SafeMode - Analysis: sajsofjjdjs.weebly.com

Captura Visual

No screenshot available

Información de Detección

https://sajsofjjdjs.weebly.com/

Detected Brand

Unknown

Country

Unknown

Confianza

100%

HTTP Status

200

Report ID

3564c9cf-7f3…

Analyzed

2026-01-25 02:11

Hashes de Contenido (Similitud HTML)

Used to detect similar phishing pages based on HTML content

Algorithm	Hash Value
CONTENT TLSH	T140E131F0D044ED37431386D9A7F96B0BB291C349CF47164453F883AB5BDACA0CB1669A
CONTENT ssdeep	96:nk2ynbzD71tDlt8v67McddtcnhwvFYehXbHFi8e9XXHF48ecjeXJX/nq2J:kTnbzD715lt8iIGd4GZ4xubcjGXfqw

Hashes Visuales (Similitud de Captura)

Used to detect visually similar phishing pages based on screenshots

Algorithm	Hash Value
VISUAL pHash	bc3cc33c38c3c33c
VISUAL aHash	df9f9fcf9f9fffff
VISUAL dHash	2030303030300000
VISUAL wHash	d0d0c0c0c0f0f0f0
VISUAL colorHash	070000001c0
VISUAL cropResistant	2030303030300000

Análisis de Código

Risk Score 100/100

🎣 Credential Harvester 🎣 OTP Stealer 🎣 Card Stealer 🎣 Banking 🎣 Personal Info

🔐 Credential Harvesting Forms

🔒 Obfuscation Detected

atob
eval
fromCharCode
unescape
hex_escape
unicode_escape
base64_strings

🎯 Kit Endpoints

https://google.com/recaptcha/admin/migrate

📡 API Calls Detected

GET
POST

📤 Form Action Targets

https://sajsofjjdjs.weebly.com/ajax/apps/formSubmitAjax.php

📊 Desglose de Puntuación de Riesgo

Total Risk Score

100/100

Contributing Factors

Active Phishing Kit

Detected multiple kit types: Credential Harvester, OTP Stealer, Card Stealer, Banking, Personal Info with 9 forms for data collection

Obfuscation Techniques

115 obfuscation techniques detected, indicating heavy evasion of static analysis

Malicious JavaScript Files

Presence of suspicious JS files: MutationObserver.js, templateArtifacts.js, plugins.js, commonly used in phishing kits for dynamic content manipulation and data exfiltration

High-Risk Domain

Domain hosted on Weebly, a free website builder frequently abused for phishing campaigns

🔬 Análisis Integral de Amenazas

Tipo de Amenaza

Banking Credential Harvester

Objetivo

General public

Método de Ataque

credential harvesting forms + obfuscated JavaScript

Canal de Exfiltración

HTTP POST to backend

Evaluación de Riesgo

CRITICAL - Automated credential harvesting with HTTP POST to backend

⚠️ Indicators of Compromise

Kit types: Credential Harvester, OTP Stealer, Card Stealer, Banking, Personal Info
115 obfuscation techniques

🏢 Análisis de Suplantación de Marca

Fake Service

Generic credential and personal information harvesting

⚔️ Metodología de Ataque

Primary Method: Credential Harvesting

The phishing kit employs form-based credential harvesting to capture user inputs in real-time. It uses JavaScript event listeners to intercept form submissions and exfiltrate data to a remote server. The presence of 9 forms suggests multi-stage data collection, likely targeting usernames, passwords, and personal information.

Secondary Method: OTP and Card Stealing

Secondary attack vectors include OTP interception and card stealing. The kit likely simulates Banking or service login pages to capture one-time passwords (OTPs) and credit card details, which are then transmitted to the attacker's infrastructure for immediate exploitation.