Phishing Analysis
Detailed analysis of captured phishing page
Visual Capture
Detection Info
http://oktaa.my.id
Detected Brand
Unknown
Country
International
Confidence
100%
HTTP Status
200
Report ID
f6f16627-05eā¦
Analyzed
2026-03-07 03:01
Final URL (after redirects)
https://oktaa.my.id/login
Content Hashes (HTML Similarity)
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T1EB8319A43A59F5665AF3439310DF1103B378562B540E4C60A350ECAE76BCC9FA06BFDA |
|
CONTENT
ssdeep
|
1536:3ezrTOq53QQHxh8N6GUsXhjaPnQsR+8uaH/:oTokmN6jstZkf |
Visual Hashes (Screenshot Similarity)
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
cc3333cc66339933 |
|
VISUAL
aHash
|
0000181818180000 |
|
VISUAL
dHash
|
10003030b0b20030 |
|
VISUAL
wHash
|
ffa2181818fee6a2 |
|
VISUAL
colorHash
|
38000000000 |
|
VISUAL
cropResistant
|
0400169696001600,10003030b0b20030 |
Code Analysis
Risk Score
100/100
Threat Level
ALTO
ā ļø Phishing Confirmed
š£ Credential Harvester
š£ OTP Stealer
š£ Banking
š£ Personal Info
š„ Firebase Backend
š¬ Threat Analysis Report
ā¢ Threat: Phishing
ā¢ Target: User credentials
ā¢ Method: Credential harvesting via fake login form
ā¢ Exfil: Potentially Firebase or other endpoint (based on extracted intel)
ā¢ Indicators: Suspicious domain, generic form, JavaScript obfuscation
ā¢ Risk: High
š Obfuscation Detected
- atob
- fromCharCode
- unicode_escape
- base64_strings
š” API Calls Detected
- https://www.google.com/ccm/geo
āļø Cloud Backend
- Firebase: portfolio-b06a1.firebaseapp.com
š Risk Score Breakdown
Total Risk Score
90/100
Contributing Factors
Suspicious Domain
The domain is not associated with any known legitimate brand or service, and the TLD is unusual.
Generic Login Form
The absence of branding and generic login fields make it highly suspicious.
Form Submission and JavaScript Obfuscation
The presence of Javascript and particularly obfuscation suggests an active attempt to hide malicious code/behavior, and the form submission indicates a direct attempt to collect credentials.
Recent Domain Age
The domain age is unknown but likely recently registered, increasing the likelihood of phishing.
š¬ Comprehensive Threat Analysis
Threat Type
Banking Credential Harvester
Target
General public
Attack Method
credential harvesting forms + obfuscated JavaScript
Exfiltration Channel
Firebase Database
Risk Assessment
CRITICAL - Automated credential harvesting with Firebase Database
ā ļø Indicators of Compromise
- Kit types: Credential Harvester, OTP Stealer, Banking, Personal Info
- 57 obfuscation techniques
š¢ Brand Impersonation Analysis
Impersonated Brand
Unknown
Fake Service
Login Portal (generic)
āļø Attack Methodology
Primary Method: Credential Harvesting
The site uses a fake login form to collect user email addresses and passwords. Once entered, this information is likely sent to a server controlled by the attacker.
Secondary Method: Javascript Obfuscation
Javascript obfuscation hides malicious code making it difficult to analyze.
š Infrastructure Indicators of Compromise
Domain Information
Domain
oktaa.my.id
Registered
Unknown
Registrar
Unknown
Status
Unknown
š¤ AI-Extracted Threat Intelligence
Similar Websites
Pages with identical visual appearance (based on perceptual hash)
"I Never Thought It Would Happen to Me"
That's what 2.3 million victims say every year. Don't wait to become a statistic.