Phishing Analysis
Detailed analysis of captured phishing page
Captura Visual
Informações de Detecção
https://mwizz.leadsbr.com.br/latest/index.php/campaigns/yp625mg5v91db/track-url/fb956a7m0a441/ca10f6b0e8eca2333c85e8a0f91e69251ec70f87
Detected Brand
CAIXA Consórcios (Likely Impersonated)
Country
Brazil
Confiança
100%
HTTP Status
200
Report ID
a2641a09-497…
Analyzed
2026-02-17 12:46
Final URL (after redirects)
https://coteaqui.planosparavc.com.br/conscx/
Hashes de Conteúdo (Similaridade HTML)
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T1AFE3B6BFA1249C6FF199C794EFB458597188D0CAFB829390C3A8877C7E600D75C3A964 |
|
CONTENT
ssdeep
|
1536:25GbtBdbp2yOux3xVfz3xVfdz3xVUeuQWhpWrdKx46dezE2gucsiFHOWpPg/bzrb:3OOiA |
Hashes Visuais (Similaridade de Captura)
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
9852ed28e2ace2de |
|
VISUAL
aHash
|
fd0c0c0c0c0f1fff |
|
VISUAL
dHash
|
999838b878b83626 |
|
VISUAL
wHash
|
fd0c0c0c0c0f1fff |
|
VISUAL
colorHash
|
03007000000 |
|
VISUAL
cropResistant
|
999838b878b83626,14108eacce2e0e4e,8b393b0b8b4b3187 |
Análise de Código
Risk Score
100/100
Nível de Ameaça
ALTO
⚠️ Phishing Confirmed
🎣 Credential Harvester
🎣 OTP Stealer
🎣 Card Stealer
🎣 Banking
🎣 Personal Info
🔬 Threat Analysis Report
• Ameaça: Phishing
• Alvo: Usuários da CAIXA Consórcios
• Método: Coleta de credenciais baseada em formulários
• Exfil: descadastramento.php, salvaeenvia.php, capture.php
• Indicadores: Formulários, ofuscação de JavaScript
• Risco: Alto
🔐 Credential Harvesting Forms
🔒 Obfuscation Detected
- atob
- eval
- fromCharCode
- unescape
- hex_escape
- unicode_escape
- base64_strings
🎯 Kit Endpoints
- http://developers.facebook.com/policy/].
- http://www.ans.gov.br/planos-de-saude-e-operadoras/contratacao-e-troca-de-plano/dicas-para-escolher-um-plano/segmentacao-assistencial
- https://www.facebook.com/privacy_sandbox/pixel/register/trigger/
- https://connect.facebook.net/
- #small-dialog-ch
- https://connect.facebook.net/en_US/fbevents.js
- https://www.googletagmanager.com/gtag/js?id=AW-1002935720
- https://connect.facebook.net/log/fbevents_telemetry/
- https://www.facebook.com/tr
- https://developers.facebook.com/docs/meta-pixel/reference/
- https://mwizz.leadsbr.com.br/latest/index.php/campaigns/yp625mg5v91db/track-url/fb956a7m0a441/custom.js
- http://www.ans.gov.br/planos-de-saude-e-operadoras/contratacao-e-troca-de-plano/dicas-para-escolher-um-plano/formas-de-contratacao-de-planos-de-saude
- https://www.instagram.com/tr/
- https://api.whatsapp.com/send?l=pt&phone=5511985499166
- http://www.ans.gov.br/images/stories/Materiais_para_pesquisa/Materiais_por_assunto/cartilha_plano_de_saude.pdf
- https://www.facebook.com/privacy_sandbox/topics/registration/
- https://gw.conversionsapigateway.com
- https://www.facebook.com/tr/
- #small-dialog-in
- #small-dialog-it
- https://www.planodesaudepopulares.com.br/contador/
- https://painel.sauti.com.br/modules/Webforms/capture.php
- https://connect.facebook.net/signals/config/889662521918595?v=2.9.265&r=stable&domain=coteaqui.planosparavc.com.br&hme=8faeb0ed09c145bbd9d3213e762abac29e9f76b8e7a9df9d71a3058625e3b7dd&ex_m=96%2C187%2C136%2C21%2C68%2C69%2C129%2C64%2C43%2C130%2C73%2C63%2C10%2C143%2C82%2C15%2C95%2C124%2C117%2C71%2C74%2C123%2C140%2C104%2C145%2C7%2C3%2C4%2C6%2C5%2C2%2C83%2C93%2C146%2C151%2C201%2C57%2C167%2C168%2C50%2C238%2C28%2C70%2C213%2C212%2C211%2C30%2C56%2C9%2C59%2C89%2C90%2C91%2C97%2C120%2C29%2C27%2C122%2C119%2C118%2C137%2C72%2C139%2C138%2C45%2C55%2C113%2C14%2C142%2C40%2C226%2C227%2C225%2C24%2C25%2C26%2C17%2C19%2C39%2C35%2C37%2C36%2C78%2C84%2C88%2C102%2C128%2C131%2C41%2C103%2C22%2C20%2C109%2C65%2C33%2C133%2C132%2C134%2C125%2C23%2C32%2C54%2C101%2C141%2C66%2C16%2C135%2C106%2C77%2C62%2C18%2C31%2C249%2C194%2C181%2C182%2C180%2C252%2C244%2C195%2C99%2C121%2C76%2C111%2C49%2C42%2C44%2C105%2C110%2C116%2C53%2C60%2C115%2C48%2C51%2C47%2C92%2C144%2C0%2C114%2C13%2C112%2C11%2C1%2C52%2C85%2C58%2C61%2C108%2C81%2C80%2C147%2C148%2C86%2C87%2C8%2C94%2C46%2C126%2C79%2C75%2C67%2C107%2C98%2C38%2C127%2C34%2C100%2C12%2C149
- https://developers.facebook.com/docs/ads-for-websites/pixel-events/#events
- https://wa.me/
- https://embed.tawk.to/5e7e2b8c35bcbb0c9aab1791/default
📡 API Calls Detected
- GET
- POST
- https://www.google.com/ccm/geo
📤 Form Action Targets
- descadastramento.php
- salvaeenvia.php
- https://painel.sauti.com.br/modules/Webforms/capture.php
📊 Detalhamento da Pontuação de Risco
Total Risk Score
95/100
Contributing Factors
Active Phishing Kit
Suspicious domain, JavaScript obfuscation, form submission to non-official endpoints, and requests for sensitive information. High probability of malicious intent.
🔬 Análise Integral de Ameaças
Tipo de Ameaça
Banking Credential Harvester
Alvo
CAIXA Consórcios (Likely Impersonated) users (Brazil)
Método de Ataque
Brand impersonation + credential harvesting forms + obfuscated JavaScript
Canal de Exfiltração
HTTP POST to backend
Avaliação de Risco
CRITICAL - Automated credential harvesting with HTTP POST to backend
⚠️ Indicators of Compromise
- Kit types: Credential Harvester, OTP Stealer, Card Stealer, Banking, Personal Info
- 216 obfuscation techniques
🏢 Análise de Falsificação de Marca
Impersonated Brand
CAIXA Consórcios
Official Website
null
Fake Service
Consórcio (financial services)
Fraudulent Claims
⚔️ Metodologia de Ataque
Primary Method: Credential Harvesting
The site is designed to collect user's personal information and financial information through a form that mimics a legitimate CAIXA Consórcios form. This data is likely used for identity theft or financial fraud.
Secondary Method: JavaScript Obfuscation
JavaScript code has been obfuscated to hide the malicious activity and make it more difficult for security tools to analyze and detect the threat.
🌐 Indicadores de Compromisso de Infraestrutura
🦠 Malicious Files
Main File
889662521918595?v=2.9.265&r=stable&domain=coteaqui.planosparavc.com.br&hme=8faeb0ed09c145bbd9d3213e762abac29e9f76b8e7a9df9d71a3058625e3b7dd&ex_m=96%2C187%2C136%2C21%2C68%2C69%2C129%2C64%2C43%2C130%2C73%2C63%2C10%2C143%2C82%2C15%2C95%2C124%2C117%2C71%2C74%2C123%2C140%2C104%2C145%2C7%2C3%2C4%2C6%2C5%2C2%2C83%2C93%2C146%2C151%2C201%2C57%2C167%2C168%2C50%2C238%2C28%2C70%2C213%2C212%2C211%2C30%2C56%2C9%2C59%2C89%2C90%2C91%2C97%2C120%2C29%2C27%2C122%2C119%2C118%2C137%2C72%2C139%2C138%2C45%2C55%2C113%2C14%2C142%2C40%2C226%2C227%2C225%2C24%2C25%2C26%2C17%2C19%2C39%2C35%2C37%2C36%2C78%2C84%2C88%2C102%2C128%2C131%2C41%2C103%2C22%2C20%2C109%2C65%2C33%2C133%2C132%2C134%2C125%2C23%2C32%2C54%2C101%2C141%2C66%2C16%2C135%2C106%2C77%2C62%2C18%2C31%2C249%2C194%2C181%2C182%2C180%2C252%2C244%2C195%2C99%2C121%2C76%2C111%2C49%2C42%2C44%2C105%2C110%2C116%2C53%2C60%2C115%2C48%2C51%2C47%2C92%2C144%2C0%2C114%2C13%2C112%2C11%2C1%2C52%2C85%2C58%2C61%2C108%2C81%2C80%2C147%2C148%2C86%2C87%2C8%2C94%2C46%2C126%2C79%2C75%2C67%2C107%2C98%2C38%2C127%2C34%2C100%2C12%2C149
File Size
🔬 JavaScript Deep Analysis
Operator Language
Portuguese (1%)
Sophistication Level
Basic
Total Code Size
566,2 KB
🔗 API Endpoints Detected
Other
14
🔐 Obfuscation Detected
- : Light
- : Moderate
- : Light
🤖 AI-Extracted Threat Intelligence
🎯 Malicious Files Identified
Main Drainer
889662521918595?v=2.9.265&r=stable&domain=coteaqui.planosparavc.com.br&hme=8faeb0ed09c145bbd9d3213e762abac29e9f76b8e7a9df9d71a3058625e3b7dd&ex_m=96%2C187%2C136%2C21%2C68%2C69%2C129%2C64%2C43%2C130%2C73%2C63%2C10%2C143%2C82%2C15%2C95%2C124%2C117%2C71%2C74%2C123%2C140%2C104%2C145%2C7%2C3%2C4%2C6%2C5%2C2%2C83%2C93%2C146%2C151%2C201%2C57%2C167%2C168%2C50%2C238%2C28%2C70%2C213%2C212%2C211%2C30%2C56%2C9%2C59%2C89%2C90%2C91%2C97%2C120%2C29%2C27%2C122%2C119%2C118%2C137%2C72%2C139%2C138%2C45%2C55%2C113%2C14%2C142%2C40%2C226%2C227%2C225%2C24%2C25%2C26%2C17%2C19%2C39%2C35%2C37%2C36%2C78%2C84%2C88%2C102%2C128%2C131%2C41%2C103%2C22%2C20%2C109%2C65%2C33%2C133%2C132%2C134%2C125%2C23%2C32%2C54%2C101%2C141%2C66%2C16%2C135%2C106%2C77%2C62%2C18%2C31%2C249%2C194%2C181%2C182%2C180%2C252%2C244%2C195%2C99%2C121%2C76%2C111%2C49%2C42%2C44%2C105%2C110%2C116%2C53%2C60%2C115%2C48%2C51%2C47%2C92%2C144%2C0%2C114%2C13%2C112%2C11%2C1%2C52%2C85%2C58%2C61%2C108%2C81%2C80%2C147%2C148%2C86%2C87%2C8%2C94%2C46%2C126%2C79%2C75%2C67%2C107%2C98%2C38%2C127%2C34%2C100%2C12%2C149File Size
567KB
Similar Websites
Pages with identical visual appearance (based on perceptual hash)
Desconhecido
https://cdn.gosafemode.com/screenshots/5c87ef713e7d.png
Mai 25, 2026
Desconhecido
https://cdn.gosafemode.com/screenshots/089b0e6ed769.png
Mai 16, 2026
Desconhecido
https://cdn.gosafemode.com/screenshots/0ee05c6b98aa.png
Mar 21, 2026
CAIXA CONSÓRCIOS
https://mwizz.leadsbr.com.br/latest/index.php/campaigns/al95...
Mar 19, 2026
Caixa Consórcios
https://mwizz.leadsbr.com.br/latest/index.php/campaigns/df62...
Mar 02, 2026
Scan History for mwizz.leadsbr.com.br
Found 7 other scans for this domain
-
https://mwizz.leadsbr.com.br/latest/index.php/camp...
http://mwizz.leadsbr.com.br/latest/index.php/campa...
https://mwizz.leadsbr.com.br/latest/index.php/camp...
https://mwizz.leadsbr.com.br/latest/index.php/camp...
https://mwizz.leadsbr.com.br/latest/index.php/camp...
https://mwizz.leadsbr.com.br/latest/index.php/camp...
https://mwizz.leadsbr.com.br/latest/index.php/camp...
"Nunca pensei que aconteceria comigo"
Isso dizem os 2,3 milhões de vítimas a cada ano. Não espere para ser uma estatística.