Phishing Analysis
Detailed analysis of captured phishing page
Visual Capture
Detection Info
Content Hashes (HTML Similarity)
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T12E122FA49A68412173A7CB6DB0A4A7ECB367604FC733A050F2D85B8583C6FF9CE59605 |
|
CONTENT
ssdeep
|
96:GQrCSdljB46he9lCdy+JuVlfK7cfQkqcv33MgRj+xGrcUQOFEcyMZ8TVm2MAzU4Y:zr1B4+LwWi3lj+Mocfk7y7 |
Visual Hashes (Screenshot Similarity)
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
acc533c32c3ec33a |
|
VISUAL
aHash
|
fffb939393ff8181 |
|
VISUAL
dHash
|
0f32233636093b3b |
|
VISUAL
wHash
|
a793919393ff8181 |
|
VISUAL
colorHash
|
07000180010 |
|
VISUAL
cropResistant
|
0f32233636093b3b |
Code Analysis
🔒 Obfuscation Detected
- atob
- eval
- fromCharCode
- unescape
- hex_escape
- base64_strings
🎯 Kit Endpoints
- https://nibiru.fi/blog/posts/042-claim-airdrop.html
- https://verify.walletconnect.com/49e8f7c1e6ea567ee16da05a48c23473
- https://nibiru.fi/blog/
- https://nibiru.fi/blog/posts/006-ambassador.html
📡 API Calls Detected
- https://discord.com/api/v10/users/@me
- 0x3b3b57de
- https://assets.leapwallet.io/cosmos-registry/v1/gas/gas-prices.json
- https://nibiru.fi/blog/posts/042-claim-airdrop.html
- proxy
- account
- stats
- https://www.google.com/ccm/geo
- logs
- GET
☁️ Cloud Backend
- Firebase: nibiru-chain.firebaseapp.com
📊 Risk Score Breakdown
Contributing Factors
🔬 Comprehensive Threat Analysis
⚠️ Indicators of Compromise
- Kit types: Credential Harvester, OTP Stealer, Card Stealer, Banking, Personal Info
- 1470 obfuscation techniques
🏢 Brand Impersonation Analysis
⚔️ Attack Methodology
Primary Method: Credential Harvesting
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Secondary Method: JavaScript Obfuscation
Malicious code is obfuscated using 1470 techniques to evade detection by security scanners and make reverse engineering more difficult.
Drainer supports multiple blockchain networks and checks for high-value tokens on each chain before executing drain operations.
🌐 Infrastructure Indicators of Compromise
Domain Information
Hosting Information
🤖 AI-Extracted Threat Intelligence
Similar Websites
Pages with identical visual appearance (based on perceptual hash)
Scan History for nibirufi-5mq.pages.dev
Found 1 other scan for this domain
