Phishing Analysis
Detailed analysis of captured phishing page
Visual Capture
Detection Info
http://public-xi-lemon.vercel.app
Detected Brand
XMission
Country
USA
Confidence
100%
HTTP Status
200
Report ID
c307bbd2-f0a…
Analyzed
2025-12-25 23:22
Final URL (after redirects)
https://public-xi-lemon.vercel.app/
Content Hashes (HTML Similarity)
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T11181831241109C334983D5E426A5AB5B32888779C603590DF7F8876E2AE3CD8CF6B669 |
|
CONTENT
ssdeep
|
96:4S2sUjd42eUEz1YJNPDCZ49O3X9/GmLNmLc:jUEz1kNPDk49O3X9/r |
Visual Hashes (Screenshot Similarity)
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
d2c433f758a678c4 |
|
VISUAL
aHash
|
6466666666666664 |
|
VISUAL
dHash
|
cccccccccccccccc |
|
VISUAL
wHash
|
6646467676666666 |
Code Analysis
Risk Score
90/100
Threat Level
CRITICAL
⚠️ Phishing Confirmed
🎣 Credential Harvester
🎣 OTP Stealer
Telegram Exfiltration
🔬 Threat Analysis Report
• Threat: Brand impersonation phishing
• Target: XMission users
• Method: Impersonates the XMission website on free hosting.
• Exfil: Likely aims to steal credentials or information, but data exfiltration method not visible in screenshot.
• Indicators: Free hosting on Vercel, logo impersonation, domain mismatch
• Risk: HIGH - Potential for credential theft and brand damage.
🔑 Telegram Bot Tokens (1)
- 8005531574:AAEf...WnGZRUMA
Similar Websites
Pages with identical visual appearance (based on perceptual hash)
Scan History for public-xi-lemon.vercel.app
Found 6 other scans for this domain
"I Never Thought It Would Happen to Me"
That's what 2.3 million victims say every year. Don't wait to become a statistic.