Phishing Analysis
Detailed analysis of captured phishing page
Visual Capture
No screenshot available
Detection Info
https://sp326487.sitebeat.crazydomains.com/
Detected Brand
Unknown
Country
Unknown
Confidence
100%
HTTP Status
200
Report ID
cc6710c6-242…
Analyzed
2026-01-26 12:45
Content Hashes (HTML Similarity)
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T1F8628331F075643B011F75E0F1A6970AE2DBC30ECBA28BE4E6B892E057D9CD5AD27605 |
|
CONTENT
ssdeep
|
192:U1Yk8D/ojEvQtJVVvmdiAjtyTfpOgsKbeJOdtAojtIv1+25MqfYcJXE4vrz12eho:bwjwiJwhytbRbeJ4fE1tNJ1wNV |
Visual Hashes (Screenshot Similarity)
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
9959a42766dc9936 |
|
VISUAL
aHash
|
18181818251f1f3f |
|
VISUAL
dHash
|
d1b2303169707474 |
|
VISUAL
wHash
|
3d181818271f1fbf |
|
VISUAL
colorHash
|
070000001c0 |
|
VISUAL
cropResistant
|
d1b2303169707474 |
Code Analysis
Risk Score
76/100
🎣 Credential Harvester
🎣 OTP Stealer
🎣 Card Stealer
🎣 Personal Info
🔒 Obfuscation Detected
- fromCharCode
- unicode_escape
📡 API Calls Detected
- POST
📊 Risk Score Breakdown
Total Risk Score
100/100
Contributing Factors
Active Phishing Kit
Detected Credential Harvester, OTP Stealer, Card Stealer, and Personal Info kits capable of real-time data interception and exfiltration.
Obfuscation Techniques
Two obfuscation techniques detected, indicating attempts to evade detection and analysis.
Malicious JavaScript
Presence of a bundled JavaScript file (bundle.js) with obfuscated code, likely containing malicious logic for data harvesting.
Lack of Attribution
No identifiable IPs, nameservers, or external APIs (Telegram/Discord) detected, increasing difficulty of tracking and mitigation.
🔬 Comprehensive Threat Analysis
Threat Type
Banking Credential Harvester
Target
General public
Attack Method
credential harvesting forms + obfuscated JavaScript
Exfiltration Channel
Unknown
Risk Assessment
HIGH - Automated credential harvesting with Unknown
⚠️ Indicators of Compromise
- Kit types: Credential Harvester, OTP Stealer, Card Stealer, Personal Info
- 2 obfuscation techniques
🏢 Brand Impersonation Analysis
Fake Service
Unknown (No specific brand or service impersonation detected)
⚔️ Attack Methodology
Primary Method: Credential Harvesting
The phishing kit employs a credential harvester to capture usernames, passwords, and other sensitive information submitted via web forms. The data is likely exfiltrated in real-time to an attacker-controlled server.
Secondary Method: OTP and Payment Data Theft
The kit includes functionality to intercept one-time passwords (OTPs) and steal payment card details, enabling attackers to bypass multi-factor authentication and conduct fraudulent transactions.
🌐 Infrastructure Indicators of Compromise
Domain Information
Domain
sp326487.sitebeat.crazydomains.com
Registered
2001-12-10 19:06:37+00:00
Registrar
Dreamscape Networks International Pte Ltd
Status
Active (8812 days old)
🦠 Malicious Files
Main File
File Size
Bundled JavaScript file containing obfuscated code for credential harvesting and data exfiltration.
📊 Attack Flow Diagram
Here's a generic ASCII art attack flow diagram for your phishing scenario:
```
┌──────────────────────────────────────────────────────────┐
│ 1. TARGET RECEIVES DECEPTIVE MESSAGE │
│ - Victim directed to fake Banking site │
└────────────────────┬─────────────────────────────────────┘
│
▼
┌──────────────────────────────────────────────────────────┐
│ 2. FAKE SITE DISPLAYED │
│ - Mimics legitimate Banking interface │
│ - Presents credential input form │
└────────────────────┬─────────────────────────────────────┘
│
▼
┌──────────────────────────────────────────────────────────┐
│ 3. CREDENTIALS ENTERED │
│ - Victim inputs Banking credentials │
│ - Form appears identical to real site │
└────────────────────┬─────────────────────────────────────┘
│
▼
┌──────────────────────────────────────────────────────────┐
│ 4. DATA SUBMISSION │
│ - Form sends credentials via HTTP POST │
│ - Data transmitted to attacker-controlled server │
└──────────────────────────────────────────────────────────┘
```
🔬 JavaScript Deep Analysis
Operator Language
English (1%)
Total Code Size
156.2 KB
🔗 API Endpoints Detected
Other
16
🔐 Obfuscation Detected
- : Light
🤖 AI-Extracted Threat Intelligence
📊 Attack Flow
Here's a generic ASCII art attack flow diagram for your phishing scenario:
```
┌──────────────────────────────────────────────────────────┐
│ 1. TARGET RECEIVES DECEPTIVE MESSAGE │
│ - Victim directed to fake Banking site │
└────────────────────┬─────────────────────────────────────┘
│
▼
┌──────────────────────────────────────────────────────────┐
│ 2. FAKE SITE DISPLAYED │
│ - Mimics legitimate Banking interface │
│ - Presents credential input form │
└────────────────────┬─────────────────────────────────────┘
│
▼
┌──────────────────────────────────────────────────────────┐
│ 3. CREDENTIALS ENTERED │
│ - Victim inputs Banking credentials │
│ - Form appears identical to real site │
└────────────────────┬─────────────────────────────────────┘
│
▼
┌──────────────────────────────────────────────────────────┐
│ 4. DATA SUBMISSION │
│ - Form sends credentials via HTTP POST │
│ - Data transmitted to attacker-controlled server │
└──────────────────────────────────────────────────────────┘
```
🎯 Malicious Files Identified
Similar Websites
Pages with identical visual appearance (based on perceptual hash)
Scan History for sp326487.sitebeat.crazydomains.com
Found 2 other scans for this domain
"I Never Thought It Would Happen to Me"
That's what 2.3 million victims say every year. Don't wait to become a statistic.