Phishing Analysis
Detailed analysis of captured phishing page
Captura Visual
Informações de Detecção
http://web3securityconnects.com.hedgepremiumcapital.com/
Detected Brand
Unknown
Country
International
Confiança
100%
HTTP Status
200
Report ID
de26bb56-57e…
Analyzed
2026-02-08 00:43
Hashes de Conteúdo (Similaridade HTML)
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T13143746052335A6B02A382D0A6BA9F9DD0C08350D3674B69F3FCC76FAECDD44BD55262 |
|
CONTENT
ssdeep
|
768:64iiVmSmw+ZOT2WPj04L3MC0hEC63xVy8H:dDVmSmw+ZOT2WPj46hVy8H |
Hashes Visuais (Similaridade de Captura)
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
bad74d2c119594d5 |
|
VISUAL
aHash
|
02a4fe4cc5818100 |
|
VISUAL
dHash
|
16494c9919252712 |
|
VISUAL
wHash
|
02f5fecfcdc78100 |
|
VISUAL
colorHash
|
300000084c0 |
|
VISUAL
cropResistant
|
16494c9919252712 |
Análise de Código
Risk Score
73/100
Nível de Ameaça
ALTO
⚠️ Phishing Confirmed
🎣 Credential Harvester
🎣 OTP Stealer
🎣 Banking
🎣 Personal Info
🔬 Threat Analysis Report
• Ameaça: Phishing
• Alvo: Usuários de criptomoedas
• Método: Falsificação de domínio e envio de formulários
• Exfil: Desconhecido, provavelmente informações da carteira
• Indicadores: Domínio suspeito, formulário, ofuscação.
• Risco: Alto
🔒 Obfuscation Detected
- eval
🎯 Kit Endpoints
- https://bootstrap.smartsuppchat.com
- http://web3securityconnects.com.hedgepremiumcapital.com/assets2/js/app.js
- https://cdn.jsdelivr.net/npm/@easepick/[email protected]/dist/index.css
- https://widget-v3.smartsuppcdn.com
- https://files.smartsuppcdn.com
- https://gsap.com/standard-license
- https://bugzilla.mozilla.org/show_bug.cgi?id=612118\n
- https://gsap.com/forums/topic/20368-possible-gsap-bug-switching-classnames-in-chrome/.\n
- https://www.highcharts.com/docs/accessibility/accessibility-module.
- https://bugzilla.mozilla.org/show_bug.cgi?id=548397\n
- https://api.smartsuppchat.com
- https://www.smartsuppchat.com/loader.js?
- https://gsap.com\n
- https://gsap.com/forums/topic/20215-problem-using-tweenmax-in-standalone-self-containing-svg-file-err-cannot-set-property-csstext-of-undefined/).\n},\n
- https://{key}.storage.smartsuppchat.com
- https://gsap.com/forums/topic/23823-closing-nav-animation-not-working-on-ie-and-iphone-6-maybe-other-older-browser/?tab=comments#comment-113005
- https://www.highcharts.com?credits\
- http://\
- https://swiperjs.com\n
- https://gsap.com/forums/topic/24583-how-to-return-colors-that-i-had-after-reverse/\n
- https://webpack.js.org/configuration/mode/).
- http://svgjs.dev\
- https://\
- https://webpack.js.org/configuration/devtool/)
- https://alpinejs.dev/plugins/${slug}`,
- https://gsap.com\
- https://gsap.com/forums/topic/18310-clippath-doesnt-work-on-ios/\n
- https://stackoverflow.com/questions/54520554/custom-element-getrootnode-closest-function-crossing-multiple-parent-shadowd\nfunction
📡 API Calls Detected
- GET
📊 Detalhamento da Pontuação de Risco
Total Risk Score
95/100
Contributing Factors
Suspicious Domain
Uses a subdomain on a seemingly unrelated domain, a classic phishing tactic. The domain also contains brand name.
Impersonation
The website is designed to look like a legitimate crypto service.
Obfuscation
The site uses obfuscation, making it harder to analyze.
🔬 Análise Integral de Ameaças
Tipo de Ameaça
Banking Credential Harvester
Alvo
General public
Método de Ataque
Brand impersonation + credential harvesting forms + obfuscated JavaScript
Canal de Exfiltração
Form submission (backend endpoint not detected - likely JavaScript-based)
Avaliação de Risco
HIGH - Automated credential harvesting with Form submission (backend endpoint not detected - likely JavaScript-based)
⚠️ Indicators of Compromise
- Kit types: Credential Harvester, OTP Stealer, Banking, Personal Info
- 168 obfuscation techniques
🏢 Análise de Falsificação de Marca
Impersonated Brand
Web3 Security Connects
Fake Service
Web3 Security Connects
⚔️ Metodologia de Ataque
Primary Method: Credential Harvesting
The attacker likely uses the website to trick users into entering their wallet credentials, leading to a compromise of their funds.
🌐 Indicadores de Compromisso de Infraestrutura
🦠 Malicious Files
Main File
loader.js?
File Size
🔬 JavaScript Deep Analysis
Operator Language
English (1%)
Total Code Size
2,3 MB
🔗 API Endpoints Detected
Other
24
🔐 Obfuscation Detected
- : Light
- : Moderate
🤖 AI-Extracted Threat Intelligence
🎯 Malicious Files Identified
Main Drainer
loader.js?File Size
2365KB
Similar Websites
Pages with identical visual appearance (based on perceptual hash)
Scan History for web3securityconnects.com.hedgepremiumcapital.com
Found 2 other scans for this domain
"Nunca pensei que aconteceria comigo"
Isso dizem os 2,3 milhões de vítimas a cada ano. Não espere para ser uma estatística.