Phishing Analysis
Detailed analysis of captured phishing page
Captura Visual
Informações de Detecção
http://bsea-f8cwf3csaacdgqfk.z02.azurefd.net/
Detected Brand
Facebook
Country
International
Confiança
95%
HTTP Status
200
Report ID
d1c1ece7-bef…
Analyzed
2026-02-11 11:58
Final URL (after redirects)
https://bsea-f8cwf3csaacdgqfk.z02.azurefd.net/
Hashes de Conteúdo (Similaridade HTML)
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T10C1102600C3D566387A581D6F9A77E073A40C786D36A1F5084F8D7FD19C9A0DC9EF560 |
|
CONTENT
ssdeep
|
24:kHks1wspc8MT0C7OkCQqb5SpXQEiKn0SZxZj7x0Jk:C1zpxk4b5SpMY0c/j7WJk |
Hashes Visuais (Similaridade de Captura)
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
b8cc9b7623336638 |
|
VISUAL
aHash
|
ffffdbc3c3c3c3c3 |
|
VISUAL
dHash
|
b0b2b28e96969696 |
|
VISUAL
wHash
|
7e5b5943c0c3c3c3 |
|
VISUAL
colorHash
|
07c00000000 |
|
VISUAL
cropResistant
|
a2948e80aa8ee0b2,b0b2b28e96969696 |
Análise de Código
Risk Score
59/100
Nível de Ameaça
ALTO
⚠️ Phishing Confirmed
🎣 Banking
🔬 Threat Analysis Report
• Ameaça: Golpe de suspensão de conta
• Alvo: Usuários do Facebook
• Método: Personificação através de uma página de login falsa.
• Exfil: Desconhecido, provavelmente credenciais.
• Indicadores: Domínio suspeito, alegação de suspensão de conta.
• Risco: ALTO
🔒 Obfuscation Detected
- hex_escape
- js_packer
- base64_strings
📡 API Calls Detected
- POST
📊 Detalhamento da Pontuação de Risco
Total Risk Score
90/100
Contributing Factors
Suspicious Domain
The domain is not a Facebook domain.
Impersonation
The page is attempting to impersonate Facebook and uses their logo.
Account Suspension Message
The page displays an account suspension warning.
Obfuscation
Javascript obfuscation detected, indicating potentially malicious code.
🔬 Análise Integral de Ameaças
Tipo de Ameaça
Banking Credential Harvester
Alvo
Facebook users (International)
Método de Ataque
Brand impersonation + obfuscated JavaScript
Canal de Exfiltração
Form submission (backend endpoint not detected - likely JavaScript-based)
Avaliação de Risco
MEDIUM - Automated credential harvesting with Form submission (backend endpoint not detected - likely JavaScript-based)
⚠️ Indicators of Compromise
- Kit types: Banking
- 565 obfuscation techniques
🏢 Análise de Falsificação de Marca
Impersonated Brand
Facebook
Official Website
https://www.facebook.com
Fake Service
Facebook Account
Fraudulent Claims
⚔️ Metodologia de Ataque
Primary Method: Credential Harvesting
The attack uses a fake Facebook login form hosted on a suspicious domain to steal the victim's login credentials (username and password).
Secondary Method: Malware Injection
It could involve code designed to download or install malware or redirect the victim to another fraudulent website or webpage.
🌐 Indicadores de Compromisso de Infraestrutura
Domain Information
Domínio
bsea-f8cwf3csaacdgqfk.z02.azurefd.net
Registered
None
Registrar
None
Estado
None
🔬 JavaScript Deep Analysis
Total Code Size
1,8 KB
🔗 API Endpoints Detected
Other
2
🔐 Obfuscation Detected
- : None
🤖 AI-Extracted Threat Intelligence
Similar Websites
Pages with identical visual appearance (based on perceptual hash)
Desconhecido
https://cdn.gosafemode.com/screenshots/4bcbc8778ff5.png
Mai 27, 2026
Facebook
http://bwzs-edcth4haeacbeje3.z02.azurefd.net/
Fev 25, 2026
Facebook
http://hssos-aaasdvaxhydch7hy.z03.azurefd.net
Fev 13, 2026
Facebook
http://kate-dfhafbdfb4e8ecac.z02.azurefd.net
Fev 13, 2026
Facebook
http://bl-sos-d9f2gkh2cnhec8h9.z03.azurefd.net
Fev 13, 2026
Scan History for bsea-f8cwf3csaacdgqfk.z02.azurefd.net
Found 1 other scan for this domain
"Nunca pensei que aconteceria comigo"
Isso dizem os 2,3 milhões de vítimas a cada ano. Não espere para ser uma estatística.