SafeMode - Analysis: 28ecne20f9u.securebankinggroup.org

Visual Capture

Screenshot of 28ecne20f9u.securebankinggroup.org

Detection Info

https://28ecne20f9u.securebankinggroup.org/s/63bzgfsvbwsfcdx7y9/584dd8/90eab167-7429-489f-99f6-ce86e8d0d81a

Detected Brand

Adobe

Country

International

Confidence

100%

HTTP Status

200

Report ID

b2f27d5f-146…

Analyzed

2025-12-26 08:42

Content Hashes (HTML Similarity)

Used to detect similar phishing pages based on HTML content

Algorithm	Hash Value
CONTENT TLSH	T17061533190459C7A6252D3A8B3D6FF0465CEC1A6C70A6800A3F4E3CDE7E7D10DAA659A
CONTENT ssdeep	48:nICYWVBcWzcYRlUxv8Xhj1fvHgoaZ6pB+OTgl162phmzeVb8JoaTokg:n7JLREAhRfvHgoaZ6KOTg2ywSNqomokg

Visual Hashes (Screenshot Similarity)

Used to detect visually similar phishing pages based on screenshots

Algorithm	Hash Value
VISUAL pHash	de9c73102738253f
VISUAL aHash	98bcbc3c3c7cf8a0
VISUAL dHash	3038316868a02949
VISUAL wHash	18bcbc3c3c7cf8a0

Code Analysis

Risk Score 65/100

Threat Level CRITICAL

⚠️ Phishing Confirmed

🎣 Credential Harvester 🎣 Personal Info

🔬 Threat Analysis Report

• Threat: Credential harvesting phishing targeting Adobe users.
• Target: Users needing to view or download PDF files.
• Method: Fake login form to steal usernames and passwords.
• Exfil: Unknown data exfiltration point. Likely a custom API or backend server.
• Indicators: Domain name doesn't match official Adobe domain, login form on a non-Adobe domain, prompts for username/password to view PDF.
• Risk: HIGH - Real-time credential theft is possible.