Phishing Analysis
Detailed analysis of captured phishing page
Captura Visual
Informações de Detecção
https://17684459060903bbad2e0795d2.temporary.link/wordpress/wp-admin/tv/persoling.htm
Detected Brand
BankID
Country
Norway
Confiança
100%
HTTP Status
200
Report ID
aaeb84ff-4c7…
Analyzed
2026-01-30 23:45
Hashes de Conteúdo (Similaridade HTML)
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T17C02A871C4089D77A002D7A8EAF9BB662363975CCA871748D6F4D3983FCBCA4DC51588 |
|
CONTENT
ssdeep
|
192:WNjLJ0rKbLDBsfcN0PHDX9n+Po66pbcJQtQeShdKsb92:oNygsfrf1+PgpoJeQemdKsx2 |
Hashes Visuais (Similaridade de Captura)
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
9999666666333333 |
|
VISUAL
aHash
|
1818181818000000 |
|
VISUAL
dHash
|
b2b2b2b2b24c3000 |
|
VISUAL
wHash
|
3f3f3f3f1c0c0000 |
|
VISUAL
colorHash
|
07001000031 |
|
VISUAL
cropResistant
|
8c4d0fe896964db2,b2b2b2b2b24c3000 |
Análise de Código
Risk Score
100/100
Nível de Ameaça
ALTO
⚠️ Phishing Confirmed
🎣 Credential Harvester
🎣 OTP Stealer
🎣 Card Stealer
🎣 Banking
🎣 Personal Info
🔬 Threat Analysis Report
• Ameaça: Phishing
• Alvo: Usuários do BankID
• Método: Coleta de credenciais
• Exfil: ./snd/step-three.php
• Indicadores: Incompatibilidade de domínio, formulário solicitando senha
• Risco: Alto
🔐 Credential Harvesting Forms
🔒 Obfuscation Detected
- fromCharCode
🎯 Kit Endpoints
- https://app.bankid.no/authorization?response_type=code&client_id=bankid-oidc-prod&redirect_uri=https%3A%2F%2Flogin.bankid.no%2Fapi%2Fbis%2Fcallback&scope=openid+profile+sub_nnin+sub_bankid&state=a6d2b1c8-cd39-4d26-a408-aee60f638217.76ccbda2-80ff-4331-bed7-b07a49224c33&nonce=553abb26-390d-40cc-bfb3-0dadcc089372&request=eyJraWQiOiI1TGdMVkZSUUNOV3Fielg3QWZGeTVxenpyalZlendjdlExV0ZxbzlGcmN3IiwidHlwIjoiSldUIiwiZW5jIjoiQTEyOENCQy1IUzI1NiIsImFsZyI6IlJTQS1PQUVQIn0.mTh--VQ3_X9JLs5ffpKIziapnbb4k9gy-z56_Pw1vJwzgsGaLU8bwABNcG4HPsWGK-GKONPVnCagNTaVXRtxD0BaIzKV3A9NXxKtlLtsXs_2fxJe5mZ2ZR-5QsvNs5f7bSHLjpBeV3CFDm4OSp8rSebSfUC9oN7OLDwq-jxHoNKiwekBVe3wuGG5QyVDf296lBO_0m_6wnb4hJZJQOC4mB7sCPppwapx0gYrsYhO7SKYQfvdGByoIf_jsj5Qto2XarAfSwCMkmaKtM-SyMoZyZxO6rciwEUUSsZBL-xHRSvwoA8JyZylxuNNL_v6k3SvNgOYLzoRCM-G5xLc541n3w.NlYDXf7ukR5VQwWHe5aDOg.p-cexVmSQ-2YtAtyYXTp9YbSHTmX4Rbbu_OII5O_3eeIcIrSpeKAok7-qB5MPR5ZTSK-_fzFqg5NznrCP1EI3W9fYfz-gs6PLyRyOovKGtxXYQripP45EFPXx4nUWezJ6EoqKuhWyhHG-y22_fNw4NPVltrzxT6ENv-C2drZidcecVkSpL9Tn-98Z1QMB-U419E-5v4phmP8KO13aN3AQwpTv_RhOjquNOp3eyuVpjPcHMMef7CJ-Y6A_5doiWSZM93miGIS4xxXQHJ1VqfLU79EnZtiifoLg4Dclp7Sh0eg6XKRV9zmJ5O7UAPTITkJ2hdFf7ZbjZRQmJlj4zjS9wTl92cG1mLqxvfOAmA7qK6JktH-Vl5Ds5wQsPBVGGgLjWMNJHLjQOApf-ZA0vTbZtLPtCYOAibLdgJRG3dLWeScDvoeSe68FQE4UqZ64QmWI6QqwyIhj0G8IYzzrnFiS274nc6HrkHeEy8rhbsFSPhUP7TG0UhnEDZePw3IgSXkVhIv579R8wDTfFo9n97usGVmCJJyw4UcB6KDt0XlFpcj7dVvmgj3QeQhsNh8EjnmuV1v1oSerDdEJkehCy4EDgYZHZGjdkzo4iSGzHzuDZ8ZLVWRm5fU3GjgvWN8BRuzMrxaLWR2Fh0kQBKrkGuXQ5yCKbnc-UMTzrRVJ2QvA9SxnAxMhwerMfIUHNCaSGVljZ_L3C6GHw2fJcHWZWBXKVSLKdmFLN-NWgL51vlqzwkBpXNFbzzqjBewS86pelmsmEUKuxh9I4iA-AIwhtvnpdqpm5kS4owtb-hs_itxvVgGkB2ETDEJeJOI9TyTuYVVHACdfNUg4gvkM3j2aF0URwVOFGCJ06dt3GPDXculjHeFTCQ1mgMAthXFgZbdcyBYDvPJcVPJmuu2lvvpWgjHHFZjdOj4-nbj1_yr7rNsLJMsgmqs7k9xDkFC7nDhoZwd4N9iT0D-T_S3MFZjlGH64K3ErcOOZkUi3WHXMSEIDUfE1ZqOLh-I1G149m6jpRZSmkuy7MUC6e9dUpwx8cRM_dSgohQVyYkB-3awdpin8UsJwlgIl1uLoi8hWpfCh7R0xis0bBVHD-FWsgl-3f-C5ojtT10guVkBeQCLlqMlbfU7YqIZ5sGdlZE3M0vPSfdwwbYXpZ9QXRuLhbP_ezFXoyGkhlDx2cr35mSnwc0uPrK_vNnhkaJ3o7ptypzn6zI5NBpnx74DlLgTPXhUohutJEiXCHuHn9E7Cduv8Ubkh3uhdWFErKNB2hhZZsx9GYt4v3k0kzXl7uheLYHLKQPBXSWN3Tfwq8bfJU8xSU0Xd0TwBv4B5mSukNFBT8_qxfuo7cwYOGe8EtfIFOBU5Pp5TXTBZrNvvGwX3eG5B4P1Qh8MXJjBtN6XxGh2nTL5hnkANzPp8mmClAH9ZjZscPsprlBm9x9gmGK5jMiVAysKpZdbhIS2AqfmikHw6mDpPSUfNdIixEwwQMzpcR1QEcnw1eiPCc-zM6FjMNAWtK-Jq6QOdsi7jfWUsQxj9KvWyvvLSenIHY0NWejagHRdBGSEhMAsSRGWOpYdgpwdC8d3A8Um8kja7RdrahJaNRzHP3QB9LrvYSwlQHkivWoJlSPBeSPCwo443Q0ONf72-Kccv6ZJCBHz_kNds0cHydcgJLxWYi9a5eh0RCSnbCoQSUlLmK1mvBI7P2GJvVdegRtnWqm1cxoXoB1guvJraZ1ZuqPFmyBAWzj1wjjg28Ov0oOTXGyZhzvaT1sL8XTHdr2inC-E5rcd-pN_JlbaaTf91U0To1Oz6JrcLS2WTBKmN9lsQO02GBX9fC2XIC5zYPuJ9cu2CijIrZrixbORCYVaK8VbK8xY3j--BOU61nsWwQl8deqzt0pax8BJuySPi7gn5QuFIZm1yjmwOlUHQ4paHqfpRzCJj2oMr8A2Ti_ZQTvMTlqYy7Er3iVrT1gGJAlDLy8UmODWQgdZIm97rDXAkf_SGNlKS3jRkiJ7DhQv_0kE68tK1uMkVMI4T8-bcHNXUeUIHuD6t47xwvreGP7mBDRih4OIyk4JmQsruNzgSBP60cgFdeizeIlejrO1E-9Xcfm7soUXm37xki-0BfSdvSpZi4t6OLHUcK08MFcC11SIDv4qsOAzZzW-LFevTtRfseHCYPCbNL5yiQEjgsTFE_tj-qdFSzCsP5kcDJuqnCn0Uw.DF7Vg_ch19y_o5D_PFDXvw
📡 API Calls Detected
- POST
📤 Form Action Targets
- ./snd/step-three.php
📊 Detalhamento da Pontuação de Risco
Total Risk Score
90/100
Contributing Factors
Domain Mismatch
The domain is completely unrelated to BankID.
Credential Harvesting
The page directly requests the user's password.
Obfuscation
The presence of code obfuscation suggests malicious intent.
🔬 Análise Integral de Ameaças
Tipo de Ameaça
Banking Credential Harvester
Alvo
BankID users (Norway)
Método de Ataque
Brand impersonation + credential harvesting forms + obfuscated JavaScript
Canal de Exfiltração
HTTP POST to backend
Avaliação de Risco
CRITICAL - Automated credential harvesting with HTTP POST to backend
⚠️ Indicators of Compromise
- Kit types: Credential Harvester, OTP Stealer, Card Stealer, Banking, Personal Info
- 4 obfuscation techniques
🏢 Análise de Falsificação de Marca
Impersonated Brand
BankID
Official Website
https://www.bankid.no/
Fake Service
BankID login
⚔️ Metodologia de Ataque
Primary Method: Credential Harvesting
The attack involves a fake BankID login page designed to steal the user's password.
🌐 Indicadores de Compromisso de Infraestrutura
Domain Information
Domínio
17684459060903bbad2e0795d2.temporary.link
Registered
Unknown
Registrar
Unknown
Estado
active
🔬 JavaScript Deep Analysis
Operator Language
English (1%)
Total Code Size
19,5 KB
🔐 Obfuscation Detected
- : Light
🤖 AI-Extracted Threat Intelligence
Similar Websites
Pages with identical visual appearance (based on perceptual hash)
"Nunca pensei que aconteceria comigo"
Isso dizem os 2,3 milhões de vítimas a cada ano. Não espere para ser uma estatística.