Phishing Analysis
Detailed analysis of captured phishing page
Visual Capture
Detection Info
https://netflixtunisie.com.tn/
Detected Brand
Netflix
Country
Unknown
Confidence
100%
HTTP Status
200
Report ID
e0ab777f-99b…
Analyzed
2026-05-30 23:15
Content Hashes (HTML Similarity)
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T139F34351BB52383930AF52CFC22B574C22C2E7CFD6952BE165F05231A5B6CA4BED22D4 |
|
CONTENT
ssdeep
|
1536:QLkgE7ohc9g7a6QHkHRxuGxm03xaMZ4pvLmE8fLhRpjVx64Eal66fsbgWhZ:QLj7t0mE8fLX4v |
Visual Hashes (Screenshot Similarity)
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
92946d2db2f2f02d |
|
VISUAL
aHash
|
00187e6e2e0e0000 |
|
VISUAL
dHash
|
b230acccccbcb3b1 |
|
VISUAL
wHash
|
18187efe7efe1800 |
|
VISUAL
colorHash
|
39006000001 |
|
VISUAL
cropResistant
|
f0e0d2a68c9ae0f0,b230acccccbcb3b1 |
Code Analysis
Risk Score
100/100
Threat Level
ALTO
⚠️ Phishing Confirmed
🎣 Credential Harvester
🎣 OTP Stealer
🎣 Banking
🎣 Personal Info
🔒 Obfuscation Detected
- atob
- fromCharCode
- base64_strings
🎯 Kit Endpoints
- /blog
- data:text/javascript,var%20ElementorProFrontendConfig%20%3D%20%7B%22ajaxurl%22%3A%22https%3A%5C%2F%5C%2Fnetflixtunisie.com.tn%5C%2Fwp-admin%5C%2Fadmin-ajax.php%22%2C%22nonce%22%3A%22adeec9fbc9%22%2C%22urls%22%3A%7B%22assets%22%3A%22https%3A%5C%2F%5C%2Fnetflixtunisie.com.tn%5C%2Fwp-content%5C%2Fplugins%5C%2Felementor-pro%5C%2Fassets%5C%2F%22%2C%22rest%22%3A%22https%3A%5C%2F%5C%2Fnetflixtunisie.com.tn%5C%2Fwp-json%5C%2F%22%7D%2C%22settings%22%3A%7B%22lazy_load_background_images%22%3Atrue%7D%2C%22popup%22%3A%7B%22hasPopUps%22%3Atrue%7D%2C%22shareButtonsNetworks%22%3A%7B%22facebook%22%3A%7B%22title%22%3A%22Facebook%22%2C%22has_counter%22%3Atrue%7D%2C%22twitter%22%3A%7B%22title%22%3A%22Twitter%22%7D%2C%22linkedin%22%3A%7B%22title%22%3A%22LinkedIn%22%2C%22has_counter%22%3Atrue%7D%2C%22pinterest%22%3A%7B%22title%22%3A%22Pinterest%22%2C%22has_counter%22%3Atrue%7D%2C%22reddit%22%3A%7B%22title%22%3A%22Reddit%22%2C%22has_counter%22%3Atrue%7D%2C%22vk%22%3A%7B%22title%22%3A%22VK%22%2C%22has_counter%22%3Atrue%7D%2C%22odnoklassniki%22%3A%7B%22title%22%3A%22OK%22%2C%22has_counter%22%3Atrue%7D%2C%22tumblr%22%3A%7B%22title%22%3A%22Tumblr%22%7D%2C%22digg%22%3A%7B%22title%22%3A%22Digg%22%7D%2C%22skype%22%3A%7B%22title%22%3A%22Skype%22%7D%2C%22stumbleupon%22%3A%7B%22title%22%3A%22StumbleUpon%22%2C%22has_counter%22%3Atrue%7D%2C%22mix%22%3A%7B%22title%22%3A%22Mix%22%7D%2C%22telegram%22%3A%7B%22title%22%3A%22Telegram%22%7D%2C%22pocket%22%3A%7B%22title%22%3A%22Pocket%22%2C%22has_counter%22%3Atrue%7D%2C%22xing%22%3A%7B%22title%22%3A%22XING%22%2C%22has_counter%22%3Atrue%7D%2C%22whatsapp%22%3A%7B%22title%22%3A%22WhatsApp%22%7D%2C%22email%22%3A%7B%22title%22%3A%22Email%22%7D%2C%22print%22%3A%7B%22title%22%3A%22Print%22%7D%2C%22x-twitter%22%3A%7B%22title%22%3A%22X%22%7D%2C%22threads%22%3A%7B%22title%22%3A%22Threads%22%7D%7D%2C%22facebook_sdk%22%3A%7B%22lang%22%3A%22fr_FR%22%2C%22app_id%22%3A%22%22%7D%2C%22lottie%22%3A%7B%22defaultAnimationUrl%22%3A%22https%3A%5C%2F%5C%2Fnetflixtunisie.com.tn%5C%2Fwp-content%5C%2Fplugins%5C%2Felementor-pro%5C%2Fmodules%5C%2Flottie%5C%2Fassets%5C%2Fanimations%5C%2Fdefault.json%22%7D%7D%3B%0A%2F%2F%23%20sourceURL%3Delementor-pro-frontend-js-before
- https://netflixtunisie.com.tn/blog/
- data:text/javascript,var%20elementorFrontendConfig%20%3D%20%7B%22environmentMode%22%3A%7B%22edit%22%3Afalse%2C%22wpPreview%22%3Afalse%2C%22isScriptDebug%22%3Afalse%7D%2C%22i18n%22%3A%7B%22shareOnFacebook%22%3A%22Partager%20sur%20Facebook%22%2C%22shareOnTwitter%22%3A%22Partager%20sur%20Twitter%22%2C%22pinIt%22%3A%22L%5Cu2019%5Cu00e9pingler%22%2C%22download%22%3A%22T%5Cu00e9l%5Cu00e9charger%22%2C%22downloadImage%22%3A%22T%5Cu00e9l%5Cu00e9charger%20une%20image%22%2C%22fullscreen%22%3A%22Plein%20%5Cu00e9cran%22%2C%22zoom%22%3A%22Zoom%22%2C%22share%22%3A%22Partager%22%2C%22playVideo%22%3A%22Lire%20la%20vid%5Cu00e9o%22%2C%22previous%22%3A%22Pr%5Cu00e9c%5Cu00e9dent%22%2C%22next%22%3A%22Suivant%22%2C%22close%22%3A%22Fermer%22%2C%22a11yCarouselPrevSlideMessage%22%3A%22Diapositive%20pr%5Cu00e9c%5Cu00e9dente%22%2C%22a11yCarouselNextSlideMessage%22%3A%22Diapositive%20suivante%22%2C%22a11yCarouselFirstSlideMessage%22%3A%22Ceci%20est%20la%20premi%5Cu00e8re%20diapositive%22%2C%22a11yCarouselLastSlideMessage%22%3A%22Ceci%20est%20la%20derni%5Cu00e8re%20diapositive%22%2C%22a11yCarouselPaginationBulletMessage%22%3A%22Aller%20%5Cu00e0%20la%20diapositive%22%7D%2C%22is_rtl%22%3Afalse%2C%22breakpoints%22%3A%7B%22xs%22%3A0%2C%22sm%22%3A480%2C%22md%22%3A768%2C%22lg%22%3A1025%2C%22xl%22%3A1440%2C%22xxl%22%3A1600%7D%2C%22responsive%22%3A%7B%22breakpoints%22%3A%7B%22mobile%22%3A%7B%22label%22%3A%22Portrait%20mobile%22%2C%22value%22%3A767%2C%22default_value%22%3A767%2C%22direction%22%3A%22max%22%2C%22is_enabled%22%3Atrue%7D%2C%22mobile_extra%22%3A%7B%22label%22%3A%22Mobile%20Paysage%22%2C%22value%22%3A880%2C%22default_value%22%3A880%2C%22direction%22%3A%22max%22%2C%22is_enabled%22%3Afalse%7D%2C%22tablet%22%3A%7B%22label%22%3A%22Tablette%20en%20mode%20portrait%22%2C%22value%22%3A1024%2C%22default_value%22%3A1024%2C%22direction%22%3A%22max%22%2C%22is_enabled%22%3Atrue%7D%2C%22tablet_extra%22%3A%7B%22label%22%3A%22Tablette%20en%20mode%20paysage%22%2C%22value%22%3A1200%2C%22default_value%22%3A1200%2C%22direction%22%3A%22max%22%2C%22is_enabled%22%3Afalse%7D%2C%22laptop%22%3A%7B%22label%22%3A%22Portable%22%2C%22value%22%3A1366%2C%22default_value%22%3A1366%2C%22direction%22%3A%22max%22%2C%22is_enabled%22%3Afalse%7D%2C%22widescreen%22%3A%7B%22label%22%3A%22%5Cu00c9cran%20large%22%2C%22value%22%3A2400%2C%22default_value%22%3A2400%2C%22direction%22%3A%22min%22%2C%22is_enabled%22%3Afalse%7D%7D%2C%22hasCustomBreakpoints%22%3Afalse%7D%2C%22version%22%3A%224.1.1%22%2C%22is_static%22%3Afalse%2C%22experimentalFeatures%22%3A%7B%22e_font_icon_svg%22%3Atrue%2C%22additional_custom_breakpoints%22%3Atrue%2C%22container%22%3Atrue%2C%22e_optimized_markup%22%3Atrue%2C%22theme_builder_v2%22%3Atrue%2C%22hello-theme-header-footer%22%3Atrue%2C%22nested-elements%22%3Atrue%2C%22global_classes_should_enforce_capabilities%22%3Atrue%2C%22e_variables%22%3Atrue%2C%22e_opt_in_v4_page%22%3Atrue%2C%22e_components%22%3Atrue%2C%22e_interactions%22%3Atrue%2C%22e_widget_creation%22%3Atrue%2C%22import-export-customization%22%3Atrue%2C%22e_pro_variables%22%3Atrue%7D%2C%22urls%22%3A%7B%22assets%22%3A%22https%3A%5C%2F%5C%2Fnetflixtunisie.com.tn%5C%2Fwp-content%5C%2Fplugins%5C%2Felementor%5C%2Fassets%5C%2F%22%2C%22ajaxurl%22%3A%22https%3A%5C%2F%5C%2Fnetflixtunisie.com.tn%5C%2Fwp-admin%5C%2Fadmin-ajax.php%22%2C%22uploadUrl%22%3A%22https%3A%5C%2F%5C%2Fnetflixtunisie.com.tn%5C%2Fwp-content%5C%2Fuploads%22%7D%2C%22nonces%22%3A%7B%22floatingButtonsClickTracking%22%3A%223a6f458a6f%22%2C%22atomicFormsSendForm%22%3A%22fef465c41a%22%7D%2C%22swiperClass%22%3A%22swiper%22%2C%22settings%22%3A%7B%22page%22%3A%5B%5D%2C%22editorPreferences%22%3A%5B%5D%7D%2C%22kit%22%3A%7B%22body_background_background%22%3A%22classic%22%2C%22lightbox_description_src%22%3A%22caption%22%2C%22active_breakpoints%22%3A%5B%22viewport_mobile%22%2C%22viewport_tablet%22%5D%2C%22global_image_lightbox%22%3A%22yes%22%2C%22lightbox_enable_counter%22%3A%22yes%22%2C%22lightbox_enable_fullscreen%22%3A%22yes%22%2C%22lightbox_enable_zoom%22%3A%22yes%22%2C%22lightbox_enable_share%22%3A%22yes%22%2C%22lightbox_title_src%22%3A%22title%22%7D%2C%22post%22%3A%7B%22id%22%3A13%2C%22title%22%3A%22Netflix%2520Tunisie%2520Officiel%2520-%2520Abonnement%2520d%25C3%25A8s%252018%2520DT%22%2C%22excerpt%22%3A%22%22%2C%22featuredImage%22%3Afalse%7D%7D%3B%0A%2F%2F%23%20sourceURL%3Delementor-frontend-js-before
📡 API Calls Detected
- https://www.google.com/ccm/geo
📊 Risk Score Breakdown
Total Risk Score
100/100
Contributing Factors
Active Phishing Kit
Detected kit types: Credential Harvester, OTP Stealer, Banking, Personal Info
Credential Harvesting
Credential harvesting detected with 1 form(s) capturing sensitive data
Code Obfuscation
JavaScript code obfuscated using 15 technique(s) to evade detection
🔬 Comprehensive Threat Analysis
Threat Type
Banking Credential Harvester
Target
Netflix users
Attack Method
credential harvesting forms + obfuscated JavaScript
Exfiltration Channel
Form submission (backend endpoint not detected - likely JavaScript-based)
Risk Assessment
CRITICAL - Automated credential harvesting with Form submission (backend endpoint not detected - likely JavaScript-based)
⚠️ Indicators of Compromise
- Kit types: Credential Harvester, OTP Stealer, Banking, Personal Info
- 15 obfuscation techniques
🏢 Brand Impersonation Analysis
Impersonated Brand
Netflix
Official Website
https://www.netflix.com
Fake Service
Banking/payment service
⚔️ Attack Methodology
Primary Method: Credential Harvesting
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Secondary Method: JavaScript Obfuscation
Malicious code is obfuscated using 15 techniques to evade detection by security scanners and make reverse engineering more difficult.
🌐 Infrastructure Indicators of Compromise
Domain Information
Domain
netflixtunisie.com.tn
Registered
2025-07-24 23:23:30-01:00
Registrar
OXAHOST
Status
Active (310 days old)
Hosting Information
Provider
OXAHOST
ASN
🤖 AI-Extracted Threat Intelligence
"I Never Thought It Would Happen to Me"
That's what 2.3 million victims say every year. Don't wait to become a statistic.