SafeMode - Analysis: dexnew.top

Visual Capture

Detection Info

https://dexnew.top/

Detected Brand

Unknown

Country

Unknown

Confidence

100%

HTTP Status

200

Report ID

197e8daa-ef8…

Analyzed

2026-07-09 05:24

Content Hashes (HTML Similarity)

Used to detect similar phishing pages based on HTML content

Algorithm	Hash Value
CONTENT TLSH	T18425FAB4B754337C8AC2C3F0811499607A8FC27E7260D664B2BDE2E026DB5ECC5D69D9
CONTENT ssdeep	6144:aqLNOREIuRsB0EqZA7b++IJBbSPAGSU2WKvG1GBuIiUZTNqE5e:3GqZeVGe

Visual Hashes (Screenshot Similarity)

Used to detect visually similar phishing pages based on screenshots

Algorithm	Hash Value
VISUAL pHash	934d3c91e5969179
VISUAL aHash	02086c746c6e0c00
VISUAL dHash	d638c8ccd8d83803
VISUAL wHash	0e0c6e7e6e6e8ec0
VISUAL colorHash	38400030000
VISUAL cropResistant	8000000c4c0c0080,d638c8ccd8d83803

Code Analysis

Risk Score 100/100

Threat Level ALTO

⚠️ Phishing Confirmed

🎣 Credential Harvester 🎣 OTP Stealer 🎣 Banking 🎣 Personal Info

WebSocket C2

🔒 Obfuscation Detected

fromCharCode
unescape
document.write
base64_strings

🎯 Kit Endpoints

/login

📡 API Calls Detected

Bank Account was deleted
Payment field was deleted
Unlimit configuration synced.
Launchpad was deleted
Translation String was deleted
Withdraw was submitted
Withdrawal request submitted successfully
Language was deleted
Settings were updated
Network was updated
Payment method was deleted
Article was deleted
Deposit of
Withdrawal was moderated
Option was deleted
Currency was deleted
Testing job has started
Coins are synced.
Market was saved
User was updated
Page was deleted
Database Updated
\u0110\xE3 copy l\u1EC7nh:
User was deleted
Staking was deleted
Document was moderated
Ad has been moved to draft
Database updated
https://api.binance.com/api/v3/klines?symbol=
New deposit detected! Processing...
POST
Sync is still in progress
Market was deleted
Voucher was deleted
The task was processed
User Roles were updated
Thao t\xE1c
Copied to clipboard
Deposit was moderated
Language Translations file was synced
Sync process started
Cold Storage was deleted
Text was copied to the clipboard

📊 Risk Score Breakdown

Total Risk Score

100/100

Contributing Factors

Active Phishing Kit

Detected kit types: Credential Harvester, OTP Stealer, Banking, Personal Info

Real-time C2

WebSocket-based Command & Control infrastructure for real-time victim monitoring

Code Obfuscation

JavaScript code obfuscated using 26 technique(s) to evade detection

🔬 Comprehensive Threat Analysis

Threat Type

Banking Credential Harvester

Target

General public

Attack Method

real-time WebSocket exfiltration + obfuscated JavaScript

Exfiltration Channel

WebSocket (1 endpoints)

Risk Assessment

CRITICAL - Automated credential harvesting with WebSocket (1 endpoints)

⚠️ Indicators of Compromise

Kit types: Credential Harvester, OTP Stealer, Banking, Personal Info
26 obfuscation techniques

🏢 Brand Impersonation Analysis

Impersonated Brand

Generic Phishing

Official Website

N/A

Fake Service

Token swap/DEX platform

⚔️ Attack Methodology

Primary Method: Credential Harvesting

Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.

Secondary Method: JavaScript Obfuscation

Malicious code is obfuscated using 26 techniques to evade detection by security scanners and make reverse engineering more difficult.

Target Blockchain

Multiple blockchains

Whitelist Bypass

YES

Drainer supports multiple blockchain networks and checks for high-value tokens on each chain before executing drain operations.

🌐 Infrastructure Indicators of Compromise

Domain Information

Domain

dexnew.top

Registered

2026-06-22 09:05:04+00:00

Registrar

NameSilo, LLC

Status

Recently registered (16 days old)

Hosting Information

Provider