Phishing Analysis
Detailed analysis of captured phishing page
Visual Capture
No screenshot available
Detection Info
https://authenticate-user-session-token-c25cd-vc689-890f-96vx.appwrite.network/
Detected Brand
Unknown
Country
International
Confidence
100%
HTTP Status
200
Report ID
c71183df-17a…
Analyzed
2026-02-22 08:33
Content Hashes (HTML Similarity)
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T17611C27040959C7B6683D3F52BB6E2167AD0CAD6C91706041BF8C79D2BE3D6BCD42990 |
|
CONTENT
ssdeep
|
12:nwMy7FUPDWYN/s6ymNn2iQcSMBqNct/iSQhCEOgNQHZo3f68tTRAiRn2HFf3oJDh:n/CM3N/4HilBBGrjUEOgN1TFn+wNw6YS |
Visual Hashes (Screenshot Similarity)
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
9b9b98cc66666631 |
|
VISUAL
aHash
|
3c3c3c0000000000 |
|
VISUAL
dHash
|
6870784c30000000 |
|
VISUAL
wHash
|
3f3f3f3f00000000 |
|
VISUAL
colorHash
|
07000000038 |
|
VISUAL
cropResistant
|
6870784c30000000 |
Code Analysis
Risk Score
77/100
Threat Level
ALTO
⚠️ Phishing Confirmed
🎣 Credential Harvester
🎣 Personal Info
🔬 Threat Analysis Report
• Threat: Phishing
• Target: Unspecified users
• Method: Credential harvesting through a fake login page.
• Exfil: Unknown, likely to a server controlled by attackers.
• Indicators: Obfuscated JS, suspicious domain, and a login form.
• Risk: High
🔒 Obfuscation Detected
- fromCharCode
- unescape
- document.write
- base64_strings
📊 Risk Score Breakdown
Total Risk Score
90/100
Contributing Factors
Suspicious Domain and Hosting
The domain appears to be randomly generated and hosted on Appwrite, a common indicator of phishing.
Obfuscated Javascript
Obfuscated code is a strong signal of malicious intent. It hides the purpose of the code and makes analysis difficult.
Form for Credentials
The form requests a username/email and password, which are used for credential harvesting
Lack of Brand Affiliation
The website lacks any branding or references that can be identified with a known brand
🔬 Comprehensive Threat Analysis
Threat Type
Credential Harvesting Kit
Target
General public
Attack Method
credential harvesting forms + obfuscated JavaScript
Exfiltration Channel
Form submission (backend endpoint not detected - likely JavaScript-based)
Risk Assessment
HIGH - Automated credential harvesting with Form submission (backend endpoint not detected - likely JavaScript-based)
⚠️ Indicators of Compromise
- Kit types: Credential Harvester, Personal Info
- 10 obfuscation techniques
🏢 Brand Impersonation Analysis
Impersonated Brand
Unknown
Fake Service
Generic email login
⚔️ Attack Methodology
Primary Method: Credential Harvesting
The attacker aims to steal user credentials (email and password) by presenting a fake login form. The information is then sent to the attacker.
Secondary Method: Javascript Obfuscation
The javascript code used to manage the form and submit user data is encoded to avoid detection.
🌐 Infrastructure Indicators of Compromise
Domain Information
Domain
authenticate-user-session-token-c25cd-vc689-890f-96vx.appwrite.network
Registered
None
Registrar
None
Status
Active
🤖 AI-Extracted Threat Intelligence
Similar Websites
Pages with identical visual appearance (based on perceptual hash)
"I Never Thought It Would Happen to Me"
That's what 2.3 million victims say every year. Don't wait to become a statistic.