SafeMode - Analysis: 36593657.com:8989

Visual Capture

No screenshot available

Detection Info

https://36593657.com:8989

Detected Brand

Unknown

Country

International

Confidence

100%

HTTP Status

200

Report ID

f2ad99c0-595…

Analyzed

2026-03-17 03:18

Final URL (after redirects)

https://36593657.com:8989/verify-page/index.html

Content Hashes (HTML Similarity)

Used to detect similar phishing pages based on HTML content

Algorithm	Hash Value
CONTENT TLSH	T1BAC13371C05B292BF90381E8B1B0DB1F62D3434ED782095592FD026677CFD51F91A9DA
CONTENT ssdeep	96:FuwK6S8LUfANuZsdFYTYcBZbEYTPdp2sclJnaWLlIJQ6B:y6SJouZs3kBNTPdp2sclJnak2Qg

Visual Hashes (Screenshot Similarity)

Used to detect visually similar phishing pages based on screenshots

Algorithm	Hash Value
VISUAL pHash	dbb107cb3c0d81b6
VISUAL aHash	ffffffffdc280000
VISUAL dHash	f2cada3329d15166
VISUAL wHash	7fefffdb98080000
VISUAL colorHash	0e0000001c0
VISUAL cropResistant	f2f3cad0b32b35d9,8c6cacdcd86a7e5c,f87e7f7ffffebdaa,7f7f3e36797c7e7f,2b2835d950516364,210830b2b2320c11,11043232b2300c21

Code Analysis

Risk Score 88/100

Threat Level ALTO

⚠️ Phishing Confirmed

🎣 Credential Harvester 🎣 OTP Stealer 🎣 Card Stealer 🎣 Banking 🎣 Personal Info

🔬 Threat Analysis Report

• Threat: Phishing attempt
• Target: Unknown
• Method: Social engineering, credential theft
• Exfil: Potentially, data submitted via forms, obfuscated JS
• Indicators: Unrelated domain, obfuscation, captcha
• Risk: High

🔒 Obfuscation Detected

fromCharCode
document.write

🎯 Kit Endpoints

https://36593657.com:8989/verify-page/theme/default/layer.css?v=3.1.0

📊 Risk Score Breakdown

Total Risk Score

90/100

Contributing Factors

Suspicious Domain

Unusual domain with no known brand association.

Obfuscated JavaScript

JavaScript obfuscation is frequently used to hide malicious code.

Forms Detected

Forms are likely used to steal credentials.

CAPTCHA

Suspicious Captcha implementation

🔬 Comprehensive Threat Analysis

Threat Type

Banking Credential Harvester

Target

General public

Attack Method

credential harvesting forms + obfuscated JavaScript

Exfiltration Channel

Form submission (backend endpoint not detected - likely JavaScript-based)

Risk Assessment

CRITICAL - Automated credential harvesting with Form submission (backend endpoint not detected - likely JavaScript-based)

⚠️ Indicators of Compromise

Kit types: Credential Harvester, OTP Stealer, Card Stealer, Banking, Personal Info
6 obfuscation techniques

🏢 Brand Impersonation Analysis

Impersonated Brand

Unknown

Fake Service

Unknown

⚔️ Attack Methodology

Primary Method: Credential Harvesting

The site likely attempts to steal login credentials or other sensitive information through forms and a misleading CAPTCHA. Obfuscation is used to hide the malicious activity.