Phishing Analysis
Detailed analysis of captured phishing page
Visual Capture
Detection Info
https://6aaac910.wcconn.pages.dev/
Detected Brand
Coinbase
Country
International
Confidence
100%
HTTP Status
200
Report ID
e6aaaafa-59e…
Analyzed
2026-02-14 13:07
Content Hashes (HTML Similarity)
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T13C21FE7520037A6B83632AE4B3548654E1A3D30DCA275C05F7FB93DB1BE1D419D42569 |
|
CONTENT
ssdeep
|
24:nxmvC7B7IsRE0wkCCfWaVfb4uGECiHQiECsF2:nxm0EkN55GECiHQiECk2 |
Visual Hashes (Screenshot Similarity)
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
cccc26b399333399 |
|
VISUAL
aHash
|
0018181818000000 |
|
VISUAL
dHash
|
08301432b20c2000 |
|
VISUAL
wHash
|
00181c1c3c3c0c0c |
|
VISUAL
colorHash
|
38001008040 |
|
VISUAL
cropResistant
|
a292a09696a6a2a2,08301432b20c2000 |
Code Analysis
Risk Score
74/100
Threat Level
ALTO
⚠️ Phishing Confirmed
🎣 Credential Harvester
🎣 OTP Stealer
🔬 Threat Analysis Report
• Threat: Phishing
• Target: Coinbase users
• Method: Impersonation via a fake landing page.
• Exfil: Potentially credentials or wallet information.
• Indicators: Free hosting and Coinbase branding.
• Risk: High
🔒 Obfuscation Detected
- fromCharCode
- unescape
- unicode_escape
🎯 Kit Endpoints
- https://6aaac910.wcconn.pages.dev/assets/index-B6v9WWnX.js
- http://fb.me/use-check-prop-types
- https://www.coinbase.com/en-in/wallet
- https://embed.${l}/${r}/${a}`,d.charset=
- http://jedwatson.github.io/classnames
- https://getbootstrap.com/)
- https://reactrouter.com/en/main/routers/picking-a-router.`}function
- http://localhost
- https://popper.js.org)
- https://reactjs.org/docs/error-decoder.html?invariant=
- https://server0002.mn19indexpre.xyz
📊 Risk Score Breakdown
Total Risk Score
90/100
Contributing Factors
Free Hosting + Brand Logo
Presence of a brand logo on a free hosting platform is a strong indicator of phishing.
Domain Mismatch
The domain does not match the official brand domain.
🔬 Comprehensive Threat Analysis
Threat Type
Two-Factor Authentication Stealer
Target
Coinbase users (International)
Attack Method
Brand impersonation + credential harvesting forms + obfuscated JavaScript
Exfiltration Channel
Form submission (backend endpoint not detected - likely JavaScript-based)
Risk Assessment
HIGH - Automated credential harvesting with Form submission (backend endpoint not detected - likely JavaScript-based)
⚠️ Indicators of Compromise
- Kit types: Credential Harvester, OTP Stealer
- 15 obfuscation techniques
🏢 Brand Impersonation Analysis
Impersonated Brand
Coinbase Wallet
Official Website
https://www.coinbase.com/
Fake Service
Coinbase Wallet
⚔️ Attack Methodology
Primary Method: Credential Harvesting
The attacker likely aims to steal user credentials by mimicking the Coinbase Wallet login page to trick users into entering their information.
🌐 Infrastructure Indicators of Compromise
🦠 Malicious Files
Main File
index-B6v9WWnX.js
File Size
🔬 JavaScript Deep Analysis
Operator Language
English (1%)
Sophistication Level
Basic
Total Code Size
399.8 KB
🔗 API Endpoints Detected
Other
7
🔐 Obfuscation Detected
- : Heavy
🤖 AI-Extracted Threat Intelligence
🎯 Malicious Files Identified
Main Drainer
index-B6v9WWnX.jsFile Size
399KB
Similar Websites
Pages with identical visual appearance (based on perceptual hash)
Scan History for 6aaac910.wcconn.pages.dev
Found 2 other scans for this domain
"I Never Thought It Would Happen to Me"
That's what 2.3 million victims say every year. Don't wait to become a statistic.