Phishing Analysis
Detailed analysis of captured phishing page
Captura Visual
Informações de Detecção
http://dusktestresolve.pages.dev/
Detected Brand
Unknown
Country
International
Confiança
100%
HTTP Status
200
Report ID
c8ae1b89-169…
Analyzed
2026-02-18 03:07
Final URL (after redirects)
https://dusktestresolve.pages.dev/
Hashes de Conteúdo (Similaridade HTML)
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T11533D8B317491EFE10C783E0B722773673A863E5E5AF820682F847655B8BD4ADC63560 |
|
CONTENT
ssdeep
|
384:arhbSgbnziNBXELiy/Y+nPacLI/omC4mGHXISBhq8t8DDOmQpvqYtZ:4bbnzsZELk+Cuz63HX38umQpiQ |
Hashes Visuais (Similaridade de Captura)
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
ce9234343696973e |
|
VISUAL
aHash
|
76383c3c30383000 |
|
VISUAL
dHash
|
c4f06969e0e0e0e0 |
|
VISUAL
wHash
|
7e787c7c7c783800 |
|
VISUAL
colorHash
|
38001600080 |
|
VISUAL
cropResistant
|
c4f06969e0e0e0e0 |
Análise de Código
Risk Score
79/100
Nível de Ameaça
ALTO
⚠️ Phishing Confirmed
🎣 Credential Harvester
🎣 OTP Stealer
🎣 Banking
🎣 Personal Info
🔬 Threat Analysis Report
• Ameaça: Phishing
• Alvo: Usuários de carteiras de criptomoedas
• Método: Personificação e tentativa de roubar credenciais de carteiras.
• Exfil: Desconhecido, provavelmente para um servidor controlado por invasores.
• Indicadores: Hospedagem gratuita, aparência semelhante à marca, 'retificação de carteira'.
• Risco: Alto
🔒 Obfuscation Detected
- fromCharCode
- unescape
- unicode_escape
🎯 Kit Endpoints
- https://files.coinmarketcap.com/static/widget/coinMarquee.js
📊 Detalhamento da Pontuação de Risco
Total Risk Score
90/100
Contributing Factors
Free Hosting
The domain uses free hosting, which is a common characteristic of phishing sites.
Suspicious Content
The content relates to cryptocurrency wallets and 'rectification', which is likely a malicious attempt.
🔬 Análise Integral de Ameaças
Tipo de Ameaça
Banking Credential Harvester
Alvo
General public
Método de Ataque
Brand impersonation + obfuscated JavaScript
Canal de Exfiltração
Unknown
Avaliação de Risco
HIGH - Automated credential harvesting with Unknown
⚠️ Indicators of Compromise
- Kit types: Credential Harvester, OTP Stealer, Banking, Personal Info
- 24 obfuscation techniques
🏢 Análise de Falsificação de Marca
Impersonated Brand
Cryptocurrency wallet
Fake Service
Wallet rectification
Fraudulent Claims
⚔️ Metodologia de Ataque
Primary Method: Credential Harvesting
The site likely aims to trick users into entering their wallet credentials (seed phrases, private keys, etc.) on a fake login page.
🌐 Indicadores de Compromisso de Infraestrutura
🦠 Malicious Files
Main File
coinMarquee.js
File Size
📊 Diagrama de Fluxo de Ataque
User fills <input name=username> → sendData() → fetch(http://dusktestresolve.pages.dev/exfiltrate) → credentials sent
🔬 JavaScript Deep Analysis
Operator Language
English (1%)
Total Code Size
455,3 KB
🔗 API Endpoints Detected
Other
10
🔐 Obfuscation Detected
- : Moderate
- : Moderate
🤖 AI-Extracted Threat Intelligence
📊 Attack Flow
User fills <input name=username> → sendData() → fetch(http://dusktestresolve.pages.dev/exfiltrate) → credentials sent
🎯 Malicious Files Identified
Main Drainer
coinMarquee.jsFile Size
45KB
Malicious Functions
sendDatasubmitForm
Similar Websites
Pages with identical visual appearance (based on perceptual hash)
Scan History for dusktestresolve.pages.dev
Found 1 other scan for this domain
"Nunca pensei que aconteceria comigo"
Isso dizem os 2,3 milhões de vítimas a cada ano. Não espere para ser uma estatística.