SafeMode - Analysis: kakefot735bezill.crabdance.com

Captura Visual

Screenshot of kakefot735bezill.crabdance.com

Información de Detección

http://kakefot735bezill.crabdance.com/NBJGUHY-SBDGFCVDF/LHKJOUI-CQDSEZXA/VFGTHY-PMOLKJU/

Detected Brand

Crédit Agricole

Country

Unknown

Confianza

100%

HTTP Status

200

Report ID

9ee2606a-d64…

Analyzed

2026-05-22 22:09

Final URL (after redirects)

https://kakefot735bezill.crabdance.com/NBJGUHY-SBDGFCVDF/LHKJOUI-CQDSEZXA/VFGTHY-PMOLKJU/

Hashes de Contenido (Similitud HTML)

Used to detect similar phishing pages based on HTML content

Algorithm	Hash Value
CONTENT TLSH	T1C562506190A05C3B429393C1B6359B1A37DAC74ACA8B574197F8839A1FF6C64DC0F72E
CONTENT ssdeep	192:hMwwxkMaNkIZI7H1S6QrQHQPEihNytR0xMv0e/xVSYw0L12:hMwJk7H1S6QrQHQPZe0xM8e/fPwO12

Hashes Visuales (Similitud de Captura)

Used to detect visually similar phishing pages based on screenshots

Algorithm	Hash Value
VISUAL pHash	b333c4d41cced54c
VISUAL aHash	ff0f0f0f0f0fffff
VISUAL dHash	d81b5b5b1b980018
VISUAL wHash	0c0909090f0fffff
VISUAL colorHash	06000000c00
VISUAL cropResistant	d81b5b5b1b980018,a280a02b2b808080,812929326949a541

Análisis de Código

Nivel de Amenaza ALTO

⚠️ Phishing Confirmed

🔐 Credential Harvesting Forms

📤 Form Action Targets

./core/actions/departement.php

📊 Desglose de Puntuación de Riesgo

Total Risk Score

70/100

Contributing Factors

Credential Harvesting

Credential harvesting detected with 1 form(s) capturing sensitive data

🔬 Análisis Integral de Amenazas

Tipo de Amenaza

Crédit Agricole Credential Harvester

Objetivo

Crédit Agricole users

Método de Ataque

credential harvesting forms

Canal de Exfiltración

HTTP POST to backend

Evaluación de Riesgo

LOW - Automated credential harvesting with HTTP POST to backend

🏢 Análisis de Suplantación de Marca

Impersonated Brand

Crédit Agricole

Official Website

N/A

Fake Service

Credential harvesting service

⚔️ Metodología de Ataque

Primary Method: Crédit Agricole Credential Harvesting

Fake Crédit Agricole login page with 1 form. Victim enters credentials which are captured and transmitted to attacker's server. Page may impersonate Crédit Agricole official login to appear legitimate.

Secondary Method: Standard Phishing Techniques

Uses typical phishing tactics including brand impersonation, urgency tactics, and social engineering to trick victims into providing sensitive information.