SafeMode - Analysis: 36593657.com:8989

Captura Visual

No screenshot available

Información de Detección

https://36593657.com:8989

Detected Brand

Unknown

Country

International

Confianza

100%

HTTP Status

200

Report ID

f2ad99c0-595…

Analyzed

2026-03-17 03:18

Final URL (after redirects)

https://36593657.com:8989/verify-page/index.html

Hashes de Contenido (Similitud HTML)

Used to detect similar phishing pages based on HTML content

Algorithm	Hash Value
CONTENT TLSH	T1BAC13371C05B292BF90381E8B1B0DB1F62D3434ED782095592FD026677CFD51F91A9DA
CONTENT ssdeep	96:FuwK6S8LUfANuZsdFYTYcBZbEYTPdp2sclJnaWLlIJQ6B:y6SJouZs3kBNTPdp2sclJnak2Qg

Hashes Visuales (Similitud de Captura)

Used to detect visually similar phishing pages based on screenshots

Algorithm	Hash Value
VISUAL pHash	dbb107cb3c0d81b6
VISUAL aHash	ffffffffdc280000
VISUAL dHash	f2cada3329d15166
VISUAL wHash	7fefffdb98080000
VISUAL colorHash	0e0000001c0
VISUAL cropResistant	f2f3cad0b32b35d9,8c6cacdcd86a7e5c,f87e7f7ffffebdaa,7f7f3e36797c7e7f,2b2835d950516364,210830b2b2320c11,11043232b2300c21

Análisis de Código

Risk Score 88/100

Nivel de Amenaza ALTO

⚠️ Phishing Confirmed

🎣 Credential Harvester 🎣 OTP Stealer 🎣 Card Stealer 🎣 Banking 🎣 Personal Info

🔬 Threat Analysis Report

• Amenaza: Intento de phishing
• Objetivo: Desconocido
• Método: Ingeniería social, robo de credenciales
• Exfil: Potencialmente, datos enviados a través de formularios, JS ofuscado
• Indicadores: Dominio no relacionado, ofuscación, captcha
• Riesgo: Alto

🔒 Obfuscation Detected

fromCharCode
document.write

🎯 Kit Endpoints

https://36593657.com:8989/verify-page/theme/default/layer.css?v=3.1.0

📊 Desglose de Puntuación de Riesgo

Total Risk Score

90/100

Contributing Factors

Suspicious Domain

Unusual domain with no known brand association.

Obfuscated JavaScript

JavaScript obfuscation is frequently used to hide malicious code.

Forms Detected

Forms are likely used to steal credentials.

CAPTCHA

Suspicious Captcha implementation

🔬 Análisis Integral de Amenazas

Tipo de Amenaza

Banking Credential Harvester

Objetivo

General public

Método de Ataque

credential harvesting forms + obfuscated JavaScript

Canal de Exfiltración

Form submission (backend endpoint not detected - likely JavaScript-based)

Evaluación de Riesgo

CRITICAL - Automated credential harvesting with Form submission (backend endpoint not detected - likely JavaScript-based)

⚠️ Indicators of Compromise

Kit types: Credential Harvester, OTP Stealer, Card Stealer, Banking, Personal Info
6 obfuscation techniques

🏢 Análisis de Suplantación de Marca

Impersonated Brand

Unknown

Fake Service

Unknown

⚔️ Metodología de Ataque

Primary Method: Credential Harvesting

The site likely attempts to steal login credentials or other sensitive information through forms and a misleading CAPTCHA. Obfuscation is used to hide the malicious activity.