Phishing Analysis
Detailed analysis of captured phishing page
Captura Visual
Informações de Detecção
https://vadreauv.site/auth/?email=alor7%40e19321315905222902645edd2aa1740a4f97.com
Detected Brand
WeTransfer
Country
Unknown
Confiança
100%
HTTP Status
200
Report ID
1cb99422-0b1…
Analyzed
2026-05-19 10:10
Hashes de Conteúdo (Similaridade HTML)
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T16C82C4F151684C2E104BA7CEF350654AD897D38FC7A15884A6FC8BFA95E1CECE4C784A |
|
CONTENT
ssdeep
|
384:iDpVfhWBD3+QWoDha8FVgvSkKRTOVOiS1Kyp45oOzbMzKyp45oOzbeDh4zAWT+HP:iDHfhkD35xDURVOi4DHZx |
Hashes Visuais (Similaridade de Captura)
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
a7e1989665711796 |
|
VISUAL
aHash
|
fe7f7f63373f1f06 |
|
VISUAL
dHash
|
c2e1cacee4ecf8fc |
|
VISUAL
wHash
|
783f7f23371f0600 |
|
VISUAL
colorHash
|
070000001c0 |
|
VISUAL
cropResistant
|
c2e1cacee4ecf8fc |
Análise de Código
Risk Score
100/100
Nível de Ameaça
ALTO
⚠️ Phishing Confirmed
🎣 Credential Harvester
🎣 Banking
🔒 Obfuscation Detected
- base64_strings
🎯 Kit Endpoints
- https://safety.wetransfer.com/report?productUrl=https%3A%2F%2Fwetransfer.com%2Fdownloads%2F42d1dfe2ea507ae7655323d222ff47f620250903142354%2F02cca0248835fd54afc664622725b26720250903142354%2F68322f%3Ft_exp%3D1757168634%26t_lsid%3Dd4bef195-36fd-47f6-9e8d-a150ef0651cb%26t_network%3Demail%26t_rid%3DZW1haWx8Njc0NDZlNmRiNjM1NTFjNmY2MGJkMzRl%26t_s%3Ddownload_link%26t_ts%3D1756909434%26utm_campaign%3DTRN_TDL_01%26utm_source%3Dsendgrid%26utm_medium%3Demail%26trk%3DTRN_TDL_01}
📊 Detalhamento da Pontuação de Risco
Total Risk Score
100/100
Contributing Factors
Active Phishing Kit
Detected kit types: Credential Harvester, Banking
Code Obfuscation
JavaScript code obfuscated using 2 technique(s) to evade detection
🔬 Análise Integral de Ameaças
Tipo de Ameaça
Banking Credential Harvester
Alvo
WeTransfer users
Método de Ataque
obfuscated JavaScript
Canal de Exfiltração
Form submission (backend endpoint not detected - likely JavaScript-based)
Avaliação de Risco
CRITICAL - Automated credential harvesting with Form submission (backend endpoint not detected - likely JavaScript-based)
⚠️ Indicators of Compromise
- Kit types: Credential Harvester, Banking
- 2 obfuscation techniques
🏢 Análise de Falsificação de Marca
Impersonated Brand
WeTransfer
Official Website
N/A
Fake Service
Account login portal
⚔️ Metodologia de Ataque
Primary Method: Credential Harvesting
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Secondary Method: JavaScript Obfuscation
Malicious code is obfuscated using 2 techniques to evade detection by security scanners and make reverse engineering more difficult.
🌐 Indicadores de Compromisso de Infraestrutura
Domain Information
Domínio
vadreauv.site
Registered
2026-04-11 13:41:18.941000+00:00
Registrar
Ligne Web Services SAS dba LWS
Estado
Active (37 days old)
Hosting Information
Provider
Ligne Web Services SAS dba LWS
ASN
🤖 AI-Extracted Threat Intelligence
Similar Websites
Pages with identical visual appearance (based on perceptual hash)
"Nunca pensei que aconteceria comigo"
Isso dizem os 2,3 milhões de vítimas a cada ano. Não espere para ser uma estatística.