EN ES PT

Phishing Analysis

Detailed analysis of captured phishing page

Back to Stats

Visual Capture

Screenshot of jopobu.cc

Detection Info

https://jopobu.cc/bisen/loginer.php
Detected Brand
Binance Pool
Country
International
Confidence
100%
HTTP Status
200
Report ID
bd84b078-e18…
Analyzed
2026-03-04 08:14

Content Hashes (HTML Similarity)

Used to detect similar phishing pages based on HTML content

Algorithm Hash Value
CONTENT TLSH
T17282873462D2167F318745B7F321AF55A2A8C64BC72BEA88B3F4C14B73DEC664996340
CONTENT ssdeep
192:OcZh1qLwMTvX7LnfXCk4OUruGAk0Oy0H+HlKsXAbbSz/S9VVP0pIa8DHzpC4:OChqtvX/VVUrvArFXhkVDHV

Visual Hashes (Screenshot Similarity)

Used to detect visually similar phishing pages based on screenshots

Algorithm Hash Value
VISUAL pHash
b7e2cc1dc01d8dc6
VISUAL aHash
ffe7e7e7e78181ff
VISUAL dHash
4d4d4dcc4d0b0b8c
VISUAL wHash
e7e7e7e7000000ff
VISUAL colorHash
0f000038000
VISUAL cropResistant
4d4d4dcc4d0b0b8c,e8c6a3a9b5b34ea8,a282754d6d6592a2,8e8e8e8e0c0fab9b

Code Analysis

Risk Score 76/100
Threat Level ALTO
⚠️ Phishing Confirmed
🎣 Credential Harvester 🎣 OTP Stealer 🎣 Banking 🎣 Personal Info

🔬 Threat Analysis Report

• Threat: Phishing
• Target: Binance Pool users
• Method: Credential harvesting
• Exfil: Unknown (ID and password)
• Indicators: Suspicious domain, prompts for credentials.
• Risk: High

🔒 Obfuscation Detected

  • fromCharCode
  • unicode_escape

📊 Risk Score Breakdown

Total Risk Score
90/100

Contributing Factors

Suspicious Domain
Domain age is new and unrelated to Binance Pool.
Credential Harvesting
The site asks for sensitive information (ID, Password reset).
Obfuscation
Obfuscation detected in javascript.

🔬 Comprehensive Threat Analysis

Threat Type
Banking Credential Harvester
Target
Binance Pool users (International)
Attack Method
Brand impersonation + obfuscated JavaScript
Exfiltration Channel
Form submission (backend endpoint not detected - likely JavaScript-based)
Risk Assessment
HIGH - Automated credential harvesting with Form submission (backend endpoint not detected - likely JavaScript-based)

⚠️ Indicators of Compromise

  • Kit types: Credential Harvester, OTP Stealer, Banking, Personal Info
  • 6 obfuscation techniques

🏢 Brand Impersonation Analysis

Impersonated Brand
Binance Pool
Fake Service
Binance Pool Login

⚔️ Attack Methodology

Primary Method: Credential Harvesting

The attacker attempts to steal user credentials by mimicking a login page and prompting the user to enter their ID and set a new password.

🌐 Infrastructure Indicators of Compromise

Domain Information

Domain
jopobu.cc
Registered
None
Registrar
None
Status
None

🤖 AI-Extracted Threat Intelligence

Scan History for jopobu.cc

Found 3 other scans for this domain

😰
"I Never Thought It Would Happen to Me"
That's what 2.3 million victims say every year. Don't wait to become a statistic.