Phishing Analysis
Detailed analysis of captured phishing page
Captura Visual
No screenshot available
Información de Detección
https://bafdc912.vip:8989/ez-login/index.html
Detected Brand
Unknown
Country
International
Confianza
100%
HTTP Status
200
Report ID
40443bb6-96d…
Analyzed
2026-03-06 01:33
Hashes de Contenido (Similitud HTML)
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T1A3C1B4A1E0497B7FBC07C3ECA6B0A65D504B638ED2910984D2E901743BDFE98F50E694 |
|
CONTENT
ssdeep
|
96:FuJPthkl/IxMzViis6S8LUrttNu/IsdFYTYcBZbE4HTPds:kthkAMzVZs6SJpnuAs3kBNVzPds |
Hashes Visuales (Similitud de Captura)
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
c9b427533c49c3b6 |
|
VISUAL
aHash
|
ffffffffdc280000 |
|
VISUAL
dHash
|
f2b6f23329d15166 |
|
VISUAL
wHash
|
7fffffdb90080000 |
|
VISUAL
colorHash
|
060000001c0 |
|
VISUAL
cropResistant
|
f2f7d2f3332dd951,0f16261b7b71f072,adf9d05451e16664 |
Análisis de Código
Risk Score
76/100
Nivel de Amenaza
ALTO
⚠️ Phishing Confirmed
🎣 Credential Harvester
🎣 Banking
🎣 Personal Info
🔬 Threat Analysis Report
• Amenaza: Phishing de credenciales
• Objetivo: Usuarios no especificados
• Método: Formulario de inicio de sesión engañoso
• Exfil: Potencialmente credenciales de usuario
• Indicadores: Dominio no relacionado, javascript ofuscado, formulario sospechoso.
• Riesgo: Alto
🔒 Obfuscation Detected
- fromCharCode
- document.write
🎯 Kit Endpoints
- https://bafdc912.vip:8989/ez-login/theme/default/layer.css?v=3.1.0
📊 Desglose de Puntuación de Riesgo
Total Risk Score
90/100
Contributing Factors
Suspicious Domain
The domain is not related to any known brand.
Obfuscated Javascript
Presence of obfuscated JavaScript code suggests malicious intent.
Form Submission
The page contains a login form designed to steal user credentials
Lack of branding
No brand or logo, generic design
🔬 Análisis Integral de Amenazas
Tipo de Amenaza
Banking Credential Harvester
Objetivo
General public
Método de Ataque
credential harvesting forms + obfuscated JavaScript
Canal de Exfiltración
Form submission (backend endpoint not detected - likely JavaScript-based)
Evaluación de Riesgo
HIGH - Automated credential harvesting with Form submission (backend endpoint not detected - likely JavaScript-based)
⚠️ Indicators of Compromise
- Kit types: Credential Harvester, Banking, Personal Info
- 7 obfuscation techniques
🏢 Análisis de Suplantación de Marca
Impersonated Brand
Unknown
Fake Service
Generic login
⚔️ Metodología de Ataque
Primary Method: Credential Phishing
The attacker aims to steal user credentials through a fake login page.
Secondary Method: Javascript Obfuscation
To hide or make harder the analysis of the malicious intent.
🌐 Indicadores de Compromiso de Infraestructura
Domain Information
Dominio
bafdc912.vip
Registered
Unknown
Registrar
Unknown
Estado
Inactive
🤖 AI-Extracted Threat Intelligence
Similar Websites
Pages with identical visual appearance (based on perceptual hash)
"Nunca pensé que me pasaría a mí"
Esto dicen las 2.3 millones de víctimas cada año. No esperes a ser una estadística.