Phishing Analysis
Detailed analysis of captured phishing page
Visual Capture
Detection Info
https://exodulogjuiui.gitbook.io
Detected Brand
Exodus Wallet
Country
International
Confidence
100%
HTTP Status
200
Report ID
a4922bed-636…
Analyzed
2026-01-30 10:15
Final URL (after redirects)
https://exodulogjuiui.gitbook.io/us/
Content Hashes (HTML Similarity)
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T1711308202221735F6C330F79F385B06AC1AFD344EAA698ADF394525234D2974CB7799A |
|
CONTENT
ssdeep
|
768:6hFYLAn7n0NXuefT6nP8PJs1LGbPDPrPrAPLODPVPJFBD5EbQSFecnRiEQ5hQ2iq:6hFYLAn7n0JuefT6hGUOPTD5EbQSFeco |
Visual Hashes (Screenshot Similarity)
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
b332cccc3333ccc6 |
|
VISUAL
aHash
|
efffc7c7c7ffefff |
|
VISUAL
dHash
|
1d160c8d8d1e1e5c |
|
VISUAL
wHash
|
01c3c7c7c7c3c387 |
|
VISUAL
colorHash
|
07006000000 |
|
VISUAL
cropResistant
|
1d160c8d8d1e1e5c,96f979f47833e4f4 |
Code Analysis
Risk Score
100/100
Threat Level
ALTO
⚠️ Phishing Confirmed
🎣 Credential Harvester
🎣 OTP Stealer
🎣 Banking
🔬 Threat Analysis Report
• Threat: Phishing
• Target: Exodus Wallet Users
• Method: Impersonation through a Gitbook page
• Exfil: Unknown (due to obfuscation and form submission)
• Indicators: Domain mismatch, Gitbook hosting, JavaScript form submission, obfuscation.
• Risk: High
🔒 Obfuscation Detected
- atob
- fromCharCode
- hex_escape
- unicode_escape
- base64_strings
🎯 Kit Endpoints
- https://exodulogjuiui.gitbook.io/us/exodus-r-login-a-comprehensive-solutionage.md
- https://exodulogjuiui.gitbook.io/us/rss.xml
- https://exodulogjuiui.gitbook.io/us
- https://exodulogjuiui.gitbook.io/us/~gitbook/icon?size=medium&theme=light&border=false
- https://exodulogjuiui.gitbook.io/us/~gitbook/icon?size=medium&theme=dark&border=false
- #benefits-of-utilizing-exodus-r-login
- https://exodulogjuiui.gitbook.io/us/~gitbook/icon?size=small&theme=light
- https://exodulogjuiui.gitbook.io/us/~gitbook/icon?size=small&theme=dark
- https://exodulogjuiui.gitbook.io/us/~gitbook/image?url=https%3A%2F%2F3221403671-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FfKfd3ucBF2XdURuwOw4S%252Fuploads%252F8AyPDMoj5Jey58kK8Jp4%252Ffile.excalidraw.svg%3Falt%3Dmedia%26token%3D755c48fd-a8bf-4501-8817-1d9b0113ddc0&width=768&dpr=3&quality=100&sign=ab04a8b6&sv=2
📡 API Calls Detected
- first
- virtual
📊 Risk Score Breakdown
Total Risk Score
90/100
Contributing Factors
Domain Mismatch
The domain does not match the official Exodus website.
Suspicious Hosting
Hosted on Gitbook, a free service often abused for phishing.
JavaScript Obfuscation
JavaScript code has been obfuscated to hide its malicious intent.
Form Submission Detected
JavaScript code submits a form, indicating data exfiltration.
🔬 Comprehensive Threat Analysis
Threat Type
Banking Credential Harvester
Target
Exodus Wallet users (International)
Attack Method
Brand impersonation + obfuscated JavaScript
Exfiltration Channel
Form submission (backend endpoint not detected - likely JavaScript-based)
Risk Assessment
CRITICAL - Automated credential harvesting with Form submission (backend endpoint not detected - likely JavaScript-based)
⚠️ Indicators of Compromise
- Kit types: Credential Harvester, OTP Stealer, Banking
- 380 obfuscation techniques
🏢 Brand Impersonation Analysis
Impersonated Brand
Exodus
Official Website
https://www.exodus.com/
Fake Service
Exodus Login
⚔️ Attack Methodology
Primary Method: Credential Harvesting
The attacker likely aims to steal Exodus login credentials. The page mimics the appearance of Exodus, and probably has a form to collect username/password, which the JavaScript submits.
🌐 Infrastructure Indicators of Compromise
Domain Information
Domain
exodulogjuiui.gitbook.io
Registered
2014-03-30
Registrar
None
Status
None
🔬 JavaScript Deep Analysis
Operator Language
English (1%)
Sophistication Level
Basic
Total Code Size
1.1 MB
🔗 API Endpoints Detected
Other
11
🔐 Obfuscation Detected
- : Moderate
- : Light
- : None
- : None
- : Light
- : Light
- : Light
- : Light
- : Light
- : None
- : None
- : Light
- : Light
- : None
- : None
- : Moderate
- : Light
🤖 AI-Extracted Threat Intelligence
Similar Websites
Pages with identical visual appearance (based on perceptual hash)
Scan History for exodulogjuiui.gitbook.io
Found 5 other scans for this domain
"I Never Thought It Would Happen to Me"
That's what 2.3 million victims say every year. Don't wait to become a statistic.