SafeMode - Analysis: www177.lexzx.com

Visual Capture

Detection Info

https://www177.lexzx.com/

Detected Brand

TKStore

Country

International

Confidence

100%

HTTP Status

200

Report ID

ce7165ba-1cb…

Analyzed

2026-01-02 07:46

Content Hashes (HTML Similarity)

Used to detect similar phishing pages based on HTML content

Algorithm	Hash Value
CONTENT TLSH	T1CE526032A051B53740C383F2AB302BAABBE0C2A7D693464595F8C35C5BD1D52DD2F62B
CONTENT ssdeep	192:CSZeRQxgRj5sMiDM6Mc+TfyKTpfT4I40STp4MnloFnxpq/+1qp31qPaWI:CJREaP6McWa6trZyhnixpaUk0XI

Visual Hashes (Screenshot Similarity)

Used to detect visually similar phishing pages based on screenshots

Algorithm	Hash Value
VISUAL pHash	ec6c9393c96b3261
VISUAL aHash	fff3c191f9ffe7cf
VISUAL dHash	5b262723230c861e
VISUAL wHash	fde38181f1ff0103
VISUAL colorHash	07400080000
VISUAL cropResistant	5b262723230c861e,666e261eb1b5b654,9e9f4dd6d292d9c9

Code Analysis

Risk Score 95/100

Threat Level ALTO

⚠️ Phishing Confirmed

🎣 Credential Harvester 🎣 OTP Stealer 🎣 Banking 🎣 Personal Info

🔬 Threat Analysis Report

• Threat: Brand impersonation phishing
• Target: Users of TKStore
• Method: Fake webpage using TKStore logo and branding to potentially redirect users to malicious sites or gather information.
• Exfil: Unknown, potential redirection or information gathering.
• Indicators: Domain name mismatch, obfuscated JS, JavaScript form submission.
• Risk: HIGH - Potential for data theft or malware infection.

🔒 Obfuscation Detected

atob
fromCharCode
unescape
unicode_escape
base64_strings

🎯 Kit Endpoints

https://accounts.google.com/ServiceLogin?service=wise&passive=1209600&osid=1&continue=https://docs.google.com/drawings/d/1_lqo4F3gmbSXC26MovTFbxSbqmAmJoT-RnkxP5QovZ4/edit&followup=https://docs.google.com/drawings/d/1_lqo4F3gmbSXC26MovTFbxSbqmAmJoT-RnkxP5QovZ4/edit&ltmpl=drawings&ec=GAZAGQ