EN ES PT

Phishing Analysis

Detailed analysis of captured phishing page

Back to Stats

Captura Visual

Screenshot of goldenjackpotpro.rest

Información de Detección

https://goldenjackpotpro.rest
Detected Brand
Elon Musk / Casino
Country
International
Confianza
100%
HTTP Status
200
Report ID
7c044e90-b9c…
Analyzed
2026-01-29 21:29
Final URL (after redirects)
https://goldenjackpotpro.rest/

Hashes de Contenido (Similitud HTML)

Used to detect similar phishing pages based on HTML content

Algorithm Hash Value
CONTENT TLSH
T1B8E229B4A230E335B2C247E8DA6429287A5FE1DCD7C695B4E388AF1170D6CE8D5160CF
CONTENT ssdeep
768:4r/aJcuv7QCRenHhhPhleMeDGCSPxeeWmHDW:PNGpxFWSW

Hashes Visuales (Similitud de Captura)

Used to detect visually similar phishing pages based on screenshots

Algorithm Hash Value
VISUAL pHash
c3073cf2781c786b
VISUAL aHash
0066303860e67610
VISUAL dHash
4c4c4ac14bc8acb1
VISUAL wHash
a0263e38e8f67f50
VISUAL colorHash
30000600018
VISUAL cropResistant
f01ede9bf2cce972,4c4c4ac14bc8acb1

Análisis de Código

Risk Score 100/100
Nivel de Amenaza ALTO
⚠️ Phishing Confirmed
🎣 Credential Harvester 🎣 OTP Stealer 🎣 Card Stealer 🎣 Banking 🎣 Personal Info
WebSocket C2

🔬 Threat Analysis Report

• Amenaza: Phishing de credenciales
• Objetivo: Usuarios desprevenidos
• Método: Sitio web engañoso que suplanta a un casino
• Exfil: wss://gambler-work.com/api/ws
• Indicadores: Dominio no relacionado, imagen de Elon Musk, entrada de contraseña, edad reciente del dominio, envío de formulario JavaScript
• Riesgo: ALTO

🔒 Obfuscation Detected

  • atob
  • eval
  • fromCharCode
  • unescape
  • base64_strings

📡 API Calls Detected

  • POST
  • GET

📊 Desglose de Puntuación de Riesgo

Total Risk Score
90/100

Contributing Factors

Recent Domain Age
Domain is less than 60 days old, a common tactic in phishing.
Impersonation
Uses Elon Musk's image to build fake trust.
Form Submission
Presence of a form requesting sensitive information (email and password).
Obfuscated Javascript
Javascript is obfuscated with atob, eval, and fromCharCode potentially hiding malicious code

🔬 Análisis Integral de Amenazas

Tipo de Amenaza
Banking Credential Harvester
Objetivo
General public
Método de Ataque
Brand impersonation + real-time WebSocket exfiltration + obfuscated JavaScript
Canal de Exfiltración
WebSocket (1 endpoints)
Evaluación de Riesgo
CRITICAL - Automated credential harvesting with WebSocket (1 endpoints)

⚠️ Indicators of Compromise

  • Kit types: Credential Harvester, OTP Stealer, Card Stealer, Banking, Personal Info
  • 151 obfuscation techniques

🏢 Análisis de Suplantación de Marca

Impersonated Brand
Casino (Unspecified)
Fake Service
Casino Signup/Registration

Fraudulent Claims

⚔️ Metodología de Ataque

Primary Method: Credential Phishing

The website mimics a casino signup page. It uses an unrelated domain and the image of Elon Musk to appear legitimate and lure users to enter their credentials. Submitted data is captured to steal user account information.

🌐 Indicadores de Compromiso de Infraestructura

🦠 Malicious Files

Main File
_next/static/chunks/main-app-fef4a8898ec7782a.js
File Size

Functions: submitForm(), sendData()

🔌 External APIs Abused

Facebook
  • account: null
  • purpose: tracking user interactions and events

📊 Diagrama de Flujo de Ataque

User fills <input name='email'> → submitForm() → fetch('https://goldenjackpotpro.rest/api/submit') → exfiltrate data

🔬 JavaScript Deep Analysis

Operator Language
English (1%)
Sophistication Level
Basic
Total Code Size
1000,5 KB

🔗 API Endpoints Detected

Other
55
Backend API
1
WebSocket (Real-time)
1

🔐 Obfuscation Detected

  • : Moderate
  • : Moderate
  • : Moderate
  • : None
  • : Light
  • : Light
  • : Light
  • : Light
  • : Light
  • : Light
  • : None
  • : Light
  • : Light
  • : Light
  • : Light
  • : Light
  • : Light
  • : Light
  • : Light

🤖 AI-Extracted Threat Intelligence

📊 Attack Flow

User fills <input name='email'> → submitForm() → fetch('https://goldenjackpotpro.rest/api/submit') → exfiltrate data

🎯 Malicious Files Identified

Main Drainer
_next/static/chunks/main-app-fef4a8898ec7782a.js
File Size
45KB
Malicious Functions
  • submitForm()
  • sendData()

🌐 External APIs Abused

  • Facebook
    Propósito: tracking user interactions and events

Similar Websites

Pages with identical visual appearance (based on perceptual hash)

Screenshot
X (formerly Twitter) / Elon Musk
https://casdex.cc/
Jun 21, 2026
No screenshot
Desconocido
https://desbet.top/
Feb 19, 2026
 Screenshot
Elon Musk
https://guwau.com
Ene 15, 2026
😰
"Nunca pensé que me pasaría a mí"
Esto dicen las 2.3 millones de víctimas cada año. No esperes a ser una estadística.