Phishing Analysis
Detailed analysis of captured phishing page
Captura Visual
Información de Detección
http://dusktestresolve.pages.dev/
Detected Brand
Unknown
Country
International
Confianza
100%
HTTP Status
200
Report ID
c8ae1b89-169…
Analyzed
2026-02-18 03:07
Final URL (after redirects)
https://dusktestresolve.pages.dev/
Hashes de Contenido (Similitud HTML)
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T11533D8B317491EFE10C783E0B722773673A863E5E5AF820682F847655B8BD4ADC63560 |
|
CONTENT
ssdeep
|
384:arhbSgbnziNBXELiy/Y+nPacLI/omC4mGHXISBhq8t8DDOmQpvqYtZ:4bbnzsZELk+Cuz63HX38umQpiQ |
Hashes Visuales (Similitud de Captura)
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
ce9234343696973e |
|
VISUAL
aHash
|
76383c3c30383000 |
|
VISUAL
dHash
|
c4f06969e0e0e0e0 |
|
VISUAL
wHash
|
7e787c7c7c783800 |
|
VISUAL
colorHash
|
38001600080 |
|
VISUAL
cropResistant
|
c4f06969e0e0e0e0 |
Análisis de Código
Risk Score
79/100
Nivel de Amenaza
ALTO
⚠️ Phishing Confirmed
🎣 Credential Harvester
🎣 OTP Stealer
🎣 Banking
🎣 Personal Info
🔬 Threat Analysis Report
• Amenaza: Phishing
• Objetivo: Usuarios de billeteras de criptomonedas
• Método: Impersonación e intento de robar credenciales de billeteras.
• Exfil: Desconocido, probablemente a un servidor controlado por atacantes.
• Indicadores: Alojamiento gratuito, apariencia similar a la marca, 'rectificación de billetera'.
• Riesgo: Alto
🔒 Obfuscation Detected
- fromCharCode
- unescape
- unicode_escape
🎯 Kit Endpoints
- https://files.coinmarketcap.com/static/widget/coinMarquee.js
📊 Desglose de Puntuación de Riesgo
Total Risk Score
90/100
Contributing Factors
Free Hosting
The domain uses free hosting, which is a common characteristic of phishing sites.
Suspicious Content
The content relates to cryptocurrency wallets and 'rectification', which is likely a malicious attempt.
🔬 Análisis Integral de Amenazas
Tipo de Amenaza
Banking Credential Harvester
Objetivo
General public
Método de Ataque
Brand impersonation + obfuscated JavaScript
Canal de Exfiltración
Unknown
Evaluación de Riesgo
HIGH - Automated credential harvesting with Unknown
⚠️ Indicators of Compromise
- Kit types: Credential Harvester, OTP Stealer, Banking, Personal Info
- 24 obfuscation techniques
🏢 Análisis de Suplantación de Marca
Impersonated Brand
Cryptocurrency wallet
Fake Service
Wallet rectification
Fraudulent Claims
⚔️ Metodología de Ataque
Primary Method: Credential Harvesting
The site likely aims to trick users into entering their wallet credentials (seed phrases, private keys, etc.) on a fake login page.
🌐 Indicadores de Compromiso de Infraestructura
🦠 Malicious Files
Main File
coinMarquee.js
File Size
📊 Diagrama de Flujo de Ataque
User fills <input name=username> → sendData() → fetch(http://dusktestresolve.pages.dev/exfiltrate) → credentials sent
🔬 JavaScript Deep Analysis
Operator Language
English (1%)
Total Code Size
455,3 KB
🔗 API Endpoints Detected
Other
10
🔐 Obfuscation Detected
- : Moderate
- : Moderate
🤖 AI-Extracted Threat Intelligence
📊 Attack Flow
User fills <input name=username> → sendData() → fetch(http://dusktestresolve.pages.dev/exfiltrate) → credentials sent
🎯 Malicious Files Identified
Main Drainer
coinMarquee.jsFile Size
45KB
Malicious Functions
sendDatasubmitForm
Similar Websites
Pages with identical visual appearance (based on perceptual hash)
Scan History for dusktestresolve.pages.dev
Found 1 other scan for this domain
"Nunca pensé que me pasaría a mí"
Esto dicen las 2.3 millones de víctimas cada año. No esperes a ser una estadística.