EN ES PT

Phishing Analysis

Detailed analysis of captured phishing page

Back to Stats

Captura Visual

Screenshot of 7003659.com:8989

Informações de Detecção

https://7003659.com:8989/lottery.html
Detected Brand
bet365
Country
International
Confiança
100%
HTTP Status
200
Report ID
230281bc-fff…
Analyzed
2026-03-17 03:33

Hashes de Conteúdo (Similaridade HTML)

Used to detect similar phishing pages based on HTML content

Algorithm Hash Value
CONTENT TLSH
T1ECF32331A848E57F01B761C3CB28775DF281B345DE2B4E6279F0526AA733AF58D424E8
CONTENT ssdeep
3072:uayuhIDfDFTXn5aDI12BlquIrJ5nOvIdD/u4R4/9hLbns8Hx96aA2nvS3bl86hhh:uayuhIDfDFTXn5aDI12BlquIrJ5nOvIB

Hashes Visuais (Similaridade de Captura)

Used to detect visually similar phishing pages based on screenshots

Algorithm Hash Value
VISUAL pHash
be3e81d169cdc486
VISUAL aHash
6904b581bdff7e7f
VISUAL dHash
516d65255169e471
VISUAL wHash
3d059581adbd3c3c
VISUAL colorHash
00000000007
VISUAL cropResistant
eac2d890c27369e4,ccccb22b9f336be2,e2590f1f1762436a,516d65255169e471

Análise de Código

Risk Score 100/100
Nível de Ameaça ALTO
⚠️ Phishing Confirmed
🎣 Credential Harvester 🎣 OTP Stealer 🎣 Card Stealer 🎣 Banking 🎣 Personal Info

🔬 Threat Analysis Report

• Ameaça: Ataque de phishing.
• Alvo: Usuários do bet365.
• Método: Personificação e colheita de credenciais.
• Exfil: Não especificado, possivelmente exfiltração de dados por meio de JavaScript.
• Indicadores: Incompatibilidade de domínio, Javascript ofuscado, formulários.
• Risco: ALTO

🔒 Obfuscation Detected

  • atob
  • eval
  • fromCharCode
  • unescape
  • document.write
  • hex_escape
  • unicode_escape
  • base64_strings

🎯 Kit Endpoints

  • javascript:loginPlayer(this)

📡 API Calls Detected

  • /imLink.html
  • /pcenter-client/pcenter/#/pcenter-client/

📊 Detalhamento da Pontuação de Risco

Total Risk Score
90/100

Contributing Factors

Domain Mismatch
The domain 7003659.com:8989 does not belong to bet365
Obfuscated Javascript
Obfuscated Javascript usually indicates hidden malicious activities like data exfiltration or credential theft.
Forms and Inputs
Presence of forms collecting user information, specifically username and password
Impersonation
The site mimics the appearance of bet365 in an attempt to trick users.

🔬 Análise Integral de Ameaças

Tipo de Ameaça
Banking Credential Harvester
Alvo
bet365 users (International)
Método de Ataque
Brand impersonation + credential harvesting forms + obfuscated JavaScript
Canal de Exfiltração
Form submission (backend endpoint not detected - likely JavaScript-based)
Avaliação de Risco
CRITICAL - Automated credential harvesting with Form submission (backend endpoint not detected - likely JavaScript-based)

⚠️ Indicators of Compromise

  • Kit types: Credential Harvester, OTP Stealer, Card Stealer, Banking, Personal Info
  • 276 obfuscation techniques

🏢 Análise de Falsificação de Marca

Impersonated Brand
bet365
Official Website
www.bet365.com
Fake Service
betting/gambling

⚔️ Metodologia de Ataque

Primary Method: Credential Harvesting

The attacker aims to steal user credentials by creating a fake login page that mimics the design of bet365. Users are tricked into entering their username and password, which are then captured by the attacker.

Secondary Method: JavaScript Obfuscation

The use of obfuscated JavaScript (atob, eval, fromCharCode) masks malicious code, making it difficult to detect and analyze. This code is often designed to exfiltrate stolen data or redirect the user.

🌐 Indicadores de Compromisso de Infraestrutura

Domain Information

Domínio
7003659.com
Registered
Unknown
Registrar
Unknown
Estado
Unknown

🤖 AI-Extracted Threat Intelligence

Scan History for 7003659.com:8989

Found 1 other scan for this domain

😰
"Nunca pensei que aconteceria comigo"
Isso dizem os 2,3 milhões de vítimas a cada ano. Não espere para ser uma estatística.