NETGRAPH
SENTINEL
Scan
PJ
ACTIVE CASE
NGS–8847 / PHISHING
LIVE
X 483.02 Y 219.77
GRAPHSPACE / GNN LAYER 08
•••
SUSPICIOUS DOMAIN
secure-billing-auth.com
Root document · TLS active
GNN 0.92
•••
HIDDEN IFRAME
payment-frame
1 × 1 px · opacity: 0
+31.2%
•••
EXTERNAL PAYLOAD SCRIPT
185.220.101.4/collect.js
Russian IP · unsigned
RISK 99.4
•••
DEVICE FINGERPRINT
fp-runtime.min.js
Canvas + WebGL entropy
18 calls
•••
REDIRECT HOP
auth-gateway.cc
302 · ASN 49505
HOP 03
•••
CREDENTIAL FORM
#account-access
POST target rewritten
7 fields
01
ROOT DOCUMENT
03
PAYLOAD CLUSTER
OVERVIEW
100%
Graph exported