Phishing Analysis
Detailed analysis of captured phishing page
Captura Visual
Información de Detección
https://trumpcasino.us
Detected Brand
Donald Trump Casino
Country
International
Confianza
100%
HTTP Status
200
Report ID
bcaef071-d21…
Analyzed
2026-01-29 21:28
Final URL (after redirects)
https://trumpcasino.us/
Hashes de Contenido (Similitud HTML)
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T16CE229B4A230D735B1C247E8DA6429287A5FE1DDD7C695B4E388AF11B0D6CE8D8250CB |
|
CONTENT
ssdeep
|
384:4r/aJcuvnQRvRhiXkdvNTDhPhLxeAxeDWNW1Tp34PxeeJEmuW3As0yRW8Md:4r/aJcuvnghhPhleMeDGCSPxeeWmHxW |
Hashes Visuales (Similitud de Captura)
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
c73338cc783e694c |
|
VISUAL
aHash
|
006660307078b690 |
|
VISUAL
dHash
|
4ccccac3e5e46431 |
|
VISUAL
wHash
|
a0666630787ebf98 |
|
VISUAL
colorHash
|
38206000000 |
|
VISUAL
cropResistant
|
85858a88da9a78fa,100c323232320810,4ccccac3e5e46431 |
Análisis de Código
Risk Score
100/100
Nivel de Amenaza
ALTO
⚠️ Phishing Confirmed
🎣 Credential Harvester
🎣 OTP Stealer
🎣 Card Stealer
🎣 Banking
🎣 Personal Info
WebSocket C2
🔬 Threat Analysis Report
• Amenaza: Phishing
• Objetivo: Usuarios desprevenidos
• Método: Suplantación de identidad y estafa de recompensa
• Exfil: wss://gambler-work.com/api/ws
• Indicadores: Dominio reciente, dominio no relacionado con la marca, uso del nombre de la marca, ofuscación de JavaScript, envío de formulario.
• Riesgo: Alto
🔒 Obfuscation Detected
- atob
- eval
- fromCharCode
- unescape
- unicode_escape
- base64_strings
📡 API Calls Detected
- POST
- GET
📊 Desglose de Puntuación de Riesgo
Total Risk Score
90/100
Contributing Factors
Recent Domain
The domain is less than 30 days old, indicating a high likelihood of malicious intent.
Impersonation/Brand Misuse
The site uses the image of Donald Trump, and claims a relationship with a casino without any evidence of authorization, which is a key phishing indicator.
Form with Sensitive Data
The website asks for email and password.
JavaScript Obfuscation
Obfuscation detected (atob, eval, fromCharCode), suggesting malicious intent or evasion tactics.
🔬 Análisis Integral de Amenazas
Tipo de Amenaza
Banking Credential Harvester
Objetivo
Donald Trump Casino users (International)
Método de Ataque
Brand impersonation + real-time WebSocket exfiltration + obfuscated JavaScript
Canal de Exfiltración
WebSocket (1 endpoints)
Evaluación de Riesgo
CRITICAL - Automated credential harvesting with WebSocket (1 endpoints)
⚠️ Indicators of Compromise
- Kit types: Credential Harvester, OTP Stealer, Card Stealer, Banking, Personal Info
- 588 obfuscation techniques
🏢 Análisis de Suplantación de Marca
Impersonated Brand
Donald Trump Casino (Fake)
Fake Service
Casino registration and rewards
Fraudulent Claims
⚔️ Metodología de Ataque
Primary Method: Credential Harvesting via Impersonation
The attacker impersonates a casino by using the name of Donald Trump to make a deceptive reward campaign. The goal is to trick the user into registering and providing sensitive information such as email and password to access rewards.
Secondary Method: Social Engineering
The website leverages the image of Donald Trump and the lure of 'free rewards' in order to gain trust and deceive victims.
🌐 Indicadores de Compromiso de Infraestructura
🦠 Malicious Files
Main File
signalsFBEventsExtractFromInputs.js
File Size
🔌 External APIs Abused
Facebook
- account: 1925131974751650
- purpose: tracking user interactions and data collection
📊 Diagrama de Flujo de Ataque
User fills <input name=email> → signalsFBEventsExtractFromInputs() → fetch('https://trumpcasino.us/api/exfiltrate') → User data sent
🔬 JavaScript Deep Analysis
Operator Language
English (1%)
Sophistication Level
Basic
Total Code Size
1,3 MB
🔗 API Endpoints Detected
Other
62
Backend API
1
WebSocket (Real-time)
1
🔐 Obfuscation Detected
- : Heavy
- : Moderate
- : Moderate
- : Moderate
- : None
- : Light
- : Light
- : Light
- : Light
- : Light
- : Light
- : None
- : Light
- : Light
- : Light
- : Light
- : Light
- : Light
- : Light
🤖 AI-Extracted Threat Intelligence
📊 Attack Flow
User fills <input name=email> → signalsFBEventsExtractFromInputs() → fetch('https://trumpcasino.us/api/exfiltrate') → User data sent
🎯 Malicious Files Identified
Main Drainer
signalsFBEventsExtractFromInputs.jsFile Size
45KB
Malicious Functions
signalsFBEventsExtractFromInputssignalsFBEventsExtractEventPayload
🌐 External APIs Abused
-
Facebook
- Account:
1925131974751650
Propósito: tracking user interactions and data collection
Similar Websites
Pages with identical visual appearance (based on perceptual hash)
"Nunca pensé que me pasaría a mí"
Esto dicen las 2.3 millones de víctimas cada año. No esperes a ser una estadística.