EN ES PT

Phishing Analysis

Detailed analysis of captured phishing page

Back to Stats

Captura Visual

Screenshot of 7003659.com:8989

Información de Detección

https://7003659.com:8989/lottery.html
Detected Brand
bet365
Country
International
Confianza
100%
HTTP Status
200
Report ID
230281bc-fff…
Analyzed
2026-03-17 03:33

Hashes de Contenido (Similitud HTML)

Used to detect similar phishing pages based on HTML content

Algorithm Hash Value
CONTENT TLSH
T1ECF32331A848E57F01B761C3CB28775DF281B345DE2B4E6279F0526AA733AF58D424E8
CONTENT ssdeep
3072:uayuhIDfDFTXn5aDI12BlquIrJ5nOvIdD/u4R4/9hLbns8Hx96aA2nvS3bl86hhh:uayuhIDfDFTXn5aDI12BlquIrJ5nOvIB

Hashes Visuales (Similitud de Captura)

Used to detect visually similar phishing pages based on screenshots

Algorithm Hash Value
VISUAL pHash
be3e81d169cdc486
VISUAL aHash
6904b581bdff7e7f
VISUAL dHash
516d65255169e471
VISUAL wHash
3d059581adbd3c3c
VISUAL colorHash
00000000007
VISUAL cropResistant
eac2d890c27369e4,ccccb22b9f336be2,e2590f1f1762436a,516d65255169e471

Análisis de Código

Risk Score 100/100
Nivel de Amenaza ALTO
⚠️ Phishing Confirmed
🎣 Credential Harvester 🎣 OTP Stealer 🎣 Card Stealer 🎣 Banking 🎣 Personal Info

🔬 Threat Analysis Report

• Amenaza: Ataque de phishing.
• Objetivo: Usuarios de bet365.
• Método: Suplantación de identidad y recopilación de credenciales.
• Exfil: No especificado, potencialmente exfiltración de datos a través de JavaScript.
• Indicadores: Coincidencia de dominio, Javascript ofuscado, formularios.
• Riesgo: ALTO

🔒 Obfuscation Detected

  • atob
  • eval
  • fromCharCode
  • unescape
  • document.write
  • hex_escape
  • unicode_escape
  • base64_strings

🎯 Kit Endpoints

  • javascript:loginPlayer(this)

📡 API Calls Detected

  • /imLink.html
  • /pcenter-client/pcenter/#/pcenter-client/

📊 Desglose de Puntuación de Riesgo

Total Risk Score
90/100

Contributing Factors

Domain Mismatch
The domain 7003659.com:8989 does not belong to bet365
Obfuscated Javascript
Obfuscated Javascript usually indicates hidden malicious activities like data exfiltration or credential theft.
Forms and Inputs
Presence of forms collecting user information, specifically username and password
Impersonation
The site mimics the appearance of bet365 in an attempt to trick users.

🔬 Análisis Integral de Amenazas

Tipo de Amenaza
Banking Credential Harvester
Objetivo
bet365 users (International)
Método de Ataque
Brand impersonation + credential harvesting forms + obfuscated JavaScript
Canal de Exfiltración
Form submission (backend endpoint not detected - likely JavaScript-based)
Evaluación de Riesgo
CRITICAL - Automated credential harvesting with Form submission (backend endpoint not detected - likely JavaScript-based)

⚠️ Indicators of Compromise

  • Kit types: Credential Harvester, OTP Stealer, Card Stealer, Banking, Personal Info
  • 276 obfuscation techniques

🏢 Análisis de Suplantación de Marca

Impersonated Brand
bet365
Official Website
www.bet365.com
Fake Service
betting/gambling

⚔️ Metodología de Ataque

Primary Method: Credential Harvesting

The attacker aims to steal user credentials by creating a fake login page that mimics the design of bet365. Users are tricked into entering their username and password, which are then captured by the attacker.

Secondary Method: JavaScript Obfuscation

The use of obfuscated JavaScript (atob, eval, fromCharCode) masks malicious code, making it difficult to detect and analyze. This code is often designed to exfiltrate stolen data or redirect the user.

🌐 Indicadores de Compromiso de Infraestructura

Domain Information

Dominio
7003659.com
Registered
Unknown
Registrar
Unknown
Estado
Unknown

🤖 AI-Extracted Threat Intelligence

Scan History for 7003659.com:8989

Found 1 other scan for this domain

😰
"Nunca pensé que me pasaría a mí"
Esto dicen las 2.3 millones de víctimas cada año. No esperes a ser una estadística.