Phishing Analysis
Detailed analysis of captured phishing page
Captura Visual
Informações de Detecção
https://6aaac910.wcconn.pages.dev/
Detected Brand
Coinbase
Country
International
Confiança
100%
HTTP Status
200
Report ID
e6aaaafa-59e…
Analyzed
2026-02-14 13:07
Hashes de Conteúdo (Similaridade HTML)
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T13C21FE7520037A6B83632AE4B3548654E1A3D30DCA275C05F7FB93DB1BE1D419D42569 |
|
CONTENT
ssdeep
|
24:nxmvC7B7IsRE0wkCCfWaVfb4uGECiHQiECsF2:nxm0EkN55GECiHQiECk2 |
Hashes Visuais (Similaridade de Captura)
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
cccc26b399333399 |
|
VISUAL
aHash
|
0018181818000000 |
|
VISUAL
dHash
|
08301432b20c2000 |
|
VISUAL
wHash
|
00181c1c3c3c0c0c |
|
VISUAL
colorHash
|
38001008040 |
|
VISUAL
cropResistant
|
a292a09696a6a2a2,08301432b20c2000 |
Análise de Código
Risk Score
74/100
Nível de Ameaça
ALTO
⚠️ Phishing Confirmed
🎣 Credential Harvester
🎣 OTP Stealer
🔬 Threat Analysis Report
• Ameaça: Phishing
• Alvo: Usuários da Coinbase
• Método: Personificação através de uma página de destino falsa.
• Exfil: Potencialmente credenciais ou informações da carteira.
• Indicadores: Hospedagem gratuita e marca Coinbase.
• Risco: Alto
🔒 Obfuscation Detected
- fromCharCode
- unescape
- unicode_escape
🎯 Kit Endpoints
- https://6aaac910.wcconn.pages.dev/assets/index-B6v9WWnX.js
- http://fb.me/use-check-prop-types
- https://www.coinbase.com/en-in/wallet
- https://embed.${l}/${r}/${a}`,d.charset=
- http://jedwatson.github.io/classnames
- https://getbootstrap.com/)
- https://reactrouter.com/en/main/routers/picking-a-router.`}function
- http://localhost
- https://popper.js.org)
- https://reactjs.org/docs/error-decoder.html?invariant=
- https://server0002.mn19indexpre.xyz
📊 Detalhamento da Pontuação de Risco
Total Risk Score
90/100
Contributing Factors
Free Hosting + Brand Logo
Presence of a brand logo on a free hosting platform is a strong indicator of phishing.
Domain Mismatch
The domain does not match the official brand domain.
🔬 Análise Integral de Ameaças
Tipo de Ameaça
Two-Factor Authentication Stealer
Alvo
Coinbase users (International)
Método de Ataque
Brand impersonation + credential harvesting forms + obfuscated JavaScript
Canal de Exfiltração
Form submission (backend endpoint not detected - likely JavaScript-based)
Avaliação de Risco
HIGH - Automated credential harvesting with Form submission (backend endpoint not detected - likely JavaScript-based)
⚠️ Indicators of Compromise
- Kit types: Credential Harvester, OTP Stealer
- 15 obfuscation techniques
🏢 Análise de Falsificação de Marca
Impersonated Brand
Coinbase Wallet
Official Website
https://www.coinbase.com/
Fake Service
Coinbase Wallet
⚔️ Metodologia de Ataque
Primary Method: Credential Harvesting
The attacker likely aims to steal user credentials by mimicking the Coinbase Wallet login page to trick users into entering their information.
🌐 Indicadores de Compromisso de Infraestrutura
🦠 Malicious Files
Main File
index-B6v9WWnX.js
File Size
🔬 JavaScript Deep Analysis
Operator Language
English (1%)
Sophistication Level
Basic
Total Code Size
399,8 KB
🔗 API Endpoints Detected
Other
7
🔐 Obfuscation Detected
- : Heavy
🤖 AI-Extracted Threat Intelligence
🎯 Malicious Files Identified
Main Drainer
index-B6v9WWnX.jsFile Size
399KB
Similar Websites
Pages with identical visual appearance (based on perceptual hash)
Scan History for 6aaac910.wcconn.pages.dev
Found 2 other scans for this domain
"Nunca pensei que aconteceria comigo"
Isso dizem os 2,3 milhões de vítimas a cada ano. Não espere para ser uma estatística.