EN ES PT

Phishing Analysis

Detailed analysis of captured phishing page

Back to Stats

Captura Visual

No screenshot available

Información de Detección

https://weraml.com/
Detected Brand
Unknown
Country
International
Confianza
100%
HTTP Status
200
Report ID
9e58f26e-7c5…
Analyzed
2026-02-27 13:39

Hashes de Contenido (Similitud HTML)

Used to detect similar phishing pages based on HTML content

Algorithm Hash Value
CONTENT TLSH
T14123533063669C3B519795E5ABB17F1A22D3E315C3420B8466F8A27E0FD2C2CFC661A5
CONTENT ssdeep
768:k6cwgGeeeOoqwq933XFEOTe7dQWWc/ZToBV80U8sV2TH/DVe2uLK1b9KQi+hIQlm:kUTeeeOoqwq93HFEOTelWcR2vU8sKrVG

Hashes Visuales (Similitud de Captura)

Used to detect visually similar phishing pages based on screenshots

Algorithm Hash Value
VISUAL pHash
f46a0f98385a89f6
VISUAL aHash
80f0e0c0c71e0e87
VISUAL dHash
3a868c928e303c6e
VISUAL wHash
80f0f0e0c71ebea7
VISUAL colorHash
30007000000
VISUAL cropResistant
3a868c928e303c6e

Análisis de Código

Risk Score 79/100
Nivel de Amenaza ALTO
⚠️ Phishing Confirmed
🎣 Credential Harvester 🎣 OTP Stealer 🎣 Personal Info

🔬 Threat Analysis Report

• Amenaza: Phishing
• Objetivo: Clientes bancarios
• Método: Suplantación de identidad e ingeniería social
• Exfil: Probablemente datos confidenciales de la cuenta bancaria.
• Indicadores: Dominio reciente, ofuscación, formularios, reclamo AML.
• Riesgo: ALTO

🔒 Obfuscation Detected

  • fromCharCode
  • unescape
  • document.write

📡 API Calls Detected

  • POST

📊 Desglose de Puntuación de Riesgo

Total Risk Score
95/100

Contributing Factors

Recent Domain
Domain created very recently (less than 30 days) increasing the likelihood of phishing.
Obfuscation
The use of JavaScript obfuscation is a common technique to hide malicious code.
Domain Mismatch
The domain weraml.com is not associated with any legitimate banking or financial institution. This mismatch is a clear sign of phishing.
Forms Present
Presence of forms indicates a likely attempt to collect user data (credentials, etc).

🔬 Análisis Integral de Amenazas

Tipo de Amenaza
Two-Factor Authentication Stealer
Objetivo
General public
Método de Ataque
credential harvesting forms + obfuscated JavaScript
Canal de Exfiltración
Form submission (backend endpoint not detected - likely JavaScript-based)
Evaluación de Riesgo
HIGH - Automated credential harvesting with Form submission (backend endpoint not detected - likely JavaScript-based)

⚠️ Indicators of Compromise

  • Kit types: Credential Harvester, OTP Stealer, Personal Info
  • 10 obfuscation techniques

🏢 Análisis de Suplantación de Marca

Impersonated Brand
Unknown
Fake Service
AML Verification

Fraudulent Claims

⚔️ Metodología de Ataque

Primary Method: Credential Harvesting

The phishing site attempts to steal user credentials by mimicking a legitimate financial service and directing users to provide account information.

Secondary Method: Social engineering

The site uses language about AML compliance to create a sense of urgency, pressuring users into providing their information.

🌐 Indicadores de Compromiso de Infraestructura

Domain Information

Dominio
weraml.com
Registered
2024-02-25
Registrar
NameCheap
Estado
ACTIVE

🤖 AI-Extracted Threat Intelligence

Similar Websites

Pages with identical visual appearance (based on perceptual hash)

Screenshot
Weryfikacja AML (Fraudulent impersonation)
https://verix.onl/
Jun 09, 2026
 Screenshot
Unknown Bank (AML impersonation)
https://werkonban.com/
Mar 23, 2026
 Screenshot
AML Verification (likely a financial institution or service)
https://werbagov.online/
Feb 13, 2026
No screenshot
Desconocido
https://wergovaml.com/
Feb 12, 2026
 Screenshot
Financial Institution (Unknown)
https://werbaaml.online/
Feb 02, 2026
😰
"Nunca pensé que me pasaría a mí"
Esto dicen las 2.3 millones de víctimas cada año. No esperes a ser una estadística.