Phishing Analysis

🔬 Threat Analysis Report

• Threat: Credential harvesting phishing attack
• Target: Bet365 users
• Method: Fake login page to steal username and password
• Exfil: Unknown, potentially to a remote server
• Indicators: Domain name mismatch, login form, unrelated domain b45077.com
• Risk: HIGH - potential credential theft and account compromise

🔐 Credential Harvesting Forms

🔒 Obfuscation Detected

• eval
• fromCharCode
• unescape
• document.write
• hex_escape
• unicode_escape
• base64_strings

🎯 Kit Endpoints

• /login_action
• //5getfab.segrft.com/js/www/login.js?ver=1606790076
• //5getfab.segrft.com/plus/js/custom/login_custom.js?ver=1606790105
• //5getfab.segrft.com/plus/css/custom/login_modal_custom.css?ver=1726649910?v=1767334430
• //5getfab.segrft.com/plus/css/custom/login_custom.css?ver=1663905027
• //5getfab.segrft.com/plus/css/unite/login_unite.css?ver=1614680240
• //5getfab.segrft.com/plus/css/unite/login_modal_unite.css?ver=1738950076?v=1767334430
• #normalLogin

📡 API Calls Detected

• https://web.fastcnregions.com/#/popup/?u=&action=help&page=faq&subsub=generalrulesforsports&sub=sport&lang=zhh
• https://rrl.net2cast.com/cs/RnR.html?darkmode=&new-window=
• http://rules.568win.com/rules/sports/cn/Rules.pdf
• https://o1sg5qe2.suu91971.com/chatwindow.aspx?siteId=60001040&planId=a661d344-4f9a-4456-8cec-779bda797109
• /prizedraw/default
• /mbuhx0as4kui
• /forgot
• /loadGame/
• https://www.bet365asiasports.com/#!/rules

📤 Form Action Targets

• /login_action