SafeMode - Analysis: bigwinner.click

Visual Capture

No screenshot available

Detection Info

https://bigwinner.click/

Detected Brand

Plinko

Country

International

Confidence

100%

HTTP Status

200

Report ID

caebde61-0d1…

Analyzed

2026-01-24 12:49

Content Hashes (HTML Similarity)

Used to detect similar phishing pages based on HTML content

Algorithm	Hash Value
CONTENT TLSH	T172E229B4A230D335B1C247E8EA6425287A5FE1DCD7C695B4E388AF15B0D6CECD5260CB
CONTENT ssdeep	384:4r/aJcuvN8QRhiXkdvNTDhPhLxeAxeDWNW1Tp34PxeeJEmuW3AssIRWoMd:4r/aJcuvVhhPhleMeDGCSPxeeWmH/W

Visual Hashes (Screenshot Similarity)

Used to detect visually similar phishing pages based on screenshots

Algorithm	Hash Value
VISUAL pHash	c0703d9f4fbc6849
VISUAL aHash	8066e0e070fe7e20
VISUAL dHash	7ccc8aabcbccecc1
VISUAL wHash	8066e66078fe7f60
VISUAL colorHash	30000000038
VISUAL cropResistant	7ccc8aabcbccecc1

Code Analysis

Risk Score 100/100

Threat Level BAJO

🎣 Credential Harvester 🎣 OTP Stealer 🎣 Card Stealer 🎣 Banking 🎣 Personal Info

WebSocket C2

🔬 Threat Analysis Report

• Threat: Potential data collection through form submission.
• Target: New users of the Plinko game.
• Method: Registration form asking for email and password.
• Exfil: Data potentially sent to a WebSocket URL (wss://gambler-work.com/api/ws).
• Indicators: Non-branded domain, registration form.
• Risk: LOW - Data collection is possible, but not necessarily malicious.