Phishing Analysis
Detailed analysis of captured phishing page
Captura Visual
Información de Detección
https://autolitefinances.pro/
Detected Brand
TopTier Trader
Country
Unknown
Confianza
100%
HTTP Status
200
Report ID
39550b19-a60…
Analyzed
2026-07-30 11:41
Hashes de Contenido (Similitud HTML)
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T12404DAB0A164EA3B41D3C6E4A7759B2F72A0C24CDF83465553F4872C9BEBDE0EE15188 |
|
CONTENT
ssdeep
|
768:W9aXfLmxg+SsshD8cIw1qMxf5oQqeItiwijF9zXnGEwB56YL0AxUegILG97h2nyp:wxg+svWMFfqeIAD2nyXeVBzFaogUAF |
Hashes Visuales (Similitud de Captura)
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
ecbc13c112db16b6 |
|
VISUAL
aHash
|
fffb93f3f3f9fb00 |
|
VISUAL
dHash
|
c9332567c7d3d36d |
|
VISUAL
wHash
|
fd93817171f1f900 |
|
VISUAL
colorHash
|
07006008080 |
|
VISUAL
cropResistant
|
c9332565c7d7d3d3,b9b99599cf671b04,05196d6d6d6d1822 |
Análisis de Código
Risk Score
100/100
Nivel de Amenaza
ALTO
⚠️ Phishing Confirmed
🎣 Credential Harvester
🎣 OTP Stealer
🎣 Card Stealer
🎣 Banking
🎣 Personal Info
🔐 Credential Harvesting Forms
🔒 Obfuscation Detected
- atob
- eval
- fromCharCode
- unescape
- hex_escape
- unicode_escape
- base64_strings
🎯 Kit Endpoints
- https://app.autolitefinances.pro/login?id=f7fe5c88-b97c-4b5a-8be0-8625b85a6fb3
- https://app.autolitefinances.pro/login?id=3fdc580b-506f-4b17-9860-30b452681913
- https://app.autolitefinances.pro/login?id=cfb0997a-137d-4304-b31a-0f365a8eafaf
- https://app.autolitefinances.pro/login/affiliate/dashboard
- https://app.autolitefinances.pro/login?id=bcb0f73e-f244-4b2f-bcce-9d107dc557fb
- https://app.autolitefinances.pro/login?id=185277e7-13d3-4855-bb06-4c4bf7c41186
- https://app.autolitefinances.pro/login?id=1234ac6b-f3f5-468e-8f0b-43639d52dc30
- https://app.autolitefinances.pro/login?id=70c9db00-176b-4293-af44-04cc20c2d962
- https://app.autolitefinances.pro/login?id=141aee51-2f48-43fb-af45-6c8eac43f8a7
- https://app.autolitefinances.pro/login?id=f2672fde-3651-42a2-9975-782140a34fad
- https://app.autolitefinances.pro/login?id=0fb1a022-096f-4b80-9815-d0e66ca43fe7
- https://app.autolitefinances.pro/login?id=4ff1f82b-9abf-41bc-ae96-852231b7c4a9
- https://app.autolitefinances.pro/login?id=840c8f97-8309-4b11-bab1-3e6e400dfa58
- https://app.autolitefinances.pro/login?id=34d38ca0-d133-460e-a273-ed04eb0edaf9
- https://app.autolitefinances.pro/login?id=b23ee6da-7e87-41da-aa5a-5c4d283f9c04
- https://app.autolitefinances.pro/login?id=44942e18-9e03-4b4b-8e62-4c53c9525c38
- https://app.autolitefinances.pro/login?id=70d20495-b604-465e-82fb-3c9127c08abc
- https://app.autolitefinances.pro/login?id=2b0b30c5-c192-4ca5-ad10-cd625000f649
- https://app.autolitefinances.pro/login?id=5802a31a-4578-4b35-9b68-707ddb6177b3
- https://app.autolitefinances.pro/login/leaderboard
- https://app.autolitefinances.pro/login?id=9d42adb2-103d-42ee-9958-0336d82cc97c
- https://app.autolitefinances.pro/login?id=810ed314-8589-4e1f-bea0-1a6bf67a67ce
- https://app.autolitefinances.pro/login/competitions-overview
- https://app.autolitefinances.pro/login?product_id=c9ff5fb0-6b27-412b-b4c3-7b097806c53f
- https://app.autolitefinances.pro/login
- https://app.autolitefinances.pro/login?id=debf49c1-d435-4a7f-9877-753eca252e23
📡 API Calls Detected
- POST
- https://18.210.229.244/is?cb=
- GET
- https://www.google.com/ccm/geo
📤 Form Action Targets
- /#gf_1
📊 Desglose de Puntuación de Riesgo
Total Risk Score
100/100
Contributing Factors
Active Phishing Kit
Detected kit types: Credential Harvester, OTP Stealer, Card Stealer, Banking, Personal Info
Credential Harvesting
Credential harvesting detected with 3 form(s) capturing sensitive data
Code Obfuscation
JavaScript code obfuscated using 519 technique(s) to evade detection
🔬 Análisis Integral de Amenazas
Tipo de Amenaza
Banking Credential Harvester
Objetivo
TopTier Trader users
Método de Ataque
credential harvesting forms + obfuscated JavaScript
Canal de Exfiltración
HTTP POST to backend
Evaluación de Riesgo
CRITICAL - Automated credential harvesting with HTTP POST to backend
⚠️ Indicators of Compromise
- Kit types: Credential Harvester, OTP Stealer, Card Stealer, Banking, Personal Info
- 519 obfuscation techniques
🏢 Análisis de Suplantación de Marca
Impersonated Brand
TopTier Trader
Official Website
N/A
Fake Service
Banking/payment service
⚔️ Metodología de Ataque
Primary Method: Credential Harvesting
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Secondary Method: JavaScript Obfuscation
Malicious code is obfuscated using 519 techniques to evade detection by security scanners and make reverse engineering more difficult.
🌐 Indicadores de Compromiso de Infraestructura
Domain Information
Dominio
autolitefinances.pro
Registered
Unknown
Registrar
None
Estado
Age unknown
Hosting Information
Provider
Unknown
ASN
🤖 AI-Extracted Threat Intelligence
"Nunca pensé que me pasaría a mí"
Esto dicen las 2.3 millones de víctimas cada año. No esperes a ser una estadística.