EN ES PT

Phishing Analysis

Detailed analysis of captured phishing page

Back to Stats

Captura Visual

No screenshot available

Informações de Detecção

https://3656d.cc
Detected Brand
Unknown
Country
International
Confiança
100%
HTTP Status
200
Report ID
5bdcd9e8-326…
Analyzed
2026-03-17 03:16
Final URL (after redirects)
https://3656d.cc:8989/verify-page/index.html

Hashes de Conteúdo (Similaridade HTML)

Used to detect similar phishing pages based on HTML content

Algorithm Hash Value
CONTENT TLSH
T180B14271C05A293BB907C1D8B1B0EB0A72D7534EDB82096582FD027A37CFD51F91A9D6
CONTENT ssdeep
96:FuwEM6S8LUfANuZsdFYTYcBZbEYTPdp2sclVSTfni1EdvB:H6SJouZs3kBNTPdp2sclEDnx

Hashes Visuais (Similaridade de Captura)

Used to detect visually similar phishing pages based on screenshots

Algorithm Hash Value
VISUAL pHash
d99905cb3c27c336
VISUAL aHash
ffffffffdc280000
VISUAL dHash
f2b2ca2b21d15166
VISUAL wHash
7fffffdb98000000
VISUAL colorHash
0e0000001c0
VISUAL cropResistant
f2b39ac8ab2b35d9,8c6cacdcd86a7e5c,f87e7f7ffffebdaa,2b2835d950516364,210830b2b2320c11,11043232b2300c21

Análise de Código

Risk Score 100/100
Nível de Ameaça ALTO
⚠️ Phishing Confirmed
🎣 Credential Harvester 🎣 OTP Stealer 🎣 Card Stealer 🎣 Banking 🎣 Personal Info

🔬 Threat Analysis Report

• Ameaça: Phishing
• Alvo: Desconhecido
• Método: Redirecionamento com Captcha malicioso
• Exfil: Desconhecido
• Indicadores: JS ofuscado, Captcha suspeito, design genérico
• Risco: ALTO

🔒 Obfuscation Detected

  • fromCharCode
  • document.write

🎯 Kit Endpoints

  • https://3656d.cc:8989/verify-page/theme/default/layer.css?v=3.1.0

📊 Detalhamento da Pontuação de Risco

Total Risk Score
90/100

Contributing Factors

Suspicious Captcha
Captchas are often used to identify bot traffic. This one looks odd, raising suspicion
Obfuscated Javascript
Obfuscation is a common technique to hide malicious code from detection. This greatly increases the risk.
Generic Design
The lack of branding suggests it is not legitimate.
Form submission and JS detection
JavaScript form submission detected.

🔬 Análise Integral de Ameaças

Tipo de Ameaça
Banking Credential Harvester
Alvo
General public
Método de Ataque
credential harvesting forms + obfuscated JavaScript
Canal de Exfiltração
Form submission (backend endpoint not detected - likely JavaScript-based)
Avaliação de Risco
CRITICAL - Automated credential harvesting with Form submission (backend endpoint not detected - likely JavaScript-based)

⚠️ Indicators of Compromise

  • Kit types: Credential Harvester, OTP Stealer, Card Stealer, Banking, Personal Info
  • 6 obfuscation techniques

🏢 Análise de Falsificação de Marca

Impersonated Brand
Unknown
Fake Service
Unknown

⚔️ Metodologia de Ataque

Primary Method: Malicious Captcha Redirect

The user interacts with the Captcha, which could redirect them to a phishing website designed to steal credentials or install malware. The obfuscation is likely to conceal malicious javascript.

Secondary Method: Credential Harvesting

The site may harvest credentials or deliver a payload based on the users actions.

🌐 Indicadores de Compromisso de Infraestrutura

Domain Information

Domínio
3656d.cc
Registered
2019-09-06T06:05:06Z
Registrar
Name.com, Inc.
Estado
ACTIVE

🤖 AI-Extracted Threat Intelligence

Scan History for 3656d.cc

Found 1 other scan for this domain

😰
"Nunca pensei que aconteceria comigo"
Isso dizem os 2,3 milhões de vítimas a cada ano. Não espere para ser uma estatística.