EN ES PT

Phishing Analysis

Detailed analysis of captured phishing page

Back to Stats

Captura Visual

Screenshot of thesauthsolver.pages.dev

Informações de Detecção

https://thesauthsolver.pages.dev/
Detected Brand
Solana
Country
International
Confiança
100%
HTTP Status
200
Report ID
e1c1e8e2-c0e…
Analyzed
2026-02-14 21:07

Hashes de Conteúdo (Similaridade HTML)

Used to detect similar phishing pages based on HTML content

Algorithm Hash Value
CONTENT TLSH
T193633BF43503B66B67A744E3207B660672B9F20BC80F8510636CE6C937D5CA588AFF56
CONTENT ssdeep
1536:pElgrF5e6XmRXuRX3RXuRX9LJRX6RXwRX9RXdRXxRXiRXwRXsRXARXBRXORyVRyh:CGF5JsE9Ex4aHnTwaeKDFqGIlKrAW8gG

Hashes Visuais (Similaridade de Captura)

Used to detect visually similar phishing pages based on screenshots

Algorithm Hash Value
VISUAL pHash
8c377164cc939b27
VISUAL aHash
00001d3f3f3f7fff
VISUAL dHash
7e3f7bf1f3f3f6b3
VISUAL wHash
00001d1f1f3f3f3f
VISUAL colorHash
10000200030
VISUAL cropResistant
7e3f7bf1f3f3f6b3

Análise de Código

Risk Score 100/100
Nível de Ameaça ALTO
⚠️ Phishing Confirmed
🎣 Credential Harvester 🎣 OTP Stealer 🎣 Card Stealer 🎣 Banking 🎣 Personal Info

🔬 Threat Analysis Report

• Ameaça: Phishing
• Alvo: Usuários Solana
• Método: Falsificação via hospedagem gratuita
• Exfil: Desconhecido (provavelmente detalhes da carteira)
• Indicadores: Hospedagem gratuita, marca, chamadas suspeitas para ação
• Risco: ALTO

🔒 Obfuscation Detected

  • atob
  • fromCharCode
  • unescape
  • hex_escape
  • unicode_escape
  • js_packer
  • base64_strings

🎯 Kit Endpoints

  • https://chrome.google.com/webstore/detail/sollet/fhmfendgdocmcbmfikdcogofphimnkno
  • https://t.me/RaydiumSpanish
  • https://www.okx.com/web3
  • https://bit.ly/3cXEKWf`)}var
  • https://chrome.google.com/webstore/detail/bitkeep-bitcoin-crypto-wa/jiidiaalihmmhddjgbnbgdfflelocpak
  • https://solflare.com/download#android
  • https://clv.org
  • http://f
  • https://feross.org
  • https://chrome.google.com/webstore/detail/safepal-extension-wallet/lgmpcpglpngdoalbgeoldeajfclnhafa
  • https://t.me/RaydiumRussian
  • https://thesauthsolver.pages.dev/_next/static/chunks/polyfills-c67a75d1b6f99dc8.js
  • https://raydium.gitbook.io/raydium/
  • https://chrome.google.com/webstore/detail/coinhub/jgaaimajipbpdogpdglhaphldakikgef
  • https://feross.org/opensource
  • https://play.google.com/store/apps/details?id=io.safepal.wallet
  • https://tor.us
  • https://t.me/RaydiumChina
  • https://solana.fm/
  • https://solflare.com/ul/v1/browse/${e}?ref=${t}`,Error(
  • https://brave.com/wallet
  • https://coin98.com
  • https://nextjs.org/docs/messages/client-side-exception-occurred
  • https://img.raydium.io/icon/So11111111111111111111111111111111111111112.png
  • http://api.devnet.solana.com
  • http://a
  • https://api.devnet.solana.com
  • https://glow.app
  • https://solflare.com/provider
  • https://bitpie.com/android/

📊 Detalhamento da Pontuação de Risco

Total Risk Score
90/100

Contributing Factors

Free hosting
The site is hosted on a free hosting platform (pages.dev), a common tactic for phishing.
Brand Impersonation
The website closely imitates the branding of Solana.
Suspicious CTAs
The presence of 'Connect Wallet' and 'Claim Reward' are common in phishing schemes, tricking users into revealing wallet information or interacting with malicious contracts.

🔬 Análise Integral de Ameaças

Tipo de Ameaça
Banking Credential Harvester
Alvo
Solana users (International)
Método de Ataque
Brand impersonation + obfuscated JavaScript
Canal de Exfiltração
Form submission (backend endpoint not detected - likely JavaScript-based)
Avaliação de Risco
CRITICAL - Automated credential harvesting with Form submission (backend endpoint not detected - likely JavaScript-based)

⚠️ Indicators of Compromise

  • Kit types: Credential Harvester, OTP Stealer, Card Stealer, Banking, Personal Info
  • 9444 obfuscation techniques

🏢 Análise de Falsificação de Marca

Impersonated Brand
Solana
Official Website
https://solana.com/
Fake Service
Wallet Connection/Rewards

⚔️ Metodologia de Ataque

Primary Method: Credential Harvesting

The attacker aims to steal cryptocurrency by prompting users to connect their wallets or claim rewards via a deceptive website.

Secondary Method: Social Engineering

The website uses Solana's branding to trick users into believing the site is legitimate. The CTAs are the key. It's built for deception.

Target Blockchain
Solana

🌐 Indicadores de Compromisso de Infraestrutura

🦠 Malicious Files

Main File
polyfills-c67a75d1b6f99dc8.js
File Size

🔬 JavaScript Deep Analysis

Operator Language
English (1%)
Sophistication Level
Advanced
Total Code Size
1,7 MB

🔗 API Endpoints Detected

Other
124
Solana RPC
3
Backend API
1
Solscan API
1
Discord Webhooks
1

🔐 Obfuscation Detected

  • : Moderate
  • : Light
  • : Heavy
  • : None
  • : Moderate
  • : None
  • : None
  • : None

🤖 AI-Extracted Threat Intelligence

🎯 Malicious Files Identified

Main Drainer
polyfills-c67a75d1b6f99dc8.js
File Size
1740KB

Similar Websites

Pages with identical visual appearance (based on perceptual hash)

Screenshot
Solana
https://multichaindex-a6o.pages.dev/
Ago 07, 2026
 Screenshot
Solana
http://thesauthsolver.pages.dev
Fev 14, 2026

Scan History for thesauthsolver.pages.dev

Found 1 other scan for this domain

😰
"Nunca pensei que aconteceria comigo"
Isso dizem os 2,3 milhões de vítimas a cada ano. Não espere para ser uma estatística.