Phishing Analysis
Detailed analysis of captured phishing page
Visual Capture
Detection Info
https://docs.google.com/forms/d/e/1FAIpQLSehUy5Q9w5cydS-2vAO8XqwCcci0vf49gkEJTxfCODrUUu3lg/viewform
Detected Brand
Canada Post
Country
Canada
Confidence
100%
HTTP Status
200
Report ID
c0e03687-82f…
Analyzed
2026-03-17 17:48
Content Hashes (HTML Similarity)
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T10D52C8B7B111F83B06138AE1B5A5AB1EB6A3935DC81F106119BC53E02FECD91A48F742 |
|
CONTENT
ssdeep
|
192:5lv+Hm+iQ6/ogxPoe6eAZ+YaEs99tTujYxauYI/YT5Y1:3+G+pQQhvs3tTujYx9YuYVY1 |
Visual Hashes (Screenshot Similarity)
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
b13167663470cece |
|
VISUAL
aHash
|
c3c3ffcfffffffff |
|
VISUAL
dHash
|
8e9e60900c280000 |
|
VISUAL
wHash
|
c0c0cccce7f33333 |
|
VISUAL
colorHash
|
070000001c2 |
|
VISUAL
cropResistant
|
8e9e60900c280000,71ccd43313941561 |
Code Analysis
Risk Score
85/100
Threat Level
ALTO
⚠️ Phishing Confirmed
🎣 Credential Harvester
🎣 OTP Stealer
🎣 Banking
🎣 Personal Info
🔬 Threat Analysis Report
• Threat: Phishing
• Target: Canada Post customers
• Method: Impersonation and malicious URL redirection
• Exfil: The linked URL likely leads to a site stealing credentials or personal information.
• Indicators: Google Form with Canada Post branding, suspicious URL redirect.
• Risk: HIGH
🔐 Credential Harvesting Forms
🔒 Obfuscation Detected
- atob
- eval
- fromCharCode
- unescape
- hex_escape
- unicode_escape
- base64_strings
📤 Form Action Targets
- https://docs.google.com/forms/d/e/1FAIpQLSehUy5Q9w5cydS-2vAO8XqwCcci0vf49gkEJTxfCODrUUu3lg/formResponse
📊 Risk Score Breakdown
Total Risk Score
90/100
Contributing Factors
Impersonation
Directly impersonating a well-known brand - Canada Post
Suspicious URL
Directing to a non-Canada Post owned IP address - potential credential harvesting or malware download.
Hosting Platform
Hosted on Google Forms. Forms are used by many legitimate users, but it is also a well known platform by threat actors.
🔬 Comprehensive Threat Analysis
Threat Type
Banking Credential Harvester
Target
Canada Post users (Canada)
Attack Method
Brand impersonation + credential harvesting forms + obfuscated JavaScript
Exfiltration Channel
HTTP POST to backend
Risk Assessment
CRITICAL - Automated credential harvesting with HTTP POST to backend
⚠️ Indicators of Compromise
- Kit types: Credential Harvester, OTP Stealer, Banking, Personal Info
- 32 obfuscation techniques
🏢 Brand Impersonation Analysis
Impersonated Brand
Canada Post
Official Website
https://www.canadapost-postescanada.ca/cpc/en
Fake Service
Delivery Notification
Fraudulent Claims
⚔️ Attack Methodology
Primary Method: Credential Harvesting
The attacker impersonates Canada Post to trick the user into clicking a link that redirects to a malicious website, likely designed to steal credentials.
🌐 Infrastructure Indicators of Compromise
Domain Information
Domain
None
Registered
None
Registrar
None
Status
None
🤖 AI-Extracted Threat Intelligence
Similar Websites
Pages with identical visual appearance (based on perceptual hash)
Canada Post
https://docs.google.com/forms/d/e/1FAIpQLSfAyG1v16WNNBUXPCJv...
Apr 08, 2026
Canada Post
https://docs.google.com/forms/d/e/1FAIpQLSfAyG1v16WNNBUXPCJv...
Apr 08, 2026
Canada Post
https://docs.google.com/forms/d/e/1FAIpQLSft7PEJQXwXtty1273W...
Mar 31, 2026
Canada Post
https://docs.google.com/forms/d/e/1FAIpQLSft7PEJQXwXtty1273W...
Mar 31, 2026
Canada Post
https://docs.google.com/forms/d/e/1FAIpQLSdtq47ivcAiicWXlVJT...
Feb 23, 2026
Scan History for docs.google.com
Found 10 other scans for this domain
-
https://docs.google.com/drawings/d/1sj4whBVnBiYbBM...
https://docs.google.com/drawings/d/1yLlUaHnTsx9QSl...
https://docs.google.com/drawings/d/1HkX3Q8Vmr0bSej...
https://docs.google.com/drawings/d/1RCgegAUJGIZOBP...
https://docs.google.com/drawings/d/18Q2Qo6ik56ER5d...
https://docs.google.com/drawings/d/1LyvbqGTLtDzf81...
https://docs.google.com/drawings/d/1QKtwKh3JuUaEHs...
https://docs.google.com/drawings/d/1fL_fne4OgKiCLk...
https://docs.google.com/drawings/d/16f_LOTLDkqMT1D...
https://docs.google.com/drawings/d/11hOe-NpeBFsnAL...
"I Never Thought It Would Happen to Me"
That's what 2.3 million victims say every year. Don't wait to become a statistic.