Phishing Analysis
Detailed analysis of captured phishing page
Captura Visual
Información de Detección
http://765g1update.update.8update.05v6nrsclqx.classroom.de5.net
Detected Brand
Doge Unblocker (DogeUB)
Country
International
Confianza
100%
HTTP Status
200
Report ID
908c7e49-d8c…
Analyzed
2026-05-29 20:10
Final URL (after redirects)
https://765g1update.update.8update.05v6nrsclqx.classroom.de5.net/
Hashes de Contenido (Similitud HTML)
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T1B752A364230C192D601747C4FFA5F779639EA396E31D501CE0AE22629783DD5ECB3AB8 |
|
CONTENT
ssdeep
|
96:R39GS27MrS2eSTuliZqj1ufcya/koXLk77mbukPVieu7mbp5Vi77mbAfViq7mbOc:FNbW8+iZqUUN7+ciMihiai8pFF6/5pHT |
Hashes Visuales (Similitud de Captura)
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
8cccad3333332766 |
|
VISUAL
aHash
|
8018381800000081 |
|
VISUAL
dHash
|
13b0213101110013 |
|
VISUAL
wHash
|
813cff000cff00ff |
|
VISUAL
colorHash
|
38007000000 |
|
VISUAL
cropResistant
|
13b0213101110013 |
Análisis de Código
Risk Score
100/100
Nivel de Amenaza
ALTO
⚠️ Phishing Confirmed
🎣 Credential Harvester
🎣 OTP Stealer
🎣 Banking
🎣 Personal Info
🔬 Threat Analysis Report
• Amenaza: Phishing/Suplantación
• Objetivo: DogeUB (Proxy/Unblocker)
• Método: Falsificación de dominio mediante subdominios aleatorios
• Exfil: Captura de datos vía JavaScript
• Indicadores: Ofuscación de JS malicioso detectada
• Riesgo: Alto debido al potencial robo de credenciales
🔒 Obfuscation Detected
- atob
- fromCharCode
- hex_escape
- unicode_escape
- base64_strings
📡 API Calls Detected
- https://www.google.com/ccm/geo
- https://publicsuffix.org/list/public_suffix_list.dat
📊 Desglose de Puntuación de Riesgo
Total Risk Score
95/100
Contributing Factors
Malicious Obfuscation
Detection of atob/fromCharCode in scripts
Suspicious Infrastructure
Host utilizes de5.net dynamic subdomains
Impersonation
Cloning of DogeUB interface
🔬 Análisis Integral de Amenazas
Tipo de Amenaza
Banking Credential Harvester
Objetivo
Doge Unblocker (DogeUB) users (International)
Método de Ataque
Brand impersonation + credential harvesting forms + obfuscated JavaScript
Canal de Exfiltración
Form submission (backend endpoint not detected - likely JavaScript-based)
Evaluación de Riesgo
CRITICAL - Automated credential harvesting with Form submission (backend endpoint not detected - likely JavaScript-based)
⚠️ Indicators of Compromise
- Kit types: Credential Harvester, OTP Stealer, Banking, Personal Info
- 715 obfuscation techniques
🏢 Análisis de Suplantación de Marca
Impersonated Brand
DogeUB
Official Website
https://dogeunblocker.com/
Fake Service
DogeUB Web Proxy
Fraudulent Claims
⚔️ Metodología de Ataque
Primary Method: Credential/Data Harvesting
The site uses obfuscated JS to intercept user input and browser data before forwarding it to external C2 servers.
Secondary Method: Man-in-the-Middle Proxy
The site acts as a proxy to monitor all unencrypted traffic from the user's browser.
🌐 Indicadores de Compromiso de Infraestructura
Domain Information
Dominio
classroom.de5.net
Registered
Unknown
Registrar
Unknown
Estado
active
🤖 AI-Extracted Threat Intelligence
Similar Websites
Pages with identical visual appearance (based on perceptual hash)
Desconocido
https://cdn.gosafemode.com/screenshots/b7fd80be6470.png
May 29, 2026
Desconocido
https://cdn.gosafemode.com/screenshots/fad58ddb655b.png
May 29, 2026
Desconocido
https://cdn.gosafemode.com/screenshots/05e001e75c14.png
May 29, 2026
Desconocido
https://cdn.gosafemode.com/screenshots/3e2b24a694ef.png
May 29, 2026
Desconocido
https://cdn.gosafemode.com/screenshots/cd3fab926b6c.png
May 29, 2026
"Nunca pensé que me pasaría a mí"
Esto dicen las 2.3 millones de víctimas cada año. No esperes a ser una estadística.