SafeMode - Analysis: apple.edenwee.workers.dev

Captura Visual

No screenshot available

Información de Detección

https://apple.edenwee.workers.dev/

Detected Brand

Unknown

Country

Unknown

Confianza

100%

HTTP Status

200

Report ID

3271068b-cc4…

Analyzed

2026-01-25 23:49

Hashes de Contenido (Similitud HTML)

Used to detect similar phishing pages based on HTML content

Algorithm	Hash Value
CONTENT TLSH	T1A8F3E8377225623E0317C7DEF5662A34F2E3A549CEDA51E8BEF883161392D70A42BD05
CONTENT ssdeep	1536:+cQ7uAc1S9XJdVnUY/iYZ1nGwmbdNDLHOeOptEYoFXDX7a2/B2Q7aj/B/7ak/Mt7:SG89p2FXDat/pi2Y

Hashes Visuales (Similitud de Captura)

Used to detect visually similar phishing pages based on screenshots

Algorithm	Hash Value
VISUAL pHash	80f800ff00ff1ff1
VISUAL aHash	7f7f7f7f3f3f3f3f
VISUAL dHash	808080c0c0c0c0c0
VISUAL wHash	7070707030303030
VISUAL colorHash	07000c00018
VISUAL cropResistant	808080c0c0c0c0c0

Análisis de Código

Risk Score 68/100

🎣 OTP Stealer 🎣 Banking

🔐 Credential Harvesting Forms

🔒 Obfuscation Detected

base64_strings

🎯 Kit Endpoints

https://fitness.apple.com/us/studio-collection/no-shoes-workouts/1779383019?itscg=10000&itsct=afp-apl_hp-watch_now--240326
https://fitness.apple.com/us/studio-collection/trainers-feature-their-favorites/1783405899?itscg=10000&itsct=afp-apl_hp-watch_now--240326

📤 Form Action Targets

/us/search

📊 Desglose de Puntuación de Riesgo

Total Risk Score

100/100

Contributing Factors

Active Phishing Kit

Detected OTP stealer and Banking phishing kit with 12 form fields for credential and OTP harvesting.

High Obfuscation

276 obfuscation techniques detected, indicating deliberate evasion of analysis and security tools.

Suspicious JavaScript Files

Large JavaScript files (2.74 MB total) with no legitimate context, likely containing malicious payloads.

Domain Reputation

Domain hosted on Cloudflare Workers (edenwee.workers.dev), a common platform for phishing campaigns due to low cost and anonymity.

🔬 Análisis Integral de Amenazas

Tipo de Amenaza

Banking Credential Harvester

Objetivo

General public

Método de Ataque

credential harvesting forms + obfuscated JavaScript

Canal de Exfiltración

HTTP POST to backend

Evaluación de Riesgo

HIGH - Automated credential harvesting with HTTP POST to backend

⚠️ Indicators of Compromise

Kit types: OTP Stealer, Banking
276 obfuscation techniques

🏢 Análisis de Suplantación de Marca

Fake Service

Banking or financial service login portal

⚔️ Metodología de Ataque

Primary Method: Credential Harvesting with OTP Interception

The phishing kit is designed to capture Banking credentials and one-time passwords (OTPs) in real-time. The 12 form fields suggest multi-stage data collection, likely simulating a bank's login and 2FA process. The OTP stealer component intercepts SMS or authenticator app codes to bypass multi-factor authentication.

Secondary Method: Session Hijacking

Post-credential capture, the kit may initiate session hijacking by injecting malicious JavaScript into the victim's browser. This allows attackers to maintain access to the victim's Banking session even after the initial phishing interaction.