Phishing Analysis
Detailed analysis of captured phishing page
Visual Capture
Detection Info
https://finishoperations.org/
Detected Brand
Microsoft SharePoint
Country
International
Confidence
98%
HTTP Status
200
Report ID
a2bcd3b7-737…
Analyzed
2026-08-06 23:14
Content Hashes (HTML Similarity)
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T1AE2163EA9841623F44A790D5FB45AB7FF2D1C097D6160E4441FC065FABE2D04ED37100 |
|
CONTENT
ssdeep
|
24:hRfCMZ9lZRN8UjvLsVPOL81SWrdU7dLADCY7Lsp:TT9rzDjv4V884WrdU7d0DCY7Yp |
Visual Hashes (Screenshot Similarity)
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
c8c2373949ec6667 |
|
VISUAL
aHash
|
f87efc7c18000000 |
|
VISUAL
dHash
|
b1f8e5f1f292b2f8 |
|
VISUAL
wHash
|
fcfefc7c78580800 |
|
VISUAL
colorHash
|
1a007000000 |
|
VISUAL
cropResistant
|
686c64e46cd4e672,b1f8e5f1f292b2f8 |
Code Analysis
Threat Level
ALTO
⚠️ Phishing Confirmed
🔬 Threat Analysis Report
• Threat: Credential Harvesting
• Target: Microsoft SharePoint Users
• Method: Fake corporate login portal
• Exfil: Likely remote database or webhook
• Indicators: Newly registered domain, generic 'SharePoint' branding
• Risk: High due to potential for corporate data breach
🎯 Kit Endpoints
- /auth/login
📊 Risk Score Breakdown
Total Risk Score
98/100
Contributing Factors
Domain Age
Domain created within the last 24 hours.
Brand Impersonation
Unauthorized use of SharePoint branding and terminology.
🔬 Comprehensive Threat Analysis
Threat Type
Microsoft SharePoint Phishing Landing Page
Target
Microsoft SharePoint users (International)
Attack Method
Brand impersonation
Exfiltration Channel
Form submission (backend endpoint not detected - likely JavaScript-based)
Risk Assessment
LOW - Automated credential harvesting with Form submission (backend endpoint not detected - likely JavaScript-based)
🏢 Brand Impersonation Analysis
Impersonated Brand
Microsoft SharePoint
Official Website
sharepoint.com
Fake Service
Corporate document access portal
Fraudulent Claims
⚔️ Attack Methodology
Primary Method: Credential Harvesting
The site mimics a Microsoft login page to capture corporate credentials.
Secondary Method: Social Engineering
Targets are told they need to sign in to access 'company documents'.
🌐 Infrastructure Indicators of Compromise
Domain Information
Domain
finishoperations.org
Registered
2026-08-06
Registrar
Unknown
Status
Active
🤖 AI-Extracted Threat Intelligence
"I Never Thought It Would Happen to Me"
That's what 2.3 million victims say every year. Don't wait to become a statistic.