SafeMode - Analysis: normgmgnnvvnfngnngn.online

Captura Visual

Screenshot of normgmgnnvvnfngnngn.online

Información de Detección

https://normgmgnnvvnfngnngn.online/

Detected Brand

InvStart AI (likely fictitious)

Country

Unknown

Confianza

95%

HTTP Status

200

Report ID

08ff500b-238…

Analyzed

2026-07-10 23:23

Hashes de Contenido (Similitud HTML)

Used to detect similar phishing pages based on HTML content

Algorithm	Hash Value
CONTENT TLSH	T11512B42020A8B937429392CDFB61A71B73D6C256DA670F02A2F9C30EDBEBD59CC15147
CONTENT ssdeep	192:ghbku44C/8GBaHoar2lAEoNrp/eRIiuZ8ONgfh5JaaMhKD2iZwV:gxt44C/BaIq2qvNrpmRIkJjMhOZwV

Hashes Visuales (Similitud de Captura)

Used to detect visually similar phishing pages based on screenshots

Algorithm	Hash Value
VISUAL pHash	d2d2946d312db86d
VISUAL aHash	007c6c6c6014002e
VISUAL dHash	14ccc8d8d0e4c6cc
VISUAL wHash	52fc7c7c607c007e
VISUAL colorHash	300020001c0
VISUAL cropResistant	14ccc8d8d0e4c6cc

Análisis de Código

Risk Score 6/100

Nivel de Amenaza ALTO

⚠️ Phishing Confirmed

🔒 Obfuscation Detected

fromCharCode
unescape

📡 API Calls Detected

POST

📊 Desglose de Puntuación de Riesgo

Total Risk Score

70/100

Contributing Factors

Credential Harvesting

Credential harvesting detected with 1 form(s) capturing sensitive data

Code Obfuscation

JavaScript code obfuscated using 3 technique(s) to evade detection

🔬 Análisis Integral de Amenazas

Tipo de Amenaza

InvStart AI (likely fictitious) Credential Harvester

Objetivo

InvStart AI (likely fictitious) users

Método de Ataque

credential harvesting forms + obfuscated JavaScript

Canal de Exfiltración

Form submission (backend endpoint not detected - likely JavaScript-based)

Evaluación de Riesgo

LOW - Automated credential harvesting with Form submission (backend endpoint not detected - likely JavaScript-based)

⚠️ Indicators of Compromise

3 obfuscation techniques

🏢 Análisis de Suplantación de Marca

Impersonated Brand

InvStart AI (likely fictitious)

Official Website

N/A

Fake Service

Credential harvesting service

⚔️ Metodología de Ataque

Primary Method: InvStart AI (likely fictitious) Credential Harvesting

Fake InvStart AI (likely fictitious) login page with 1 form. Victim enters credentials which are captured and transmitted to attacker's server. Page may impersonate InvStart AI (likely fictitious) official login to appear legitimate.