EN ES PT

Phishing Analysis

Detailed analysis of captured phishing page

Back to Stats

Captura Visual

Screenshot of dorianixfloxin.com

Informações de Detecção

http://dorianixfloxin.com
Detected Brand
Dorianix Floxin
Country
International
Confiança
100%
HTTP Status
200
Report ID
9af2ea1d-eca…
Analyzed
2026-01-30 12:41
Final URL (after redirects)
https://dorianixfloxin.com/

Hashes de Conteúdo (Similaridade HTML)

Used to detect similar phishing pages based on HTML content

Algorithm Hash Value
CONTENT TLSH
T177B3DD274219692B4477C2D130795F3BE1A5DE8BFAE70A014EECC7F62BF9C90B41A119
CONTENT ssdeep
1536:WGY2pR4nXBKpSpFl26vFRmNwmN84YA/t8P57:uSUMsRmNwmN+

Hashes Visuais (Similaridade de Captura)

Used to detect visually similar phishing pages based on screenshots

Algorithm Hash Value
VISUAL pHash
de16e9e91c43b641
VISUAL aHash
0000040400fffbff
VISUAL dHash
9eececaca4230333
VISUAL wHash
000004047effffff
VISUAL colorHash
1b402008040
VISUAL cropResistant
808080c0d0808080,808080c0c0808080,808080c0d0c08082,a080b89a9aa88080,004092ccccc40300,c833331333033333,d69cccecececa4a4,6f6e674d19368632,d9090f1f34662e14

Análise de Código

Risk Score 79/100
Nível de Ameaça ALTO
⚠️ Phishing Confirmed
🎣 Credential Harvester 🎣 OTP Stealer 🎣 Banking

🔬 Threat Analysis Report

• Ameaça: Phishing
• Alvo: Usuários de plataformas de negociação de criptomoedas
• Método: Personificação e Engenharia Social
• Exfil: Envio de formulário, provavelmente rouba dados do usuário
• Indicadores: Idade do domínio, JavaScript ofuscado, formulário, depoimento de celebridade, chamada urgente para ação
• Risco: ALTO

🔒 Obfuscation Detected

  • fromCharCode
  • document.write
  • unicode_escape

📡 API Calls Detected

  • gettup.php?subid5=
  • POST
  • /systems/geo-ip.php

📊 Detalhamento da Pontuação de Risco

Total Risk Score
90/100

Contributing Factors

Domain Age
Recent domain indicates potential malicious activity.
Obfuscated Javascript
Obfuscation is used to hide malicious code from detection.
Forms Present
Forms on phishing websites harvest user credentials.
Impersonation
The site impersonates a brand/service.

🔬 Análise Integral de Ameaças

Tipo de Ameaça
Banking Credential Harvester
Alvo
Dorianix Floxin users (International)
Método de Ataque
Brand impersonation + credential harvesting forms + obfuscated JavaScript
Canal de Exfiltração
Form submission (backend endpoint not detected - likely JavaScript-based)
Avaliação de Risco
HIGH - Automated credential harvesting with Form submission (backend endpoint not detected - likely JavaScript-based)

⚠️ Indicators of Compromise

  • Kit types: Credential Harvester, OTP Stealer, Banking
  • 38 obfuscation techniques

🏢 Análise de Falsificação de Marca

Impersonated Brand
Dorianix Floxin
Fake Service
Cryptocurrency Trading Platform

Fraudulent Claims

⚔️ Metodologia de Ataque

Primary Method: Credential Harvesting

The site uses a form to collect personal information and likely steal credentials, taking advantage of the user's belief that they are interacting with a legitimate financial service.

Secondary Method: Social Engineering

The site uses design elements like a celebrity endorsement to build trust and persuade users to enter their information.

🌐 Indicadores de Compromisso de Infraestrutura

Domain Information

Domínio
dorianixfloxin.com
Registered
2023-09-21
Registrar
Unknown
Estado
active

🔬 JavaScript Deep Analysis

Operator Language
Portuguese (1%)
Total Code Size
19,5 KB

🔐 Obfuscation Detected

  • : None
  • : None
  • : None

🤖 AI-Extracted Threat Intelligence

Scan History for dorianixfloxin.com

Found 1 other scan for this domain

😰
"Nunca pensei que aconteceria comigo"
Isso dizem os 2,3 milhões de vítimas a cada ano. Não espere para ser uma estatística.