EN ES PT

Phishing Analysis

Detailed analysis of captured phishing page

Back to Stats

Captura Visual

Screenshot of acceso-v2p.webcindario.com

Informações de Detecção

https://acceso-v2p.webcindario.com/
Detected Brand
Microsoft
Country
International
Confiança
100%
HTTP Status
200
Report ID
9f4edebc-69b…
Analyzed
2026-03-12 08:30

Hashes de Conteúdo (Similaridade HTML)

Used to detect similar phishing pages based on HTML content

Algorithm Hash Value
CONTENT TLSH
T148510A3598400D777D2BC630EAD9A10975434D5FDB5302B28AF105FFA2E4EAEC8D60A8
CONTENT ssdeep
48:Y7CfVVd6jPJYoD/k6jPBrRV9FP1A2AFP5fJtWtFPo62eHxgtDvFJu:Zn09TBn9YLfqtO6MNu

Hashes Visuais (Similaridade de Captura)

Used to detect visually similar phishing pages based on screenshots

Algorithm Hash Value
VISUAL pHash
9c2c6332cc9dcc37
VISUAL aHash
03031f1f1e1e1c3c
VISUAL dHash
ffffb2b2f0f0f0f0
VISUAL wHash
03071f1f1f1e1e3c
VISUAL colorHash
000000180c0
VISUAL cropResistant
ffffb2b2f0f0f0f0,fffdf6f6fffeffff

Análise de Código

Risk Score 100/100
Nível de Ameaça ALTO
⚠️ Phishing Confirmed
🎣 Credential Harvester 🎣 OTP Stealer 🎣 Banking 🎣 Personal Info
Telegram Exfiltration

🔬 Threat Analysis Report

• Ameaça: Phishing
• Alvo: Usuários da Microsoft
• Método: Coleta de credenciais
• Exfil: Telegram
• Indicadores: Domínio suspeito, Formulário, Obfuscação, Token do Telegram
• Risco: ALTO

🔒 Obfuscation Detected

  • atob
  • fromCharCode
  • hex_escape
  • unicode_escape
  • base64_strings

📡 API Calls Detected

  • https://www.google.com/ccm/geo
  • GET
  • /hosting__contador__visitas__unicas.php

🔑 Telegram Bot Tokens (1)

  • 8203516804:AAEW...ynFC4lAU

💬 Telegram Chat IDs (1)

  • 7064533965

📊 Detalhamento da Pontuação de Risco

Total Risk Score
90/100

Contributing Factors

Suspicious Domain
The domain is not related to Microsoft.
Active Phishing Kit
The presence of a login form suggests credential harvesting.
Obfuscation
Obfuscation techniques are detected, further suggesting malicious intent.
Telegram Token
Data likely being exfiltrated to Telegram bot.

🔬 Análise Integral de Ameaças

Tipo de Ameaça
Banking Credential Harvester
Alvo
Microsoft users (International)
Método de Ataque
Brand impersonation + credential harvesting forms + obfuscated JavaScript
Canal de Exfiltração
Telegram Bot (8203516804:AAEWgtjsa...)
Avaliação de Risco
CRITICAL - Automated credential harvesting with Telegram Bot (8203516804:AAEWgtjsa...)

⚠️ Indicators of Compromise

  • 1 Telegram bot token(s)
  • Kit types: Credential Harvester, OTP Stealer, Banking, Personal Info
  • 59 obfuscation techniques

🏢 Análise de Falsificação de Marca

Impersonated Brand
Microsoft
Official Website
microsoft.com
Fake Service
Outlook

⚔️ Metodologia de Ataque

Primary Method: Credential Harvesting

The site is designed to steal user credentials by mimicking the Microsoft login page.

Secondary Method: Obfuscation

JavaScript code obfuscation is used to hide malicious intentions.

📡 Infraestrutura de Comando e Controle Telegram

Bot Token (Masked)
8203516804:AAEW...ynFC4lAU
Bot ID
8203516804
Group/Chat ID
7064533965
Operator Language
Unknown

💬 Message Templates (3)

ID Português Inglês Trigger

🌐 Indicadores de Compromisso de Infraestrutura

Domain Information

Domínio
acceso-v2p.webcindario.com
Registered
2001-02-28
Registrar
Namecheap, Inc.
Estado
ACTIVE

🤖 AI-Extracted Threat Intelligence

Similar Websites

Pages with identical visual appearance (based on perceptual hash)

Screenshot
Microsoft
https://reactivautlook356.iceiy.com/?i=1
Jun 01, 2026
 Screenshot
Microsoft
https://verificar-emailmxx.iceiy.com/?i=1
Mai 16, 2026
 Screenshot
Microsoft
https://serviciosdeseguridad.iceiy.com/?i=1
Abr 23, 2026
 Screenshot
Microsoft
https://validarwsaccountweb.iceiy.com/?i=1
Abr 20, 2026
 Screenshot
Microsoft
http://acceso-v2p.webcindario.com
Mar 14, 2026

Scan History for acceso-v2p.webcindario.com

Found 3 other scans for this domain

😰
"Nunca pensei que aconteceria comigo"
Isso dizem os 2,3 milhões de vítimas a cada ano. Não espere para ser uma estatística.