Phishing Analysis
Detailed analysis of captured phishing page
Visual Capture
Detection Info
https://auth-secure.me/THrkG16Tmw5DXxA
Detected Brand
Malta Airport
Country
International
Confidence
100%
HTTP Status
200
Report ID
b38643ae-4c2…
Analyzed
2026-02-25 04:29
Content Hashes (HTML Similarity)
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T123D1ED71A0509D3B5283C7D4B2B96B4F3394C346EA87565A67F4C79C0EF3E16CC1A226 |
|
CONTENT
ssdeep
|
96:nIpkCGTHRPyCdM+krwkMyQs39TbJG9KjsWsjON0U2gs0sjOoOVJQ6Q6ynQjNsjOR:9Pdfk80r9TbJG9ajIOVJQyyQj1 |
Visual Hashes (Screenshot Similarity)
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
9c497326cc99d9e4 |
|
VISUAL
aHash
|
18001818191f0f9f |
|
VISUAL
dHash
|
7161313331727d38 |
|
VISUAL
wHash
|
191818181f1f1fff |
|
VISUAL
colorHash
|
070000001c0 |
|
VISUAL
cropResistant
|
7161313331727d38 |
Code Analysis
Risk Score
70/100
Threat Level
ALTO
⚠️ Phishing Confirmed
🎣 Credential Harvester
🎣 OTP Stealer
🎣 Personal Info
🔬 Threat Analysis Report
• Threat: Phishing
• Target: Malta Airport Employees/Users
• Method: Impersonation via a fake login page.
• Exfil: Credentials (email & password)
• Indicators: Domain mismatch, login form.
• Risk: HIGH
🎯 Kit Endpoints
- https://passwordreset.microsoftonline.com/?ru=https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000001-0000-cff1-ce00-805426991350&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=1&msaredir=1&client-request-id=d98292e6-fa3f-ce32-6766-21bc5137cc6d&protectedtoken=true&domain_hint=maltairport.com&nonce=875783755647.ec82d3ed-b372-7cd6-3e42-fcfc13352e79&state=bWFyaWx5bi5nYWxlYUBtYWx0YWlycG9ydC5jb20#
- https://login.microsoftonline.com/common/login#
- https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000001-0000-cff1-ce00-415697731655&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=1&msaredir=1&client-request-id=d98292e6-fa3f-ce32-1332-21bc5137cc6d&protectedtoken=true&domain_hint=maltairport.com&nonce=450065634233.ec82d3ed-b372-7cd6-3e42-fcfc13352e79&state=bWFyaWx5bi5nYWxlYUBtYWx0YWlycG9ydC5jb20#
- https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000001-0000-cff1-ce00-449647977745&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=1&msaredir=1&client-request-id=d98292e6-fa3f-ce32-6536-21bc5137cc6d&protectedtoken=true&domain_hint=maltairport.com&nonce=355090921121.ec82d3ed-b372-7cd6-3e42-fcfc13352e79&state=bWFyaWx5bi5nYWxlYUBtYWx0YWlycG9ydC5jb20#
📊 Risk Score Breakdown
Total Risk Score
90/100
Contributing Factors
Domain Mismatch
The domain 'auth-secure.me' is not related to the brand.
Login Form
The page includes a login form, which is used to harvest credentials.
Impersonation
The page attempts to impersonate the legitimate brand.
🔬 Comprehensive Threat Analysis
Threat Type
Two-Factor Authentication Stealer
Target
Malta Airport users (International)
Attack Method
Brand impersonation
Exfiltration Channel
Form submission (backend endpoint not detected - likely JavaScript-based)
Risk Assessment
HIGH - Automated credential harvesting with Form submission (backend endpoint not detected - likely JavaScript-based)
⚠️ Indicators of Compromise
- Kit types: Credential Harvester, OTP Stealer, Personal Info
🏢 Brand Impersonation Analysis
Impersonated Brand
Malta Airport
Fake Service
Login
⚔️ Attack Methodology
Primary Method: Credential Harvesting
The attacker attempts to steal user credentials by creating a fake login form that mimics the appearance of Malta Airport's login page.
🌐 Infrastructure Indicators of Compromise
Domain Information
Domain
auth-secure.me
Registered
2023-05-15
Registrar
Unknown
Status
Active
🤖 AI-Extracted Threat Intelligence
Similar Websites
Pages with identical visual appearance (based on perceptual hash)
Copart
https://auth-secure.me/8t0G40Uc4yzL
Apr 04, 2026
DP World
https://auth-secure.me/FcJF1VCMe7t3p6dU
Apr 04, 2026
Microsoft
https://authentication.ms/FQXXJbjMQUwdPlw
Apr 04, 2026
DP World
https://signin.broker/yEXpO8mh47e1zQ
Apr 01, 2026
Copart
https://sso-security.com/hmoR7AjmD5_J9_rblw
Mar 31, 2026
Scan History for auth-secure.me
Found 10 other scans for this domain
-
https://auth-secure.me/8t0G40Uc4yzL
https://auth-secure.me/FcJF1VCMe7t3p6dU
https://auth-secure.me/aHS0lPwJXIgH
https://auth-secure.me/FD6ykZKir2E
https://auth-secure.me/VUdcJNnhD7bqnLCWgw
https://auth-secure.me/qU3AmxUILiqopQ
https://auth-secure.me/QGzrBLQ5YfdCUg
https://auth-secure.me/ehtRFxyFoletQQ
https://auth-secure.me/PnAdVDt9w961P1KJfQ
https://auth-secure.me/W9fGQN9d7MBo
"I Never Thought It Would Happen to Me"
That's what 2.3 million victims say every year. Don't wait to become a statistic.