Phishing Analysis
Detailed analysis of captured phishing page
Visual Capture
Detection Info
http://ww547.cobinbase.com/
Detected Brand
Coinbase
Country
Unknown
Confidence
95%
HTTP Status
200
Report ID
c95067be-483…
Analyzed
2026-06-25 22:21
Content Hashes (HTML Similarity)
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T18312D6F2AD52D4A660D5D089FFE2EE4A0189803AF9D3949D9A9CCF47169EFD3E807044 |
|
CONTENT
ssdeep
|
192:FEBrFTFgjjTxstlFTFgjjRxstfFTFgjjlxstFFTFgjj4xstMFTFgjjdxscy:GtJGX2tlJGXAtfJGXUtFJGXNtMJGXMcy |
Visual Hashes (Screenshot Similarity)
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
ccce39333171dc31 |
|
VISUAL
aHash
|
183c3c3800000000 |
|
VISUAL
dHash
|
3060606014000010 |
|
VISUAL
wHash
|
3c3c3c3c0c0c1c1c |
|
VISUAL
colorHash
|
38007000000 |
|
VISUAL
cropResistant
|
3060606014000010 |
Code Analysis
Risk Score
50/100
Threat Level
ALTO
⚠️ Phishing Confirmed
🎣 OTP Stealer
🎯 Kit Endpoints
- /kw-click?keyword=Blockchain%20Technology&position=2&clickUrl=https%3A%2F%2Fintivesearch.com%2Fsearch%3Fqs%3Dqsx-55d1d2e184fa97e2b08ab5c66730d59f47af072f81bef959e6f3f7f10f001877cb90d35c53e3b328941c1ba1589fb73a2b3866b2b626021a3f35594868f897a7a9dc0d1ee5973ec688454b58223a0027be0607e578795e45a21462b631ce767e6475d16b9160393e1c4a3a7d648902f01e39677e2703d1042d3782d3902792ad8e53745f669105443eceecf9513f96e72c084136d5665afc4b8c336526473476d9106c903aa6a7ba083102de6b42befaa0e94444cdbbc1b4810ba29da046e859dbb2ba5e83005ee156d6dbb658068523fd0936f2bbdbd67850501fb764460381db4d79430e989093e6d3627996d11e4268998be542567b548747b100d5066089f339b745b9eb469c925745034668543ef88e7f919d77c1af12ea45430dc32d3fd9c25858a62fa7da68e1a497035b6742c9bff8de120df8c48cc79054d2da5d23298bd34f85f401e9a295e624a15eb7a53de97c484af829dce8712c961ef50d77b2c1cf2e256bfadc157671f039c0112369a92d72582fa2f073c46e396acd03088de4fb483888614b0b6ee7083444a07b1c8ff42720272eeb6220cf815cad4d1ec06b62c05921a708ee4ca69d200d0d09c353758e6704e4f61f33289db23e86d81646513a8f97ed0b0e93a229728bc91275ec6efa3efd13a154d92e06f22a8f0d855aad636c72b859c76f2c446e60197c1261c6e7b10ff50efc11d963a84f634fed7af0a7af77b3919b86ee8eedefe83468d83425fb8f5523fae43b04256c6744286e07dae73bada1.69e8c12ceee467ff1726c045e82c18df%26type%3Ddm_t2GsA9xY__cobinbase_com%26dmn%3Dcobinbase.com%26q%3DBlockchain%2BTechnology%26testId%3D15%26tkn%3Dt2GsA9xY&testId=15&tkn=t2GsA9xY&source=&sid=57c621bb-73e2-4858-a5cd-5c2abace21f4
📊 Risk Score Breakdown
Total Risk Score
75/100
Contributing Factors
Active Phishing Kit
Detected kit types: OTP Stealer
🔬 Comprehensive Threat Analysis
Threat Type
Two-Factor Authentication Stealer
Target
Coinbase users
Attack Method
Phishing webpage
Exfiltration Channel
Form submission (backend endpoint not detected - likely JavaScript-based)
Risk Assessment
MEDIUM - Automated credential harvesting with Form submission (backend endpoint not detected - likely JavaScript-based)
⚠️ Indicators of Compromise
- Kit types: OTP Stealer
🏢 Brand Impersonation Analysis
Impersonated Brand
Coinbase
Official Website
https://www.coinbase.com
Fake Service
Credential harvesting service
⚔️ Attack Methodology
Primary Method: Two-Factor Authentication Bypass
Victim is prompted for 2FA code after entering credentials. The code is intercepted and used by attacker to access victim's account in real-time.
Secondary Method: Standard Phishing Techniques
Uses typical phishing tactics including brand impersonation, urgency tactics, and social engineering to trick victims into providing sensitive information.
🌐 Infrastructure Indicators of Compromise
Domain Information
Domain
ww547.cobinbase.com
Registered
2025-08-18 16:21:09+00:00
Registrar
NAMECHEAP INC
Status
Active (311 days old)
Hosting Information
Provider
Namecheap
ASN
🤖 AI-Extracted Threat Intelligence
"I Never Thought It Would Happen to Me"
That's what 2.3 million victims say every year. Don't wait to become a statistic.