SafeMode - Analysis: centvibe.com

Captura Visual

No screenshot available

Información de Detección

https://centvibe.com/

Detected Brand

Unknown

Country

International

Confianza

100%

HTTP Status

200

Report ID

bd9cd86e-8a6…

Analyzed

2026-02-19 16:04

Hashes de Contenido (Similitud HTML)

Used to detect similar phishing pages based on HTML content

Algorithm	Hash Value
CONTENT TLSH	T19CE229B49230D335B1C24BE8DA6425287A5FE1DCD7C695B4E388AF51B0D6CECD9260CB
CONTENT ssdeep	384:4r/aMJgua8uRhiXkdvNTDhPhLxeAxeDWNW1Tp34PxeeJEmuW3As+ONRW0Md:4r/aMJgushhPhleMeDGCSPxeeWmHxW

Hashes Visuales (Similitud de Captura)

Used to detect visually similar phishing pages based on screenshots

Algorithm	Hash Value
VISUAL pHash	f02317fc6e034b4e
VISUAL aHash	806660f0d8dede10
VISUAL dHash	5cdcda93b1b4ac21
VISUAL wHash	80466ef0d8dedf90
VISUAL colorHash	38001000c40
VISUAL cropResistant	b62c69c89081020c,5cdcda93b1b4ac21

Análisis de Código

Risk Score 100/100

Nivel de Amenaza ALTO

⚠️ Phishing Confirmed

🎣 Credential Harvester 🎣 OTP Stealer 🎣 Card Stealer 🎣 Banking 🎣 Personal Info

WebSocket C2

🔬 Threat Analysis Report

• Amenaza: Phishing
• Objetivo: Credenciales de usuario
• Método: Sitio web malicioso usando ingeniería social para recopilar datos
• Exfil: wss://gambler-work.com/api/ws
• Indicadores: Dominio reciente, javascript ofuscado, formulario con campos sensibles
• Riesgo: ALTO

🔒 Obfuscation Detected

atob
eval
fromCharCode
unescape
unicode_escape
base64_strings

🎯 Kit Endpoints

https://centvibe.com/api/submit
https://centvibe.com/api/exfiltrate

📡 API Calls Detected

POST
GET

📊 Desglose de Puntuación de Riesgo

Total Risk Score

90/100

Contributing Factors

Recent Domain

Domain is less than 30 days old.

JavaScript Obfuscation

Javascript is obfuscated to hide malicious behavior.

Form Submission

Form collects sensitive information (email, password).

WebSocket URL

WebSocket URL used for potential data exfiltration

🔬 Análisis Integral de Amenazas

Tipo de Amenaza

Banking Credential Harvester

Objetivo

General public

Método de Ataque

real-time WebSocket exfiltration + obfuscated JavaScript

Canal de Exfiltración

WebSocket (1 endpoints)

Evaluación de Riesgo

CRITICAL - Automated credential harvesting with WebSocket (1 endpoints)

⚠️ Indicators of Compromise

Kit types: Credential Harvester, OTP Stealer, Card Stealer, Banking, Personal Info
168 obfuscation techniques

🏢 Análisis de Suplantación de Marca

Impersonated Brand

Unknown

Fake Service

Contest / Giveaway

Fraudulent Claims

⚔️ Metodología de Ataque

Primary Method: Credential Harvesting

The site uses a form to collect email and password information, with the intention of harvesting login credentials.

Secondary Method: JavaScript Obfuscation

Obfuscated Javascript is used to hide malicious behavior and/or payload.

🌐 Indicadores de Compromiso de Infraestructura

🦠 Malicious Files

Main File

layout-2344be9881d79b44.js

File Size

Functions: submitForm(), sendData()

🔌 External APIs Abused

Facebook

account: fb_pixel_id
purpose: tracking user interactions

📊 Diagrama de Flujo de Ataque

User fills <input name='email'> → submitForm() → fetch('https://centvibe.com/api/submit') → exfiltrate credentials

🔬 JavaScript Deep Analysis

Sophistication Level

Basic

Total Code Size

10,3 KB

🔗 API Endpoints Detected

Other

18

Backend API

1

WebSocket (Real-time)

1

🔐 Obfuscation Detected

: Light

🤖 AI-Extracted Threat Intelligence

📊 Attack Flow

User fills <input name='email'> → submitForm() → fetch('https://centvibe.com/api/submit') → exfiltrate credentials

🎯 Malicious Files Identified

Main Drainer

layout-2344be9881d79b44.js

File Size

45KB

Malicious Functions

submitForm()
sendData()

🌐 External APIs Abused

Facebook - Account: fb_pixel_id
Propósito: tracking user interactions

Similar Websites

Pages with identical visual appearance (based on perceptual hash)

Desconocido

https://mcas.us/

Ago 06, 2026