EN ES PT

Phishing Analysis

Detailed analysis of captured phishing page

Back to Stats

Captura Visual

Screenshot of live-ledge.zapier.app

Información de Detección

https://live-ledge.zapier.app/start
Detected Brand
Ledger
Country
International
Confianza
100%
HTTP Status
200
Report ID
b62b6886-ebf…
Analyzed
2026-02-21 18:26

Hashes de Contenido (Similitud HTML)

Used to detect similar phishing pages based on HTML content

Algorithm Hash Value
CONTENT TLSH
T1C1522B79F62512758A8343DAFF3622EEF61340EAD6126BCCD764431CB299AEE8514CC1
CONTENT ssdeep
192:kojoBNJ5U948cVmwJK2tixv5GQUlcMu9cuGRmKbMpBXp7sfgg8gk:kko+v25K2Yxv1UlrsmMpBZ7eg/B

Hashes Visuales (Similitud de Captura)

Used to detect visually similar phishing pages based on screenshots

Algorithm Hash Value
VISUAL pHash
f72a552a55aa55a8
VISUAL aHash
8183e7e7e7e7e7e6
VISUAL dHash
2b0b8e0c0e0f4d4e
VISUAL wHash
8100c3e7e7c1e7e6
VISUAL colorHash
07007000000
VISUAL cropResistant
2b0b8e0c0e0f4d4e

Análisis de Código

Risk Score 100/100
Nivel de Amenaza ALTO
⚠️ Phishing Confirmed
🎣 Credential Harvester 🎣 OTP Stealer 🎣 Card Stealer 🎣 Banking 🎣 Personal Info
WebSocket C2

🔬 Threat Analysis Report

• Amenaza: Impersonación de Ledger para robar datos sensibles.
• Objetivo: Usuarios de Ledger.
• Método: Sitio web malicioso para engañar a los usuarios.
• Exfil: Potencialmente a través de la ofuscación de Javascript.
• Indicadores: Coincidencia de dominio, uso de Zapier, 'live' en el dominio y ofuscación de Javascript.
• Riesgo: ALTO

🔒 Obfuscation Detected

  • atob
  • eval
  • fromCharCode
  • unescape
  • hex_escape
  • unicode_escape
  • base64_strings

🎯 Kit Endpoints

  • https://live-ledge.zapier.app/start
  • /app/login?reauth=true

📡 API Calls Detected

  • virtual
  • https://interfaces-report.zapier.app/report-form
  • first
  • GET
  • POST

📊 Desglose de Puntuación de Riesgo

Total Risk Score
90/100

Contributing Factors

Domain Mismatch
The domain does not match the expected brand domain (ledger.com).
Obfuscated Javascript
Javascript Obfuscation detected is often a sign of malicious intent.
Hosting Platform
The usage of Zapier app is a red flag.

🔬 Análisis Integral de Amenazas

Tipo de Amenaza
Banking Credential Harvester
Objetivo
Ledger users (International)
Método de Ataque
Brand impersonation + credential harvesting forms + real-time WebSocket exfiltration + obfuscated JavaScript
Canal de Exfiltración
WebSocket (1 endpoints)
Evaluación de Riesgo
CRITICAL - Automated credential harvesting with WebSocket (1 endpoints)

⚠️ Indicators of Compromise

  • Kit types: Credential Harvester, OTP Stealer, Card Stealer, Banking, Personal Info
  • 488 obfuscation techniques

🏢 Análisis de Suplantación de Marca

Impersonated Brand
Ledger
Official Website
https://www.ledger.com/
Fake Service
Ledger Start setup guide

⚔️ Metodología de Ataque

Primary Method: Impersonation

The attacker creates a page that looks like the real Ledger website to trick users into providing their sensitive information. The use of a look-alike domain and branding allows it to appear legitimate.

Secondary Method: Javascript Obfuscation

The malicious javascript code might be used to steal data (e.g. keylogging or data exfiltration)

🌐 Indicadores de Compromiso de Infraestructura

🦠 Malicious Files

Main File
3205eab5-9a11eb2ff901f603.js
File Size

Functions: submitForm, sendData

📊 Diagrama de Flujo de Ataque

User fills <input name=username> → submitForm() → fetch('https://live-ledge.zapier.app/start') → credentials sent

🔬 JavaScript Deep Analysis

Operator Language
English (1%)
Sophistication Level
Basic
Total Code Size
245,5 KB

🔗 API Endpoints Detected

Other
15

🔐 Obfuscation Detected

  • : None
  • : Light
  • : Light
  • : None
  • : Light
  • : None
  • : Light
  • : None
  • : Light
  • : Light

🤖 AI-Extracted Threat Intelligence

📊 Attack Flow

User fills <input name=username> → submitForm() → fetch('https://live-ledge.zapier.app/start') → credentials sent

🎯 Malicious Files Identified

Main Drainer
3205eab5-9a11eb2ff901f603.js
File Size
45KB
Malicious Functions
  • submitForm
  • sendData

Similar Websites

Pages with identical visual appearance (based on perceptual hash)

Screenshot
Ledger
https://help-start-ledger.zapier.app/home-sso
Jun 21, 2026
 Screenshot
Trezor
https://trezbridgen.zapier.app/homepage
May 19, 2026
 Screenshot
Ledger
https://live-ledge.zapier.app/start
Feb 21, 2026

Scan History for live-ledge.zapier.app

Found 2 other scans for this domain

😰
"Nunca pensé que me pasaría a mí"
Esto dicen las 2.3 millones de víctimas cada año. No esperes a ser una estadística.