SafeMode - Analysis: webprotalapp.ghost.io

Visual Capture

No screenshot available

Detection Info

https://webprotalapp.ghost.io/ledgerrlive-learn/

Detected Brand

Unknown

Country

Unknown

Confidence

100%

HTTP Status

200

Report ID

c52d42fe-1bc…

Analyzed

2026-01-26 02:19

Content Hashes (HTML Similarity)

Used to detect similar phishing pages based on HTML content

Algorithm	Hash Value
CONTENT TLSH	T19C92B6379340A73D4A2603DDAE6B379EB3B2404DF69A05D4E1FFC23E5581CA0993AC95
CONTENT ssdeep	384:0BnE93lKOA/rkfAV4t9uRWndtzhSD9jAmfCG:0BEhokVeytCA8t

Visual Hashes (Screenshot Similarity)

Used to detect visually similar phishing pages based on screenshots

Algorithm	Hash Value
VISUAL pHash	b04acacacaceca9b
VISUAL aHash	fdc7c7c3c7c3c7c7
VISUAL dHash	491c1d0e1e161e1c
VISUAL wHash	a5c3c3c3c3c3c3c3
VISUAL colorHash	07000000007
VISUAL cropResistant	491c1d0e1e161e1c

Code Analysis

Risk Score 76/100

🎣 Credential Harvester 🎣 OTP Stealer 🎣 Card Stealer 🎣 Banking 🎣 Personal Info

🔒 Obfuscation Detected

fromCharCode
base64_strings

📡 API Calls Detected

POST
https://ghost.org

📊 Risk Score Breakdown

Total Risk Score

100/100

Contributing Factors

Active Phishing Kit

Detected Credential Harvester, OTP Stealer, Card Stealer, and Banking kits with real-time form interception capabilities.

Obfuscation Techniques

20 obfuscation techniques detected, indicating deliberate evasion of detection and analysis.

Malicious JavaScript Files

Presence of multiple minified JavaScript files (cards.min.js, member-attribution.min.js, ghost-stats.min.js) with potential malicious functionality.

High-Risk Targeting

Targeting multiple high-risk data types (credentials, OTPs, card details, Banking info, personal info).

🔬 Comprehensive Threat Analysis

Threat Type

Banking Credential Harvester

Target

General public

Attack Method

credential harvesting forms + obfuscated JavaScript

Exfiltration Channel

Unknown

Risk Assessment

HIGH - Automated credential harvesting with Unknown

⚠️ Indicators of Compromise

Kit types: Credential Harvester, OTP Stealer, Card Stealer, Banking, Personal Info
20 obfuscation techniques

🏢 Brand Impersonation Analysis

Fake Service

Unknown (no specific brand impersonation detected)

⚔️ Attack Methodology

Primary Method: Credential Harvesting

The phishing kit employs a credential harvester to capture user input from form fields in real-time. Data is likely exfiltrated via HTTP POST requests to a command-and-control server upon submission.

Secondary Method: OTP and Card Data Interception

The kit includes modules for intercepting one-time passwords (OTPs) and credit card details, possibly through fake authentication prompts or overlay forms that mimic legitimate services.