EN ES PT

Phishing Analysis

Detailed analysis of captured phishing page

Back to Stats

Captura Visual

No screenshot available

Información de Detección

https://3656d.cc
Detected Brand
Unknown
Country
International
Confianza
100%
HTTP Status
200
Report ID
5bdcd9e8-326…
Analyzed
2026-03-17 03:16
Final URL (after redirects)
https://3656d.cc:8989/verify-page/index.html

Hashes de Contenido (Similitud HTML)

Used to detect similar phishing pages based on HTML content

Algorithm Hash Value
CONTENT TLSH
T180B14271C05A293BB907C1D8B1B0EB0A72D7534EDB82096582FD027A37CFD51F91A9D6
CONTENT ssdeep
96:FuwEM6S8LUfANuZsdFYTYcBZbEYTPdp2sclVSTfni1EdvB:H6SJouZs3kBNTPdp2sclEDnx

Hashes Visuales (Similitud de Captura)

Used to detect visually similar phishing pages based on screenshots

Algorithm Hash Value
VISUAL pHash
d99905cb3c27c336
VISUAL aHash
ffffffffdc280000
VISUAL dHash
f2b2ca2b21d15166
VISUAL wHash
7fffffdb98000000
VISUAL colorHash
0e0000001c0
VISUAL cropResistant
f2b39ac8ab2b35d9,8c6cacdcd86a7e5c,f87e7f7ffffebdaa,2b2835d950516364,210830b2b2320c11,11043232b2300c21

Análisis de Código

Risk Score 100/100
Nivel de Amenaza ALTO
⚠️ Phishing Confirmed
🎣 Credential Harvester 🎣 OTP Stealer 🎣 Card Stealer 🎣 Banking 🎣 Personal Info

🔬 Threat Analysis Report

• Amenaza: Phishing
• Objetivo: Desconocido
• Método: Redirección con Captcha malicioso
• Exfil: Desconocido
• Indicadores: JS ofuscado, Captcha sospechoso, diseño genérico.
• Riesgo: ALTO

🔒 Obfuscation Detected

  • fromCharCode
  • document.write

🎯 Kit Endpoints

  • https://3656d.cc:8989/verify-page/theme/default/layer.css?v=3.1.0

📊 Desglose de Puntuación de Riesgo

Total Risk Score
90/100

Contributing Factors

Suspicious Captcha
Captchas are often used to identify bot traffic. This one looks odd, raising suspicion
Obfuscated Javascript
Obfuscation is a common technique to hide malicious code from detection. This greatly increases the risk.
Generic Design
The lack of branding suggests it is not legitimate.
Form submission and JS detection
JavaScript form submission detected.

🔬 Análisis Integral de Amenazas

Tipo de Amenaza
Banking Credential Harvester
Objetivo
General public
Método de Ataque
credential harvesting forms + obfuscated JavaScript
Canal de Exfiltración
Form submission (backend endpoint not detected - likely JavaScript-based)
Evaluación de Riesgo
CRITICAL - Automated credential harvesting with Form submission (backend endpoint not detected - likely JavaScript-based)

⚠️ Indicators of Compromise

  • Kit types: Credential Harvester, OTP Stealer, Card Stealer, Banking, Personal Info
  • 6 obfuscation techniques

🏢 Análisis de Suplantación de Marca

Impersonated Brand
Unknown
Fake Service
Unknown

⚔️ Metodología de Ataque

Primary Method: Malicious Captcha Redirect

The user interacts with the Captcha, which could redirect them to a phishing website designed to steal credentials or install malware. The obfuscation is likely to conceal malicious javascript.

Secondary Method: Credential Harvesting

The site may harvest credentials or deliver a payload based on the users actions.

🌐 Indicadores de Compromiso de Infraestructura

Domain Information

Dominio
3656d.cc
Registered
2019-09-06T06:05:06Z
Registrar
Name.com, Inc.
Estado
ACTIVE

🤖 AI-Extracted Threat Intelligence

Scan History for 3656d.cc

Found 1 other scan for this domain

😰
"Nunca pensé que me pasaría a mí"
Esto dicen las 2.3 millones de víctimas cada año. No esperes a ser una estadística.