Phishing Analysis
Detailed analysis of captured phishing page
Visual Capture
Detection Info
http://solviontrust-de.net
Detected Brand
Unknown
Country
Germany (based on language and targeting)
Confidence
95%
HTTP Status
200
Report ID
f7e948ab-8e3…
Analyzed
2026-02-14 21:09
Final URL (after redirects)
https://solviontrust-de.net/
Content Hashes (HTML Similarity)
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T13BC2A4305486E97B048BB3E0A32A9B677790E344C257570A52FCC76E5FE2C94EC3A275 |
|
CONTENT
ssdeep
|
384:IutIl4oM8Vh4F5go2mXxQqf/u2g6m3E+I2i3rWRVumBUMf:IuDB2mlf/uHEyMrW31BUMf |
Visual Hashes (Screenshot Similarity)
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
9234ebe914d2b761 |
|
VISUAL
aHash
|
0000060404ffffff |
|
VISUAL
dHash
|
96cc9cac9c232321 |
|
VISUAL
wHash
|
000006060fffffff |
|
VISUAL
colorHash
|
13001000180 |
|
VISUAL
cropResistant
|
a080e0b4b48080a0,a280e0b434a080b2,a080e0ba1ad88092,8a009898da380082,8023d4e4a4842180,1b00232b23230133,963ecc9c9cacac98,f2f272c8ccf4a0ce |
Code Analysis
Risk Score
66/100
Threat Level
ALTO
⚠️ Phishing Confirmed
🎣 OTP Stealer
🔬 Threat Analysis Report
• Threat: Phishing
• Target: Cryptocurrency investors, German speakers
• Method: Impersonation and data theft
• Exfil: validation/thankyou.php
• Indicators: Recent domain, form submission, urgency, high profit claim, obfuscation
• Risk: High
🔐 Credential Harvesting Forms
🔒 Obfuscation Detected
- document.write
- unicode_escape
📡 API Calls Detected
- /validation/style.php
- https://ipapi.co/json
- POST
- https://ipapi.co/json/
📤 Form Action Targets
- validation/thankyou.php
📊 Risk Score Breakdown
Total Risk Score
90/100
Contributing Factors
Recent Domain
The domain was registered very recently (3 days ago), a strong indicator of phishing.
Form Submission to Unexpected Location
The form submits to a location (validation/thankyou.php) not typical of legitimate sites.
JavaScript Obfuscation
The presence of obfuscated JavaScript code is often used to hide malicious activity.
Urgency and Profit Claims
Using claims of high profit and limited availability is a common phishing tactic to manipulate users
🔬 Comprehensive Threat Analysis
Threat Type
Two-Factor Authentication Stealer
Target
General public
Attack Method
Brand impersonation + credential harvesting forms + obfuscated JavaScript
Exfiltration Channel
HTTP POST to backend
Risk Assessment
HIGH - Automated credential harvesting with HTTP POST to backend
⚠️ Indicators of Compromise
- Kit types: OTP Stealer
- 32 obfuscation techniques
🏢 Brand Impersonation Analysis
Impersonated Brand
Unknown Cryptocurrency platform
Fake Service
Cryptocurrency trading
Fraudulent Claims
⚔️ Attack Methodology
Primary Method: Credential Harvesting
The site uses a form to collect personal information (name, email, phone number) which will be used for malicious purposes, such as identity theft or further phishing attempts.
Secondary Method: Malware distribution
The site could be used as a front for a variety of malware infections.
🌐 Infrastructure Indicators of Compromise
Domain Information
Domain
solviontrust-de.net
Registered
2024-02-08
Registrar
Unknown
Status
ACTIVE
🔬 JavaScript Deep Analysis
Total Code Size
38.9 KB
🔗 API Endpoints Detected
Other
2
🔐 Obfuscation Detected
- : None
- : None
- : None
🤖 AI-Extracted Threat Intelligence
Similar Websites
Pages with identical visual appearance (based on perceptual hash)
Scan History for solviontrust-de.net
Found 1 other scan for this domain
"I Never Thought It Would Happen to Me"
That's what 2.3 million victims say every year. Don't wait to become a statistic.