Phishing Analysis: Instagram

Captura Visual

Screenshot of instagram-clone-mu.vercel.app

Información de Detección

https://instagram-clone-mu.vercel.app/

Detected Brand

Instagram

Country

International

Confidence

95%

HTTP Status

200

Report ID

ea8e3b63-626…

Analyzed

2026-03-01 03:46

Hashes de Contenido (Similitud HTML)

Used to detect similar phishing pages based on HTML content

Algorithm	Hash Value
CONTENT TLSH	T15B52F679C2E690371127C8C3A9352BBD70F293BDD8321816B2FC93990BD9D85BD42E59
CONTENT ssdeep	384:xJWMAO0LdHg0LRVA0LHdI0LTCE0LRAo0L0xb0L/B10Lu/w0LHx10l3VA:xJ1AOMHg2VAKdI8CE8AotxboB11/wexX

Hashes Visuales (Similitud de Captura)

Used to detect visually similar phishing pages based on screenshots

Algorithm	Hash Value
VISUAL pHash	b3cccc8c33cc3966
VISUAL aHash	cfffe7c7c7e7ffc7
VISUAL dHash	b28b8b9d8d1d108d
VISUAL wHash	0b414147c7c7df47
VISUAL colorHash	07c00208000
VISUAL cropResistant	b28b8b9d8d1d108d,385f8923571a4763,a0a0a000501008c0

Análisis de Código

Risk Score 53/100

Threat Level ALTO

⚠️ Phishing Confirmed

🎣 Credential Harvester

🔬 Threat Analysis Report

• Amenaza: Phishing
• Objetivo: Usuarios de Instagram
• Método: Suplantación de identidad a través de un sitio web falso
• Exfil: Desconocido, probablemente credenciales o toma de control de cuenta
• Indicadores: Alojamiento gratuito, logotipo de la marca, interfaz falsa.
• Riesgo: ALTO

🔒 Obfuscation Detected

fromCharCode

🎯 Kit Endpoints

data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAADIAAAAyCAYAAAAeP4ixAAAACXBIWXMAAAsTAAALEwEAmpwYAAAChUlEQVR4nO2Zu24TQRSGPxeElgYbEVKYPAIFEC6vgAQO8gUJER4AiYuIkBLogBdAooIUSBGiIDFKHQINl7wBDS2kCiIhsYPRkf6VpjCIxTNj77KfNNLK3v3/Pes9Z86MoaBgJDkEzAALwDqwAexqfAU+6rsrQIUR5CzQBjpA7y+HnbsMnGEEmARWnJvrAq+B68BxoAzs07DjE8ANYE3nJte9Ao4OK4gW8E038h24DxxMcb0F9gDYksYm0CAy887TXATGB9A6Ajx39OaIxD0Z/tRxyZPuNWAvVjAtGZlhLYD+tBNMnYCJneTE7VAmwKyTM9UQBitOToSk5ORMO8Q80VOFmSA846qEPeC0T+G2RK3ExsJKs3ku+Ww7OprA0swTg2LzTFftjR0PzFU9mVXi80bel32ILUjM2o7Y3JT3Ex9i6xKz3ik2U/J+70NsQ2Ix8yOhIu8vPsR2JDZGfPbL+0deAtnMy6v1yWey26IoNqfkbWU4F+X3sQ+xGYnZ8jQ2b+V93td7mrQoXlqFlC1KBzjgS3RZT8YauVg8lKe19N44KdHtIbTxx3yLt50n5Gud3g/TfiGvlyEMqpqYelqOhuKOPGxn8nAok4az+WAbBb656Gw+nCMwc04ws55es5J+iSSIPe3YECuYJGdsk+1fmXBywh1WeptEoO7kzJZKc5p5pqwSu+00ht0+wTSIQNWpZonxmlqLKU2mYxoVfXZLvZN704tK7OYwg0FbNksp/1aw5cGzPs3o74KpE5GyNgqeAh9UQnc0uX0G3gGPdFN/WhY0RiEYX1h57/QJ5hI5CqZFBpnOUzC1/yGYJhkNZrcIJiMFYJ6McsH5Ze6ScWox/84uKAB+ATiuEwljmLOIAAAAAElFTkSuQmCC

📡 API Calls Detected

./data/profile.json
./data/suggestionUsers.json
./data/posts.json
/data/stories.json

📊 Desglose de Puntuación de Riesgo

Total Risk Score

95/100

Contributing Factors

Free hosting detected

The site is hosted on a free hosting platform, a common tactic for phishing.

Impersonation of Instagram

The website attempts to mimic the appearance and functionality of Instagram.

Obfuscation

Obfuscation detected.

🔬 Análisis Integral de Amenazas

Tipo de Amenaza

Credential Harvesting Kit

Objetivo

Instagram users (International)

Método de Ataque

Brand impersonation + credential harvesting forms + obfuscated JavaScript

Canal de Exfiltración

Form submission (backend endpoint not detected - likely JavaScript-based)

Evaluación de Riesgo

MEDIUM - Automated credential harvesting with Form submission (backend endpoint not detected - likely JavaScript-based)

⚠️ Indicators of Compromise

Kit types: Credential Harvester
4 obfuscation techniques

🏢 Análisis de Suplantación de Marca

Impersonated Brand

Instagram

Official Website

https://www.instagram.com

Fake Service

Instagram User Interface

⚔️ Metodología de Ataque

Primary Method: Credential Harvesting

The attacker likely aims to steal user credentials (username and password) by creating a fake login page that closely resembles the legitimate Instagram interface. This page will capture any entered information and send it to the attacker.