Phishing Analysis
Detailed analysis of captured phishing page
Captura Visual
Informações de Detecção
https://konovasjfgngbgnggnghg.site/
Detected Brand
Unknown (Investment Scam)
Country
Poland
Confiança
95%
HTTP Status
200
Report ID
2d42565b-4c9…
Analyzed
2026-07-13 23:23
Hashes de Conteúdo (Similaridade HTML)
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T11512B42020A8B937429392CDFB61A71B73D6C256DA670F02A2F9C30EDBEBD59CC15147 |
|
CONTENT
ssdeep
|
192:ghbku44C/8GBaHoar2lAEoNrp/eRIiuZ8ONgfh5JaaMhKD2iZwV:gxt44C/BaIq2qvNrpmRIkJjMhOZwV |
Hashes Visuais (Similaridade de Captura)
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
d2d2946d312db86d |
|
VISUAL
aHash
|
007c6c6c6014002e |
|
VISUAL
dHash
|
14ccc8d8d0e4c6cc |
|
VISUAL
wHash
|
52fc7c7c607c007e |
|
VISUAL
colorHash
|
300020001c0 |
|
VISUAL
cropResistant
|
14ccc8d8d0e4c6cc |
Análise de Código
Risk Score
6/100
Nível de Ameaça
ALTO
⚠️ Phishing Confirmed
🔬 Threat Analysis Report
• Ameaça: Fraude de investimento financeiro
• Alvo: Investidores de retalho polacos
• Método: Engenharia social através de site falso de investimento em IA
• Exfil: Submissão de formulário baseada em JavaScript
• Indicadores: Idade do domínio, promessas financeiras suspeitas, scripts ofuscados
• Risco: Crítico
🔒 Obfuscation Detected
- fromCharCode
- unescape
📡 API Calls Detected
- POST
📊 Detalhamento da Pontuação de Risco
Total Risk Score
95/100
Contributing Factors
Domain Age
0-day old domain
Investment Fraud
Unrealistic ROI promises
Obfuscation
Detected fromCharCode/unescape usage
🔬 Análise Integral de Ameaças
Tipo de Ameaça
Unknown (Investment Scam) Credential Harvester
Alvo
Unknown (Investment Scam) users (Poland)
Método de Ataque
credential harvesting forms + obfuscated JavaScript
Canal de Exfiltração
Form submission (backend endpoint not detected - likely JavaScript-based)
Avaliação de Risco
LOW - Automated credential harvesting with Form submission (backend endpoint not detected - likely JavaScript-based)
⚠️ Indicators of Compromise
- 3 obfuscation techniques
🏢 Análise de Falsificação de Marca
Impersonated Brand
N/A
Fake Service
Investment Platform
Fraudulent Claims
⚔️ Metodologia de Ataque
Primary Method: Financial Fraud / Investment Scam
The site lures users with 'AI Investment' returns, intending to harvest user data via forms for call-center fraud.
Secondary Method: Social Engineering
Misusing the KNF (Polish Financial Supervision Authority) name to gain legitimacy.
🌐 Indicadores de Compromisso de Infraestrutura
Domain Information
Domínio
konovasjfgngbgnggnghg.site
Registered
2026-07-13
Registrar
Unknown
Estado
Active
🤖 AI-Extracted Threat Intelligence
Similar Websites
Pages with identical visual appearance (based on perceptual hash)
KNF (impersonated)
https://kilnamrtbngbnbnbg.site/
Jul 13, 2026
KNF (impersonated)
https://jotjngnjgghnghjjgnng.site/
Jul 13, 2026
Desconhecido
https://farnalsnfnggmmv.site/
Jul 13, 2026
Desconhecido
https://satreufufgngnvnfnfbgb.online/
Jul 10, 2026
InvStart AI (likely fictitious)
https://normgmgnnvvnfngnngn.online/
Jul 10, 2026
"Nunca pensei que aconteceria comigo"
Isso dizem os 2,3 milhões de vítimas a cada ano. Não espere para ser uma estatística.