Phishing Analysis
Detailed analysis of captured phishing page
Captura Visual
Informações de Detecção
https://auth-secure.me/PnAdVDt9w961P1KJfQ
Detected Brand
Malta Airport
Country
International
Confidence
100%
HTTP Status
200
Report ID
1a609de7-4a1…
Analyzed
2026-02-27 11:27
Hashes de Conteúdo (Similaridade HTML)
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T17BD1007160509D3B5283C6D4B3B96B5F3394C346EA97565A63F4C78C0EF3E16CC1A226 |
|
CONTENT
ssdeep
|
96:nIpkCGTHRPyCdM+krwkMcs39TbJG9KjsWsjOv0U2gs0sjOaOVJQ6Q6ynQjNsjOb:9Pdfk8F9TbJG9ap6OVJQyyQjn |
Hashes Visuais (Similaridade de Captura)
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
9c497326cc99d9e4 |
|
VISUAL
aHash
|
18001818191f0f9f |
|
VISUAL
dHash
|
7161313331727d38 |
|
VISUAL
wHash
|
191818181f1f1fff |
|
VISUAL
colorHash
|
070000001c0 |
|
VISUAL
cropResistant
|
7161313331727d38 |
Análise de Código
Risk Score
70/100
Threat Level
ALTO
⚠️ Phishing Confirmed
🎣 Credential Harvester
🎣 OTP Stealer
🎣 Personal Info
🔬 Threat Analysis Report
• Ameaça: Phishing
• Alvo: Funcionários da Malta Airport
• Método: Coleta de credenciais
• Exfil: Desconhecido
• Indicadores: Incompatibilidade de domínio, formulário de login
• Risco: Alto
🎯 Kit Endpoints
- https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000001-0000-cff1-ce00-948463173626&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=1&msaredir=1&client-request-id=d98292e6-fa3f-ce32-9137-21bc5137cc6d&protectedtoken=true&domain_hint=maltairport.com&nonce=451294972200.ec82d3ed-b372-7cd6-3e42-fcfc13352e79&state=c2FsbWEubWJhamphQG1hbHRhaXJwb3J0LmNvbQ#
- https://passwordreset.microsoftonline.com/?ru=https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000001-0000-cff1-ce00-761534286862&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=1&msaredir=1&client-request-id=d98292e6-fa3f-ce32-9342-21bc5137cc6d&protectedtoken=true&domain_hint=maltairport.com&nonce=923736829528.ec82d3ed-b372-7cd6-3e42-fcfc13352e79&state=c2FsbWEubWJhamphQG1hbHRhaXJwb3J0LmNvbQ#
- https://login.microsoftonline.com/common/login#
- https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000001-0000-cff1-ce00-412809100797&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=1&msaredir=1&client-request-id=d98292e6-fa3f-ce32-1527-21bc5137cc6d&protectedtoken=true&domain_hint=maltairport.com&nonce=802288103944.ec82d3ed-b372-7cd6-3e42-fcfc13352e79&state=c2FsbWEubWJhamphQG1hbHRhaXJwb3J0LmNvbQ#
📊 Detalhamento da Pontuação de Risco
Total Risk Score
90/100
Contributing Factors
Domain Mismatch
The domain does not match the brand.
Login Form
The site is requesting login credentials.
Impersonation
The site impersonates a known brand.
🔬 Análise Integral de Ameaças
Tipo de Ameaça
Two-Factor Authentication Stealer
Alvo
Malta Airport users (International)
Método de Ataque
Brand impersonation
Canal de Exfiltração
Form submission (backend endpoint not detected - likely JavaScript-based)
Avaliação de Risco
HIGH - Automated credential harvesting with Form submission (backend endpoint not detected - likely JavaScript-based)
⚠️ Indicators of Compromise
- Kit types: Credential Harvester, OTP Stealer, Personal Info
🏢 Análise de Falsificação de Marca
Impersonated Brand
Malta Airport
Fake Service
Login
⚔️ Metodologia de Ataque
Primary Method: Credential Harvesting
The attacker sets up a fake login page to collect usernames and passwords.
🌐 Indicadores de Compromisso de Infraestrutura
Domain Information
Domain
auth-secure.me
Registered
2023-05-15
Registrar
None
Status
None
🤖 AI-Extracted Threat Intelligence
Similar Websites
Pages with identical visual appearance (based on perceptual hash)
Copart
https://auth-secure.me/8t0G40Uc4yzL
Abr 04, 2026
DP World
https://auth-secure.me/FcJF1VCMe7t3p6dU
Abr 04, 2026
Microsoft
https://authentication.ms/FQXXJbjMQUwdPlw
Abr 04, 2026
DP World
https://signin.broker/yEXpO8mh47e1zQ
Abr 01, 2026
Copart
https://sso-security.com/hmoR7AjmD5_J9_rblw
Mar 31, 2026
Scan History for auth-secure.me
Found 10 other scans for this domain
-
https://auth-secure.me/8t0G40Uc4yzL
https://auth-secure.me/FcJF1VCMe7t3p6dU
https://auth-secure.me/aHS0lPwJXIgH
https://auth-secure.me/FD6ykZKir2E
https://auth-secure.me/VUdcJNnhD7bqnLCWgw
https://auth-secure.me/qU3AmxUILiqopQ
https://auth-secure.me/QGzrBLQ5YfdCUg
https://auth-secure.me/ehtRFxyFoletQQ
https://auth-secure.me/THrkG16Tmw5DXxA
https://auth-secure.me/W9fGQN9d7MBo
"Nunca pensei que aconteceria comigo"
Isso dizem os 2,3 milhões de vítimas a cada ano. Não espere para ser uma estatística.