SafeMode - Analysis: m.izuoluo.com

Visual Capture

Detection Info

http://m.izuoluo.com

Detected Brand

Unknown - Multiple gambling platforms

Country

International

Confidence

100%

HTTP Status

200

Report ID

e59f19ea-92a…

Analyzed

2026-03-17 02:02

Final URL (after redirects)

http://m.izuoluo.com/

Content Hashes (HTML Similarity)

Used to detect similar phishing pages based on HTML content

Algorithm	Hash Value
CONTENT TLSH	T13173545191BEA9B71363C2C07AB4AB5AF3C163C9CB421E41ABF087895FC6F45CC0A576
CONTENT ssdeep	1536:BFjbC+rFXRdFr7FJnXV6byFs4dbAdroXR/FtV7FSnXV6by5uE:7zauE

Visual Hashes (Screenshot Similarity)

Used to detect visually similar phishing pages based on screenshots

Algorithm	Hash Value
VISUAL pHash	9e8663d961669969
VISUAL aHash	1c3e3e36183c0000
VISUAL dHash	f0e4e4e4b2f0ccf0
VISUAL wHash	7e7e7e7e3c3c0000
VISUAL colorHash	30206008000
VISUAL cropResistant	f0e4e4e4b2f0ccf0

Code Analysis

Risk Score 80/100

Threat Level ALTO

⚠️ Phishing Confirmed

🎣 OTP Stealer 🎣 Banking

🔬 Threat Analysis Report

• Threat: Phishing
• Target: Users interested in gambling
• Method: Impersonation and promotion
• Exfil: Unclear, likely through fraudulent websites.
• Indicators: Mismatched domain, brand impersonation, promotional content
• Risk: High

🔐 Credential Harvesting Forms

🔒 Obfuscation Detected

eval
unescape
document.write
hex_escape
unicode_escape

📡 API Calls Detected

get

📤 Form Action Targets

/search.php

📊 Risk Score Breakdown

Total Risk Score

90/100

Contributing Factors

Mismatched domain and brands

The domain does not belong to any of the advertised brands.

Brand impersonation

The site uses the logos and names of legitimate gambling platforms to lure users.

Promotional content

Offers and incentives (bonuses) are commonly used in phishing campaigns to attract victims.

Obfuscated Javascript

Javascript Obfuscation detected - potential malicious behavior

🔬 Comprehensive Threat Analysis

Threat Type

Banking Credential Harvester

Target

Unknown - Multiple gambling platforms users (International)

Attack Method

Brand impersonation + credential harvesting forms + obfuscated JavaScript

Exfiltration Channel

HTTP POST to backend

Risk Assessment

CRITICAL - Automated credential harvesting with HTTP POST to backend

⚠️ Indicators of Compromise

Kit types: OTP Stealer, Banking
39 obfuscation techniques

🏢 Brand Impersonation Analysis

Impersonated Brand

Multiple Gambling platforms

Official Website

Unknown

Fake Service

Gambling platforms

Fraudulent Claims

⚔️ Attack Methodology

Primary Method: Brand impersonation/Affiliate Marketing

The site uses the logos and names of various gambling platforms to make the user believe the site is legit. The goal is to get the user to click on the links, likely for affiliate marketing or redirecting to malicious websites.