SafeMode - Analysis: 18888.cyou

Visual Capture

Detection Info

http://18888.cyou

Detected Brand

Long.bet

Country

International

Confidence

95%

HTTP Status

200

Report ID

8753dd14-587…

Analyzed

2026-01-01 18:07

Final URL (after redirects)

http://18888.cyou/

Content Hashes (HTML Similarity)

Used to detect similar phishing pages based on HTML content

Algorithm	Hash Value
CONTENT TLSH	T17F41B7F491645B7D3EC640C4DFE1E229D3C889CBA7632B8456F101DB8E26BA3C0602A6
CONTENT ssdeep	48:stWYWuhbBZwN7B6jg+X2gYWpWYb9XtmAyxGpSSN5jVkUrb1w:sgTTi2gF+AdpSSNjki6

Visual Hashes (Screenshot Similarity)

Used to detect visually similar phishing pages based on screenshots

Algorithm	Hash Value
VISUAL pHash	e464e6ce7d646464
VISUAL aHash	c3ffc3c3ffffffff
VISUAL dHash	0e08961600040000
VISUAL wHash	c0e4c0c00f0f0f0f
VISUAL colorHash	07000007000
VISUAL cropResistant	0e08961600040000,04286860622a0410

Code Analysis

Risk Score 75/100

Threat Level ALTO

⚠️ Phishing Confirmed

🎣 OTP Stealer

🔬 Threat Analysis Report

• Threat: Phishing targeting users of Long.bet.
• Target: Long.bet users.
• Method: Presents a fake page with buttons redirecting to malicious sites under the guise of safety checks and various server locations.
• Exfil: Likely redirects to credential harvesting or malware distribution.
• Indicators: Domain mismatch (18888.cyou vs long.bet), new domain, and code obfuscation.
• Risk: HIGH - Potential for credential theft, malware infection, or further exploitation.