SafeMode - Analysis: ahv3ctpms4e.premisp.net

Captura Visual

Informações de Detecção

https://ahv3ctpms4e.premisp.net/education_redirect_second?8c5781c2-7b1e-4035-b1d7-990e269e5380

Detected Brand

KPMG

Country

International

Confiança

95%

HTTP Status

200

Report ID

59cea021-2ad…

Analyzed

2026-03-17 04:22

Hashes de Conteúdo (Similaridade HTML)

Used to detect similar phishing pages based on HTML content

Algorithm	Hash Value
CONTENT TLSH	T1C66173B1808444EF22A6D1EBF220F60ED0539519DB8796007BB2D3DD91D8DC6CDE7762
CONTENT ssdeep	48:TIpcvtcvkQcXcQc1Fu7oIqiU3kyqtLBi43Q5diiFXpXaq7qH:TGaXQC70o7oIpU3kXFi43nidRaq7qH

Hashes Visuais (Similaridade de Captura)

Used to detect visually similar phishing pages based on screenshots

Algorithm	Hash Value
VISUAL pHash	b73c3625252d3636
VISUAL aHash	030707ffefefefef
VISUAL dHash	6e2d6d58cccc4c0c
VISUAL wHash	0307070767e7a7c7
VISUAL colorHash	06000000098
VISUAL cropResistant	6e2d6d58cccc4c0c,c025dad23968e412,1028c8c84c32d2b2,2c9993d14da4c8a9

Análise de Código

Risk Score 53/100

Nível de Ameaça ALTO

⚠️ Phishing Confirmed

🎣 Credential Harvester

🔬 Threat Analysis Report

• Ameaça: Phishing
• Alvo: Funcionários da KPMG
• Método: Imitação via e-mail e link de treinamento falso
• Exfil: Provável coleta de credenciais via formulário de phishing.
• Indicadores: Domínio incompatível, URL suspeito, e-mail de domínio desconhecido.
• Risco: Alto

🔒 Obfuscation Detected

fromCharCode

🎯 Kit Endpoints

https://login.phishme.com.au/spa-ckeditor

📡 API Calls Detected

GET

📊 Detalhamento da Pontuação de Risco

Total Risk Score

90/100

Contributing Factors

Domain Mismatch

The domain used in the email and URL do not match the expected official KPMG domains.

Impersonation

The email and page attempt to mimic the official KPMG branding, increasing the likelihood of successful impersonation.

Suspicious Content

The email requests a user to login using email. Forms detected. Obfuscation detected.

🔬 Análise Integral de Ameaças

Tipo de Ameaça

Credential Harvesting Kit

Alvo

KPMG users (International)

Método de Ataque

Brand impersonation + credential harvesting forms + obfuscated JavaScript

Canal de Exfiltração

Form submission (backend endpoint not detected - likely JavaScript-based)

Avaliação de Risco

MEDIUM - Automated credential harvesting with Form submission (backend endpoint not detected - likely JavaScript-based)

⚠️ Indicators of Compromise

Kit types: Credential Harvester
4 obfuscation techniques

🏢 Análise de Falsificação de Marca

Impersonated Brand

KPMG

Official Website

kpmg.com

Fake Service

Compliance Training

Fraudulent Claims

⚔️ Metodologia de Ataque

Primary Method: Credential Harvesting (Spear Phishing)

The attacker sends a seemingly legitimate email, likely pretending to be from KPMG, to trick employees into entering their credentials on a fake login page. The content is about mandatory training.