EN ES PT

Phishing Analysis

Detailed analysis of captured phishing page

Back to Stats

Visual Capture

Screenshot of a1.wazaf.cc

Detection Info

http://a1.wazaf.cc/
Detected Brand
WaEGY (Likely, needs validation)
Country
International
Confidence
100%
HTTP Status
200
Report ID
a2bd2305-983…
Analyzed
2026-02-07 23:37
Final URL (after redirects)
https://a1.wazaf.cc/#/pages/guide/guide

Content Hashes (HTML Similarity)

Used to detect similar phishing pages based on HTML content

Algorithm Hash Value
CONTENT TLSH
T1CEF1013070063877922B56C1F4624B1E2213C335D752195CB7B957A7BFCECE989B26A4
CONTENT ssdeep
192:oqnZbogS+gVdikIvErEFZ5LfiQLfcLbLfNLVLfdLqgLfKL4McfYNqyTzhBeC3L:bnVgoFZ5LfiQLfcLbLfNLVLfdLJLfKLb

Visual Hashes (Screenshot Similarity)

Used to detect visually similar phishing pages based on screenshots

Algorithm Hash Value
VISUAL pHash
b373cc4cb1b14ccc
VISUAL aHash
ffe7e7c70000ffff
VISUAL dHash
10280c4c714d0000
VISUAL wHash
30200000ff00ffff
VISUAL colorHash
07000000e00
VISUAL cropResistant
10280c4c714d0000,0000101010100000

Code Analysis

Risk Score 100/100
Threat Level MEDIO
⚠️ Phishing Confirmed
🎣 Credential Harvester 🎣 OTP Stealer 🎣 Card Stealer 🎣 Banking 🎣 Personal Info

🔬 Threat Analysis Report

• Threat: Phishing
• Target: WaEGY users
• Method: Domain spoofing and Javascript obfuscation
• Exfil: Potentially stealing credentials
• Indicators: Domain mismatch, obfuscated code.
• Risk: Moderate

🔒 Obfuscation Detected

  • atob
  • eval
  • fromCharCode
  • unescape
  • document.write
  • hex_escape
  • unicode_escape
  • base64_strings

🎯 Kit Endpoints

  • http://developers.facebook.com/policy/].
  • http://a/c%20d?a=1&c=3
  • https://apis.map.qq.com/jsapi?qt=translate&type=1&points=
  • https://www.facebook.com/privacy_sandbox/pixel/register/trigger/
  • https://one-api.ud3r.com
  • http://a1.wazaf.cc/static/js/chunk-vendors.042ad1ec.js
  • http://a1.wazaf.cc/static/js/index.528cde6c.js
  • https://connect.facebook.net/
  • http://x
  • https://apis.map.qq.com/ws/location/v1/ip?output=jsonp&key=
  • http://a1.wazaf.cc/static/config.js?t=1770510152164
  • https://webapi.amap.com/maps?v=2.0&
  • https://egy.rj5d.com
  • https://connect.facebook.net/en_US/fbevents.js
  • http://a1.wazaf.cc/static/js/pages-guide-guide.da71d180.js
  • https://hac1.dcloud.net.cn/ah5
  • http://a1.wazaf.cc/static/js/pages-test_login-test_login.2de5ad6d.js
  • https://a@b
  • https://connect.facebook.net/log/fbevents_telemetry/
  • https://www.facebook.com/tr
  • https://developers.facebook.com/docs/meta-pixel/reference/
  • https://connect.facebook.net/signals/config/8140457929394423?v=2.9.261&r=stable&domain=a1.wazaf.cc&hme=20296eac3bb30511174edf43e83f1c9e303df926d3c833283a366d6f5480f82a&ex_m=95%2C158%2C135%2C20%2C67%2C68%2C128%2C63%2C42%2C129%2C72%2C62%2C10%2C142%2C81%2C15%2C94%2C123%2C116%2C70%2C73%2C122%2C139%2C103%2C144%2C7%2C3%2C4%2C6%2C5%2C2%2C82%2C92%2C145%2C226%2C170%2C56%2C228%2C229%2C49%2C185%2C27%2C69%2C234%2C233%2C173%2C29%2C55%2C9%2C58%2C88%2C89%2C90%2C96%2C119%2C28%2C26%2C121%2C118%2C117%2C136%2C71%2C138%2C137%2C44%2C54%2C112%2C14%2C141%2C39%2C215%2C217%2C180%2C23%2C24%2C25%2C17%2C18%2C38%2C34%2C36%2C35%2C77%2C83%2C87%2C101%2C127%2C130%2C40%2C102%2C21%2C19%2C108%2C64%2C32%2C132%2C131%2C133%2C124%2C22%2C31%2C53%2C100%2C140%2C65%2C16%2C134%2C105%2C76%2C61%2C30%2C195%2C165%2C287%2C213%2C156%2C198%2C191%2C166%2C98%2C120%2C75%2C110%2C48%2C41%2C43%2C104%2C109%2C115%2C52%2C59%2C114%2C47%2C50%2C46%2C91%2C143%2C0%2C113%2C13%2C111%2C11%2C1%2C51%2C84%2C57%2C60%2C107%2C80%2C79%2C146%2C147%2C85%2C86%2C8%2C93%2C45%2C125%2C78%2C74%2C66%2C106%2C97%2C37%2C126%2C33%2C99%2C12%2C148
  • https://map.qq.com/api/js?v=2.exp&
  • https://apis.map.qq.com/ws/place/v1/search?output=jsonp&key=
  • https://idn.rj5d.com
  • https://unpkg.com/[email protected]/dist/quill.min.js
  • https://unpkg.com/[email protected]/image-resize.min.js
  • https://server.share-ng.net
  • https://www.instagram.com/tr/
  • https://www.google-analytics.com

📡 API Calls Detected

  • GET
  • https://www.google.com/ccm/geo
  • POST

📊 Risk Score Breakdown

Total Risk Score
65/100

Contributing Factors

Domain Mismatch
The domain is not related to WaEGY.
Obfuscated Javascript
Javascript obfuscation increases the risk of malicious activities.

🔬 Comprehensive Threat Analysis

Threat Type
Banking Credential Harvester
Target
WaEGY (Likely, needs validation) users (International)
Attack Method
Brand impersonation + obfuscated JavaScript
Exfiltration Channel
Form submission (backend endpoint not detected - likely JavaScript-based)
Risk Assessment
CRITICAL - Automated credential harvesting with Form submission (backend endpoint not detected - likely JavaScript-based)

⚠️ Indicators of Compromise

  • Kit types: Credential Harvester, OTP Stealer, Card Stealer, Banking, Personal Info
  • 621 obfuscation techniques

🏢 Brand Impersonation Analysis

Impersonated Brand
WaEGY
Fake Service
Login

⚔️ Attack Methodology

Primary Method: Credential Harvesting

The site likely attempts to steal login credentials for WaEGY accounts by mimicking the official login page. The obfuscated Javascript could be used for further malicious actions or credential exfiltration.

Secondary Method: JavaScript-based Attacks

Obfuscated Javascript allows the attacker to run malicious code on the victim's browser.

🌐 Infrastructure Indicators of Compromise

🦠 Malicious Files

Main File
8140457929394423?v=2.9.261&r=stable&domain=a1.wazaf.cc&hme=20296eac3bb30511174edf43e83f1c9e303df926d3c833283a366d6f5480f82a&ex_m=95%2C158%2C135%2C20%2C67%2C68%2C128%2C63%2C42%2C129%2C72%2C62%2C10%2C142%2C81%2C15%2C94%2C123%2C116%2C70%2C73%2C122%2C139%2C103%2C144%2C7%2C3%2C4%2C6%2C5%2C2%2C82%2C92%2C145%2C226%2C170%2C56%2C228%2C229%2C49%2C185%2C27%2C69%2C234%2C233%2C173%2C29%2C55%2C9%2C58%2C88%2C89%2C90%2C96%2C119%2C28%2C26%2C121%2C118%2C117%2C136%2C71%2C138%2C137%2C44%2C54%2C112%2C14%2C141%2C39%2C215%2C217%2C180%2C23%2C24%2C25%2C17%2C18%2C38%2C34%2C36%2C35%2C77%2C83%2C87%2C101%2C127%2C130%2C40%2C102%2C21%2C19%2C108%2C64%2C32%2C132%2C131%2C133%2C124%2C22%2C31%2C53%2C100%2C140%2C65%2C16%2C134%2C105%2C76%2C61%2C30%2C195%2C165%2C287%2C213%2C156%2C198%2C191%2C166%2C98%2C120%2C75%2C110%2C48%2C41%2C43%2C104%2C109%2C115%2C52%2C59%2C114%2C47%2C50%2C46%2C91%2C143%2C0%2C113%2C13%2C111%2C11%2C1%2C51%2C84%2C57%2C60%2C107%2C80%2C79%2C146%2C147%2C85%2C86%2C8%2C93%2C45%2C125%2C78%2C74%2C66%2C106%2C97%2C37%2C126%2C33%2C99%2C12%2C148
File Size

🔬 JavaScript Deep Analysis

Operator Language
English (0%)
Sophistication Level
Basic
Total Code Size
2.0 MB

🔗 API Endpoints Detected

Other
34
Backend API
1

🔐 Obfuscation Detected

  • : Light
  • : Moderate
  • : None
  • : None
  • : None
  • : Light
  • : Light
  • : Heavy
  • : Moderate

🤖 AI-Extracted Threat Intelligence

🎯 Malicious Files Identified

Main Drainer
8140457929394423?v=2.9.261&r=stable&domain=a1.wazaf.cc&hme=20296eac3bb30511174edf43e83f1c9e303df926d3c833283a366d6f5480f82a&ex_m=95%2C158%2C135%2C20%2C67%2C68%2C128%2C63%2C42%2C129%2C72%2C62%2C10%2C142%2C81%2C15%2C94%2C123%2C116%2C70%2C73%2C122%2C139%2C103%2C144%2C7%2C3%2C4%2C6%2C5%2C2%2C82%2C92%2C145%2C226%2C170%2C56%2C228%2C229%2C49%2C185%2C27%2C69%2C234%2C233%2C173%2C29%2C55%2C9%2C58%2C88%2C89%2C90%2C96%2C119%2C28%2C26%2C121%2C118%2C117%2C136%2C71%2C138%2C137%2C44%2C54%2C112%2C14%2C141%2C39%2C215%2C217%2C180%2C23%2C24%2C25%2C17%2C18%2C38%2C34%2C36%2C35%2C77%2C83%2C87%2C101%2C127%2C130%2C40%2C102%2C21%2C19%2C108%2C64%2C32%2C132%2C131%2C133%2C124%2C22%2C31%2C53%2C100%2C140%2C65%2C16%2C134%2C105%2C76%2C61%2C30%2C195%2C165%2C287%2C213%2C156%2C198%2C191%2C166%2C98%2C120%2C75%2C110%2C48%2C41%2C43%2C104%2C109%2C115%2C52%2C59%2C114%2C47%2C50%2C46%2C91%2C143%2C0%2C113%2C13%2C111%2C11%2C1%2C51%2C84%2C57%2C60%2C107%2C80%2C79%2C146%2C147%2C85%2C86%2C8%2C93%2C45%2C125%2C78%2C74%2C66%2C106%2C97%2C37%2C126%2C33%2C99%2C12%2C148
File Size
2087KB

Similar Websites

Pages with identical visual appearance (based on perceptual hash)

Screenshot
WaEGY
http://a1.waegy.org/
Feb 25, 2026
 Screenshot
WaEGY
http://a1.hb1p.com/
Feb 11, 2026
 Screenshot
WaEGY
http://a1.wazaf.cc
Dec 31, 2025
 Screenshot
WaEGY
http://a1.1faw.com/
Dec 27, 2025
 Screenshot
WaEgy
http://a1.hb1p.com
Dec 24, 2025

Scan History for a1.wazaf.cc

Found 3 other scans for this domain

😰
"I Never Thought It Would Happen to Me"
That's what 2.3 million victims say every year. Don't wait to become a statistic.