Phishing Analysis

🔬 Threat Analysis Report

• Threat: Brand impersonation phishing using a free hosting service.
• Target: PayPal users are targeted.
• Method: The phishing page uses the PayPal logo and branding but is hosted on a blogspot domain, likely leading to a form for credential theft.
• Exfil: The form action points to the blogspot domain, suggesting data exfiltration through a custom script or similar method.
• Indicators: Free hosting, domain mismatch, brand impersonation, obfuscation detected.
• Risk: HIGH - Credential theft and potential account compromise.

🔐 Credential Harvesting Forms

🔒 Obfuscation Detected

• eval
• hex_escape
• unicode_escape

🎯 Kit Endpoints

• https://www.blogger.com/share-post.g?blogID=4165901018681820242&postID=8043106242831253549&target=twitter
• https://www.blogger.com/profile/11377455202849998003
• https://www.blogger.com/share-post.g?blogID=4165901018681820242&postID=8043106242831253549&target=email
• https://extpaypalupdatenonqs.blogspot.com/feeds/posts/default?alt=rss
• https://www.blogger.com
• https://extpaypalupdatenonqs.blogspot.com/feeds/posts/default
• https://extpaypalupdatenonqs.blogspot.com/2021/02/blog-post.html#comments
• https://www.blogger.com/share-post.g?blogID=4165901018681820242&postID=8043106242831253549&target=
• https://extpaypalupdatenonqs.blogspot.com/
• /responsive/sprite_v1_6.css.svg#ic_post_blogger_black_24dp
• https://www.blogger.com/share-post.g?blogID=4165901018681820242&postID=8043106242831253549&target=facebook
• https://extpaypalupdatenonqs.blogspot.com/2021/02/
• https://www.blogger.com/go/report-abuse
• https://www.blogger.com/share-post.g?blogID=4165901018681820242&postID=8043106242831253549&target=pinterest
• https://extpaypalupdatenonqs.blogspot.com/2021/02/blog-post.html
• https://extpaypalupdatenonqs.blogspot.com/search
• https://www.blogger.com/feeds/4165901018681820242/posts/default

📡 API Calls Detected

• GET
• post

📤 Form Action Targets

• https://extpaypalupdatenonqs.blogspot.com/search