Phishing Analysis
Detailed analysis of captured phishing page
Visual Capture
Detection Info
https://www57365.cc
Detected Brand
bet365
Country
International
Confidence
95%
HTTP Status
200
Report ID
18a532fe-550…
Analyzed
2026-03-02 18:21
Final URL (after redirects)
https://www57365.cc/
Content Hashes (HTML Similarity)
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T1B041F1F2C285A53722518AC6FE70B739F5D3018EF8411652C6F116FD03C5EB9D442A5A |
|
CONTENT
ssdeep
|
48:epWxqnmsQ2HwvlFx6l607m7roj7ao77ro6:hsAvlj6s7cnd/c6 |
Visual Hashes (Screenshot Similarity)
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
cfb331c73131c698 |
|
VISUAL
aHash
|
ef3c3c003c7c3000 |
|
VISUAL
dHash
|
4969792af165600a |
|
VISUAL
wHash
|
ff3c3c307c7c3c00 |
|
VISUAL
colorHash
|
00000000e00 |
|
VISUAL
cropResistant
|
3232b232b6323232,9c7c424c7e480c1e,4969792af165600a |
Code Analysis
Risk Score
53/100
Threat Level
ALTO
⚠️ Phishing Confirmed
🎣 Credential Harvester
🔬 Threat Analysis Report
• Threat: Phishing
• Target: bet365 users
• Method: Domain spoofing and urging users to use a new domain
• Exfil: Unknown (likely redirects to a phishing site)
• Indicators: Suspicious domain, domain expiry warning
• Risk: HIGH
🔒 Obfuscation Detected
- document.write
📊 Risk Score Breakdown
Total Risk Score
90/100
Contributing Factors
Suspicious Domain
The domain is not the official bet365 domain.
Domain Expiry Claim
The site claims the current domain is expiring, a common phishing technique.
Obfuscation
Presence of document.write can indicate malicious intent
Impersonation
The site tries to impersonate a legitimate brand (bet365).
🔬 Comprehensive Threat Analysis
Threat Type
Credential Harvesting Kit
Target
bet365 users (International)
Attack Method
Brand impersonation + obfuscated JavaScript
Exfiltration Channel
Form submission (backend endpoint not detected - likely JavaScript-based)
Risk Assessment
MEDIUM - Automated credential harvesting with Form submission (backend endpoint not detected - likely JavaScript-based)
⚠️ Indicators of Compromise
- Kit types: Credential Harvester
- 1 obfuscation techniques
🏢 Brand Impersonation Analysis
Impersonated Brand
bet365
Fake Service
bet365 website
Fraudulent Claims
⚔️ Attack Methodology
Primary Method: Domain Spoofing
The attackers are using a domain that is visually similar to the target brand to trick users into believing it's the legitimate website.
Secondary Method: Redirecting and Harvesting Credentials
The site likely redirects users or asks them to log in, harvesting their credentials.
🌐 Infrastructure Indicators of Compromise
Domain Information
Domain
www.app57365.com
Registered
2019-04-04
Registrar
NameCheap
Status
active
🤖 AI-Extracted Threat Intelligence
Similar Websites
Pages with identical visual appearance (based on perceptual hash)
Scan History for www57365.cc
Found 4 other scans for this domain
"I Never Thought It Would Happen to Me"
That's what 2.3 million victims say every year. Don't wait to become a statistic.