Phishing Analysis
Detailed analysis of captured phishing page
Captura Visual
Informações de Detecção
http://finiityupdate.dpdns.org/
Detected Brand
Xfinity
Country
Unknown
Confiança
100%
HTTP Status
200
Report ID
535beff9-b5b…
Analyzed
2026-08-17 22:13
Hashes de Conteúdo (Similaridade HTML)
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T196B20A3950252B3B8067DB90F9FEF309A0A5C1A6FAE602C9F7E95109CEC1CE65435C8D |
|
CONTENT
ssdeep
|
384:R5wskrI5NkJRxR7RMzoe4yLDSyxWlIRNjzqIjId:0IcnIiyxhRtud |
Hashes Visuais (Similaridade de Captura)
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
efeb30f430d616c0 |
|
VISUAL
aHash
|
f1f1f1f1f1f0f800 |
|
VISUAL
dHash
|
6723634323270101 |
|
VISUAL
wHash
|
f1f1b1f1f1f0f000 |
|
VISUAL
colorHash
|
07600000018 |
|
VISUAL
cropResistant
|
6723634323230101,650111ccc4962949,0000341210081000 |
Análise de Código
Risk Score
100/100
Nível de Ameaça
ALTO
⚠️ Phishing Confirmed
🎣 Credential Harvester
🎣 OTP Stealer
🎣 Card Stealer
🎣 Banking
🎣 Personal Info
Telegram Exfiltration
🔐 Credential Harvesting Forms
🔒 Obfuscation Detected
- unescape
🎯 Kit Endpoints
- https://idm.xfinity.com/myaccount/lookup?continue=https%3A%2F%2Flogin.xfinity.com%2Flogin%3Fr%3Dcomcast.net%26selectAccount%3Dtrue%26s%3Doauth%26continue%3Dhttps%253A%252F%252Foauth.xfinity.com%252F%252Foauth%252Fauthorize%253Fresponse_type%253Dcode%2526prompt%253Dselect_billing_account%2526redirect_uri%253Dhttps%25253A%25252F%25252Fwww.xfinity.com%25252Fsitecore%25252Fapi%25252Flearn%25252Fneptune%25252Fcustomer%25252Fexisting%25252Fpostauth%2526client_id%253Dshoplearn-web%2526state%253Dhttps%25253A%25252F%25252Fwww.xfinity.com%25252Fauth%2526nonce%253DjrwYkMcX8GNzUuAD%2526response%253D1%2526reqId%253Dcd0a0c15-fb48-4361-a5eb-959b072ad739%26client_id%3Dshoplearn-web%26reqId%3Dcd0a0c15-fb48-4361-a5eb-959b072ad739%26rm%3D2%26ui_style%3Dlight&ui_style=light
- https://login.xfinity.com/login
- https://login.xfinity.com/login?c_ds_na=c_ds_na%2Cc_ds_no%2Cc_ds_ts%2Cclient_id%2Ccontinue%2Cr%2CreqId%2Cs%2CselectAccount&c_ds_no=E170CD7B34EDA1FA4E27EA534D6E17B3&c_ds_ts=1762780354&c_ds_val=E2B3B1ECC82C7D51998C4C26885ECB6F36E7C7A825B829F0477988137326DA14&client_id=shoplearn-web&continue=https%3A%2F%2Foauth.xfinity.com%2F%2Foauth%2Fauthorize%3Fresponse_type%3Dcode%26prompt%3Dselect_billing_account%26redirect_uri%3Dhttps%253A%252F%252Fwww.xfinity.com%252Fsitecore%252Fapi%252Flearn%252Fneptune%252Fcustomer%252Fexisting%252Fpostauth%26client_id%3Dshoplearn-web%26state%3Dhttps%253A%252F%252Fwww.xfinity.com%252Fauth%26nonce%3DjrwYkMcX8GNzUuAD%26response%3D1%26reqId%3Dcd0a0c15-fb48-4361-a5eb-959b072ad739&r=comcast.net&reqId=cd0a0c15-fb48-4361-a5eb-959b072ad739&s=oauth&selectAccount=1
- https://idm.xfinity.com/myaccount/create-uid?continue=https%3A%2F%2Flogin.xfinity.com%2Flogin%3Fr%3Dcomcast.net%26selectAccount%3Dtrue%26s%3Doauth%26continue%3Dhttps%253A%252F%252Foauth.xfinity.com%252F%252Foauth%252Fauthorize%253Fresponse_type%253Dcode%2526prompt%253Dselect_billing_account%2526redirect_uri%253Dhttps%25253A%25252F%25252Fwww.xfinity.com%25252Fsitecore%25252Fapi%25252Flearn%25252Fneptune%25252Fcustomer%25252Fexisting%25252Fpostauth%2526client_id%253Dshoplearn-web%2526state%253Dhttps%25253A%25252F%25252Fwww.xfinity.com%25252Fauth%2526nonce%253DjrwYkMcX8GNzUuAD%2526response%253D1%2526reqId%253Dcd0a0c15-fb48-4361-a5eb-959b072ad739%26client_id%3Dshoplearn-web%26reqId%3Dcd0a0c15-fb48-4361-a5eb-959b072ad739%26rm%3D2%26ui_style%3Dlight&ui_style=light
📡 API Calls Detected
- https://api.db-ip.com/v2/free/self
- https://ipwho.is/
- POST
📤 Form Action Targets
- https://login.xfinity.com/login
🔑 Telegram Bot Tokens (1)
- 8556388532:AAHf...2Qpi3BRY
📊 Detalhamento da Pontuação de Risco
Total Risk Score
100/100
Contributing Factors
Active Phishing Kit
Detected kit types: Credential Harvester, OTP Stealer, Card Stealer, Banking, Personal Info
Credential Harvesting
Credential harvesting detected with 2 form(s) capturing sensitive data
Telegram Exfiltration
Real-time data exfiltration via Telegram (1 bot token(s) exposed in client-side code)
Code Obfuscation
JavaScript code obfuscated using 2 technique(s) to evade detection
🔬 Análise Integral de Ameaças
Tipo de Ameaça
Banking Credential Harvester
Alvo
Xfinity users
Método de Ataque
credential harvesting forms + obfuscated JavaScript
Canal de Exfiltração
Telegram Bot (8556388532:AAHfEzZD0...) + HTTP POST to backend
Avaliação de Risco
CRITICAL - Automated credential harvesting with Telegram Bot (8556388532:AAHfEzZD0...) + HTTP POST to backend
⚠️ Indicators of Compromise
- 1 Telegram bot token(s)
- Kit types: Credential Harvester, OTP Stealer, Card Stealer, Banking, Personal Info
- 2 obfuscation techniques
🏢 Análise de Falsificação de Marca
Impersonated Brand
Xfinity
Official Website
N/A
Fake Service
Banking/payment service
⚔️ Metodologia de Ataque
Primary Method: Credential Harvesting
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Secondary Method: JavaScript Obfuscation
Malicious code is obfuscated using 2 techniques to evade detection by security scanners and make reverse engineering more difficult.
📡 Infraestrutura de Comando e Controle Telegram
Bot Token (Masked)
8556388532:AAHf...2Qpi3BRY
Bot ID
8556388532
Group/Chat ID
Unknown
Operator Language
Unknown
💬 Message Templates (3)
| ID | Português | Inglês | Trigger |
|---|---|---|---|
🌐 Indicadores de Compromisso de Infraestrutura
Domain Information
Domínio
finiityupdate.dpdns.org
Registered
Unknown
Registrar
Unknown
Estado
Age unknown
Hosting Information
Provider
Unknown
ASN
🤖 AI-Extracted Threat Intelligence
Similar Websites
Pages with identical visual appearance (based on perceptual hash)
"Nunca pensei que aconteceria comigo"
Isso dizem os 2,3 milhões de vítimas a cada ano. Não espere para ser uma estatística.