SafeMode - Analysis: webprotalapp.ghost.io

Captura Visual

No screenshot available

Información de Detección

https://webprotalapp.ghost.io/ledgerrlive-learn/

Detected Brand

Unknown

Country

Unknown

Confianza

100%

HTTP Status

200

Report ID

c52d42fe-1bc…

Analyzed

2026-01-26 02:19

Hashes de Contenido (Similitud HTML)

Used to detect similar phishing pages based on HTML content

Algorithm	Hash Value
CONTENT TLSH	T19C92B6379340A73D4A2603DDAE6B379EB3B2404DF69A05D4E1FFC23E5581CA0993AC95
CONTENT ssdeep	384:0BnE93lKOA/rkfAV4t9uRWndtzhSD9jAmfCG:0BEhokVeytCA8t

Hashes Visuales (Similitud de Captura)

Used to detect visually similar phishing pages based on screenshots

Algorithm	Hash Value
VISUAL pHash	b04acacacaceca9b
VISUAL aHash	fdc7c7c3c7c3c7c7
VISUAL dHash	491c1d0e1e161e1c
VISUAL wHash	a5c3c3c3c3c3c3c3
VISUAL colorHash	07000000007
VISUAL cropResistant	491c1d0e1e161e1c

Análisis de Código

Risk Score 76/100

🎣 Credential Harvester 🎣 OTP Stealer 🎣 Card Stealer 🎣 Banking 🎣 Personal Info

🔒 Obfuscation Detected

fromCharCode
base64_strings

📡 API Calls Detected

POST
https://ghost.org

📊 Desglose de Puntuación de Riesgo

Total Risk Score

100/100

Contributing Factors

Active Phishing Kit

Detected Credential Harvester, OTP Stealer, Card Stealer, and Banking kits with real-time form interception capabilities.

Obfuscation Techniques

20 obfuscation techniques detected, indicating deliberate evasion of detection and analysis.

Malicious JavaScript Files

Presence of multiple minified JavaScript files (cards.min.js, member-attribution.min.js, ghost-stats.min.js) with potential malicious functionality.

High-Risk Targeting

Targeting multiple high-risk data types (credentials, OTPs, card details, Banking info, personal info).

🔬 Análisis Integral de Amenazas

Tipo de Amenaza

Banking Credential Harvester

Objetivo

General public

Método de Ataque

credential harvesting forms + obfuscated JavaScript

Canal de Exfiltración

Unknown

Evaluación de Riesgo

HIGH - Automated credential harvesting with Unknown

⚠️ Indicators of Compromise

Kit types: Credential Harvester, OTP Stealer, Card Stealer, Banking, Personal Info
20 obfuscation techniques

🏢 Análisis de Suplantación de Marca

Fake Service

Unknown (no specific brand impersonation detected)

⚔️ Metodología de Ataque

Primary Method: Credential Harvesting

The phishing kit employs a credential harvester to capture user input from form fields in real-time. Data is likely exfiltrated via HTTP POST requests to a command-and-control server upon submission.

Secondary Method: OTP and Card Data Interception

The kit includes modules for intercepting one-time passwords (OTPs) and credit card details, possibly through fake authentication prompts or overlay forms that mimic legitimate services.