Phishing Analysis
Detailed analysis of captured phishing page
Captura Visual
Información de Detección
https://6aaac910.wcconn.pages.dev/
Detected Brand
Coinbase
Country
International
Confianza
100%
HTTP Status
200
Report ID
e6aaaafa-59e…
Analyzed
2026-02-14 13:07
Hashes de Contenido (Similitud HTML)
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T13C21FE7520037A6B83632AE4B3548654E1A3D30DCA275C05F7FB93DB1BE1D419D42569 |
|
CONTENT
ssdeep
|
24:nxmvC7B7IsRE0wkCCfWaVfb4uGECiHQiECsF2:nxm0EkN55GECiHQiECk2 |
Hashes Visuales (Similitud de Captura)
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
cccc26b399333399 |
|
VISUAL
aHash
|
0018181818000000 |
|
VISUAL
dHash
|
08301432b20c2000 |
|
VISUAL
wHash
|
00181c1c3c3c0c0c |
|
VISUAL
colorHash
|
38001008040 |
|
VISUAL
cropResistant
|
a292a09696a6a2a2,08301432b20c2000 |
Análisis de Código
Risk Score
74/100
Nivel de Amenaza
ALTO
⚠️ Phishing Confirmed
🎣 Credential Harvester
🎣 OTP Stealer
🔬 Threat Analysis Report
• Amenaza: Phishing
• Objetivo: Usuarios de Coinbase
• Método: Suplantación de identidad a través de una página de destino falsa.
• Exfil: Potencialmente credenciales o información de la cartera.
• Indicadores: Alojamiento gratuito y marca Coinbase.
• Riesgo: Alto
🔒 Obfuscation Detected
- fromCharCode
- unescape
- unicode_escape
🎯 Kit Endpoints
- https://6aaac910.wcconn.pages.dev/assets/index-B6v9WWnX.js
- http://fb.me/use-check-prop-types
- https://www.coinbase.com/en-in/wallet
- https://embed.${l}/${r}/${a}`,d.charset=
- http://jedwatson.github.io/classnames
- https://getbootstrap.com/)
- https://reactrouter.com/en/main/routers/picking-a-router.`}function
- http://localhost
- https://popper.js.org)
- https://reactjs.org/docs/error-decoder.html?invariant=
- https://server0002.mn19indexpre.xyz
📊 Desglose de Puntuación de Riesgo
Total Risk Score
90/100
Contributing Factors
Free Hosting + Brand Logo
Presence of a brand logo on a free hosting platform is a strong indicator of phishing.
Domain Mismatch
The domain does not match the official brand domain.
🔬 Análisis Integral de Amenazas
Tipo de Amenaza
Two-Factor Authentication Stealer
Objetivo
Coinbase users (International)
Método de Ataque
Brand impersonation + credential harvesting forms + obfuscated JavaScript
Canal de Exfiltración
Form submission (backend endpoint not detected - likely JavaScript-based)
Evaluación de Riesgo
HIGH - Automated credential harvesting with Form submission (backend endpoint not detected - likely JavaScript-based)
⚠️ Indicators of Compromise
- Kit types: Credential Harvester, OTP Stealer
- 15 obfuscation techniques
🏢 Análisis de Suplantación de Marca
Impersonated Brand
Coinbase Wallet
Official Website
https://www.coinbase.com/
Fake Service
Coinbase Wallet
⚔️ Metodología de Ataque
Primary Method: Credential Harvesting
The attacker likely aims to steal user credentials by mimicking the Coinbase Wallet login page to trick users into entering their information.
🌐 Indicadores de Compromiso de Infraestructura
🦠 Malicious Files
Main File
index-B6v9WWnX.js
File Size
🔬 JavaScript Deep Analysis
Operator Language
English (1%)
Sophistication Level
Basic
Total Code Size
399,8 KB
🔗 API Endpoints Detected
Other
7
🔐 Obfuscation Detected
- : Heavy
🤖 AI-Extracted Threat Intelligence
🎯 Malicious Files Identified
Main Drainer
index-B6v9WWnX.jsFile Size
399KB
Similar Websites
Pages with identical visual appearance (based on perceptual hash)
Scan History for 6aaac910.wcconn.pages.dev
Found 2 other scans for this domain
"Nunca pensé que me pasaría a mí"
Esto dicen las 2.3 millones de víctimas cada año. No esperes a ser una estadística.