EN ES PT

Phishing Analysis

Detailed analysis of captured phishing page

Back to Stats

Visual Capture

No screenshot available

Detection Info

https://3656d.cc
Detected Brand
Unknown
Country
International
Confidence
100%
HTTP Status
200
Report ID
5bdcd9e8-326…
Analyzed
2026-03-17 03:16
Final URL (after redirects)
https://3656d.cc:8989/verify-page/index.html

Content Hashes (HTML Similarity)

Used to detect similar phishing pages based on HTML content

Algorithm Hash Value
CONTENT TLSH
T180B14271C05A293BB907C1D8B1B0EB0A72D7534EDB82096582FD027A37CFD51F91A9D6
CONTENT ssdeep
96:FuwEM6S8LUfANuZsdFYTYcBZbEYTPdp2sclVSTfni1EdvB:H6SJouZs3kBNTPdp2sclEDnx

Visual Hashes (Screenshot Similarity)

Used to detect visually similar phishing pages based on screenshots

Algorithm Hash Value
VISUAL pHash
d99905cb3c27c336
VISUAL aHash
ffffffffdc280000
VISUAL dHash
f2b2ca2b21d15166
VISUAL wHash
7fffffdb98000000
VISUAL colorHash
0e0000001c0
VISUAL cropResistant
f2b39ac8ab2b35d9,8c6cacdcd86a7e5c,f87e7f7ffffebdaa,2b2835d950516364,210830b2b2320c11,11043232b2300c21

Code Analysis

Risk Score 100/100
Threat Level ALTO
⚠️ Phishing Confirmed
🎣 Credential Harvester 🎣 OTP Stealer 🎣 Card Stealer 🎣 Banking 🎣 Personal Info

🔬 Threat Analysis Report

• Threat: Phishing
• Target: Unknown
• Method: Malicious Captcha redirect
• Exfil: Unknown
• Indicators: Obfuscated JS, Suspicious Captcha, Generic design
• Risk: HIGH

🔒 Obfuscation Detected

  • fromCharCode
  • document.write

🎯 Kit Endpoints

  • https://3656d.cc:8989/verify-page/theme/default/layer.css?v=3.1.0

📊 Risk Score Breakdown

Total Risk Score
90/100

Contributing Factors

Suspicious Captcha
Captchas are often used to identify bot traffic. This one looks odd, raising suspicion
Obfuscated Javascript
Obfuscation is a common technique to hide malicious code from detection. This greatly increases the risk.
Generic Design
The lack of branding suggests it is not legitimate.
Form submission and JS detection
JavaScript form submission detected.

🔬 Comprehensive Threat Analysis

Threat Type
Banking Credential Harvester
Target
General public
Attack Method
credential harvesting forms + obfuscated JavaScript
Exfiltration Channel
Form submission (backend endpoint not detected - likely JavaScript-based)
Risk Assessment
CRITICAL - Automated credential harvesting with Form submission (backend endpoint not detected - likely JavaScript-based)

⚠️ Indicators of Compromise

  • Kit types: Credential Harvester, OTP Stealer, Card Stealer, Banking, Personal Info
  • 6 obfuscation techniques

🏢 Brand Impersonation Analysis

Impersonated Brand
Unknown
Fake Service
Unknown

⚔️ Attack Methodology

Primary Method: Malicious Captcha Redirect

The user interacts with the Captcha, which could redirect them to a phishing website designed to steal credentials or install malware. The obfuscation is likely to conceal malicious javascript.

Secondary Method: Credential Harvesting

The site may harvest credentials or deliver a payload based on the users actions.

🌐 Infrastructure Indicators of Compromise

Domain Information

Domain
3656d.cc
Registered
2019-09-06T06:05:06Z
Registrar
Name.com, Inc.
Status
ACTIVE

🤖 AI-Extracted Threat Intelligence

Scan History for 3656d.cc

Found 1 other scan for this domain

😰
"I Never Thought It Would Happen to Me"
That's what 2.3 million victims say every year. Don't wait to become a statistic.