Phishing Analysis
Detailed analysis of captured phishing page
Captura Visual
Información de Detección
http://bsea-f8cwf3csaacdgqfk.z02.azurefd.net/
Detected Brand
Facebook
Country
International
Confianza
95%
HTTP Status
200
Report ID
d1c1ece7-bef…
Analyzed
2026-02-11 11:58
Final URL (after redirects)
https://bsea-f8cwf3csaacdgqfk.z02.azurefd.net/
Hashes de Contenido (Similitud HTML)
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T10C1102600C3D566387A581D6F9A77E073A40C786D36A1F5084F8D7FD19C9A0DC9EF560 |
|
CONTENT
ssdeep
|
24:kHks1wspc8MT0C7OkCQqb5SpXQEiKn0SZxZj7x0Jk:C1zpxk4b5SpMY0c/j7WJk |
Hashes Visuales (Similitud de Captura)
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
b8cc9b7623336638 |
|
VISUAL
aHash
|
ffffdbc3c3c3c3c3 |
|
VISUAL
dHash
|
b0b2b28e96969696 |
|
VISUAL
wHash
|
7e5b5943c0c3c3c3 |
|
VISUAL
colorHash
|
07c00000000 |
|
VISUAL
cropResistant
|
a2948e80aa8ee0b2,b0b2b28e96969696 |
Análisis de Código
Risk Score
59/100
Nivel de Amenaza
ALTO
⚠️ Phishing Confirmed
🎣 Banking
🔬 Threat Analysis Report
• Amenaza: Estafa de suspensión de cuenta
• Objetivo: Usuarios de Facebook
• Método: Suplantación de identidad a través de una página de inicio de sesión falsa.
• Exfil: Desconocido, probablemente credenciales.
• Indicadores: Dominio sospechoso, reclamación de suspensión de cuenta.
• Riesgo: ALTO
🔒 Obfuscation Detected
- hex_escape
- js_packer
- base64_strings
📡 API Calls Detected
- POST
📊 Desglose de Puntuación de Riesgo
Total Risk Score
90/100
Contributing Factors
Suspicious Domain
The domain is not a Facebook domain.
Impersonation
The page is attempting to impersonate Facebook and uses their logo.
Account Suspension Message
The page displays an account suspension warning.
Obfuscation
Javascript obfuscation detected, indicating potentially malicious code.
🔬 Análisis Integral de Amenazas
Tipo de Amenaza
Banking Credential Harvester
Objetivo
Facebook users (International)
Método de Ataque
Brand impersonation + obfuscated JavaScript
Canal de Exfiltración
Form submission (backend endpoint not detected - likely JavaScript-based)
Evaluación de Riesgo
MEDIUM - Automated credential harvesting with Form submission (backend endpoint not detected - likely JavaScript-based)
⚠️ Indicators of Compromise
- Kit types: Banking
- 565 obfuscation techniques
🏢 Análisis de Suplantación de Marca
Impersonated Brand
Facebook
Official Website
https://www.facebook.com
Fake Service
Facebook Account
Fraudulent Claims
⚔️ Metodología de Ataque
Primary Method: Credential Harvesting
The attack uses a fake Facebook login form hosted on a suspicious domain to steal the victim's login credentials (username and password).
Secondary Method: Malware Injection
It could involve code designed to download or install malware or redirect the victim to another fraudulent website or webpage.
🌐 Indicadores de Compromiso de Infraestructura
Domain Information
Dominio
bsea-f8cwf3csaacdgqfk.z02.azurefd.net
Registered
None
Registrar
None
Estado
None
🔬 JavaScript Deep Analysis
Total Code Size
1,8 KB
🔗 API Endpoints Detected
Other
2
🔐 Obfuscation Detected
- : None
🤖 AI-Extracted Threat Intelligence
Similar Websites
Pages with identical visual appearance (based on perceptual hash)
Desconocido
https://cdn.gosafemode.com/screenshots/4bcbc8778ff5.png
May 27, 2026
Facebook
http://bwzs-edcth4haeacbeje3.z02.azurefd.net/
Feb 25, 2026
Facebook
http://hssos-aaasdvaxhydch7hy.z03.azurefd.net
Feb 13, 2026
Facebook
http://kate-dfhafbdfb4e8ecac.z02.azurefd.net
Feb 13, 2026
Facebook
http://bl-sos-d9f2gkh2cnhec8h9.z03.azurefd.net
Feb 13, 2026
Scan History for bsea-f8cwf3csaacdgqfk.z02.azurefd.net
Found 1 other scan for this domain
"Nunca pensé que me pasaría a mí"
Esto dicen las 2.3 millones de víctimas cada año. No esperes a ser una estadística.