Phishing Analysis: Meta

Captura Visual

Información de Detección

https://sw.run/Verifybluetick

Detected Brand

Meta

Country

International

Confidence

100%

HTTP Status

200

Report ID

5539ae30-71d…

Analyzed

2026-02-13 06:52

Final URL (after redirects)

http://185.199.224.13/

Hashes de Contenido (Similitud HTML)

Used to detect similar phishing pages based on HTML content

Algorithm	Hash Value
CONTENT TLSH	T1BA725410D904991D01DF8DC5E1736A5822F843AEC31304D8FE60ABFAA6EF839D777669
CONTENT ssdeep	192:PPpbmWkEcGMkRY/zO2YzorUiXwHBw+FhYEUCpsdxEH5LgnttAjg+ust7VaHa4Xjf:Jbm92UGYEROEXUac7x

Hashes Visuales (Similitud de Captura)

Used to detect visually similar phishing pages based on screenshots

Algorithm	Hash Value
VISUAL pHash	b3cecc3364cc3364
VISUAL aHash	ffffefcfc3c3ffff
VISUAL dHash	28284c1c5d5c1818
VISUAL wHash	3c24040cc3c3cfdf
VISUAL colorHash	07c00010000
VISUAL cropResistant	28284c1c5d5c1818,b02030f293b2f070,c34f3f3f3f3f3f3c

Análisis de Código

Risk Score 100/100

Threat Level ALTO

⚠️ Phishing Confirmed

🎣 Credential Harvester 🎣 OTP Stealer 🎣 Card Stealer 🎣 Banking 🎣 Personal Info

🔬 Threat Analysis Report

• Amenaza: Phishing
• Objetivo: Usuarios de Meta
• Método: Suplantación de identidad y recolección de credenciales
• Exfil: https://financeroutine.com/, //translate.googleapis.com/translate_voting?client=te
• Indicadores: Coincidencia de dominio, JavaScript ofuscado, múltiples formularios.
• Riesgo: Alto

🔐 Credential Harvesting Forms

🔒 Obfuscation Detected

atob
eval
fromCharCode
unescape
document.write
hex_escape
unicode_escape
base64_strings

🎯 Kit Endpoints

https://financeroutine.com/author/roselee/
https://financeroutine.com/
https://financeroutine.com/money-management-tools-apps-track-spending-effectively/
https://beta.melroseplacerestaurant.com/media/2025/11/favicon.png
https://financeroutine.com/?p=1195
https://ogp.me/ns#
https://financeroutine.com/category/money-management/
https://financeroutine.com/wp-json/oembed/1.0/embed?url=https%3A%2F%2Ffinanceroutine.com%2Fmoney-management-tools-apps-track-spending-effectively%2F&format=xml
https://financeroutine.com/feed/
https://financeroutine.com/simple-investment-plan-long-term-wealth/
https://financeroutine.com/category/investing-wealth/
https://financeroutine.com/wp-includes/blocks/categories/style.min.css
https://financeroutine.com/wp-content/themes/generatepress/assets/js/menu.min.js?ver=3.1.3
https://financeroutine.com/#website
https://financeroutine.com/money-management-tools-apps-track-spending-effectively/#richSnippet
https://financeroutine.com/wp-includes/blocks/paragraph/style.min.css
https://financeroutine.com/wp-includes/blocks/search/style.min.css
https://financeroutine.com/wp-json/
https://gmpg.org/xfn/11
https://financeroutine.com/build-wealth-in-your-20s-30s-40s/
https://financeroutine.com/category/financial-literacy/
https://financeroutine.com/media/2026/01/Money-Management-Tools-and-Apps-to-Track-Spending-Effectively-768x512.jpg
https://financeroutine.com/financial-literacy-vs-financial-education/
https://api.w.org/
https://financeroutine.com/media/2026/01/Money-Management-Tools-and-Apps-to-Track-Spending-Effectively-300x200.jpg
https://financeroutine.com/why-financial-literacy-matters-todays-economy/
https://financeroutine.com/media/2026/01/financeroutine-512.png
https://sw.run/js/element.js
https://rankmath.com/
https://financeroutine.com/wp-includes/blocks/latest-posts/style.min.css

📡 API Calls Detected

https://ipinfo.io/json?token=0916643fd922ec
https://www.google.com/ccm/geo

📤 Form Action Targets

https://financeroutine.com/
//translate.googleapis.com/translate_voting?client=te

📊 Desglose de Puntuación de Riesgo

Total Risk Score

90/100

Contributing Factors

Domain Mismatch

The domain 'sw.run' is not associated with the legitimate brand Meta.

Obfuscated Javascript

Obfuscated Javascript makes the code harder to understand, raising suspicion.

Form Actions to external sites

Forms submit to potentially malicious destinations, suggesting credential harvesting.

Impersonation Attempt

The site mimics Meta's branding to deceive users.

🔬 Análisis Integral de Amenazas

Tipo de Amenaza

Banking Credential Harvester

Objetivo

Meta users (International)

Método de Ataque

Brand impersonation + credential harvesting forms + obfuscated JavaScript

Canal de Exfiltración

HTTP POST to backend

Evaluación de Riesgo

CRITICAL - Automated credential harvesting with HTTP POST to backend

⚠️ Indicators of Compromise

Kit types: Credential Harvester, OTP Stealer, Card Stealer, Banking, Personal Info
285 obfuscation techniques

🏢 Análisis de Suplantación de Marca

Impersonated Brand

Meta

Official Website

https://about.meta.com/

Fake Service

Meta Verified

Fraudulent Claims

⚔️ Metodología de Ataque

Primary Method: Credential Harvesting

The site uses a visually similar design and branding to impersonate Meta and attempt to collect user credentials through a form, or by redirecting to a phishing site.

Secondary Method: Javascript Obfuscation

Javascript code obfuscation attempts to hide malicious behavior.

🌐 Indicadores de Compromiso de Infraestructura

🦠 Malicious Files

Main File

element.js

File Size

Functions: iziToast['error']() - Displays fake error message to manipulate user, URLSearchParams - Checks for malicious URL parameter (utm_campaign=lnnf), Cloudflare script injection (c function) - Loads external challenge script, setTimeout - Delays malicious behavior to avoid immediate detection

📊 Diagrama de Flujo de Ataque

1. Step 1: User lands on page via malicious short link (e.g., sw.run/Verifybluetick)
2. Step 2: URL parameter `utm_campaign=lnnf` triggers fake error message after 2.5 seconds
3. Step 3: Fake 'URL Not Found' toast appears, pressuring user to take action (e.g., re-enter credentials or click a malicious link)
4. Step 4: Cloudflare challenge script loads, potentially enabling further malicious activity (e.g., keylogging, form hijacking)
5. Step 5: Obfuscated functions (n, c, u, p, o, f, i, r) capture and exfiltrate user data (e.g., form submissions, session tokens)

🔬 JavaScript Deep Analysis

Operator Language

English (1%)

Total Code Size

92,6 KB

🔗 API Endpoints Detected

Other

62

Solana RPC

1

🔐 Obfuscation Detected

: Moderate

🤖 AI-Extracted Threat Intelligence

📊 Attack Flow

1. Step 1: User lands on page via malicious short link (e.g., sw.run/Verifybluetick)
2. Step 2: URL parameter `utm_campaign=lnnf` triggers fake error message after 2.5 seconds
3. Step 3: Fake 'URL Not Found' toast appears, pressuring user to take action (e.g., re-enter credentials or click a malicious link)
4. Step 4: Cloudflare challenge script loads, potentially enabling further malicious activity (e.g., keylogging, form hijacking)
5. Step 5: Obfuscated functions (n, c, u, p, o, f, i, r) capture and exfiltrate user data (e.g., form submissions, session tokens)