EN ES PT

Phishing Analysis

Detailed analysis of captured phishing page

Back to Stats

Captura Visual

Screenshot of dorianixfloxin.com

Información de Detección

http://dorianixfloxin.com
Detected Brand
Dorianix Floxin
Country
International
Confianza
100%
HTTP Status
200
Report ID
9af2ea1d-eca…
Analyzed
2026-01-30 12:41
Final URL (after redirects)
https://dorianixfloxin.com/

Hashes de Contenido (Similitud HTML)

Used to detect similar phishing pages based on HTML content

Algorithm Hash Value
CONTENT TLSH
T177B3DD274219692B4477C2D130795F3BE1A5DE8BFAE70A014EECC7F62BF9C90B41A119
CONTENT ssdeep
1536:WGY2pR4nXBKpSpFl26vFRmNwmN84YA/t8P57:uSUMsRmNwmN+

Hashes Visuales (Similitud de Captura)

Used to detect visually similar phishing pages based on screenshots

Algorithm Hash Value
VISUAL pHash
de16e9e91c43b641
VISUAL aHash
0000040400fffbff
VISUAL dHash
9eececaca4230333
VISUAL wHash
000004047effffff
VISUAL colorHash
1b402008040
VISUAL cropResistant
808080c0d0808080,808080c0c0808080,808080c0d0c08082,a080b89a9aa88080,004092ccccc40300,c833331333033333,d69cccecececa4a4,6f6e674d19368632,d9090f1f34662e14

Análisis de Código

Risk Score 79/100
Nivel de Amenaza ALTO
⚠️ Phishing Confirmed
🎣 Credential Harvester 🎣 OTP Stealer 🎣 Banking

🔬 Threat Analysis Report

• Amenaza: Phishing
• Objetivo: Usuarios de plataformas de trading de criptomonedas
• Método: Suplantación de identidad e ingeniería social
• Exfil: Envío de formulario, probablemente roba datos de usuario
• Indicadores: Edad del dominio, JavaScript ofuscado, formulario, testimonio de celebridad, llamada urgente a la acción
• Riesgo: ALTO

🔒 Obfuscation Detected

  • fromCharCode
  • document.write
  • unicode_escape

📡 API Calls Detected

  • gettup.php?subid5=
  • POST
  • /systems/geo-ip.php

📊 Desglose de Puntuación de Riesgo

Total Risk Score
90/100

Contributing Factors

Domain Age
Recent domain indicates potential malicious activity.
Obfuscated Javascript
Obfuscation is used to hide malicious code from detection.
Forms Present
Forms on phishing websites harvest user credentials.
Impersonation
The site impersonates a brand/service.

🔬 Análisis Integral de Amenazas

Tipo de Amenaza
Banking Credential Harvester
Objetivo
Dorianix Floxin users (International)
Método de Ataque
Brand impersonation + credential harvesting forms + obfuscated JavaScript
Canal de Exfiltración
Form submission (backend endpoint not detected - likely JavaScript-based)
Evaluación de Riesgo
HIGH - Automated credential harvesting with Form submission (backend endpoint not detected - likely JavaScript-based)

⚠️ Indicators of Compromise

  • Kit types: Credential Harvester, OTP Stealer, Banking
  • 38 obfuscation techniques

🏢 Análisis de Suplantación de Marca

Impersonated Brand
Dorianix Floxin
Fake Service
Cryptocurrency Trading Platform

Fraudulent Claims

⚔️ Metodología de Ataque

Primary Method: Credential Harvesting

The site uses a form to collect personal information and likely steal credentials, taking advantage of the user's belief that they are interacting with a legitimate financial service.

Secondary Method: Social Engineering

The site uses design elements like a celebrity endorsement to build trust and persuade users to enter their information.

🌐 Indicadores de Compromiso de Infraestructura

Domain Information

Dominio
dorianixfloxin.com
Registered
2023-09-21
Registrar
Unknown
Estado
active

🔬 JavaScript Deep Analysis

Operator Language
Portuguese (1%)
Total Code Size
19,5 KB

🔐 Obfuscation Detected

  • : None
  • : None
  • : None

🤖 AI-Extracted Threat Intelligence

Scan History for dorianixfloxin.com

Found 1 other scan for this domain

😰
"Nunca pensé que me pasaría a mí"
Esto dicen las 2.3 millones de víctimas cada año. No esperes a ser una estadística.