Phishing Analysis
Detailed analysis of captured phishing page
Visual Capture
Detection Info
http://f.digitalmailpath.com/igit/4/5jlrppuFyeurq27hxrFn9dFbpcrzerFbsyFdslF4hFxFq
Detected Brand
PayPal
Country
Unknown
Confidence
95%
HTTP Status
200
Report ID
b621d36e-3eb…
Analyzed
2026-06-14 10:13
Content Hashes (HTML Similarity)
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T18D338920C2809A1D546E8071F6B16ED57390029BDF671AE0D963D73EE4C58B7FE632AC |
|
CONTENT
ssdeep
|
768:Dv8MEltdsIbQGrOB7tO5kSIAmYaBF/siA34:DvgtMS9mYDt34 |
Visual Hashes (Screenshot Similarity)
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
e66699998ccc8e99 |
|
VISUAL
aHash
|
ffe7e7e7e7e7e7e7 |
|
VISUAL
dHash
|
684d6d6d48684c4c |
|
VISUAL
wHash
|
24242424e7e7e7e7 |
|
VISUAL
colorHash
|
07c00000080 |
|
VISUAL
cropResistant
|
684d6d6d48684c4c |
Code Analysis
Risk Score
50/100
Threat Level
ALTO
⚠️ Phishing Confirmed
🎣 Credential Harvester
🎯 Kit Endpoints
- http://f.digitalmailpath.com/gita/5jlrppuFyeurq27hxrFn9dFbpcrzerFbsyFdslF4hFxFq/2/s/www.paypal.com/US/webapps/mpp/home?utm_content=en_US_FTR_PayPal_Logo&utm_medium=email&utm_source=stirista&utm_campaign=Email+-+OW_EM_AH_HR_NI_NI_202605_578266_Phase_1_US_Prospecting_MVP_Campaign_Offer_$10_Phase_1
- http://f.digitalmailpath.com/gita/5jlrppuFyeurq27hxrFn9dFbpcrzerFbsyFdslF4hFxFq/2/s/www.paypal.com/us/home?utm_content=Paypal_logo&utm_medium=email&utm_source=stirista&utm_campaign=Email+-+OW_EM_AH_HR_NI_NI_202605_578266_Phase_1_US_Prospecting_MVP_Campaign_Offer_$10_Phase_1
📊 Risk Score Breakdown
Total Risk Score
70/100
Contributing Factors
Active Phishing Kit
Detected kit types: Credential Harvester
🔬 Comprehensive Threat Analysis
Threat Type
Credential Harvesting Kit
Target
PayPal users
Attack Method
Phishing webpage
Exfiltration Channel
Form submission (backend endpoint not detected - likely JavaScript-based)
Risk Assessment
MEDIUM - Automated credential harvesting with Form submission (backend endpoint not detected - likely JavaScript-based)
⚠️ Indicators of Compromise
- Kit types: Credential Harvester
🏢 Brand Impersonation Analysis
Impersonated Brand
PayPal
Official Website
https://www.paypal.com
Fake Service
Credential harvesting service
⚔️ Attack Methodology
Primary Method: Credential Harvesting
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Secondary Method: Standard Phishing Techniques
Uses typical phishing tactics including brand impersonation, urgency tactics, and social engineering to trick victims into providing sensitive information.
🌐 Infrastructure Indicators of Compromise
Domain Information
Domain
f.digitalmailpath.com
Registered
2023-07-26 16:50:16+00:00
Registrar
TUCOWS.COM, CO.
Status
Active (older domain)
Hosting Information
Provider
TUCOWS.COM, CO.
ASN
🤖 AI-Extracted Threat Intelligence
"I Never Thought It Would Happen to Me"
That's what 2.3 million victims say every year. Don't wait to become a statistic.