Phishing Analysis: Social Security Administration

Captura Visual

Informações de Detecção

https://ln.run/xtWgJ

Detected Brand

Social Security Administration

Country

Unknown

Confidence

100%

HTTP Status

200

Report ID

cddc65e5-1a5…

Analyzed

2026-03-31 16:54

Final URL (after redirects)

https://seciportall.com/dosxx.php

Hashes de Conteúdo (Similaridade HTML)

Used to detect similar phishing pages based on HTML content

Algorithm	Hash Value
CONTENT TLSH	T1A091413651286AB38596D6C5ABAD834F73C18198FB53130457F8C38CDBDEC8AE832691
CONTENT ssdeep	96:TZb9Dl8KeS6hd1eV/dNLG9oOSqSaASmLBqe:tb9J8KX8d8g9Mna5mLBd

Hashes Visuais (Similaridade de Captura)

Used to detect visually similar phishing pages based on screenshots

Algorithm	Hash Value
VISUAL pHash	f364663199ce898b
VISUAL aHash	c3c3fffffffff7ff
VISUAL dHash	8e8e080818386828
VISUAL wHash	c2c0e4e4fcfce4e0
VISUAL colorHash	070000001c0
VISUAL cropResistant	8e8e080818386828,4d33333351c87131

Análise de Código

Risk Score 85/100

Threat Level ALTO

⚠️ Phishing Confirmed

🎣 OTP Stealer

Telegram Exfiltration

📡 API Calls Detected

https://ipapi.co/json/

🔑 Telegram Bot Tokens (1)

6115663685:AAF3...CoaZ85hM

📊 Detalhamento da Pontuação de Risco

Total Risk Score

85/100

Contributing Factors

Active Phishing Kit

Detected kit types: OTP Stealer

Telegram Exfiltration

Real-time data exfiltration via Telegram (1 bot token(s) exposed in client-side code)

🔬 Análise Integral de Ameaças

Tipo de Ameaça

Two-Factor Authentication Stealer

Alvo

Social Security Administration users

Método de Ataque

Phishing webpage

Canal de Exfiltração

Telegram Bot (6115663685:AAF3Vme8y...)

Avaliação de Risco

CRITICAL - Automated credential harvesting with Telegram Bot (6115663685:AAF3Vme8y...)

⚠️ Indicators of Compromise

1 Telegram bot token(s)
Kit types: OTP Stealer

🏢 Análise de Falsificação de Marca

Impersonated Brand

Social Security Administration

Official Website

N/A

Fake Service

Credential harvesting service

⚔️ Metodologia de Ataque

Primary Method: Two-Factor Authentication Bypass

Victim is prompted for 2FA code after entering credentials. The code is intercepted and used by attacker to access victim's account in real-time.

Secondary Method: Standard Phishing Techniques

Uses typical phishing tactics including brand impersonation, urgency tactics, and social engineering to trick victims into providing sensitive information.