Phishing Analysis
Detailed analysis of captured phishing page
Captura Visual
Información de Detección
https://ai-openclaw.live/
Detected Brand
Pump.fun
Country
International
Confianza
95%
HTTP Status
200
Report ID
a86e79b7-979…
Analyzed
2026-07-27 11:33
Final URL (after redirects)
https://ai-openclaw.shop/x/
Hashes de Contenido (Similitud HTML)
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T1B003A470D1492926B177D4D1E471936FB2A1C34CDB930B5897EC936AB6CACB1FE221C8 |
|
CONTENT
ssdeep
|
768:dKUS33gQS1CcuWCvQODcuWCvQOqzebbiGSMJaUVniJI3OASAIIzCj/F6byyY0fKW:03gQS1CcuWCvQODcuWCvQOxtW+eASAI+ |
Hashes Visuales (Similitud de Captura)
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
cc993366cc996666 |
|
VISUAL
aHash
|
0000181818000000 |
|
VISUAL
dHash
|
0008303030080000 |
|
VISUAL
wHash
|
bd5abd3cbd42a500 |
|
VISUAL
colorHash
|
38200040006 |
|
VISUAL
cropResistant
|
0008303030080000 |
Análisis de Código
Risk Score
74/100
Nivel de Amenaza
ALTO
⚠️ Phishing Confirmed
🎣 Personal Info
WebSocket C2
🔬 Threat Analysis Report
• Amenaza: Drenador de criptomonedas
• Objetivo: Usuarios de Pump.fun
• Método: Conexión a dApp maliciosa
• Exfil: Captura de datos vía WebSocket
• Indicadores: JS ofuscado, dominio sospechoso
• Riesgo: Crítico
🔒 Obfuscation Detected
- atob
- unescape
- base64_strings
🎯 Kit Endpoints
- https://openclaw.ai/blog
📡 API Calls Detected
- https://pump.fun/2tunJMkYJTwU57zf632sQ9ynKbudG3z85UYzFByGpump
- https://pump.fun/beXjn8EghNXnKCucBh1oiRa23rmnrhrpUvPBLPupump
- https://pump.fun/2ZvFgTyLMrgyLmoPHtD5KsTyALh14ffzxJoni4oPpump
- https://pump.fun/6Bi9sLPRwyn1Z3NvBSUPC1QUMUDHZW3p7GdTLXfBfy5i
- https://pump.fun/FL4eKdJrVZ1dVu1RoekeQRnuPxavzD4oCcR5HTcspump
- https://pump.fun/HpmEKB59BpjrejUgyD4CBo2pYepZVsvHW2KBjQTPpump
- https://pump.fun/8vgaTBW1nz4fBboCYFph7MVSLsgL8wBbex9M1hE5pump
- https://pump.fun/5g8HQVhmmXBZ7mRH2PqYrWAh1tb628HJxD6vfRkxWuLi
- https://api.dexscreener.com/token-boosts/latest/v1
- https://pump.fun/${t.tokenAddress||
- POST
- https://pump.fun/8qw8VRw5EajAjaijrLrnqP9AgThRsnvLeHxeSWyCfFhA
- https://pump.fun/8kAYCongF4r6kVKe2uhDTJZhTEANcyAjUn3ZqgGxpump
- https://pump.fun/2p6PYHMVb97RrRyf7p98dPsBZCL5HxVgQYxQHDPjo4d5
- https://pump.fun/96X4zg5T4NFWzTVFXHsadvYbxbzFX2Rqt3GXUv92pump
📊 Desglose de Puntuación de Riesgo
Total Risk Score
95/100
Contributing Factors
Malicious Scripting
Use of obfuscated exfiltration scripts.
Impersonation
Targets legitimate crypto platform Pump.fun.
🔬 Análisis Integral de Amenazas
Tipo de Amenaza
Cryptocurrency Wallet Drainer
Objetivo
Pump.fun users (International)
Método de Ataque
Brand impersonation + real-time WebSocket exfiltration + obfuscated JavaScript
Canal de Exfiltración
WebSocket (1 endpoints)
Evaluación de Riesgo
HIGH - Automated credential harvesting with WebSocket (1 endpoints)
⚠️ Indicators of Compromise
- Kit types: Personal Info
- 5 obfuscation techniques
🏢 Análisis de Suplantación de Marca
Impersonated Brand
Pump.fun
Official Website
https://pump.fun
Fake Service
Pump.fun AI Data Sync
Fraudulent Claims
⚔️ Metodología de Ataque
Primary Method: Wallet Drainer
The site uses social engineering to prompt a wallet connection, subsequently executing malicious transactions to empty assets.
Secondary Method: Data Harvesting
Uses WebSockets to monitor session activity and extract metadata.
Target Blockchain
Solana
🌐 Indicadores de Compromiso de Infraestructura
Domain Information
Dominio
ai-openclaw.live
Registered
Unknown
Registrar
Unknown
Estado
Active
🤖 AI-Extracted Threat Intelligence
Similar Websites
Pages with identical visual appearance (based on perceptual hash)
"Nunca pensé que me pasaría a mí"
Esto dicen las 2.3 millones de víctimas cada año. No esperes a ser una estadística.