SafeMode - Analysis: swastik-purohit-coder.github.io

Visual Capture

Screenshot of swastik-purohit-coder.github.io

Detection Info

https://swastik-purohit-coder.github.io/streaming-clone-educational

Detected Brand

Netflix

Country

International

Confidence

95%

HTTP Status

200

Report ID

e896a805-9a6…

Analyzed

2026-03-02 21:20

Final URL (after redirects)

https://swastik-purohit-coder.github.io/streaming-clone-educational/

Content Hashes (HTML Similarity)

Used to detect similar phishing pages based on HTML content

Algorithm	Hash Value
CONTENT TLSH	T10EB142A21245DE2E116782E2F372377A23A68289CA46130084FDD3681FE6D5DED3F8C4
CONTENT ssdeep	96:Tp+RLAp7kJLo2f9meRzkHo2f9me281JfbQornGBu:9+RLaklo2f9me5kHo2f9me28bfbQor5

Visual Hashes (Screenshot Similarity)

Used to detect visually similar phishing pages based on screenshots

Algorithm	Hash Value
VISUAL pHash	d2e9366d922dca86
VISUAL aHash	62203c387c780666
VISUAL dHash	d4d06161e8d0cccc
VISUAL wHash	7a603c787c7e0666
VISUAL colorHash	31401008000
VISUAL cropResistant	e4f43230e4a1a1e0,d4d06161e8d0cccc

Code Analysis

Threat Level ALTO

⚠️ Phishing Confirmed

🔬 Threat Analysis Report

• Threat: Phishing
• Target: Netflix users
• Method: Impersonation through a fake login page
• Exfil: Email address
• Indicators: Free hosting, Netflix logo, login form.
• Risk: HIGH

📊 Risk Score Breakdown

Total Risk Score

90/100

Contributing Factors

Free hosting

The domain is using free hosting service which is commonly associated with phishing.

Brand impersonation

The site mimics a legitimate Netflix page.

Form asking for sensitive information

Requests the user's email.

🔬 Comprehensive Threat Analysis

Threat Type

Netflix Phishing Landing Page

Target

Netflix users (International)

Attack Method

Brand impersonation

Exfiltration Channel

Form submission (backend endpoint not detected - likely JavaScript-based)

Risk Assessment

LOW - Automated credential harvesting with Form submission (backend endpoint not detected - likely JavaScript-based)

🏢 Brand Impersonation Analysis

Impersonated Brand

Netflix

Official Website

https://www.netflix.com/

Fake Service

Netflix account access

⚔️ Attack Methodology

Primary Method: Credential Harvesting

The attacker is attempting to collect the user's email address by impersonating the Netflix login page. Once the user enters the email, it will be sent to the attacker.