Phishing Analysis
Detailed analysis of captured phishing page
Captura Visual
No screenshot available
Información de Detección
https://norevixpulses-de.com
Detected Brand
Unknown
Country
International
Confianza
95%
HTTP Status
200
Report ID
7d763c79-438…
Analyzed
2026-08-15 10:54
Final URL (after redirects)
https://norevixpulses-de.com/
Hashes de Contenido (Similitud HTML)
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T11414D823125876264037D3D02065DF76F3B6BA9BFB63CB0047E887B676F9C4C640A56A |
|
CONTENT
ssdeep
|
1536:pHjxvvV2RjuUgQmTa3MZo+Hd1+E08uHZIErrTqCHNjXt1XDyKWPw+h+xlshwt0we:fvHOQO8uHZIErrTqCtjLlkRuIsm |
Hashes Visuales (Similitud de Captura)
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
8ad6563623b254fc |
|
VISUAL
aHash
|
663818290100d901 |
|
VISUAL
dHash
|
cc31326b2b232b2b |
|
VISUAL
wHash
|
66bc98bd81b1db81 |
|
VISUAL
colorHash
|
38250001000 |
|
VISUAL
cropResistant
|
3232f3734d5dc9d5,fef3f3f6e6ccf0c1,cc31326b2b232b2b |
Análisis de Código
Risk Score
63/100
Nivel de Amenaza
ALTO
⚠️ Phishing Confirmed
🎣 Credential Harvester
🔬 Threat Analysis Report
• Amenaza: Fraude de Inversión en Criptomonedas
• Objetivo: Usuarios financieros
• Método: Página de aterrizaje de phishing para capturar datos
• Exfil: Endpoint /send mediante JS ofuscado
• Indicadores: Marca genérica, reseñas falsas, CTA fraudulento
• Riesgo: Alto
🔐 Credential Harvesting Forms
🔒 Obfuscation Detected
- unicode_escape
🎯 Kit Endpoints
- /send
📡 API Calls Detected
- https://ipapi.co/json/
📤 Form Action Targets
- /send
📊 Desglose de Puntuación de Riesgo
Total Risk Score
95/100
Contributing Factors
JavaScript Obfuscation
Used to hide malicious submission logic.
Fraudulent Business Model
Impersonates crypto platform with fake social proof.
🔬 Análisis Integral de Amenazas
Tipo de Amenaza
Credential Harvesting Kit
Objetivo
General public
Método de Ataque
credential harvesting forms + obfuscated JavaScript
Canal de Exfiltración
HTTP POST to backend
Evaluación de Riesgo
HIGH - Automated credential harvesting with HTTP POST to backend
⚠️ Indicators of Compromise
- Kit types: Credential Harvester
- 31 obfuscation techniques
🏢 Análisis de Suplantación de Marca
Impersonated Brand
NorevixPulses
Fake Service
Crypto Trading Platform
Fraudulent Claims
⚔️ Metodología de Ataque
Primary Method: Credential Harvesting
The site lures victims to sign up on a fake trading platform to steal account credentials or PII.
Secondary Method: Financial Fraud
Users are prompted to deposit funds into the fake platform that are then stolen.
🌐 Indicadores de Compromiso de Infraestructura
Domain Information
Dominio
norevixpulses-de.com
Registered
2026-04-23
Registrar
Unknown
Estado
Active
🤖 AI-Extracted Threat Intelligence
"Nunca pensé que me pasaría a mí"
Esto dicen las 2.3 millones de víctimas cada año. No esperes a ser una estadística.