EN ES PT

Phishing Analysis

Detailed analysis of captured phishing page

Back to Stats

Captura Visual

Screenshot of nscapp.com.ng

Información de Detección

https://nscapp.com.ng/data/load/gggg/arubaaufix/web/authen.php?web/auth/arub12#/dashboard/overviewAccounts/overview/index=D1O1b2XnxM19LFedWWCrJkIzAklNDbSsrTWBYzEL2pcPw0neIMwhyWbcA62h83sqI2MlBdy84No5LuU4
Detected Brand
Aruba.it
Country
International
Confianza
95%
HTTP Status
200
Report ID
2a8461df-0cd…
Analyzed
2026-03-01 20:05

Hashes de Contenido (Similitud HTML)

Used to detect similar phishing pages based on HTML content

Algorithm Hash Value
CONTENT TLSH
T149B1633021218FB71697D7E07A10FF9971CAA382DB138E04D2F89A6A1FC7D85CC916B1
CONTENT ssdeep
96:TqYMKIj3VME5kFgwwd/6kmxj6F0OzqfRTu2gX+8sPwK3vi:uYMKIrOExm3a

Hashes Visuales (Similitud de Captura)

Used to detect visually similar phishing pages based on screenshots

Algorithm Hash Value
VISUAL pHash
b838c6cf3832c739
VISUAL aHash
ffcf8787c3ffffff
VISUAL dHash
051e1a1b1b001a0c
VISUAL wHash
f1818181013fffe7
VISUAL colorHash
07000030040
VISUAL cropResistant
051e1a1b1b001a0c,18a4a1b9c989899b

Análisis de Código

Risk Score 53/100
Nivel de Amenaza ALTO
⚠️ Phishing Confirmed
🎣 Credential Harvester

🔬 Threat Analysis Report

• Amenaza: Phishing
• Objetivo: Usuarios de Aruba.it
• Método: Recopilación de credenciales
• Exfil: ../next.php (de acciones de formulario)
• Indicadores: Discordancia de dominio, formulario de contraseña.
• Riesgo: ALTO

🔐 Credential Harvesting Forms

🔒 Obfuscation Detected

  • fromCharCode

📤 Form Action Targets

  • ../next.php

📊 Desglose de Puntuación de Riesgo

Total Risk Score
90/100

Contributing Factors

Domain Mismatch
The domain nscapp.com.ng is not related to Aruba.it
Form for credentials
The presence of a password field with a login attempt to Aruba.it, is very suspicious.
Obfuscation Detected
JS obfuscation detected

🔬 Análisis Integral de Amenazas

Tipo de Amenaza
Credential Harvesting Kit
Objetivo
Aruba.it users (International)
Método de Ataque
Brand impersonation + credential harvesting forms + obfuscated JavaScript
Canal de Exfiltración
HTTP POST to backend
Evaluación de Riesgo
MEDIUM - Automated credential harvesting with HTTP POST to backend

⚠️ Indicators of Compromise

  • Kit types: Credential Harvester
  • 2 obfuscation techniques

🏢 Análisis de Suplantación de Marca

Impersonated Brand
Aruba.it
Official Website
https://www.aruba.it/
Fake Service
Aruba.it Webmail

⚔️ Metodología de Ataque

Primary Method: Credential Harvesting

The attacker is using a fake login page that closely resembles Aruba.it's webmail login to steal user credentials.

🌐 Indicadores de Compromiso de Infraestructura

Domain Information

Dominio
nscapp.com.ng
Registered
None
Registrar
None
Estado
None

🤖 AI-Extracted Threat Intelligence

Similar Websites

Pages with identical visual appearance (based on perceptual hash)

Screenshot
Desconocido
https://cdn.gosafemode.com/screenshots/c5418d937eab.png
Jul 04, 2026
 Screenshot
Desconocido
https://cdn.gosafemode.com/screenshots/2fe4088c4ddb.png
Jul 03, 2026
 Screenshot
Aruba.it
https://nscapp.com.ng/data/load/gggg/arubaaufix/web/authen.p...
Mar 01, 2026
 Screenshot
Aruba.it
https://nscapp.com.ng/data/load/gggg/arubaaufix/web/authen.p...
Feb 28, 2026
No screenshot
Aruba.it
https://nscapp.com.ng/data/load/gggg/arubaaufix/web/authen.p...
Feb 27, 2026

Scan History for nscapp.com.ng

Found 10 other scans for this domain

😰
"Nunca pensé que me pasaría a mí"
Esto dicen las 2.3 millones de víctimas cada año. No esperes a ser una estadística.