Phishing Analysis
Detailed analysis of captured phishing page
Captura Visual
Informações de Detecção
https://ai-openclaw.live/
Detected Brand
Pump.fun
Country
International
Confiança
95%
HTTP Status
200
Report ID
a86e79b7-979…
Analyzed
2026-07-27 11:33
Final URL (after redirects)
https://ai-openclaw.shop/x/
Hashes de Conteúdo (Similaridade HTML)
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T1B003A470D1492926B177D4D1E471936FB2A1C34CDB930B5897EC936AB6CACB1FE221C8 |
|
CONTENT
ssdeep
|
768:dKUS33gQS1CcuWCvQODcuWCvQOqzebbiGSMJaUVniJI3OASAIIzCj/F6byyY0fKW:03gQS1CcuWCvQODcuWCvQOxtW+eASAI+ |
Hashes Visuais (Similaridade de Captura)
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
cc993366cc996666 |
|
VISUAL
aHash
|
0000181818000000 |
|
VISUAL
dHash
|
0008303030080000 |
|
VISUAL
wHash
|
bd5abd3cbd42a500 |
|
VISUAL
colorHash
|
38200040006 |
|
VISUAL
cropResistant
|
0008303030080000 |
Análise de Código
Risk Score
74/100
Nível de Ameaça
ALTO
⚠️ Phishing Confirmed
🎣 Personal Info
WebSocket C2
🔬 Threat Analysis Report
• Ameaça: Drenador de criptomoedas
• Alvo: Usuários do Pump.fun
• Método: Conexão a dApp malicioso
• Exfil: Captura de dados via WebSocket
• Indicadores: JS ofuscado, domínio suspeito
• Risco: Crítico
🔒 Obfuscation Detected
- atob
- unescape
- base64_strings
🎯 Kit Endpoints
- https://openclaw.ai/blog
📡 API Calls Detected
- https://pump.fun/2tunJMkYJTwU57zf632sQ9ynKbudG3z85UYzFByGpump
- https://pump.fun/beXjn8EghNXnKCucBh1oiRa23rmnrhrpUvPBLPupump
- https://pump.fun/2ZvFgTyLMrgyLmoPHtD5KsTyALh14ffzxJoni4oPpump
- https://pump.fun/6Bi9sLPRwyn1Z3NvBSUPC1QUMUDHZW3p7GdTLXfBfy5i
- https://pump.fun/FL4eKdJrVZ1dVu1RoekeQRnuPxavzD4oCcR5HTcspump
- https://pump.fun/HpmEKB59BpjrejUgyD4CBo2pYepZVsvHW2KBjQTPpump
- https://pump.fun/8vgaTBW1nz4fBboCYFph7MVSLsgL8wBbex9M1hE5pump
- https://pump.fun/5g8HQVhmmXBZ7mRH2PqYrWAh1tb628HJxD6vfRkxWuLi
- https://api.dexscreener.com/token-boosts/latest/v1
- https://pump.fun/${t.tokenAddress||
- POST
- https://pump.fun/8qw8VRw5EajAjaijrLrnqP9AgThRsnvLeHxeSWyCfFhA
- https://pump.fun/8kAYCongF4r6kVKe2uhDTJZhTEANcyAjUn3ZqgGxpump
- https://pump.fun/2p6PYHMVb97RrRyf7p98dPsBZCL5HxVgQYxQHDPjo4d5
- https://pump.fun/96X4zg5T4NFWzTVFXHsadvYbxbzFX2Rqt3GXUv92pump
📊 Detalhamento da Pontuação de Risco
Total Risk Score
95/100
Contributing Factors
Malicious Scripting
Use of obfuscated exfiltration scripts.
Impersonation
Targets legitimate crypto platform Pump.fun.
🔬 Análise Integral de Ameaças
Tipo de Ameaça
Cryptocurrency Wallet Drainer
Alvo
Pump.fun users (International)
Método de Ataque
Brand impersonation + real-time WebSocket exfiltration + obfuscated JavaScript
Canal de Exfiltração
WebSocket (1 endpoints)
Avaliação de Risco
HIGH - Automated credential harvesting with WebSocket (1 endpoints)
⚠️ Indicators of Compromise
- Kit types: Personal Info
- 5 obfuscation techniques
🏢 Análise de Falsificação de Marca
Impersonated Brand
Pump.fun
Official Website
https://pump.fun
Fake Service
Pump.fun AI Data Sync
Fraudulent Claims
⚔️ Metodologia de Ataque
Primary Method: Wallet Drainer
The site uses social engineering to prompt a wallet connection, subsequently executing malicious transactions to empty assets.
Secondary Method: Data Harvesting
Uses WebSockets to monitor session activity and extract metadata.
Target Blockchain
Solana
🌐 Indicadores de Compromisso de Infraestrutura
Domain Information
Domínio
ai-openclaw.live
Registered
Unknown
Registrar
Unknown
Estado
Active
🤖 AI-Extracted Threat Intelligence
Similar Websites
Pages with identical visual appearance (based on perceptual hash)
"Nunca pensei que aconteceria comigo"
Isso dizem os 2,3 milhões de vítimas a cada ano. Não espere para ser uma estatística.