Phishing Analysis: Social Security Administration

Captura Visual

Información de Detección

https://ln.run/xtWgJ

Detected Brand

Social Security Administration

Country

Unknown

Confidence

100%

HTTP Status

200

Report ID

cddc65e5-1a5…

Analyzed

2026-03-31 16:54

Final URL (after redirects)

https://seciportall.com/dosxx.php

Hashes de Contenido (Similitud HTML)

Used to detect similar phishing pages based on HTML content

Algorithm	Hash Value
CONTENT TLSH	T1A091413651286AB38596D6C5ABAD834F73C18198FB53130457F8C38CDBDEC8AE832691
CONTENT ssdeep	96:TZb9Dl8KeS6hd1eV/dNLG9oOSqSaASmLBqe:tb9J8KX8d8g9Mna5mLBd

Hashes Visuales (Similitud de Captura)

Used to detect visually similar phishing pages based on screenshots

Algorithm	Hash Value
VISUAL pHash	f364663199ce898b
VISUAL aHash	c3c3fffffffff7ff
VISUAL dHash	8e8e080818386828
VISUAL wHash	c2c0e4e4fcfce4e0
VISUAL colorHash	070000001c0
VISUAL cropResistant	8e8e080818386828,4d33333351c87131

Análisis de Código

Risk Score 85/100

Threat Level ALTO

⚠️ Phishing Confirmed

🎣 OTP Stealer

Telegram Exfiltration

📡 API Calls Detected

https://ipapi.co/json/

🔑 Telegram Bot Tokens (1)

6115663685:AAF3...CoaZ85hM

📊 Desglose de Puntuación de Riesgo

Total Risk Score

85/100

Contributing Factors

Active Phishing Kit

Detected kit types: OTP Stealer

Telegram Exfiltration

Real-time data exfiltration via Telegram (1 bot token(s) exposed in client-side code)

🔬 Análisis Integral de Amenazas

Tipo de Amenaza

Two-Factor Authentication Stealer

Objetivo

Social Security Administration users

Método de Ataque

Phishing webpage

Canal de Exfiltración

Telegram Bot (6115663685:AAF3Vme8y...)

Evaluación de Riesgo

CRITICAL - Automated credential harvesting with Telegram Bot (6115663685:AAF3Vme8y...)

⚠️ Indicators of Compromise

1 Telegram bot token(s)
Kit types: OTP Stealer

🏢 Análisis de Suplantación de Marca

Impersonated Brand

Social Security Administration

Official Website

N/A

Fake Service

Credential harvesting service

⚔️ Metodología de Ataque

Primary Method: Two-Factor Authentication Bypass

Victim is prompted for 2FA code after entering credentials. The code is intercepted and used by attacker to access victim's account in real-time.

Secondary Method: Standard Phishing Techniques

Uses typical phishing tactics including brand impersonation, urgency tactics, and social engineering to trick victims into providing sensitive information.