand Impersonation Analysis
⚔️ Attack Methodology
Primary Method: Credential Harvesting
The phishing kit captures user credentials (username, password) via fake login forms mimicking KuCoin's authentication portal. Submitted data is likely exfiltrated to an attacker-controlled server in real-time.
Secondary Method: OTP Stealer
The kit includes functionality to intercept one-time passwords (OTPs) or 2FA codes, enabling attackers to bypass multi-factor authentication and gain unauthorized access to victim accounts.
🌐 Infrastructure Indicators of Compromise
Domain Information
🦠 Malicious Files
Obfuscated JavaScript file containing credential harvesting and OTP interception logic.
🔬 JavaScript Deep Analysis
🔗 API Endpoints Detected
🔐 Obfuscation Detected
- : Light
🤖 AI-Extracted Threat Intelligence
🎯 Malicious Files Identified
Similar Websites
Pages with identical visual appearance (based on perceptual hash)
Scan History for kucoinx-login.webflow.io
Found 2 other scans for this domain
