EN ES PT

Phishing Analysis

Detailed analysis of captured phishing page

Back to Stats

Captura Visual

Screenshot of bitcoin-everest.net

Informações de Detecção

https://bitcoin-everest.net/
Detected Brand
Bitcoin Everest
Country
International
Confiança
92%
HTTP Status
200
Report ID
39a712a8-373…
Analyzed
2026-08-12 23:12

Hashes de Conteúdo (Similaridade HTML)

Used to detect similar phishing pages based on HTML content

Algorithm Hash Value
CONTENT TLSH
T1AB6254B69102A93F11F3C1D2A621AB3F72E6914DDA4B0B0653FC4B2D4BC6DA0FC25599
CONTENT ssdeep
192:wVsBilI0IINBXf3myiCBdtE5kMEzmc8T5c3/7MNR3PZR/37:usBgxII/3m70DE9zW3jA3PDj

Hashes Visuais (Similaridade de Captura)

Used to detect visually similar phishing pages based on screenshots

Algorithm Hash Value
VISUAL pHash
c68cb8b086cfe1bc
VISUAL aHash
ff000074266000ff
VISUAL dHash
2f34cbc4c4cc2340
VISUAL wHash
ff000076767700ff
VISUAL colorHash
30000e40000
VISUAL cropResistant
c029292f2f2929c4,0000000000000000,4133c8c4cccd2340

Análise de Código

Risk Score 53/100
Nível de Ameaça ALTO
⚠️ Phishing Confirmed
🎣 OTP Stealer

🔬 Threat Analysis Report

• Ameaça: Drenador de carteiras cripto
• Alvo: Usuários de criptomoedas
• Método: Engenharia social via ferramenta de trading
• Exfil: Envio de formulário JS
• Indicadores: JS ofuscado, promessas de ganhos rápidos
• Risco: Perda financeira crítica

🔒 Obfuscation Detected

  • unescape

📡 API Calls Detected

  • POST
  • /api/sms/verify
  • /api/sms/send
  • /api/sms-verification-status

📊 Detalhamento da Pontuação de Risco

Total Risk Score
95/100

Contributing Factors

Malicious Scripting
Obfuscated JS patterns identified
Deceptive Content
Crypto-sniping/drainer themes
Domain Indicators
Short domain history and niche crypto usage

🔬 Análise Integral de Ameaças

Tipo de Ameaça
Two-Factor Authentication Stealer
Alvo
Bitcoin Everest users (International)
Método de Ataque
Brand impersonation + obfuscated JavaScript
Canal de Exfiltração
Form submission (backend endpoint not detected - likely JavaScript-based)
Avaliação de Risco
MEDIUM - Automated credential harvesting with Form submission (backend endpoint not detected - likely JavaScript-based)

⚠️ Indicators of Compromise

  • Kit types: OTP Stealer
  • 2 obfuscation techniques

🏢 Análise de Falsificação de Marca

Impersonated Brand
Bitcoin Everest
Official Website
N/A
Fake Service
AI Crypto Trading Terminal

Fraudulent Claims

⚔️ Metodologia de Ataque

Primary Method: Wallet Drainer

The site uses a deceptive interface to trick users into connecting their Web3 wallets. Once connected, malicious scripts attempt to prompt the user to sign a fraudulent transaction or approve token transfers.

Secondary Method: Credential Harvesting

Forms designed to capture wallet information or API keys under the guise of setting up an AI trading terminal.

Target Blockchain
Ethereum

🌐 Indicadores de Compromisso de Infraestrutura

Domain Information

Domínio
bitcoin-everest.net
Registered
2026-03-16
Registrar
Unknown
Estado
active

🤖 AI-Extracted Threat Intelligence

😰
"Nunca pensei que aconteceria comigo"
Isso dizem os 2,3 milhões de vítimas a cada ano. Não espere para ser uma estatística.