EN ES PT

Phishing Analysis

Detailed analysis of captured phishing page

Back to Stats
100 Risk Score

High Risk

Threat Level: ALTO • Impersonating: Bitget
  • • Threat: Credential harvesting phishing kit
  • • Target: Bitget users internationally
  • • Method: Fake login form stealing email and password
  • • Exfil: Data sent via WebSocket (wss://laoqws., wss://rtuiws.)
  • • Indicators: Domain mismatch, recent domain, obfuscated JavaScript
  • • Risk: HIGH - Immediate credential theft

⚠ Risk Factors

  • JavaScript obfuscation detected (5 patterns)
  • Credential harvesting indicators detected
  • OTP/2FA stealing indicators detected
  • WebSocket connection for real-time C2 communication

Visual Capture

Screenshot of bitgets.vip

Detection Info

https://bitgets.vip
Detected Brand
Bitget
Country
International
Confidence
100%
HTTP Status
200
Report ID
4f74b51a-1f9…
Analyzed
2026-01-11 08:36
Final URL (after redirects)
https://bitgets.vip/#/pages/login/login

Content Hashes (HTML Similarity)

Used to detect similar phishing pages based on HTML content

Algorithm Hash Value
CONTENT TLSH
T179E12F343112348A5A3B4B81F8B25B1C2523C377C7551A6A77AC0665AFCECF98D727E8
CONTENT ssdeep
192:HcjdvXLhbbcgSU+7dNED6Zwote5CvENfYNqyTzhBeC3L:qv7lX+Jecw+mCtTzhBeC3L

Visual Hashes (Screenshot Similarity)

Used to detect visually similar phishing pages based on screenshots

Algorithm Hash Value
VISUAL pHash
ffff7f230080882a
VISUAL aHash
0080ffff00000000
VISUAL dHash
010001b200000000
VISUAL wHash
ffffffff00000000
VISUAL colorHash
380000001c0
VISUAL cropResistant
010001b200000000

Code Analysis

Risk Score 100/100
Threat Level ALTO
⚠️ Phishing Confirmed
🎣 Credential Harvester 🎣 OTP Stealer 🎣 Card Stealer 🎣 Banking 🎣 Personal Info
WebSocket C2

🔬 Threat Analysis Report

• Threat: Credential harvesting phishing kit
• Target: Bitget users internationally
• Method: Fake login form stealing email and password
• Exfil: Data sent via WebSocket (wss://laoqws., wss://rtuiws.)
• Indicators: Domain mismatch, recent domain, obfuscated JavaScript
• Risk: HIGH - Immediate credential theft

🔒 Obfuscation Detected

  • atob
  • fromCharCode
  • unescape
  • unicode_escape
  • base64_strings