SafeMode - Analysis: mwizz.leadsbr.com.br

Captura Visual

Informações de Detecção

https://mwizz.leadsbr.com.br/latest/index.php/campaigns/nq545gfx7l578/track-url/le484ve9ex5e3/3a45a40c018b285e4fab438fb20311f3afa6c1f3

Detected Brand

Seguro Auto (Insurance)

Country

International

Confiança

100%

HTTP Status

200

Report ID

6be64136-b79…

Analyzed

2026-02-17 12:46

Final URL (after redirects)

https://coteaqui.planosparavc.com.br/auto-1/

Hashes de Conteúdo (Similaridade HTML)

Used to detect similar phishing pages based on HTML content

Algorithm	Hash Value
CONTENT TLSH	T155E3A67FA1249C6FF29AC394EFB414697198D0C9E782D394C3E8837C6E604DB5C3A964
CONTENT ssdeep	768:qrHlpBS5sKuOIbFlMGYjMPNnhVM58ZK4zNes0o0:qTlpiuOaFlMGYjoFK500

Hashes Visuais (Similaridade de Captura)

Used to detect visually similar phishing pages based on screenshots

Algorithm	Hash Value
VISUAL pHash	9753e82ae2aae2cc
VISUAL aHash	bd0e0e0e0e0f9fff
VISUAL dHash	69dc9c5c7cfa330c
VISUAL wHash	850e0e0e0e0f1fff
VISUAL colorHash	060000001c0
VISUAL cropResistant	0061697969699609,dcdc5c7cfc7b330c,a1a94c76a80e61a9,4960928c14cd4a55,a69e16d4598ba242,dcd89c5c7cfcfa33

Análise de Código

Risk Score 100/100

Nível de Ameaça MEDIO

⚠️ Phishing Confirmed

🎣 Credential Harvester 🎣 OTP Stealer 🎣 Card Stealer 🎣 Banking 🎣 Personal Info

🔬 Threat Analysis Report

• Ameaça: Phishing
• Alvo: Clientes de seguros
• Método: Phishing baseado em formulários, solicitando informações pessoais
• Exfil: descadastramento.php, https://painel.sauti.com.br/modules/Webforms/capture.php, salvaeenvia.php
• Indicadores: Domínio não relacionado, formulários solicitam informações sensíveis, ofuscação de javascript.
• Risco: Moderado

🔐 Credential Harvesting Forms

🔒 Obfuscation Detected

atob
eval
fromCharCode
unescape
hex_escape
unicode_escape
base64_strings

🎯 Kit Endpoints

http://developers.facebook.com/policy/].
http://www.ans.gov.br/planos-de-saude-e-operadoras/contratacao-e-troca-de-plano/dicas-para-escolher-um-plano/segmentacao-assistencial
https://www.facebook.com/privacy_sandbox/pixel/register/trigger/
https://connect.facebook.net/
#small-dialog-ch
https://connect.facebook.net/en_US/fbevents.js
https://www.googletagmanager.com/gtag/js?id=AW-1002935720
https://connect.facebook.net/log/fbevents_telemetry/
https://www.facebook.com/tr
https://developers.facebook.com/docs/meta-pixel/reference/
http://www.ans.gov.br/planos-de-saude-e-operadoras/contratacao-e-troca-de-plano/dicas-para-escolher-um-plano/formas-de-contratacao-de-planos-de-saude
https://www.instagram.com/tr/
https://api.whatsapp.com/send?l=pt&phone=5511985499166
http://www.ans.gov.br/images/stories/Materiais_para_pesquisa/Materiais_por_assunto/cartilha_plano_de_saude.pdf
https://www.facebook.com/privacy_sandbox/topics/registration/
https://gw.conversionsapigateway.com
https://www.facebook.com/tr/
#small-dialog-in
#small-dialog-it
https://www.planodesaudepopulares.com.br/contador/
https://painel.sauti.com.br/modules/Webforms/capture.php
https://developers.facebook.com/docs/ads-for-websites/pixel-events/#events
https://wa.me/
https://mwizz.leadsbr.com.br/latest/index.php/campaigns/nq545gfx7l578/track-url/le484ve9ex5e3/custom.js
https://embed.tawk.to/5e7e2b8c35bcbb0c9aab1791/default
https://connect.facebook.net/signals/config/2029723907178183?v=2.9.265&r=stable&domain=coteaqui.planosparavc.com.br&hme=8faeb0ed09c145bbd9d3213e762abac29e9f76b8e7a9df9d71a3058625e3b7dd&ex_m=96%2C187%2C136%2C21%2C68%2C69%2C129%2C64%2C43%2C130%2C73%2C63%2C10%2C143%2C82%2C15%2C95%2C124%2C117%2C71%2C74%2C123%2C140%2C104%2C145%2C7%2C3%2C4%2C6%2C5%2C2%2C83%2C93%2C146%2C151%2C201%2C57%2C167%2C168%2C50%2C238%2C28%2C70%2C213%2C212%2C211%2C30%2C56%2C9%2C59%2C89%2C90%2C91%2C97%2C120%2C29%2C27%2C122%2C119%2C118%2C137%2C72%2C139%2C138%2C45%2C55%2C113%2C14%2C142%2C40%2C226%2C227%2C225%2C24%2C25%2C26%2C17%2C19%2C39%2C35%2C37%2C36%2C78%2C84%2C88%2C102%2C128%2C131%2C41%2C103%2C22%2C20%2C109%2C65%2C33%2C133%2C132%2C134%2C125%2C23%2C32%2C54%2C101%2C141%2C66%2C16%2C135%2C106%2C77%2C62%2C18%2C31%2C249%2C194%2C181%2C182%2C180%2C252%2C244%2C195%2C99%2C121%2C76%2C111%2C49%2C42%2C44%2C105%2C110%2C116%2C53%2C60%2C115%2C48%2C51%2C47%2C92%2C144%2C0%2C114%2C13%2C112%2C11%2C1%2C52%2C85%2C58%2C61%2C108%2C81%2C80%2C147%2C148%2C86%2C87%2C8%2C94%2C46%2C126%2C79%2C75%2C67%2C107%2C98%2C38%2C127%2C34%2C100%2C12%2C149

📡 API Calls Detected

GET
POST
https://www.google.com/ccm/geo

📤 Form Action Targets

descadastramento.php
https://painel.sauti.com.br/modules/Webforms/capture.php
salvaeenvia.php

📊 Detalhamento da Pontuação de Risco

Total Risk Score

65/100

Contributing Factors

Domain mismatch

The domain does not match the insurance services.

Form with sensitive fields

The form asks for personal and contact details, which are sensitive.

Javascript Obfuscation

Obfuscated javascript code detected (atob, eval, fromCharCode)

🔬 Análise Integral de Ameaças

Tipo de Ameaça

Banking Credential Harvester

Alvo

Seguro Auto (Insurance) users (International)

Método de Ataque

credential harvesting forms + obfuscated JavaScript

Canal de Exfiltração

HTTP POST to backend

Avaliação de Risco

CRITICAL - Automated credential harvesting with HTTP POST to backend

⚠️ Indicators of Compromise

Kit types: Credential Harvester, OTP Stealer, Card Stealer, Banking, Personal Info
243 obfuscation techniques

🏢 Análise de Falsificação de Marca

Impersonated Brand

Seguro Auto

Fake Service

Insurance quote simulation

⚔️ Metodologia de Ataque

Primary Method: Credential Harvesting

The site uses a form to collect personal information under the pretense of providing insurance quotes. This information can be used for various malicious purposes, including identity theft or fraud.

Secondary Method: Potential redirection

Form data may be redirected to a phishing site or used for further attacks.

🌐 Indicadores de Compromisso de Infraestrutura

🦠 Malicious Files

Main File

2029723907178183?v=2.9.265&r=stable&domain=coteaqui.planosparavc.com.br&hme=8faeb0ed09c145bbd9d3213e762abac29e9f76b8e7a9df9d71a3058625e3b7dd&ex_m=96%2C187%2C136%2C21%2C68%2C69%2C129%2C64%2C43%2C130%2C73%2C63%2C10%2C143%2C82%2C15%2C95%2C124%2C117%2C71%2C74%2C123%2C140%2C104%2C145%2C7%2C3%2C4%2C6%2C5%2C2%2C83%2C93%2C146%2C151%2C201%2C57%2C167%2C168%2C50%2C238%2C28%2C70%2C213%2C212%2C211%2C30%2C56%2C9%2C59%2C89%2C90%2C91%2C97%2C120%2C29%2C27%2C122%2C119%2C118%2C137%2C72%2C139%2C138%2C45%2C55%2C113%2C14%2C142%2C40%2C226%2C227%2C225%2C24%2C25%2C26%2C17%2C19%2C39%2C35%2C37%2C36%2C78%2C84%2C88%2C102%2C128%2C131%2C41%2C103%2C22%2C20%2C109%2C65%2C33%2C133%2C132%2C134%2C125%2C23%2C32%2C54%2C101%2C141%2C66%2C16%2C135%2C106%2C77%2C62%2C18%2C31%2C249%2C194%2C181%2C182%2C180%2C252%2C244%2C195%2C99%2C121%2C76%2C111%2C49%2C42%2C44%2C105%2C110%2C116%2C53%2C60%2C115%2C48%2C51%2C47%2C92%2C144%2C0%2C114%2C13%2C112%2C11%2C1%2C52%2C85%2C58%2C61%2C108%2C81%2C80%2C147%2C148%2C86%2C87%2C8%2C94%2C46%2C126%2C79%2C75%2C67%2C107%2C98%2C38%2C127%2C34%2C100%2C12%2C149

File Size

🔬 JavaScript Deep Analysis

Operator Language

Portuguese (1%)

Sophistication Level

Basic

Total Code Size

566,4 KB

🔗 API Endpoints Detected

Other

14

🔐 Obfuscation Detected

: Light
: Moderate
: Light

🤖 AI-Extracted Threat Intelligence

🎯 Malicious Files Identified

Main Drainer

2029723907178183?v=2.9.265&amp;r=stable&amp;domain=coteaqui.planosparavc.com.br&amp;hme=8faeb0ed09c145bbd9d3213e762abac29e9f76b8e7a9df9d71a3058625e3b7dd&amp;ex_m=96%2C187%2C136%2C21%2C68%2C69%2C129%2C64%2C43%2C130%2C73%2C63%2C10%2C143%2C82%2C15%2C95%2C124%2C117%2C71%2C74%2C123%2C140%2C104%2C145%2C7%2C3%2C4%2C6%2C5%2C2%2C83%2C93%2C146%2C151%2C201%2C57%2C167%2C168%2C50%2C238%2C28%2C70%2C213%2C212%2C211%2C30%2C56%2C9%2C59%2C89%2C90%2C91%2C97%2C120%2C29%2C27%2C122%2C119%2C118%2C137%2C72%2C139%2C138%2C45%2C55%2C113%2C14%2C142%2C40%2C226%2C227%2C225%2C24%2C25%2C26%2C17%2C19%2C39%2C35%2C37%2C36%2C78%2C84%2C88%2C102%2C128%2C131%2C41%2C103%2C22%2C20%2C109%2C65%2C33%2C133%2C132%2C134%2C125%2C23%2C32%2C54%2C101%2C141%2C66%2C16%2C135%2C106%2C77%2C62%2C18%2C31%2C249%2C194%2C181%2C182%2C180%2C252%2C244%2C195%2C99%2C121%2C76%2C111%2C49%2C42%2C44%2C105%2C110%2C116%2C53%2C60%2C115%2C48%2C51%2C47%2C92%2C144%2C0%2C114%2C13%2C112%2C11%2C1%2C52%2C85%2C58%2C61%2C108%2C81%2C80%2C147%2C148%2C86%2C87%2C8%2C94%2C46%2C126%2C79%2C75%2C67%2C107%2C98%2C38%2C127%2C34%2C100%2C12%2C149

File Size

567KB