EN ES PT

Phishing Analysis

Detailed analysis of captured phishing page

Back to Stats

Captura Visual

Screenshot of crestunitfinance.net

Informações de Detecção

https://crestunitfinance.net/
Detected Brand
Crestunit Finance
Country
International
Confiança
100%
HTTP Status
200
Report ID
8c1f9d56-d56…
Analyzed
2026-08-12 23:14

Hashes de Conteúdo (Similaridade HTML)

Used to detect similar phishing pages based on HTML content

Algorithm Hash Value
CONTENT TLSH
T1BA6256B26154A93782F3C2D7BB25132FB2E34AC9C987065523FD871D8ED2E80EC15D56
CONTENT ssdeep
384:DLPukh6Uq3Ap7Yts4RaCS05HpIIHTpDqXm5RPLMrxwRVXjk7D3eYrW:fSIIJqXm5hgeLqrW

Hashes Visuais (Similaridade de Captura)

Used to detect visually similar phishing pages based on screenshots

Algorithm Hash Value
VISUAL pHash
c3073c3079c7c7c6
VISUAL aHash
00007e7e7efcf8c0
VISUAL dHash
f8f8c0c0c0c02000
VISUAL wHash
00007f7e7efcf8c0
VISUAL colorHash
10000600030
VISUAL cropResistant
f8f8c0c0c0c02000

Análise de Código

Risk Score 71/100
Nível de Ameaça ALTO
⚠️ Phishing Confirmed
🎣 OTP Stealer 🎣 Banking

🔬 Threat Analysis Report

• Ameaça: Fraude Financeira/HYIP
• Alvo: Investidores
• Método: Landing page corporativa enganosa com scripts ofuscados
• Exfil: Captura via formulário JavaScript
• Indicadores: Código-fonte ofuscado, promessas financeiras vagas
• Risco: Alto

🔒 Obfuscation Detected

  • fromCharCode
  • unescape

📡 API Calls Detected

  • POST
  • /api/sms/verify
  • /api/sms/send
  • /api/sms-verification-status

📊 Detalhamento da Pontuação de Risco

Total Risk Score
88/100

Contributing Factors

Obfuscation
Detection of fromCharCode/unescape used to obscure site logic.
Content
HYIP-style hyperbolic language common in investment scams.

🔬 Análise Integral de Ameaças

Tipo de Ameaça
Banking Credential Harvester
Alvo
Crestunit Finance users (International)
Método de Ataque
Brand impersonation + obfuscated JavaScript
Canal de Exfiltração
Form submission (backend endpoint not detected - likely JavaScript-based)
Avaliação de Risco
HIGH - Automated credential harvesting with Form submission (backend endpoint not detected - likely JavaScript-based)

⚠️ Indicators of Compromise

  • Kit types: OTP Stealer, Banking
  • 3 obfuscation techniques

🏢 Análise de Falsificação de Marca

Impersonated Brand
Crestunit Finance
Fake Service
Investment Management

Fraudulent Claims

⚔️ Metodologia de Ataque

Primary Method: Financial Fraud / Investment Scam

The site lures users into providing personal or financial data under the guise of an 'exclusive' investment opportunity.

Secondary Method: Credential Harvesting

Form inputs capture sensitive data which is then obfuscated and transmitted to a remote server.

🌐 Indicadores de Compromisso de Infraestrutura

Domain Information

Domínio
crestunitfinance.net
Registered
2026-06-09
Registrar
Unknown
Estado
Active

🤖 AI-Extracted Threat Intelligence

😰
"Nunca pensei que aconteceria comigo"
Isso dizem os 2,3 milhões de vítimas a cada ano. Não espere para ser uma estatística.