Phishing Analysis
Detailed analysis of captured phishing page
Visual Capture
Detection Info
https://disneyplus-help.ddnsking.com/lang.php
Detected Brand
Disney+
Country
International
Confidence
99%
HTTP Status
200
Report ID
ad97dcc6-be8…
Analyzed
2025-12-28 16:16
Content Hashes (HTML Similarity)
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T18361746161412C4140078959B7E3674ED3B5C1124B134AAA07D298BAEBCEEBC95FB7CE |
|
CONTENT
ssdeep
|
48:d2+PZKB7tDgVZgfjcH6KeB/ACkEcDAVH6KeB/AgAVIKOrfhzqQO:Y08B7tRj5bx1N2bxRKOdRO |
Visual Hashes (Screenshot Similarity)
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
cccc33b319cc66a6 |
|
VISUAL
aHash
|
180810181800ff00 |
|
VISUAL
dHash
|
301024b2320c2010 |
|
VISUAL
wHash
|
fcfcfcfc1c1c0000 |
Code Analysis
Risk Score
50/100
Threat Level
HIGH
⚠️ Phishing Confirmed
🎣 Credential Harvester
🔬 Threat Analysis Report
• Threat: Disney+ login page phishing
• Target: Disney+ subscribers
• Method: Directing users to a fake Disney+ page to steal login credentials
• Exfil: Unknown, likely a custom API or webhook
• Indicators: Unofficial domain (disneyplus-help.ddnsking.com), Disney+ logo, language selection buttons
• Risk: HIGH - Risk of Disney+ account compromise
🔐 Credential Harvesting Forms
📤 Form Action Targets
- DE/index.php
- FR/index.php
Similar Websites
Pages with identical visual appearance (based on perceptual hash)
No screenshot
Disney
https://disney-support.gotdns.ch
Jan 02, 2026
No screenshot
Disney
https://disney-support.gotdns.ch/lang.php
Jan 01, 2026
Disney+
http://disneyplus-help.ddnsking.com
Dec 28, 2025
Disney+
http://disneyplus-help.ddnsking.com/
Dec 28, 2025
Disney+
https://disneyplus-help.ddnsking.com/lang.php
Dec 28, 2025
Scan History for disneyplus-help.ddnsking.com
Found 3 other scans for this domain
"I Never Thought It Would Happen to Me"
That's what 2.3 million victims say every year. Don't wait to become a statistic.