SafeMode - Analysis: noctiscapital.net

Captura Visual

Informações de Detecção

https://noctiscapital.net/

Detected Brand

Noctis Capital

Country

International

Confiança

92%

HTTP Status

200

Report ID

d6c6b1ce-339…

Analyzed

2026-08-12 11:17

Hashes de Conteúdo (Similaridade HTML)

Used to detect similar phishing pages based on HTML content

Algorithm	Hash Value
CONTENT TLSH	T1198274B2A040B83B0193C2E6B675636FA3D24689CD87171663FD8B9D0DE3D94FD1A119
CONTENT ssdeep	192:nWa44oCIIoT+BLxe3rL2eCYfWdaLMmTM4zb2mBq:Wa44oBIxe3jPfWdaD4

Hashes Visuais (Similaridade de Captura)

Used to detect visually similar phishing pages based on screenshots

Algorithm	Hash Value
VISUAL pHash	c38d3833f6c6c398
VISUAL aHash	000078f8f8f04000
VISUAL dHash	dcd2c2c0c0c08080
VISUAL wHash	0402fefcfcfcf800
VISUAL colorHash	30000000e00
VISUAL cropResistant	a292ee2b2bda82a2,dcd2c2c0c0c08080

Análise de Código

Risk Score 53/100

Nível de Ameaça ALTO

⚠️ Phishing Confirmed

🎣 OTP Stealer

🔬 Threat Analysis Report

• Ameaça: Golpe de Investimento Financeiro
• Alvo: Investidores
• Método: Impersonificação / Coleta de credenciais
• Exfil: Envio de formulário JS ofuscado
• Indicadores: Domínio recente, texto corporativo genérico
• Risco: Alto

🔒 Obfuscation Detected

unescape

📡 API Calls Detected

/api/sms-verification-status
/api/sms/send
POST
/api/sms/verify

📊 Detalhamento da Pontuação de Risco

Total Risk Score

92/100

Contributing Factors

Domain Age

Registered less than 30 days ago

Obfuscation

Detection of unescape/obfuscated JS

Suspicious Content

Generic corporate/financial scam language

🔬 Análise Integral de Ameaças

Tipo de Ameaça

Two-Factor Authentication Stealer

Alvo

Noctis Capital users (International)

Método de Ataque

Brand impersonation + obfuscated JavaScript

Canal de Exfiltração

Form submission (backend endpoint not detected - likely JavaScript-based)

Avaliação de Risco

MEDIUM - Automated credential harvesting with Form submission (backend endpoint not detected - likely JavaScript-based)

⚠️ Indicators of Compromise

Kit types: OTP Stealer
2 obfuscation techniques

🏢 Análise de Falsificação de Marca

Impersonated Brand

Noctis Capital

Fake Service

Investment Portal

Fraudulent Claims

⚔️ Metodologia de Ataque

Primary Method: Financial Fraud / Credential Harvesting

The site uses a deceptive, high-end financial appearance to build trust, followed by JS-based interception of user input to steal data.

Secondary Method: None

N/A

🌐 Indicadores de Compromisso de Infraestrutura

Domain Information

Domínio

noctiscapital.net

Registered

2026-07-26

Registrar

Unknown

Estado

Active

Phishing Analysis