Phishing Analysis
Detailed analysis of captured phishing page
Captura Visual
Informações de Detecção
https://imm-ai-system.com/
Detected Brand
Immediate AI (Financial/Trading)
Country
International
Confiança
100%
HTTP Status
200
Report ID
d9f2c6b7-659…
Analyzed
2026-08-05 23:17
Hashes de Conteúdo (Similaridade HTML)
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T198B2943261602A3B6157C3CD7262B76EE5E3934DDA960805A3FC478E8BD7ED0D81781B |
|
CONTENT
ssdeep
|
384:qtFy5NMgAnmWkuU19DYnJLOsIIIaiDO6BTjCri3gpsuRdUQ1R0IYsOy2+y9BH4cZ:qFy5NMNeYnJLOsIIIaiDO6BTjCr5suR0 |
Hashes Visuais (Similaridade de Captura)
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
c3638c3ab269e596 |
|
VISUAL
aHash
|
000020000400ffff |
|
VISUAL
dHash
|
9dc1c1cb6c0cf100 |
|
VISUAL
wHash
|
00717060fe00ffff |
|
VISUAL
colorHash
|
31008000602 |
|
VISUAL
cropResistant
|
0000084c4d4c3008,7168808030708000,9dcbc5cbc84c0471 |
Análise de Código
Risk Score
76/100
Nível de Ameaça
ALTO
⚠️ Phishing Confirmed
🎣 Credential Harvester
🎣 OTP Stealer
🎣 Banking
🎣 Personal Info
🔬 Threat Analysis Report
• Ameaça: Phishing Financeiro/Investimentos
• Alvo: Traders de criptomoedas
• Método: Imitação de plataforma de negociação
• Exfil: Dados pessoais via formulário
• Indicadores: Domínio recente, scripts ofuscados, marketing agressivo
• Risco: Alto - Roubo de dados e potencial fraude
🔒 Obfuscation Detected
- unescape
- document.write
🎯 Kit Endpoints
- login
📡 API Calls Detected
- /app/register
- POST
📊 Detalhamento da Pontuação de Risco
Total Risk Score
95/100
Contributing Factors
Domain Age
Domain is only 9 days old.
Technical Obfuscation
Detection of unescape/document.write obfuscation.
Brand Impersonation
Targeting financial trading space with generic branding.
🔬 Análise Integral de Ameaças
Tipo de Ameaça
Banking Credential Harvester
Alvo
Immediate AI (Financial/Trading) users (International)
Método de Ataque
Brand impersonation + credential harvesting forms + obfuscated JavaScript
Canal de Exfiltração
Form submission (backend endpoint not detected - likely JavaScript-based)
Avaliação de Risco
HIGH - Automated credential harvesting with Form submission (backend endpoint not detected - likely JavaScript-based)
⚠️ Indicators of Compromise
- Kit types: Credential Harvester, OTP Stealer, Banking, Personal Info
- 8 obfuscation techniques
🏢 Análise de Falsificação de Marca
Impersonated Brand
Immediate AI
Official Website
N/A
Fake Service
Automated crypto trading
Fraudulent Claims
⚔️ Metodologia de Ataque
Primary Method: Credential/PII Harvesting
The site uses a lead-generation form to collect personal information from users under the guise of an 'AI trading platform' to feed into subsequent phone or email scams.
Secondary Method: Obfuscated Exfiltration
Uses obfuscated JavaScript to hide the destination of collected user data.
🌐 Indicadores de Compromisso de Infraestrutura
Domain Information
Domínio
imm-ai-system.com
Registered
2026-07-27
Registrar
unknown
Estado
active
🤖 AI-Extracted Threat Intelligence
"Nunca pensei que aconteceria comigo"
Isso dizem os 2,3 milhões de vítimas a cada ano. Não espere para ser uma estatística.