EN ES PT

Phishing Analysis

Detailed analysis of captured phishing page

Back to Stats

Captura Visual

Screenshot of corevestcapitals.com

Información de Detección

https://corevestcapitals.com/
Detected Brand
Corevest
Country
International
Confianza
100%
HTTP Status
200
Report ID
ad4d8f85-40c…
Analyzed
2026-06-27 23:23

Hashes de Contenido (Similitud HTML)

Used to detect similar phishing pages based on HTML content

Algorithm Hash Value
CONTENT TLSH
T152E3F874E3F5E1F9E106D3E0E5727835369619B9AF01CA4843F98FE8CAA245D895CC83
CONTENT ssdeep
1536:2Cjo44u44ynOI4DquYW0oxNO96BIn3DmeXYW0ox6O96BIn3DXeoYW0oxDO96BInd:g4DDeoeNeLp

Hashes Visuales (Similitud de Captura)

Used to detect visually similar phishing pages based on screenshots

Algorithm Hash Value
VISUAL pHash
9606e9499bce96c6
VISUAL aHash
7f0004040400ffff
VISUAL dHash
e08ccceccccca330
VISUAL wHash
ff0036060600ffff
VISUAL colorHash
02006000000
VISUAL cropResistant
a2a1859999858180,60e8e8a424666b02,2998dcec4d6c6460,0000000030381e1e,ec8ccceccccccc34

Análisis de Código

Risk Score 76/100
Nivel de Amenaza ALTO
⚠️ Phishing Confirmed
🎣 Credential Harvester 🎣 OTP Stealer 🎣 Banking 🎣 Personal Info

🔬 Threat Analysis Report

• Amenaza: Phishing Financiero / Recolección de credenciales
• Objetivo: Clientes de Corevest
• Método: Suplantación de identidad de firma de gestión de activos
• Exfil: Envío de formularios mediante JavaScript
• Indicadores: Código ofuscado, número de teléfono genérico
• Riesgo: Alto - robo de credenciales e información personal

🔒 Obfuscation Detected

  • atob
  • fromCharCode

📡 API Calls Detected

  • GET

📊 Desglose de Puntuación de Riesgo

Total Risk Score
92/100

Contributing Factors

JavaScript Obfuscation
Use of atob/fromCharCode to hide exfil logic
Suspicious Contact Info
Placeholder '1234567890' used for customer support
Domain Analysis
Newer domain registration patterns

🔬 Análisis Integral de Amenazas

Tipo de Amenaza
Banking Credential Harvester
Objetivo
Corevest users (International)
Método de Ataque
Brand impersonation + credential harvesting forms + obfuscated JavaScript
Canal de Exfiltración
Form submission (backend endpoint not detected - likely JavaScript-based)
Evaluación de Riesgo
HIGH - Automated credential harvesting with Form submission (backend endpoint not detected - likely JavaScript-based)

⚠️ Indicators of Compromise

  • Kit types: Credential Harvester, OTP Stealer, Banking, Personal Info
  • 10 obfuscation techniques

🏢 Análisis de Suplantación de Marca

Impersonated Brand
Corevest
Official Website
unknown
Fake Service
Asset Management / Banking

Fraudulent Claims

⚔️ Metodología de Ataque

Primary Method: Credential Harvesting

The site uses a fake banking interface to capture user credentials for 'E-Banking' access, which are then exfiltrated via obfuscated JS requests.

Secondary Method: Brand Impersonation

Leverages the aesthetic of a financial institution to build false trust with victims.

🌐 Indicadores de Compromiso de Infraestructura

Domain Information

Dominio
corevestcapitals.com
Registered
2025-08-20
Registrar
Unknown
Estado
Active

🤖 AI-Extracted Threat Intelligence

😰
"Nunca pensé que me pasaría a mí"
Esto dicen las 2.3 millones de víctimas cada año. No esperes a ser una estadística.