Phishing Analysis: Unknown

Captura Visual

No screenshot available

Información de Detección

https://suer-cqeur.cc/es

Detected Brand

Unknown

Country

Unknown

Confidence

100%

HTTP Status

N/A

Report ID

56a5a31d-863…

Analyzed

2026-01-29 04:07

Hashes de Contenido (Similitud HTML)

Used to detect similar phishing pages based on HTML content

Algorithm	Hash Value
CONTENT TLSH	T1ECF251B05C8AE977225355D1E631AF08F9E3A399CB660E4057F692D723C2DD8DC4B8B0
CONTENT ssdeep	384:inSJNa+AhcATomKtAq24MZ9yTLa9qgKcUgKjgK+gKIgKYgK/houo2pt/uY:Xa+sxoaUTu9qgWgcgHgHg1gaouX

Hashes Visuales (Similitud de Captura)

Used to detect visually similar phishing pages based on screenshots

Algorithm	Hash Value
VISUAL pHash	e99298699a6b6b92
VISUAL aHash	fdffe7e7dfc1c3ff
VISUAL dHash	7b544d48b4828a9c
VISUAL wHash	b925247ec3c3c381
VISUAL colorHash	07200030000
VISUAL cropResistant	7b544d48b4828a9c

Análisis de Código

Risk Score 100/100

🎣 Credential Harvester 🎣 OTP Stealer 🎣 Card Stealer 🎣 Banking 🎣 Personal Info

WebSocket C2

🔒 Obfuscation Detected

fromCharCode
unescape
base64_strings

🎯 Kit Endpoints

resend
/es/empresas/logistica-fulfillment-by-seur/
https://blog.seur.com/
http://www.seur.com/miseur/login
https://info.notificaciones.e-seur.com/Formulario-Web-SeurPro?utm_source=menu-seur.com&utm_medium=login&utm_campaign=SEURPro&utm_id=loginSEURPro

📡 API Calls Detected

/api/confirm-delivery

📊 Desglose de Puntuación de Riesgo

Total Risk Score

100/100

Contributing Factors

Active Phishing Kit

Detected active phishing kit types: Credential Harvester, OTP Stealer, Card Stealer, Banking, Personal Info

Credential Harvesting

Credential harvesting detected with 1 form(s) capturing sensitive data

Real-time C2

WebSocket-based Command & Control infrastructure for real-time victim monitoring

Code Obfuscation

JavaScript code obfuscated using 10 technique(s) to evade detection

🔬 Análisis Integral de Amenazas

Tipo de Amenaza

Banking Credential Harvester

Objetivo

General public

Método de Ataque

credential harvesting forms + real-time WebSocket exfiltration + obfuscated JavaScript

Canal de Exfiltración

WebSocket (1 endpoints)

Evaluación de Riesgo

CRITICAL - Automated credential harvesting with WebSocket (1 endpoints)

⚠️ Indicators of Compromise

Kit types: Credential Harvester, OTP Stealer, Card Stealer, Banking, Personal Info
10 obfuscation techniques

🏢 Análisis de Suplantación de Marca

Impersonated Brand

Generic Phishing

Official Website

N/A

Fake Service

Banking/payment service

⚔️ Metodología de Ataque

Primary Method: Credential Harvesting

Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.

Secondary Method: JavaScript Obfuscation

Malicious code is obfuscated using 10 techniques to evade detection by security scanners and make reverse engineering more difficult.

Target Blockchain

Multiple blockchains

Whitelist Bypass

YES

Drainer supports multiple blockchain networks and checks for high-value tokens on each chain before executing drain operations.

🌐 Indicadores de Compromiso de Infraestructura

Domain Information

Domain

suer-cqeur.cc

Registered

2026-01-27 08:56:20+00:00

Registrar

NameSilo, LLC

Status

Recently registered (1 days old)

Hosting Information

Provider

NameSilo, LLC

ASN

📊 Diagrama de Flujo de Ataque

```
┌─────────────────────────────────────────────────────────────────┐
│                VICTIM VISITS PHISHING PAGE                      │
│           (Fake login, verification, support page)             │
└─────────────────────────┬───────────────────────────────────────┘
                          │
                          ▼
┌─────────────────────────────────────────────────────────────────┐
│              VICTIM ENTERS CREDENTIALS (Form 1)                │
│                                                                 │
│  - Email/Username                                               │
│  - Password                                                     │
│  - 2FA code (if requested)                                      │
│  - Seed phrase (if crypto-related)                              │
└─────────────────────────┬───────────────────────────────────────┘
                          │
                          ▼
┌─────────────────────────────────────────────────────────────────┐
│              FORM SUBMISSION (JavaScript POST)                  │
│                                                                 │
│  Credentials sent to backend server                             │
└─────────────────────────┬───────────────────────────────────────┘
                          │
                          ▼
┌─────────────────────────────────────────────────────────────────┐
│              VICTIM SEES FAKE ERROR / REDIRECT                  │
│                                                                 │
│  - "Incorrect password, try again"                              │
│  - "Account locked, contact support"                            │
│  - Redirect to legitimate site                                  │
└─────────────────────────┬───────────────────────────────────────┘
                          │
                          ▼
┌─────────────────────────────────────────────────────────────────┐
│                🚨 CREDENTIALS STOLEN                            │
│                                                                 │
│  Attacker can now:                                              │
│  - Access victim's account                                      │
│  - Bypass 2FA (if captured)                                     │
│  - Steal funds (if crypto seed phrase)                          │
└─────────────────────────────────────────────────────────────────┘
```

🔬 JavaScript Deep Analysis

Operator Language

Spanish (1%)

Total Code Size

480,3 KB

🔗 API Endpoints Detected

Other

20

WebSocket (Real-time)

1

🔐 Obfuscation Detected

: Heavy

🤖 AI-Extracted Threat Intelligence

📊 Attack Flow

```
┌─────────────────────────────────────────────────────────────────┐
│                VICTIM VISITS PHISHING PAGE                      │
│           (Fake login, verification, support page)             │
└─────────────────────────┬───────────────────────────────────────┘
                          │
                          ▼
┌─────────────────────────────────────────────────────────────────┐
│              VICTIM ENTERS CREDENTIALS (Form 1)                │
│                                                                 │
│  - Email/Username                                               │
│  - Password                                                     │
│  - 2FA code (if requested)                                      │
│  - Seed phrase (if crypto-related)                              │
└─────────────────────────┬───────────────────────────────────────┘
                          │
                          ▼
┌─────────────────────────────────────────────────────────────────┐
│              FORM SUBMISSION (JavaScript POST)                  │
│                                                                 │
│  Credentials sent to backend server                             │
└─────────────────────────┬───────────────────────────────────────┘
                          │
                          ▼
┌─────────────────────────────────────────────────────────────────┐
│              VICTIM SEES FAKE ERROR / REDIRECT                  │
│                                                                 │
│  - "Incorrect password, try again"                              │
│  - "Account locked, contact support"                            │
│  - Redirect to legitimate site                                  │
└─────────────────────────┬───────────────────────────────────────┘
                          │
                          ▼
┌─────────────────────────────────────────────────────────────────┐
│                🚨 CREDENTIALS STOLEN                            │
│                                                                 │
│  Attacker can now:                                              │
│  - Access victim's account                                      │
│  - Bypass 2FA (if captured)                                     │
│  - Steal funds (if crypto seed phrase)                          │
└─────────────────────────────────────────────────────────────────┘
```