Phishing Analysis
Detailed analysis of captured phishing page
Visual Capture
Detection Info
https://bafkreidccja3l5z7l6q244cigjzqg75no45p6gl3d5fzl3ddawactsckqu.ipfs.dweb.link/
Detected Brand
Unknown
Country
International
Confidence
95%
HTTP Status
200
Report ID
d7f2afc2-18cā¦
Analyzed
2026-02-10 08:40
Content Hashes (HTML Similarity)
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T11EA10530434CAE73484391E4A6A19B0772C9C327C6539F0897F4839D9FDBED2CA59699 |
|
CONTENT
ssdeep
|
48:pyJBD2BKdWZ4KsLx6Se6S3qA/XTxkAVT/2WXbt6HYPsL3Hy7Dd1n6QQRHrBGYfhk:83HDjLaTXTxxhX7vd1nmRHrd/nF9gT73 |
Visual Hashes (Screenshot Similarity)
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
cccc333399cc6666 |
|
VISUAL
aHash
|
1818181818000000 |
|
VISUAL
dHash
|
103232b232080000 |
|
VISUAL
wHash
|
383818181f0f0f0f |
|
VISUAL
colorHash
|
000000001c0 |
|
VISUAL
cropResistant
|
82a0e09280c0e080,103232b232080000 |
Code Analysis
Risk Score
56/100
Threat Level
ALTO
ā ļø Phishing Confirmed
š£ Credential Harvester
š¬ Threat Analysis Report
ā¢ Threat: Credential Phishing
ā¢ Target: Webmail users
ā¢ Method: Impersonation with malicious JavaScript and forms
ā¢ Exfil: Form submission, JS Obfuscation
ā¢ Indicators: JavaScript, IPFS hosting, Login form
ā¢ Risk: High
š Obfuscation Detected
- unescape
- document.write
š Risk Score Breakdown
Total Risk Score
90/100
Contributing Factors
Obfuscated JavaScript
Obfuscated Javascript often indicates malicious intent.
IPFS Hosting
Unusual and suspicious hosting method. Often used for hosting phishing pages.
Form Submission
Capturing sensitive data is a primary goal of phishing.
Domain Age
While the domain age is high, it is not an indicator for this context.
š¬ Comprehensive Threat Analysis
Threat Type
Credential Harvesting Kit
Target
General public
Attack Method
Brand impersonation + credential harvesting forms + obfuscated JavaScript
Exfiltration Channel
Form submission (backend endpoint not detected - likely JavaScript-based)
Risk Assessment
MEDIUM - Automated credential harvesting with Form submission (backend endpoint not detected - likely JavaScript-based)
ā ļø Indicators of Compromise
- Kit types: Credential Harvester
- 4 obfuscation techniques
š¢ Brand Impersonation Analysis
Impersonated Brand
Webmail
Fake Service
Webmail login
āļø Attack Methodology
Primary Method: Credential Harvesting
The site uses a form to collect email and password credentials, attempting to impersonate a legitimate webmail service to trick users into entering their login details.
Secondary Method: JavaScript Obfuscation
The site uses obfuscated JavaScript to likely hide malicious activity, such as credential exfiltration, redirection, or other attacks.
š Infrastructure Indicators of Compromise
Domain Information
Domain
bafkreidccja3l5z7l6q244cigjzqg75no45p6gl3d5fzl3ddawactsckqu.ipfs.dweb.link
Registered
None
Registrar
None
Status
active
š¤ AI-Extracted Threat Intelligence
Similar Websites
Pages with identical visual appearance (based on perceptual hash)
Unknown
https://firststepschemicalclassificationkit.com/wq2/#email@e...
Jun 17, 2026
Netflix
http://facebook-registrer.github.io/NETFLIX
May 02, 2026
Unknown
https://akpk2e9aqj.us-east-2.awsapprunner.com/
Apr 15, 2026
Spotify
https://luxatia-international.com/upgrade/home.php?userid=66...
Jan 23, 2026
"I Never Thought It Would Happen to Me"
That's what 2.3 million victims say every year. Don't wait to become a statistic.