Phishing Analysis
Detailed analysis of captured phishing page
Visual Capture
Detection Info
https://totalbestpromo.com/1xbt/?refCode=sk_w238255c300299l23986p2169_d1xbet220&sub_id=d1xbet220
Detected Brand
1xBet
Country
International
Confidence
100%
HTTP Status
200
Report ID
1b6aaa66-a9c…
Analyzed
2026-01-30 11:46
Content Hashes (HTML Similarity)
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T1717184709040DD3B5583C5E8F3FAEB5F37DAC1A4CA46050262F983EE5BE9D42EE51618 |
|
CONTENT
ssdeep
|
96:nusuXwCZwSZ7ocEATNL6UM6BGIDRdZYR+:qXwCZXk6zDDrZYs |
Visual Hashes (Screenshot Similarity)
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
94d67a700fc6e06d |
|
VISUAL
aHash
|
246e7e3e3e4e0400 |
|
VISUAL
dHash
|
eccce4ecf29ccc32 |
|
VISUAL
wHash
|
647e7e7e3e4e2400 |
|
VISUAL
colorHash
|
190020000c0 |
|
VISUAL
cropResistant
|
f0f8f2f09e9c94e8,39e0e0f0e2c0f8f8,6e6c7c53b6fce8e8,f9f9e1e1e0a68ecc,a280a2d2d2a28082,a280a06060a480a2,eccce4ecf29ccc32 |
Code Analysis
Risk Score
68/100
Threat Level
ALTO
⚠️ Phishing Confirmed
🎣 Credential Harvester
🎣 Personal Info
🔬 Threat Analysis Report
• Threat: Phishing
• Target: 1xBet users
• Method: Impersonation
• Exfil: /register/landing_signup.php
• Indicators: Suspicious domain, Form to steal credentials, Javascript Obfuscation
• Risk: HIGH
🔐 Credential Harvesting Forms
🔒 Obfuscation Detected
- fromCharCode
📡 API Calls Detected
- GET
📤 Form Action Targets
- /register/landing_signup.php
📊 Risk Score Breakdown
Total Risk Score
90/100
Contributing Factors
Suspicious Domain
The domain name does not match the brand's official domain.
Form for Credentials
The form requests a password, indicating a login attempt.
JavaScript Obfuscation
Obfuscation is used, often to hide malicious code.
Impersonation
Visual similarity to 1xBet
🔬 Comprehensive Threat Analysis
Threat Type
Credential Harvesting Kit
Target
1xBet users (International)
Attack Method
Brand impersonation + credential harvesting forms + obfuscated JavaScript
Exfiltration Channel
HTTP POST to backend
Risk Assessment
HIGH - Automated credential harvesting with HTTP POST to backend
⚠️ Indicators of Compromise
- Kit types: Credential Harvester, Personal Info
- 4 obfuscation techniques
🏢 Brand Impersonation Analysis
Impersonated Brand
1xBet
Official Website
https://1xbet.com
Fake Service
Login
⚔️ Attack Methodology
Primary Method: Credential Harvesting
The attacker is trying to steal user's 1xBet account credentials (email and password) by displaying a fake login page that mimics the legitimate website's appearance. Submitting the form on the phishing site sends the credentials to the attacker.
🌐 Infrastructure Indicators of Compromise
Domain Information
Domain
totalbestpromo.com
Registered
None
Registrar
None
Status
Active
🔬 JavaScript Deep Analysis
Total Code Size
29.3 KB
🔗 API Endpoints Detected
Other
1
🔐 Obfuscation Detected
- : Light
- : None
🤖 AI-Extracted Threat Intelligence
Similar Websites
Pages with identical visual appearance (based on perceptual hash)
1xBet
https://7000partpromo.com/l/687a7dbc10e46e6ab1083af9
Apr 03, 2026
1xBet
http://7000-landing.com/l/687a7dbc10e46e6ab1083af9
Mar 31, 2026
1xBet
https://sevenkpartners.com/l/687a7dbc10e46e6ab1083af9
Mar 30, 2026
1xBet
https://fastthemegaplay.com/1xbt/?refCode=sk_w238255c300299l...
Mar 25, 2026
1xBet
https://7kpartnerspromo-faststream.com/1xbt/?refCode=sk_w238...
Feb 07, 2026
Scan History for totalbestpromo.com
Found 2 other scans for this domain
"I Never Thought It Would Happen to Me"
That's what 2.3 million victims say every year. Don't wait to become a statistic.