SafeMode - Analysis: m.lmasv.xyz

Visual Capture

No screenshot available

Detection Info

http://m.lmasv.xyz/

Detected Brand

Unknown

Country

Unknown

Confidence

100%

HTTP Status

200

Report ID

b32d6b3e-1a2…

Analyzed

2026-01-25 23:49

Final URL (after redirects)

http://m.lmasv.xyz/#/

Content Hashes (HTML Similarity)

Used to detect similar phishing pages based on HTML content

Algorithm	Hash Value
CONTENT TLSH	T127E20E347003BC5B657396D1F862AF183646E736C2180F98B3E925BA6FDACF45862374
CONTENT ssdeep	768:9vVYKlgNle0ldJYNuYATmbtwdQgNYTGAgWBujY5Lf5LfZLftLf2rCtTzhBeC3L:9vVYKlgNle0l3YNuYzbtwdNNYTGAgWBV

Visual Hashes (Screenshot Similarity)

Used to detect visually similar phishing pages based on screenshots

Algorithm	Hash Value
VISUAL pHash	b333333323cccccc
VISUAL aHash	e7e7ffeff7efe7ff
VISUAL dHash	4d4d000c0c0c0c0c
VISUAL wHash	0707272727272727
VISUAL colorHash	07200038000
VISUAL cropResistant	4d4d000c0c0c0c0c,7efcfefcfcfcf8f1

Code Analysis

Risk Score 100/100

🎣 Credential Harvester 🎣 OTP Stealer 🎣 Card Stealer 🎣 Banking 🎣 Personal Info

WebSocket C2

🔒 Obfuscation Detected

atob
eval
fromCharCode
unescape
document.write
hex_escape
unicode_escape
base64_strings

📡 API Calls Detected

POST
GET

📊 Risk Score Breakdown

Total Risk Score

100/100

Contributing Factors

Active Phishing Kit

Detected multiple kit types: Credential Harvester, OTP Stealer, Card Stealer, and Banking kits.

High Obfuscation

108 obfuscation techniques detected, indicating deliberate evasion of analysis.

WebSocket Communication

1 WebSocket URL detected, suggesting real-time data exfiltration.

Large JavaScript Payload

Total JavaScript size of 2.28 MB, unusually large for a phishing page, indicating complex malicious functionality.

🔬 Comprehensive Threat Analysis

Threat Type

Banking Credential Harvester

Target

General public

Attack Method

real-time WebSocket exfiltration + obfuscated JavaScript

Exfiltration Channel

WebSocket (1 endpoints)

Risk Assessment

CRITICAL - Automated credential harvesting with WebSocket (1 endpoints)

⚠️ Indicators of Compromise

Kit types: Credential Harvester, OTP Stealer, Card Stealer, Banking, Personal Info
108 obfuscation techniques

🏢 Brand Impersonation Analysis

Fake Service

Unknown (No specific brand impersonation detected)

⚔️ Attack Methodology

Primary Method: Credential Harvesting

The phishing kit is designed to capture user credentials through fake login forms. The presence of a Credential Harvester kit suggests real-time interception and exfiltration of entered credentials via WebSocket or other communication channels.

Secondary Method: OTP and Payment Data Theft

The kit includes OTP Stealer and Card Stealer components, enabling the interception of one-time passwords and credit card details. This data is likely exfiltrated in real-time to an attacker-controlled server.