EN ES PT

Phishing Analysis

Detailed analysis of captured phishing page

Back to Stats

Captura Visual

Screenshot of crestunitfinance.net

Información de Detección

https://crestunitfinance.net/
Detected Brand
Crestunit Finance
Country
International
Confianza
100%
HTTP Status
200
Report ID
8c1f9d56-d56…
Analyzed
2026-08-12 23:14

Hashes de Contenido (Similitud HTML)

Used to detect similar phishing pages based on HTML content

Algorithm Hash Value
CONTENT TLSH
T1BA6256B26154A93782F3C2D7BB25132FB2E34AC9C987065523FD871D8ED2E80EC15D56
CONTENT ssdeep
384:DLPukh6Uq3Ap7Yts4RaCS05HpIIHTpDqXm5RPLMrxwRVXjk7D3eYrW:fSIIJqXm5hgeLqrW

Hashes Visuales (Similitud de Captura)

Used to detect visually similar phishing pages based on screenshots

Algorithm Hash Value
VISUAL pHash
c3073c3079c7c7c6
VISUAL aHash
00007e7e7efcf8c0
VISUAL dHash
f8f8c0c0c0c02000
VISUAL wHash
00007f7e7efcf8c0
VISUAL colorHash
10000600030
VISUAL cropResistant
f8f8c0c0c0c02000

Análisis de Código

Risk Score 71/100
Nivel de Amenaza ALTO
⚠️ Phishing Confirmed
🎣 OTP Stealer 🎣 Banking

🔬 Threat Analysis Report

• Amenaza: Fraude Financiero/HYIP
• Objetivo: Inversores
• Método: Landing page corporativa engañosa con scripts ofuscados
• Exfil: Captura mediante formulario JavaScript
• Indicadores: Código fuente ofuscado, promesas financieras vagas
• Riesgo: Alto

🔒 Obfuscation Detected

  • fromCharCode
  • unescape

📡 API Calls Detected

  • POST
  • /api/sms/verify
  • /api/sms/send
  • /api/sms-verification-status

📊 Desglose de Puntuación de Riesgo

Total Risk Score
88/100

Contributing Factors

Obfuscation
Detection of fromCharCode/unescape used to obscure site logic.
Content
HYIP-style hyperbolic language common in investment scams.

🔬 Análisis Integral de Amenazas

Tipo de Amenaza
Banking Credential Harvester
Objetivo
Crestunit Finance users (International)
Método de Ataque
Brand impersonation + obfuscated JavaScript
Canal de Exfiltración
Form submission (backend endpoint not detected - likely JavaScript-based)
Evaluación de Riesgo
HIGH - Automated credential harvesting with Form submission (backend endpoint not detected - likely JavaScript-based)

⚠️ Indicators of Compromise

  • Kit types: OTP Stealer, Banking
  • 3 obfuscation techniques

🏢 Análisis de Suplantación de Marca

Impersonated Brand
Crestunit Finance
Fake Service
Investment Management

Fraudulent Claims

⚔️ Metodología de Ataque

Primary Method: Financial Fraud / Investment Scam

The site lures users into providing personal or financial data under the guise of an 'exclusive' investment opportunity.

Secondary Method: Credential Harvesting

Form inputs capture sensitive data which is then obfuscated and transmitted to a remote server.

🌐 Indicadores de Compromiso de Infraestructura

Domain Information

Dominio
crestunitfinance.net
Registered
2026-06-09
Registrar
Unknown
Estado
Active

🤖 AI-Extracted Threat Intelligence

😰
"Nunca pensé que me pasaría a mí"
Esto dicen las 2.3 millones de víctimas cada año. No esperes a ser una estadística.