Phishing Analysis
Detailed analysis of captured phishing page
Captura Visual
Informações de Detecção
https://ekli2610.cfd/hizligirisiniz.php
Detected Brand
e-Devlet Kapısı
Country
Turkey
Confiança
95%
HTTP Status
200
Report ID
5cb720dc-f5a…
Analyzed
2026-01-30 05:00
Hashes de Conteúdo (Similaridade HTML)
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T19D12EB9018556C3E435253CEEA92D72592CBC372CB10790992F4AB6E3FE6F90CFD6219 |
|
CONTENT
ssdeep
|
96:0xejij9hryuNFr7vzc3DTFo+rb+AAI78n8gY2n8kAu2MSxt6kS0qDNbfITZR+Wdx:nizt83DTLbQ8i8XMYt6kS0GN0j+2 |
Hashes Visuais (Similaridade de Captura)
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
f6d9a96689592619 |
|
VISUAL
aHash
|
fcfcccfcf4e0c0d0 |
|
VISUAL
dHash
|
00101008680c1014 |
|
VISUAL
wHash
|
f8f8d8ecfce480c0 |
|
VISUAL
colorHash
|
07000000180 |
|
VISUAL
cropResistant
|
00101008680c1014 |
Análise de Código
Risk Score
50/100
Nível de Ameaça
ALTO
⚠️ Phishing Confirmed
🎣 Credential Harvester
🔬 Threat Analysis Report
• Ameaça: Phishing
• Alvo: Usuários do e-Devlet Kapısı
• Método: Imitação da página de login
• Exfil: log-isleniyor.php (provavelmente)
• Indicadores: Domínio novo, envio de formulário, personificação da marca
• Risco: Alto
🔐 Credential Harvesting Forms
🎯 Kit Endpoints
- log-isleniyor.php
📤 Form Action Targets
- log-isleniyor.php
📊 Detalhamento da Pontuação de Risco
Total Risk Score
90/100
Contributing Factors
Recent Domain
The domain is very recently registered, a strong indicator of phishing.
Domain Mismatch
The domain does not match the expected domain of the target brand.
Form Submission to Suspicious Location
The form submits to a PHP script, commonly used in phishing campaigns.
🔬 Análise Integral de Ameaças
Tipo de Ameaça
Credential Harvesting Kit
Alvo
e-Devlet Kapısı users (Turkey)
Método de Ataque
Brand impersonation + credential harvesting forms
Canal de Exfiltração
HTTP POST to backend
Avaliação de Risco
MEDIUM - Automated credential harvesting with HTTP POST to backend
⚠️ Indicators of Compromise
- Kit types: Credential Harvester
🏢 Análise de Falsificação de Marca
Impersonated Brand
e-Devlet Kapısı
Official Website
www.turkiye.gov.tr
Fake Service
e-Devlet Kapısı Login
⚔️ Metodologia de Ataque
Primary Method: Credential Harvesting
The attacker attempts to steal user credentials by mimicking the e-Devlet Kapısı login page and capturing the username and password.
🌐 Indicadores de Compromisso de Infraestrutura
Domain Information
Domínio
ekli2610.cfd
Registered
2024-05-09
Registrar
NameCheap
Estado
None
🔬 JavaScript Deep Analysis
Total Code Size
6,3 KB
🔐 Obfuscation Detected
- : None
- : None
- : None
🤖 AI-Extracted Threat Intelligence
Similar Websites
Pages with identical visual appearance (based on perceptual hash)
e-Devlet (türkiye.gov.tr)
https://e-devlet-portal-giris.haksizfil.cfd/login.php
Mai 21, 2026
e-Devlet
https://cloudauth-gateway.com/p/u/uVKvCQLfGB
Mai 06, 2026
e-Devlet
https://ekosgeb.com/login
Abr 20, 2026
e-Devlet Kapısı (Turkey's e-government portal)
https://hizli-basvurum.vip/hizligirisiniz.php
Mar 01, 2026
e-Devlet Kapısı (Turkey's e-government portal)
https://hizli-basvurum.vip/hizligirisiniz.php
Fev 28, 2026
"Nunca pensei que aconteceria comigo"
Isso dizem os 2,3 milhões de vítimas a cada ano. Não espere para ser uma estatística.