Phishing Analysis
Detailed analysis of captured phishing page
Captura Visual
Información de Detección
https://malinosayr1787243640405.0591585.meusitehostgator.com.br/avvoir/avidanew/avidanew/page/info.php
Detected Brand
Mediapart
Country
Unknown
Confianza
100%
HTTP Status
200
Report ID
f830977b-51d…
Analyzed
2026-08-24 11:18
Final URL (after redirects)
https://www.mediapart.fr/
Hashes de Contenido (Similitud HTML)
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T1875585E16620A3ADD4C7DAADDF39DD90530F40BAB9B6C6C18ABEC75C9447D80FB06814 |
|
CONTENT
ssdeep
|
3072:Lxipi9Q3nGEFRmmilsu9v5e3FmDxAConwTWSLdTwudLsiwDbmTbp0l4fN1s6Y84h:LGJ3Yj3xFCz+qJ9L |
Hashes Visuales (Similitud de Captura)
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
cb9b646631cc99ca |
|
VISUAL
aHash
|
00003c3c3c3c3800 |
|
VISUAL
dHash
|
4d2971717971638f |
|
VISUAL
wHash
|
0018bdbdfdbdb900 |
|
VISUAL
colorHash
|
0e001038000 |
|
VISUAL
cropResistant
|
7adaacc38e595588,4d2971717971638f,3434b5d4d4353434 |
Análisis de Código
Risk Score
85/100
Nivel de Amenaza
ALTO
⚠️ Phishing Confirmed
🎣 Credential Harvester
🎣 OTP Stealer
🎣 Personal Info
🔐 Credential Harvesting Forms
🔒 Obfuscation Detected
- atob
- eval
- fromCharCode
- unicode_escape
- base64_strings
🎯 Kit Endpoints
- //blogs.mediapart.fr/marie-vm/blog/210826/chicas-tristes-l-amitie-feminine-l-epreuve-de-la-crise-du-soin
- //blogs.mediapart.fr/nejma-brahim/blog/230826/arrive-osons-perturber-ceux-qui-pensent-que-la-montagne-doit-rester-blanche
- /journal/ecologie
- https://blogs.mediapart.fr/
- //blogs.mediapart.fr/most-media/blog/190826/il-y-35-ans-une-question-de-journaliste-change-ma-vie
- //blogs.mediapart.fr/48H
- //blogs.mediapart.fr/editions
- //blogs.mediapart.fr/guillaume-lasserre/blog/230826/la-casa-conti-l-art-comme-maniere-d-habiter
- //blogs.mediapart.fr/carlos-schmerkin/blog/160826/moria-netflix-celebre-le-mythe-vivant-de-la-television-argentine
- //blogs.mediapart.fr/agenda
- //blogs.mediapart.fr/eleonora-farade/blog/190826/la-fatigue-democratique-pourquoi-2027-nous-epuise-avant-davoir-commence
- //blogs.mediapart.fr/dominique-wittorski/blog/220826/vancouver-n-est-plus
- //blogs.mediapart.fr/samuel-clauzier/blog/200826/ingerences-russes-le-paradoxe-de-nos-libertes
- //blogs.mediapart.fr/edition/le-monde-de-la-bd/article/190826/hypersurveillance-enquete-sur-les-nouveaux-outils-de-controle
- /journal/politique/210826/marre-de-voter-pour-le-moins-pire-les-militants-ecologistes-restent-tirailles-entre-les-gauches
- //blogs.mediapart.fr/regard-marseillais/blog/180826/piratage-du-fisc-et-si-la-sophistication-netait-quun-ecran-de-fumee
- //blogs.mediapart.fr/jonathan-gensburger/blog/200826/quand-l-extreme-droite-attaque-la-ldh-c-est-notre-democratie-qu-elle-attaque
- //blogs.mediapart.fr/allan-barte/blog/220826/sauvons-les-milliardaires
- //blogs.mediapart.fr/abdi-nidam/blog/170826/spotify-couronne-les-fantomes-la-musique-t-elle-encore-un-roi
- //blogs.mediapart.fr/edition/femmes-et-culture-pop-de-lautre-cote-du-male-gaze/article/180826/la-colere-de-penelope-le-regard-sur-les-femmes-et
- //blogs.mediapart.fr/
- //blogs.mediapart.fr/eleonora-farade/blog/180826/la-cyberpiraterie-nest-jamais-finie-letat-passoire-face-la-fuite-des-donnees
- //blogs.mediapart.fr/khaled-satour/blog/210826/les-langues-de-lecrit-en-algerie-une-incontournable-bipolarisation
- https://www.mediapart.fr/charte-de-deontologie
- /journal/politique/220826/aux-universites-d-ete-insoumise-et-ecologiste-le-vent-du-rapprochement
- https://blogs.mediapart.fr/charte-de-participation
- //blogs.mediapart.fr/marcsalomone/blog/180826/gangs-punir-les-mineurs-ou-les-majeurs-0
- /charte-de-deontologie
- /login
- //blogs.mediapart.fr/marine-v/blog/190826/pour-une-rentree-en-conscience
- /journal/economie-et-social/190826/le-pouvoir-des-monopoles-technologiques-passe-au-crible
- //blogs.mediapart.fr/jean-pierre-favier/blog/190826/adieu-la-france-bonjour-lalgerie
- //blogs.mediapart.fr/blogs
- //blogs.mediapart.fr/charte-de-participation
- //blogs.mediapart.fr/borischenaud/blog/240826/montpellier-2026-presidentielle-2027-lfi-une-meme-strategie
- //blogs.mediapart.fr/michelle-zancarini-fournel/blog/210826/yvette-roudy-1929-2026-inlassable-militante-pour-les-droits-des-femmes
- //blogs.mediapart.fr/jean-pierre-thibaudat/blog/210826/disparition-de-berangere-bonvoisin
- //blogs.mediapart.fr/geographies-en-mouvement/blog/210826/nouvelle-alerte-dans-les-landes
- //blogs.mediapart.fr/cocain/blog/180826/la-haute-trahison-des-eveques-francais
- //blogs.mediapart.fr/c-est-nabum/blog/210826/les-boites-livres
- //blogs.mediapart.fr/voix-en-exil/blog/180826/le-combat-delaheh-mohammadi
📡 API Calls Detected
- GET
📤 Form Action Targets
- /journal/une/240826
📊 Desglose de Puntuación de Riesgo
Total Risk Score
100/100
Contributing Factors
Active Phishing Kit
Detected kit types: Credential Harvester, OTP Stealer, Personal Info
Credential Harvesting
Credential harvesting detected with 1 form(s) capturing sensitive data
Code Obfuscation
JavaScript code obfuscated using 20 technique(s) to evade detection
🔬 Análisis Integral de Amenazas
Tipo de Amenaza
Two-Factor Authentication Stealer
Objetivo
Mediapart users
Método de Ataque
credential harvesting forms + obfuscated JavaScript
Canal de Exfiltración
HTTP POST to backend
Evaluación de Riesgo
CRITICAL - Automated credential harvesting with HTTP POST to backend
⚠️ Indicators of Compromise
- Kit types: Credential Harvester, OTP Stealer, Personal Info
- 20 obfuscation techniques
🏢 Análisis de Suplantación de Marca
Impersonated Brand
Mediapart
Official Website
N/A
Fake Service
Credential harvesting service
⚔️ Metodología de Ataque
Primary Method: Credential Harvesting
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Secondary Method: JavaScript Obfuscation
Malicious code is obfuscated using 20 techniques to evade detection by security scanners and make reverse engineering more difficult.
🌐 Indicadores de Compromiso de Infraestructura
Domain Information
Dominio
malinosayr1787243640405.0591585.meusitehostgator.com.br
Registered
2025-03-14 00:00:00+00:00
Registrar
Unknown
Estado
Active (older domain)
Hosting Information
Provider
Unknown
ASN
🤖 AI-Extracted Threat Intelligence
Similar Websites
Pages with identical visual appearance (based on perceptual hash)
"Nunca pensé que me pasaría a mí"
Esto dicen las 2.3 millones de víctimas cada año. No esperes a ser una estadística.