EN ES PT

Phishing Analysis

Detailed analysis of captured phishing page

Back to Stats

Captura Visual

No screenshot available

Informações de Detecção

https://nscapp.com.ng/data/load/gggg/arubaaufix/web/authen.php?web/auth/arub12#/dashboard/overviewAccounts/overview/index=B0zNNWzSOi425hzaNpLCGVQ9shfCjmwQf8nmibcE9lv8Y6jhMk2r7TyVPlW92jtHKOzGFWVVvqMnne5Q
Detected Brand
Aruba.it
Country
International
Confiança
95%
HTTP Status
200
Report ID
c13e82ff-3a4…
Analyzed
2026-02-27 20:45

Hashes de Conteúdo (Similaridade HTML)

Used to detect similar phishing pages based on HTML content

Algorithm Hash Value
CONTENT TLSH
T149B1633021218FB71697D7E07A10FF9971CAA382DB138E04D2F89A6A1FC7D85CC916B1
CONTENT ssdeep
96:TqYMKIj3VME5kFgwwd/6kmxj6F0OzqfRTu2gX+8sPwK3vi:uYMKIrOExm3a

Hashes Visuais (Similaridade de Captura)

Used to detect visually similar phishing pages based on screenshots

Algorithm Hash Value
VISUAL pHash
b838c6cf3832c739
VISUAL aHash
ffcf8787c3ffffff
VISUAL dHash
051e1a1b1b001a0c
VISUAL wHash
f1818181013f3f27
VISUAL colorHash
07000030040
VISUAL cropResistant
051e1a1b1b001a0c,18a4a1b9c989899b

Análise de Código

Risk Score 53/100
Nível de Ameaça BAJO
🎣 Credential Harvester

🔬 Threat Analysis Report

• Ameaça: Nenhuma, página de login provavelmente legítima.
• Alvo: Usuários do webmail Aruba.it
• Método: O usuário insere credenciais para acessar o webmail.
• Exfil: Credenciais inseridas na página de login.
• Indicadores: Logotipo da marca correspondente, branding consistente, SSL presente.
• Risco: Baixo

🔐 Credential Harvesting Forms

🔒 Obfuscation Detected

  • fromCharCode

📤 Form Action Targets

  • ../next.php

📊 Detalhamento da Pontuação de Risco

Total Risk Score
10/100

🔬 Análise Integral de Ameaças

Tipo de Ameaça
Credential Harvesting Kit
Alvo
Aruba.it users (International)
Método de Ataque
Brand impersonation + credential harvesting forms + obfuscated JavaScript
Canal de Exfiltração
HTTP POST to backend
Avaliação de Risco
MEDIUM - Automated credential harvesting with HTTP POST to backend

⚠️ Indicators of Compromise

  • Kit types: Credential Harvester
  • 2 obfuscation techniques

🏢 Análise de Falsificação de Marca

Impersonated Brand
Aruba.it
Fake Service
Webmail

⚔️ Metodologia de Ataque

Primary Method: Credential Harvesting.

The attacker would be trying to collect username and password from the login fields on the form.

🌐 Indicadores de Compromisso de Infraestrutura

🤖 AI-Extracted Threat Intelligence

Similar Websites

Pages with identical visual appearance (based on perceptual hash)

Screenshot
Desconhecido
https://cdn.gosafemode.com/screenshots/2fe4088c4ddb.png
Jul 03, 2026
 Screenshot
Aruba.it
https://nscapp.com.ng/data/load/gggg/arubaaufix/web/authen.p...
Mar 01, 2026
 Screenshot
Aruba.it
https://nscapp.com.ng/data/load/gggg/arubaaufix/web/authen.p...
Mar 01, 2026
 Screenshot
Aruba.it
https://nscapp.com.ng/data/load/gggg/arubaaufix/web/authen.p...
Fev 28, 2026
 Screenshot
Aruba.it
https://nscapp.com.ng/data/load/gggg/arubaaufix/web/authen.p...
Fev 27, 2026

Scan History for nscapp.com.ng

Found 10 other scans for this domain

😰
"Nunca pensei que aconteceria comigo"
Isso dizem os 2,3 milhões de vítimas a cada ano. Não espere para ser uma estatística.