Phishing Analysis
Detailed analysis of captured phishing page
Captura Visual
Informações de Detecção
https://frgrgjfeijfegrfeifei.cfolks.pl/cr/fo/
Detected Brand
Mediapart
Country
Unknown
Confiança
100%
HTTP Status
200
Report ID
974a3d62-d38…
Analyzed
2026-06-17 06:24
Final URL (after redirects)
https://www.mediapart.fr/
Hashes de Conteúdo (Similaridade HTML)
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T1484576E16620A3AD94C7DAEDDF39DE90530F40BAB976C6C18ABEC75C9447D80FB06814 |
|
CONTENT
ssdeep
|
3072:LxiobzgXXLTfSfY48ALko62PhyysivULmTbp0l4fNhwhPPLV01QnEoT1LYuLTte8:L/gu/LcOe+tmJ9L |
Hashes Visuais (Similaridade de Captura)
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
cbd934a662ca9c99 |
|
VISUAL
aHash
|
00183c3c3c3c3800 |
|
VISUAL
dHash
|
4d7371717971710f |
|
VISUAL
wHash
|
0018bdbdbdbdbd00 |
|
VISUAL
colorHash
|
0e200038000 |
|
VISUAL
cropResistant
|
f8dcacc38e595588,4d7371717971710f,3434b5d4d4353434 |
Análise de Código
Risk Score
85/100
Nível de Ameaça
ALTO
⚠️ Phishing Confirmed
🎣 Credential Harvester
🎣 Banking
🎣 Personal Info
🔐 Credential Harvesting Forms
🔒 Obfuscation Detected
- atob
- eval
- fromCharCode
- unicode_escape
- base64_strings
🎯 Kit Endpoints
- //blogs.mediapart.fr/charte-de-participation
- //blogs.mediapart.fr/chrispi/blog/170626/paris-15-jeunes-lecteurs-en-finale-des-petits-champions-de-la-lecture
- //blogs.mediapart.fr/les-rendez-vous-de-mediapart/blog/150626/prolonger-le-mediapart-festival-2026
- /journal/ecologie/150626/a69-bientot-la-fin-du-feuilleton-judiciaire
- /charte-de-deontologie
- /journal/ecologie/140626/un-livre-pour-definir-l-habitabilite-et-ce-qu-ne-doit-jamais-faire-un-monde
- //blogs.mediapart.fr/mehdi-chaibi/blog/150626/du-qatar-aux-etats-unis-geographie-variable-de-l-indignation-0
- //blogs.mediapart.fr/
- //blogs.mediapart.fr/lesnaufragesdelajustice/blog/150626/les-naufrages-de-la-justice
- //blogs.mediapart.fr/blogs
- //blogs.mediapart.fr/snj-cgt-france-tv/blog/150626/franceinfo-nouvelles-derives-editoriales-le-pour-et-le-contre
- https://blogs.mediapart.fr/charte-de-participation
- //blogs.mediapart.fr/carine-fouteau/blog/160626/pressions-judiciaires-mediapart-apporte-son-soutien-guyaweb
- //blogs.mediapart.fr/editions
- https://blogs.mediapart.fr/
- /journal/ecologie
- //blogs.mediapart.fr/clement-morel/blog/160626/cap-frehel-deux-avions-de-chasse-au-ras-dun-site-ornithologique-majeur
- /journal/france/160626/ce-n-est-pas-la-collectivite-de-subvenir-aux-besoins-de-votre-enfant-au-tribunal-de-brest-le-proces-du-rsa
- //blogs.mediapart.fr/parents-feministes-et-en-avant-toutes/blog/160626/1-apres-quel-bilan-pour-levar-s-tables-rondes-le-18-juin-cite-audacieuse
- //blogs.mediapart.fr/eleonore-bassop/blog/150626/140-ans-d-amitie-relire-l-histoire-franco-coreenne-l-ombre-des-empires
- //blogs.mediapart.fr/faris-lounis/blog/270526/yahia-belaskri-un-chant-pour-attenter-la-mort
- https://www.mediapart.fr/charte-de-deontologie
- /journal/ecologie/160626/mobilisation-au-parlement-europeen-contre-la-privatisation-du-vivant
- //blogs.mediapart.fr/claudio-casparrino/blog/150626/territoire-et-liberte-l-organisation-paysanne-et-autochtone-mocase-vc-d-argentine-0
- //blogs.mediapart.fr/pierrefarge/blog/160626/ocabsa-pourquoi-avoir-attendu-dix-ans-pour-agir
- //blogs.mediapart.fr/guillaume-lasserre/blog/120626/duane-michals-l-image-apres-la-photographie
- /login
- //blogs.mediapart.fr/48H
- //blogs.mediapart.fr/perou/blog/150626/vers-un-pavillon-maritime-europeen-pour-le-sauvetage-et-le-soin-en-haute-mer
- /journal/international/130626/dans-la-region-colombienne-du-cauca-une-oasis-agroecologique-en-pleine-terre-de-conflits
- //blogs.mediapart.fr/salariees-du-wwf-france/blog/160626/proteger-le-vivant-et-oeuvrer-pour-les-dignites-une-seule-et-meme-lutte
- //blogs.mediapart.fr/maxime-combes/blog/150626/instance-illegitime-au-bilan-calamiteux-le-g7-est-une-scorie-du-passe
- /journal/ecologie/140626/nouveaux-ogm-ultime-bataille-europeenne-contre-la-privatisation-du-vivant
- //blogs.mediapart.fr/agenda
- //blogs.mediapart.fr/perrinevasque/blog/170626/lextreme-droite-veut-ficher-des-pedocriminels-quelle-refuse-de-voir
- //blogs.mediapart.fr/ikio/blog/150626/tribune-resf-31-le-monde-universitaire-toulousain-se-mobilise
- //blogs.mediapart.fr/association-amour-de-la-justice/blog/170626/affaire-lyhanna-chronique-d-une-tragedie-previsible
- //blogs.mediapart.fr/anne-blandine-caire/blog/160626/affaire-lyhanna-proteger-avant-qu-il-ne-soit-trop-tard-sans-renoncer-l-etat-de-droit
- //blogs.mediapart.fr/macko-dragan/blog/150626/ma-presse-libre
- //blogs.mediapart.fr/edwy-plenel/blog/120626/hommage-jean-max-causse-franc-tireur-cinephile
- //blogs.mediapart.fr/yorgos-mitralias/blog/150626/des-jo-d-hitler-au-mondial-de-trump-affinites-electives-et-differences
- //blogs.mediapart.fr/guillaume-lasserre/blog/150626/la-marche-la-foule-le-monde-propos-d-extra-moenia-d-emma-dante
- //blogs.mediapart.fr/julien-cueille/blog/150626/quand-l-ia-corrige-l-ia-un-bac-de-philo-tres-augmente
- //blogs.mediapart.fr/survival-international/blog/150626/wwf-et-le-racisme-lindignation-lenvers
- //blogs.mediapart.fr/christophe-prudhomme/blog/080626/le-systeme-de-sante-francais-n-est-pas-exceptionnellement-genereux
- /journal/france/160626/nacira-guenif-souilamas-le-slogan-black-blanc-beur-fonctionne-la-fois-comme-un-tabou-et-une-injonction-au
- //blogs.mediapart.fr/les-invite-es-de-mediapart/blog/170626/un-jugement-qui-met-tous-les-enseignants-et-chercheurs-en-danger
📡 API Calls Detected
- GET
📤 Form Action Targets
- /journal/une/170626
📊 Detalhamento da Pontuação de Risco
Total Risk Score
100/100
Contributing Factors
Active Phishing Kit
Detected kit types: Credential Harvester, Banking, Personal Info
Credential Harvesting
Credential harvesting detected with 1 form(s) capturing sensitive data
Code Obfuscation
JavaScript code obfuscated using 20 technique(s) to evade detection
🔬 Análise Integral de Ameaças
Tipo de Ameaça
Banking Credential Harvester
Alvo
Mediapart users
Método de Ataque
credential harvesting forms + obfuscated JavaScript
Canal de Exfiltração
HTTP POST to backend
Avaliação de Risco
CRITICAL - Automated credential harvesting with HTTP POST to backend
⚠️ Indicators of Compromise
- Kit types: Credential Harvester, Banking, Personal Info
- 20 obfuscation techniques
🏢 Análise de Falsificação de Marca
Impersonated Brand
Mediapart
Official Website
N/A
Fake Service
Banking/payment service
⚔️ Metodologia de Ataque
Primary Method: Credential Harvesting
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Secondary Method: JavaScript Obfuscation
Malicious code is obfuscated using 20 techniques to evade detection by security scanners and make reverse engineering more difficult.
🌐 Indicadores de Compromisso de Infraestrutura
Domain Information
Domínio
frgrgjfeijfegrfeifei.cfolks.pl
Registered
Unknown
Registrar
None
Estado
Age unknown
Hosting Information
Provider
Unknown
ASN
🤖 AI-Extracted Threat Intelligence
Similar Websites
Pages with identical visual appearance (based on perceptual hash)
"Nunca pensei que aconteceria comigo"
Isso dizem os 2,3 milhões de vítimas a cada ano. Não espere para ser uma estatística.