EN ES PT

Phishing Analysis

Detailed analysis of captured phishing page

Back to Stats

Captura Visual

Screenshot of bet63bbb.com

Información de Detección

https://bet63bbb.com/fish/197
Detected Brand
Bet365
Country
International
Confianza
100%
HTTP Status
200
Report ID
9c5f283c-18d…
Analyzed
2026-03-11 03:45
Final URL (after redirects)
https://bet63bbb.com/fish/197#

Hashes de Contenido (Similitud HTML)

Used to detect similar phishing pages based on HTML content

Algorithm Hash Value
CONTENT TLSH
T129F23070945AAA3702F3A2E57B743B5EB3C5E289D903070426F8D39E4FDBE94ED21161
CONTENT ssdeep
384:wT3Jbc+VWfzKYvwKQoyLQ5/kSPoWCygUyD084mR8m9Q8lzK:wT9c+V0ztvwKQoyLQ5/kSPoZ1WQ8yVK

Hashes Visuales (Similitud de Captura)

Used to detect visually similar phishing pages based on screenshots

Algorithm Hash Value
VISUAL pHash
e992966f6729c134
VISUAL aHash
feff7e0081f9017c
VISUAL dHash
4d29d41323e32bd0
VISUAL wHash
2cff7e0081f9017e
VISUAL colorHash
00001000380
VISUAL cropResistant
0c00080880e2f8fc,24d2c0b2b2c0d222,70b0b6376ce9a7c6,9834fe8eccb8b4cc,4cce9e8699d9b0aa,d4d4da19a5b5bd3c,4d29d41323e32bd0

Análisis de Código

Risk Score 100/100
Nivel de Amenaza ALTO
⚠️ Phishing Confirmed
🎣 Credential Harvester 🎣 OTP Stealer 🎣 Card Stealer 🎣 Banking 🎣 Personal Info

🔬 Threat Analysis Report

• Amenaza: Phishing
• Objetivo: Usuarios de Bet365
• Método: Suplantación de identidad y recopilación de credenciales
• Exfil: /login_action
• Indicadores: Coincidencia de dominio, ofuscación, acciones de formulario.
• Riesgo: ALTO

🔐 Credential Harvesting Forms

🔒 Obfuscation Detected

  • eval
  • fromCharCode
  • unescape
  • document.write
  • hex_escape
  • unicode_escape
  • base64_strings

🎯 Kit Endpoints

  • //3f38sfb.qdhyxt.com/plus/css/custom/login_modal_custom.css?ver=1726650059?v=1773015194
  • //3f38sfb.qdhyxt.com/plus/js/custom/login.js?ver=1597629260
  • /login_action
  • //3f38sfb.qdhyxt.com/images_plus/main/logo.gif?ver=1612839866
  • //3f38sfb.qdhyxt.com/plus/js/custom/login_custom.js?ver=1598008226
  • //3f38sfb.qdhyxt.com/plus/css/unite/login_modal_unite.css?ver=1738950076?v=1773015194
  • //3f38sfb.qdhyxt.com/images_plus/footer/footer-logo.png?ver=1600719130
  • /logout
  • //3f38sfb.qdhyxt.com/plus/css/unite/login_unite.css?ver=1614680239
  • #normalLogin
  • //3f38sfb.qdhyxt.com/plus/css/custom/login_custom.css?ver=1663905027

📡 API Calls Detected

  • https://5sx5x5y.bipnzhh8.com/03694358abf04e8jkfle-keli6c4e59a3f8458672b518938744adfbd2b99a2ede4903545d86cda66e48a54429
  • /forgot
  • /mbuhx0as4kui
  • /prizedraw/default
  • POST
  • /loadGame/

📤 Form Action Targets

  • /login_action

📊 Desglose de Puntuación de Riesgo

Total Risk Score
90/100

Contributing Factors

Domain Mismatch
The domain name is a clear typo-squatting attempt.
Form Actions and Credential Harvesting
The site contains a login form with a suspicious action attribute and is collecting sensitive information.
JavaScript Obfuscation
Obfuscated code is a common tactic to evade detection.

🔬 Análisis Integral de Amenazas

Tipo de Amenaza
Banking Credential Harvester
Objetivo
Bet365 users (International)
Método de Ataque
Brand impersonation + credential harvesting forms + obfuscated JavaScript
Canal de Exfiltración
HTTP POST to backend
Evaluación de Riesgo
CRITICAL - Automated credential harvesting with HTTP POST to backend

⚠️ Indicators of Compromise

  • Kit types: Credential Harvester, OTP Stealer, Card Stealer, Banking, Personal Info
  • 55 obfuscation techniques

🏢 Análisis de Suplantación de Marca

Impersonated Brand
Bet365
Official Website
https://www.bet365.com/
Fake Service
Bet365 login

⚔️ Metodología de Ataque

Primary Method: Credential Harvesting

The attacker attempts to steal user credentials by mimicking the Bet365 login page.

Secondary Method: Typosquatting

The malicious domain name is similar to the legitimate Bet365 domain to deceive users.

🌐 Indicadores de Compromiso de Infraestructura

Domain Information

Dominio
bet63bbb.com
Registered
2018-12-03
Registrar
Unknown
Estado
Active

🤖 AI-Extracted Threat Intelligence

Scan History for bet63bbb.com

Found 1 other scan for this domain

😰
"Nunca pensé que me pasaría a mí"
Esto dicen las 2.3 millones de víctimas cada año. No esperes a ser una estadística.