Phishing Analysis
Detailed analysis of captured phishing page
Visual Capture
Detection Info
https://balalaika.org/ar/servicio.html
Detected Brand
Aruba
Country
Italy
Confidence
95%
HTTP Status
200
Report ID
fc25db5b-31a…
Analyzed
2026-01-15 11:43
Content Hashes (HTML Similarity)
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T1257195709294783E08C5C3D8B7E17F2A27C28195E742086993EACB7E8FD7E50DC019E9 |
|
CONTENT
ssdeep
|
48:GjPCeNmTNMgEMFIiGy5a9O/qIXmQJIkQSqyBhor9ak14xQ9GEjVsJRp7ic1dqQr:GjiERlynmQKyzKKosfBqK |
Visual Hashes (Screenshot Similarity)
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
d71a5d2a772a5522 |
|
VISUAL
aHash
|
00fffffffffffffe |
|
VISUAL
dHash
|
28004d686810010e |
|
VISUAL
wHash
|
001c2434e7dbf8e0 |
|
VISUAL
colorHash
|
07000038040 |
|
VISUAL
cropResistant
|
309964694810010e,00000288988c4208 |
Code Analysis
Threat Level
ALTO
⚠️ Phishing Confirmed
🔬 Threat Analysis Report
• Threat: Credential harvesting phishing kit
• Target: Aruba customers in Italy
• Method: Fake payment form stealing credit card details
• Exfil: Unknown, likely sent to attacker's server
• Indicators: Domain mismatch, free hosting, phishing form
• Risk: HIGH - Immediate credential theft
🔐 Credential Harvesting Forms
📤 Form Action Targets
- py.html
Similar Websites
Pages with identical visual appearance (based on perceptual hash)
Unknown
https://cdn.gosafemode.com/screenshots/9c3236202526.png
Apr 14, 2026
Unknown
https://cdn.gosafemode.com/screenshots/3f896db33721.png
Apr 12, 2026
Unknown
https://cdn.gosafemode.com/screenshots/facbf4550e40.png
Mar 25, 2026
Unknown
https://cdn.gosafemode.com/screenshots/e797ef7ce909.png
Mar 24, 2026
No screenshot
Aruba.it
http://luqmanlegal.com/said/servicio.html
Jan 26, 2026
"I Never Thought It Would Happen to Me"
That's what 2.3 million victims say every year. Don't wait to become a statistic.