EN ES PT

Phishing Analysis

Detailed analysis of captured phishing page

Back to Stats

Visual Capture

No screenshot available

Detection Info

https://nscapp.com.ng/data/load/gggg/arubaaufix/web/authen.php?web/auth/arub12#/dashboard/overviewAccounts/overview/index=B0zNNWzSOi425hzaNpLCGVQ9shfCjmwQf8nmibcE9lv8Y6jhMk2r7TyVPlW92jtHKOzGFWVVvqMnne5Q
Detected Brand
Aruba.it
Country
International
Confidence
95%
HTTP Status
200
Report ID
c13e82ff-3a4…
Analyzed
2026-02-27 20:45

Content Hashes (HTML Similarity)

Used to detect similar phishing pages based on HTML content

Algorithm Hash Value
CONTENT TLSH
T149B1633021218FB71697D7E07A10FF9971CAA382DB138E04D2F89A6A1FC7D85CC916B1
CONTENT ssdeep
96:TqYMKIj3VME5kFgwwd/6kmxj6F0OzqfRTu2gX+8sPwK3vi:uYMKIrOExm3a

Visual Hashes (Screenshot Similarity)

Used to detect visually similar phishing pages based on screenshots

Algorithm Hash Value
VISUAL pHash
b838c6cf3832c739
VISUAL aHash
ffcf8787c3ffffff
VISUAL dHash
051e1a1b1b001a0c
VISUAL wHash
f1818181013f3f27
VISUAL colorHash
07000030040
VISUAL cropResistant
051e1a1b1b001a0c,18a4a1b9c989899b

Code Analysis

Risk Score 53/100
Threat Level BAJO
🎣 Credential Harvester

🔬 Threat Analysis Report

• Threat: None, likely legitimate login page.
• Target: Aruba.it webmail users
• Method: User enters credentials to access webmail.
• Exfil: Credentials entered on login page.
• Indicators: Matching brand logo, consistent branding, SSL present.
• Risk: Low

🔐 Credential Harvesting Forms

🔒 Obfuscation Detected

  • fromCharCode

📤 Form Action Targets

  • ../next.php

📊 Risk Score Breakdown

Total Risk Score
10/100

🔬 Comprehensive Threat Analysis

Threat Type
Credential Harvesting Kit
Target
Aruba.it users (International)
Attack Method
Brand impersonation + credential harvesting forms + obfuscated JavaScript
Exfiltration Channel
HTTP POST to backend
Risk Assessment
MEDIUM - Automated credential harvesting with HTTP POST to backend

⚠️ Indicators of Compromise

  • Kit types: Credential Harvester
  • 2 obfuscation techniques

🏢 Brand Impersonation Analysis

Impersonated Brand
Aruba.it
Fake Service
Webmail

⚔️ Attack Methodology

Primary Method: Credential Harvesting.

The attacker would be trying to collect username and password from the login fields on the form.

🌐 Infrastructure Indicators of Compromise

🤖 AI-Extracted Threat Intelligence

Similar Websites

Pages with identical visual appearance (based on perceptual hash)

Screenshot
Unknown
https://cdn.gosafemode.com/screenshots/2fe4088c4ddb.png
Jul 03, 2026
 Screenshot
Aruba.it
https://nscapp.com.ng/data/load/gggg/arubaaufix/web/authen.p...
Mar 01, 2026
 Screenshot
Aruba.it
https://nscapp.com.ng/data/load/gggg/arubaaufix/web/authen.p...
Mar 01, 2026
 Screenshot
Aruba.it
https://nscapp.com.ng/data/load/gggg/arubaaufix/web/authen.p...
Feb 28, 2026
 Screenshot
Aruba.it
https://nscapp.com.ng/data/load/gggg/arubaaufix/web/authen.p...
Feb 27, 2026

Scan History for nscapp.com.ng

Found 10 other scans for this domain

😰
"I Never Thought It Would Happen to Me"
That's what 2.3 million victims say every year. Don't wait to become a statistic.