Phishing Analysis
Detailed analysis of captured phishing page
Visual Capture
Detection Info
https://samtdpp.com/bbs/login.php?url=/
Detected Brand
Apple
Country
International
Confidence
100%
HTTP Status
200
Report ID
c72f780a-701…
Analyzed
2026-01-29 03:58
Content Hashes (HTML Similarity)
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T1CA638AB38042B53B02D3D3D446367B6EF3C2514ECAAE0A8641F4D76A9F87D92CE6151E |
|
CONTENT
ssdeep
|
1536:2V+4j/xjQSUUz9W8H4b44H8dZs5Q4ea4U4q4sNommm/65:2V+4j/xjQSUUz9W868dZsammmw |
Visual Hashes (Screenshot Similarity)
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
f7bb083677080877 |
|
VISUAL
aHash
|
00ffffffff000000 |
|
VISUAL
dHash
|
43082a0c0cf0008a |
|
VISUAL
wHash
|
00ffffffff000000 |
|
VISUAL
colorHash
|
1e000038000 |
|
VISUAL
cropResistant
|
0808080c004c4c00,0040017373050000,4100103230100800,01dca4e4caca8080 |
Code Analysis
Risk Score
100/100
Threat Level
ALTO
⚠️ Phishing Confirmed
🎣 Credential Harvester
🎣 OTP Stealer
🎣 Card Stealer
🎣 Banking
🎣 Personal Info
🔬 Threat Analysis Report
• Threat: Credential Phishing
• Target: Apple customers
• Method: Impersonation via login form
• Exfil: https://samtdpp.com/shop/orderinquiry.php, https://samtdpp.com/bbs/login_check.php, https://samtdpp.com/bbs/password_form_update.php
• Indicators: Domain mismatch, Obfuscation, Login Form.
• Risk: High
🔐 Credential Harvesting Forms
🔒 Obfuscation Detected
- atob
- eval
- fromCharCode
- unescape
- document.write
- unicode_escape
- base64_strings
🎯 Kit Endpoints
- https://samtdpp.com/bbs/login_check.php
- https://samtdpp.com/bbs/login.php?url=/
- https://samtdpp.com/bbs/login.php
- https://samtdpp.com/bbs/login.php?url=%2F
📡 API Calls Detected
- https://www.google.com/ccm/geo
- POST
- smartlook_internal_db
- GET
📤 Form Action Targets
- https://samtdpp.com/shop/orderinquiry.php
- https://samtdpp.com/bbs/login_check.php
- https://samtdpp.com/bbs/password_form_update.php
📊 Risk Score Breakdown
Total Risk Score
90/100
Contributing Factors
Domain Mismatch
The domain does not belong to Apple.
Obfuscation
Code obfuscation is a common technique used by phishers.
Login Form
The form attempts to collect sensitive credentials.
🔬 Comprehensive Threat Analysis
Threat Type
Banking Credential Harvester
Target
Apple users (International)
Attack Method
Brand impersonation + credential harvesting forms + obfuscated JavaScript
Exfiltration Channel
HTTP POST to backend
Risk Assessment
CRITICAL - Automated credential harvesting with HTTP POST to backend
⚠️ Indicators of Compromise
- Kit types: Credential Harvester, OTP Stealer, Card Stealer, Banking, Personal Info
- 123 obfuscation techniques
🏢 Brand Impersonation Analysis
Impersonated Brand
Apple
Official Website
apple.com
Fake Service
Apple login
⚔️ Attack Methodology
Primary Method: Credential Harvesting
The attacker is using a fake login form that mimics an Apple login page. Users are tricked into entering their Apple ID and password, which are then harvested by the attackers.
Secondary Method: Social Engineering
The attacker likely uses social engineering techniques, such as sending emails or SMS messages, to direct users to the phishing website.
🌐 Infrastructure Indicators of Compromise
Domain Information
Domain
samtdpp.com
Registered
2024-06-25
Registrar
Unknown
Status
Active
🔬 JavaScript Deep Analysis
Operator Language
English (1%)
Sophistication Level
Basic
Total Code Size
1.1 MB
🔗 API Endpoints Detected
Other
55
🔐 Obfuscation Detected
- : Light
- : Light
- : None
- : None
- : Light
- : None
- : Light
- : Light
- : None
- : Light
- : Light
- : Moderate
- : Light
- : None
- : Light
- : Light
- : Heavy
- : Light
- : None
- : None
🤖 AI-Extracted Threat Intelligence
Scan History for samtdpp.com
Found 2 other scans for this domain
"I Never Thought It Would Happen to Me"
That's what 2.3 million victims say every year. Don't wait to become a statistic.