SafeMode - Analysis: ingresoahoraneswes.fun

Visual Capture

Detection Info

https://ingresoahoraneswes.fun/

Detected Brand

Banco Internacional

Country

International

Confidence

95%

HTTP Status

200

Report ID

9a41592e-831…

Analyzed

2026-03-02 22:24

Content Hashes (HTML Similarity)

Used to detect similar phishing pages based on HTML content

Algorithm	Hash Value
CONTENT TLSH	T1F1D10F70D96CAD331253D2D6BAB29F1BB6D0C215DB826F0B46F8874C5FE6D04ED061A2
CONTENT ssdeep	96:emZqkY39EvsM90vMNd4Ioqk9XOxHFDbSW4hDEEnNS:emZqkY3KNdUqk9QDmW4BEEng

Visual Hashes (Screenshot Similarity)

Used to detect visually similar phishing pages based on screenshots

Algorithm	Hash Value
VISUAL pHash	c2863d3996c7898f
VISUAL aHash	0f343c7c7c000000
VISUAL dHash	ecece1f0f9939696
VISUAL wHash	ff7c7efe7c400000
VISUAL colorHash	01000038000
VISUAL cropResistant	ecece1f0f9939696,0103020141410100

Code Analysis

Risk Score 50/100

Threat Level ALTO

⚠️ Phishing Confirmed

🎣 Credential Harvester

🔬 Threat Analysis Report

• Threat: Phishing
• Target: Customers of Banco Internacional
• Method: Impersonation of a login page
• Exfil: Credentials
• Indicators: Mismatched domain, login form
• Risk: HIGH

📡 API Calls Detected

handlers/login_handler.php
handlers/check_status.php?t=

📊 Risk Score Breakdown

Total Risk Score

90/100

Contributing Factors

Domain Mismatch

The domain does not belong to Banco Internacional.

Recent Domain

The domain is very recently registered.

Impersonation

The site visually impersonates the bank's login page.

🔬 Comprehensive Threat Analysis

Threat Type

Credential Harvesting Kit

Target

Banco Internacional users (International)

Attack Method

Brand impersonation

Exfiltration Channel

Form submission (backend endpoint not detected - likely JavaScript-based)

Risk Assessment

MEDIUM - Automated credential harvesting with Form submission (backend endpoint not detected - likely JavaScript-based)

⚠️ Indicators of Compromise

Kit types: Credential Harvester

🏢 Brand Impersonation Analysis

Impersonated Brand

Banco Internacional

Fake Service

Online banking login

⚔️ Attack Methodology

Primary Method: Credential Harvesting

The attacker sets up a fake login page that mirrors the legitimate Banco Internacional site. Victims are tricked into entering their credentials, which are then harvested by the attacker.