Phishing Analysis
Detailed analysis of captured phishing page
Visual Capture
No screenshot available
Detection Info
http://auth.saxo.com/?returnUrl=https://pub-55d4e66ad88746a881ca38372f04d03d.r2.dev/2FA-SSO.html
Detected Brand
Saxo
Country
International
Confidence
100%
HTTP Status
200
Report ID
a09fc1b7-704…
Analyzed
2025-12-31 05:14
Final URL (after redirects)
https://auth.saxo.com/Account/Login
Content Hashes (HTML Similarity)
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T17E4185519051C8195D03CAE077D5BE36B087E26ECE01198E93D487FE99EDE90BA1A162 |
|
CONTENT
ssdeep
|
24:nJ+IcjXu1Qgh7G9M2tSsFsajhpA4Xc08tElV1h+BM0gTk1y/AkvNXbc26aRJ71St:nQIcSSggK9sJSLeDAcSpaRVxJ8sOV |
Visual Hashes (Screenshot Similarity)
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
993366cc99336666 |
|
VISUAL
aHash
|
0000181818180000 |
|
VISUAL
dHash
|
304cb2b2b2b24c30 |
|
VISUAL
wHash
|
000038383c3c0000 |
|
VISUAL
colorHash
|
07007000001 |
|
VISUAL
cropResistant
|
968ea2a033139e86,304cb2b2b2b24c30 |
Code Analysis
Risk Score
95/100
Threat Level
BAJO
🎣 Credential Harvester
🎣 OTP Stealer
🎣 Card Stealer
🎣 Banking
🎣 Personal Info
🔬 Threat Analysis Report
• Threat: No threat detected.
• Target: Saxo Bank users.
• Method: Legitimate login page.
• Exfil: No data exfiltration.
• Indicators: Official domain, standard login form.
• Risk: LOW - Legitimate login page.
🔐 Credential Harvesting Forms
🔒 Obfuscation Detected
- atob
- eval
- fromCharCode
- hex_escape
- unicode_escape
- base64_strings
🎯 Kit Endpoints
- /Account/Login
- https://bam.nr-data.net/1/0bc10d7dd9?a=281207130&v=1216.487a282&to=MlFXZktXWkFYVUELDQsbeGR6GXVRWllADBYmW1tGS1lYXlxEGi4NAl1b&rst=1852&ck=1&ref=https://auth.saxo.com/Account/Login&ap=2&be=1247&fe=1759&dc=1746&perf=%7B%22timing%22:%7B%22of%22:1767158009052,%22n%22:0,%22f%22:362,%22dn%22:362,%22dne%22:362,%22c%22:362,%22ce%22:362,%22rq%22:367,%22rp%22:554,%22rpe%22:555,%22dl%22:567,%22di%22:592,%22ds%22:1091,%22de%22:1091,%22dc%22:1244,%22l%22:1244,%22le%22:1253%7D,%22navigation%22:%7B%7D%7D&fp=916&fcp=916&jsonp=NREUM.setToken
📡 API Calls Detected
- POST
- https://www.google.com/ccm/geo
- GET
📤 Form Action Targets
- /Account/Login
Similar Websites
Pages with identical visual appearance (based on perceptual hash)
Scan History for auth.saxo.com
Found 2 other scans for this domain
"I Never Thought It Would Happen to Me"
That's what 2.3 million victims say every year. Don't wait to become a statistic.