Phishing Analysis
Detailed analysis of captured phishing page
Visual Capture
Detection Info
https://apple-web-clone-beige.vercel.app/
Detected Brand
Apple
Country
Unknown
Confidence
100%
HTTP Status
200
Report ID
ac3029b4-82d…
Analyzed
2026-02-27 20:07
Content Hashes (HTML Similarity)
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T1AF32BA32B688202707671BDDB820271DA9A3856FCB370D4667E8CF4E5F96E42DE1245F |
|
CONTENT
ssdeep
|
192:D058nkDRnpOsp17wdm/5BJ/aeEG7/6I6juriOBIs9:Da8kDFt0dEygiOBIq |
Visual Hashes (Screenshot Similarity)
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
b34c6659195c334f |
|
VISUAL
aHash
|
00ffe7ffffefe7e7 |
|
VISUAL
dHash
|
8e088c94585c4c4c |
|
VISUAL
wHash
|
00c3070f0c0ce3e7 |
|
VISUAL
colorHash
|
07002000180 |
|
VISUAL
cropResistant
|
0e0c8c90585c0c4c,000204ccc8d40000 |
Code Analysis
Risk Score
73/100
Threat Level
ALTO
⚠️ Phishing Confirmed
🎣 Credential Harvester
🎣 Banking
🎣 Personal Info
🔒 Obfuscation Detected
- fromCharCode
🎯 Kit Endpoints
- data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABIAAAAVCAYAAABLy77vAAAACXBIWXMAAC4jAAAuIwF4pT92AAAGvmlUWHRYTUw6Y29tLmFkb2JlLnhtcAAAAAAAPD94cGFja2V0IGJlZ2luPSLvu78iIGlkPSJXNU0wTXBDZWhpSHpyZVN6TlRjemtjOWQiPz4gPHg6eG1wbWV0YSB4bWxuczp4PSJhZG9iZTpuczptZXRhLyIgeDp4bXB0az0iQWRvYmUgWE1QIENvcmUgNS42LWMxNDAgNzkuMTYwNDUxLCAyMDE3LzA1LzA2LTAxOjA4OjIxICAgICAgICAiPiA8cmRmOlJERiB4bWxuczpyZGY9Imh0dHA6Ly93d3cudzMub3JnLzE5OTkvMDIvMjItcmRmLXN5bnRheC1ucyMiPiA8cmRmOkRlc2NyaXB0aW9uIHJkZjphYm91dD0iIiB4bWxuczp4bXA9Imh0dHA6Ly9ucy5hZG9iZS5jb20veGFwLzEuMC8iIHhtbG5zOnhtcE1NPSJodHRwOi8vbnMuYWRvYmUuY29tL3hhcC8xLjAvbW0vIiB4bWxuczpzdEV2dD0iaHR0cDovL25zLmFkb2JlLmNvbS94YXAvMS4wL3NUeXBlL1Jlc291cmNlRXZlbnQjIiB4bWxuczpkYz0iaHR0cDovL3B1cmwub3JnL2RjL2VsZW1lbnRzLzEuMS8iIHhtbG5zOnBob3Rvc2hvcD0iaHR0cDovL25zLmFkb2JlLmNvbS9waG90b3Nob3AvMS4wLyIgeG1wOkNyZWF0b3JUb29sPSJBZG9iZSBQaG90b3Nob3AgQ0MgKE1hY2ludG9zaCkiIHhtcDpDcmVhdGVEYXRlPSIyMDE5LTExLTIzVDA4OjE4OjQ0LTA1OjAwIiB4bXA6TWV0YWRhdGFEYXRlPSIyMDIwLTAzLTIzVDE3OjQ3OjU3LTA0OjAwIiB4bXA6TW9kaWZ5RGF0ZT0iMjAyMC0wMy0yM1QxNzo0Nzo1Ny0wNDowMCIgeG1wTU06SW5zdGFuY2VJRD0ieG1wLmlpZDpkMWQxNjU5YS0zNjMzLTQzNzMtYjZhZi04MGNkNjk4OWQzY2QiIHhtcE1NOkRvY3VtZW50SUQ9ImFkb2JlOmRvY2lkOnBob3Rvc2hvcDplOGU3ZjI2NC0xNGIyLWM5NDEtOTUyNS01Y2YzZmNjYTNiYjUiIHhtcE1NOk9yaWdpbmFsRG9jdW1lbnRJRD0ieG1wLmRpZDpmNjYyNTVhMy04YTlkLTQ5ZjYtYWMyOC1jYTBiZjU0ZjE1YmYiIGRjOmZvcm1hdD0iaW1hZ2UvcG5nIiBwaG90b3Nob3A6Q29sb3JNb2RlPSIzIiBwaG90b3Nob3A6SUNDUHJvZmlsZT0ic1JHQiBJRUM2MTk2Ni0yLjEiPiA8eG1wTU06SGlzdG9yeT4gPHJkZjpTZXE+IDxyZGY6bGkgc3RFdnQ6YWN0aW9uPSJjcmVhdGVkIiBzdEV2dDppbnN0YW5jZUlEPSJ4bXAuaWlkOmY2NjI1NWEzLThhOWQtNDlmNi1hYzI4LWNhMGJmNTRmMTViZiIgc3RFdnQ6d2hlbj0iMjAxOS0xMS0yM1QwODoxODo0NC0wNTowMCIgc3RFdnQ6c29mdHdhcmVBZ2VudD0iQWRvYmUgUGhvdG9zaG9wIENDIChNYWNpbnRvc2gpIi8+IDxyZGY6bGkgc3RFdnQ6YWN0aW9uPSJzYXZlZCIgc3RFdnQ6aW5zdGFuY2VJRD0ieG1wLmlpZDoxMDE5MTA0MC1kNDM4LTRjNDUtYWM5ZS1jNDNiYTcwMTA4OWQiIHN0RXZ0OndoZW49IjIwMTktMTEtMjNUMDg6MTg6NDQtMDU6MDAiIHN0RXZ0OnNvZnR3YXJlQWdlbnQ9IkFkb2JlIFBob3Rvc2hvcCBDQyAoTWFjaW50b3NoKSIgc3RFdnQ6Y2hhbmdlZD0iLyIvPiA8cmRmOmxpIHN0RXZ0OmFjdGlvbj0ic2F2ZWQiIHN0RXZ0Omluc3RhbmNlSUQ9InhtcC5paWQ6ZDFkMTY1OWEtMzYzMy00MzczLWI2YWYtODBjZDY5ODlkM2NkIiBzdEV2dDp3aGVuPSIyMDIwLTAzLTIzVDE3OjQ3OjU3LTA0OjAwIiBzdEV2dDpzb2Z0d2FyZUFnZW50PSJBZG9iZSBQaG90b3Nob3AgQ0MgKE1hY2ludG9zaCkiIHN0RXZ0OmNoYW5nZWQ9Ii8iLz4gPC9yZGY6U2VxPiA8L3htcE1NOkhpc3Rvcnk+IDwvcmRmOkRlc2NyaXB0aW9uPiA8L3JkZjpSREY+IDwveDp4bXBtZXRhPiA8P3hwYWNrZXQgZW5kPSJyIj8+mp+XaQAAAO9JREFUOI3t1D9OQkEQx/EPD/BPRUHpMTyDidJr40GoPQxHEDyEV6A0oXkFBUEhj7F4k2jIAxFK/SWTnezMfnd2s7Miwg67johpfGmac435hWY94BUz3KTNcu6+cUUDvZ8VDBtiw4z1t2NNoKeIKPccucycRtAkd1p8G8uIWKa/SL/cyolcq4MxbvGINub4wBWqrZto4w3n6GV8hLGI2ETEYM9RfrJBRGwKrLKKYzXHqshyuyeAumjveke/1j/oz4MqrE9grFEVOFM34LHq4ayDFzyru7/CxYGAd3V7jTBpRQRM1F/JEnEgqIXLLOTuE/DbSSM0LhCQAAAAAElFTkSuQmCC
📊 Risk Score Breakdown
Total Risk Score
100/100
Contributing Factors
Active Phishing Kit
Detected kit types: Credential Harvester, Banking, Personal Info
Code Obfuscation
JavaScript code obfuscated using 6 technique(s) to evade detection
🔬 Comprehensive Threat Analysis
Threat Type
Banking Credential Harvester
Target
Apple users
Attack Method
obfuscated JavaScript
Exfiltration Channel
Form submission (backend endpoint not detected - likely JavaScript-based)
Risk Assessment
HIGH - Automated credential harvesting with Form submission (backend endpoint not detected - likely JavaScript-based)
⚠️ Indicators of Compromise
- Kit types: Credential Harvester, Banking, Personal Info
- 6 obfuscation techniques
🏢 Brand Impersonation Analysis
Impersonated Brand
Apple
Official Website
https://www.apple.com
Fake Service
Banking/payment service
⚔️ Attack Methodology
Primary Method: Credential Harvesting
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Secondary Method: JavaScript Obfuscation
Malicious code is obfuscated using 6 techniques to evade detection by security scanners and make reverse engineering more difficult.
🌐 Infrastructure Indicators of Compromise
Domain Information
Domain
apple-web-clone-beige.vercel.app
Registered
Unknown
Registrar
Unknown
Status
Hosting platform (subdomain)
Hosting Information
Provider
Unknown
ASN
🤖 AI-Extracted Threat Intelligence
Similar Websites
Pages with identical visual appearance (based on perceptual hash)
Unknown
https://cdn.gosafemode.com/screenshots/29cdfcfd02bb.png
May 27, 2026
Apple
http://api-routing-one.vercel.app/
May 13, 2026
Apple
http://birukkebede11.github.io/apple.com-replica-bootstrap
May 10, 2026
Unknown
https://cdn.gosafemode.com/screenshots/250393499652.png
Mar 14, 2026
Unknown
https://cdn.gosafemode.com/screenshots/2ce5f7903241.png
Mar 14, 2026
Scan History for apple-web-clone-beige.vercel.app
Found 2 other scans for this domain
"I Never Thought It Would Happen to Me"
That's what 2.3 million victims say every year. Don't wait to become a statistic.