EN ES PT

Phishing Analysis

Detailed analysis of captured phishing page

Back to Stats

Captura Visual

Screenshot of frthingy.es

Informações de Detecção

https://frthingy.es/review
Detected Brand
DocuSign
Country
Unknown
Confiança
100%
HTTP Status
200
Report ID
95d9b5f0-bbc…
Analyzed
2026-05-08 05:25
Final URL (after redirects)
https://frthingy.es/review/

Hashes de Conteúdo (Similaridade HTML)

Used to detect similar phishing pages based on HTML content

Algorithm Hash Value
CONTENT TLSH
T1E05165B84367983E1663C6F47BBA9B2A63C541DDF992120757FCC38809FAC96EC03184
CONTENT ssdeep
48:TVVGP0YzBg89e7y+gl5+SEj7cnhT5GkIYbS3D:TV9Yz6el5+SE7K5GeO3D

Hashes Visuais (Similaridade de Captura)

Used to detect visually similar phishing pages based on screenshots

Algorithm Hash Value
VISUAL pHash
e431cfce9b986431
VISUAL aHash
ffc3c3cffff3ffff
VISUAL dHash
6096969e39660600
VISUAL wHash
ffc2c2c0fcf0c0f0
VISUAL colorHash
07000400038
VISUAL cropResistant
6096969e39660600,7dbeb7cb83f3d3f7

Análise de Código

Risk Score 100/100
Nível de Ameaça ALTO
⚠️ Phishing Confirmed
🎣 OTP Stealer 🎣 Banking
Telegram Exfiltration

🔒 Obfuscation Detected

  • atob
  • unescape

📡 API Calls Detected

  • POST
  • http://ipinfo.io/json

🔑 Telegram Bot Tokens (1)

  • 8531279903:AAEr...V8bK_UBo

📊 Detalhamento da Pontuação de Risco

Total Risk Score
100/100

Contributing Factors

Active Phishing Kit
Detected kit types: OTP Stealer, Banking
Telegram Exfiltration
Real-time data exfiltration via Telegram (1 bot token(s) exposed in client-side code)
Code Obfuscation
JavaScript code obfuscated using 3 technique(s) to evade detection

🔬 Análise Integral de Ameaças

Tipo de Ameaça
Banking Credential Harvester
Alvo
DocuSign users
Método de Ataque
obfuscated JavaScript
Canal de Exfiltração
Telegram Bot (8531279903:AAErCLOmG...)
Avaliação de Risco
CRITICAL - Automated credential harvesting with Telegram Bot (8531279903:AAErCLOmG...)

⚠️ Indicators of Compromise

  • 1 Telegram bot token(s)
  • Kit types: OTP Stealer, Banking
  • 3 obfuscation techniques

🏢 Análise de Falsificação de Marca

Impersonated Brand
DocuSign
Official Website
N/A
Fake Service
Banking/payment service

⚔️ Metodologia de Ataque

Primary Method: Two-Factor Authentication Bypass

Victim is prompted for 2FA code after entering credentials. The code is intercepted and used by attacker to access victim's account in real-time.

Secondary Method: JavaScript Obfuscation

Malicious code is obfuscated using 3 techniques to evade detection by security scanners and make reverse engineering more difficult.

📡 Infraestrutura de Comando e Controle Telegram

Bot Token (Masked)
8531279903:AAEr...V8bK_UBo
Bot ID
8531279903
Group/Chat ID
Unknown
Operator Language
Unknown

💬 Message Templates (3)

ID Português Inglês Trigger

🌐 Indicadores de Compromisso de Infraestrutura

Domain Information

Domínio
frthingy.es
Registered
Unknown
Registrar
Unknown
Estado
Age unknown

Hosting Information

Provider
Unknown
ASN

🤖 AI-Extracted Threat Intelligence

Similar Websites

Pages with identical visual appearance (based on perceptual hash)

Screenshot
DocuSign
https://rebrand.ly/sq6qj91
Mai 08, 2026
😰
"Nunca pensei que aconteceria comigo"
Isso dizem os 2,3 milhões de vítimas a cada ano. Não espere para ser uma estatística.