SafeMode - Analysis: audit-usdt.net

Captura Visual

Informações de Detecção

https://audit-usdt.net/

Detected Brand

Unknown

Country

International

Confiança

100%

HTTP Status

200

Report ID

eae43ec1-b26…

Analyzed

2026-02-28 02:38

Hashes de Conteúdo (Similaridade HTML)

Used to detect similar phishing pages based on HTML content

Algorithm	Hash Value
CONTENT TLSH	T184E2636D1116247F6237C9E576207749E1A7A31CCF3B9D08B7F8422A7BDAC428EC2539
CONTENT ssdeep	768:P9+C5oFe/13odaW72A0RvG0dAIpmp2pDpap3papIpypYpapvpWpIXHLL0lLL0EXP:P3J+AFAawg1UZUaMKUxAbb

Hashes Visuais (Similaridade de Captura)

Used to detect visually similar phishing pages based on screenshots

Algorithm	Hash Value
VISUAL pHash	ac19c1c34b6bd369
VISUAL aHash	f99b8f9797f7f1f1
VISUAL dHash	6b36372727052703
VISUAL wHash	b98b838191f1f1f1
VISUAL colorHash	070080001c0
VISUAL cropResistant	6b36372727052703,0551a6d4d423d445,01100cb2b2320c20

Análise de Código

Risk Score 100/100

Nível de Ameaça MEDIO

⚠️ Phishing Confirmed

🎣 Credential Harvester 🎣 OTP Stealer 🎣 Card Stealer 🎣 Banking 🎣 Personal Info

WebSocket C2

🔬 Threat Analysis Report

• Ameaça: Phishing
• Alvo: Usuários de criptomoedas
• Método: Falsificação de identidade e execução de código malicioso.
• Exfil: URLs do WalletConnect indicam potencial para drenar carteira.
• Indicadores: Incompatibilidade de domínio, JavaScript ofuscado, formulários.
• Risco: Moderado

🔒 Obfuscation Detected

atob
fromCharCode
unescape
hex_escape
unicode_escape
base64_strings

🎯 Kit Endpoints

data:image/webp;base64,UklGRiIKAABXRUJQVlA4WAoAAAAQAAAApwEAiwAAQUxQSFgHAAABsERs2+zY2jsJizUoi1iTEDIJRQa7KZFBBlFEyCCKCKXIIIOwhd1kUGQQSih2k0EIuynK6aIIp88k7CaD3UQRosgggyKiKCGEIhEhe3kHeb9vNfXtdb5zzt9ExATA//3/f///h1xFCyX288Vy9fTn1tvOx48fO+3fG/VKqZBNRXzq3wNKKFNsnF9ODbR+Pr5oP83FvDJPjZfao6/o1GmvfhCQcnq2OUbHL7rlHdkWb0zxlhrdh7pES7bxVo9LXkkWe4u3flxSJZh+ikIcJKTX7iWK8qkitw7XKM6Pusw6QqH2fPKqjILt67Iqj8LtanIqYYgHm1Jqa4wizsqoKgr5WpdPobWYsCaffkZBLwOyaXstKvxONp2gsOc+ueSdiQsLcukABf5RLjVFtgjIJOVKZJiVSWFDaCcyKY9Cv5BJJ2Kb6RKpJzbc/Xao6l8dZSy43DfBk6i3+qOu+hcnsBBc+VuQG+DmxEHqnVQ2t5/wu6xdFPyZ+JQzpMeOSf08RnLerwTc1L7ouk5RY/lStVZ5mPI57xQdFv2I3LOyiyqIbuCM2OkYmbN2xmEpZE+dkVuh2bbmmkqiGykOUL9Dk2/9jmoxFsOW4oS4geYbrqkqusmWff4emh7HHOSdUd8FPOBE9RKtjLulhuhudNu0AVp4c8c5d5AcecCZR0gPKwf7D9uMjltqi269bVsdmTdXExb2FMdEqQY4UxlSJyps5tbEwu+SuqLDHbv8c2p44FO16EsG7jut4pCQQfQ9QH9HYMol9YUXtSuH5LUfyAcG9bOJndxRrXqY8W/okXA4HI54AcAb2SlQP+yEw2GVxxPJlar144dJL18KySIwYwaRdUlD4SXsqlNPgfkzNVE51Ic9A8mbszsABSTzAHCAJsOswNMhMqc/x3mi35Ehlm9BHLikkfD27HpLpVh708nmOMCKXiDv8hjy9nmOb5C/tc0yf2dN7LqkK+Ht29WhsizQtkhg7i3Q5MsHPPvWeN+i6VnSsipuzjSXNBFe1q4zqs1hNrVC02O71C5auIxZlFwQP4AkyNlVovCpxxrvFVq+kTUT2XiJzPnl5YyBl14LtDtPl7i5DLml2bcuysDzrG5FHZlX9WzqoDoy489kKtTv6UwmowFACulB3q8oerpD4Q8mEm/fnk8NpPMgSaDDQJyeHQTMBBaMqgabW8crPgCIUBWgPX3qTAX60CC+hvjyyDnLgTQJXrMQcfm2GOQqIV0EdnptZpd6yogi2fcA+ymBNb4cy2joIE9ge8CDiMtWkqNLtYC3alON2gNObUIMFWtwWPZKFNCbfIjY0CltShgRLt/cno/EGLjbxDrIledAHIYkCkCkPuLDYZAIG8TAwwUtW7Qp9YC7S2CUK95qvR0uKLwKyBSArcTJwODAoXcjhWQN+J/aElgS1qa5Nj2Bg3MC23IFADx3Sl0WvtzIUIcmHtoSWtuQMwUASoPAmEuauofNyO+Muc+6wm3JWAHKiHjpkibCyzoLoEZhAgBSVN1ExZbgiljPFxZGLYGXRM8lXQtv32nQp0oAsGMQAw9f0xbvjOj5/BZ6ACAU3gzyFIiRSxoJL21XNEkGOMpUDQC2JoQR4dKmtkCXGIHVPdzsmrtySUPhJe26QLLGcUgdAQB8JLDNdYT21AlM8mz5SX2jRUw1jpfEyCVdCC9mV4Pqc3So1MYhhYccsZVNMeqcp7vYXD7dqBJ4yNKuib5L6govbFeewoeMzJpYBTaCS8ooKVR2hjYpAwJfsupI72zsUjdxSvkZyVOX9FZ06227fDPqa+2OAkqwskKyBeQJhTg43L0TzXeQ0yrYp/DjngagxtpIN2FTGRK4+i4V0IIHXaTjLqkpurnPLihTiOvLweUSaSNM6RMGIhrIbxk0KMTrfn+EzJFOQJpCxOVshcyP4JLroptqtnlaDP4KMBNLDubYLrXD4J5HgVll8S523FJZdGPVNlDaFpwAZ3ptplmwC7SuuUUSOF+aM7Lglh+KbuCxD5TjhYmbInAnx3zfeXK2gXayNtGPAHfh2sQgCa45K7pzcGTo6ZBjVAuCSf3pmPUxCfCQKlBxqsoFsNOYcvTzCpjUi70lY9UvquCeE6L73RkAnnCu/PLs9PhBTAULt/Yqv3c6p8UIAEAgQwYoPUOGTADo6dJZp9Ou5XfA0mC6UK6UH2aC4KqDK8EdO0WGqteCeyCP4EJwSYnUFNvCL5GKYht6JNKu2JogkbWp0AoyCd6KbH1HKhVENgCpHFgIrCKXoCWu9bZkionrLcjmj6IyItIpLqrfQT7/LKbltoQKLoR0DDL6oYh6qpSCuniugyCpz0QzuwOyWvlZLNMoyGtPUySTCEjt4lIYb4MguSM9McxLIL+V4vj2GT+HQIp7j65v2c8RkOa+0uD2TBtxkOu79eFtmLZzPpDvnnCxPTIcNO3V0jpIe+VO9rg9mHy16WbUPXmY0OFvwK1QMlusnLY/9i4Gw8vRaDwaXQ4HvW6nWS3l0xGfAv/3///9/x/CAVZQOCCkAgAAUBoAnQEqqAGMAD6RSKBMpaQjIiE1WCCwEglpbuF3YR3MK8BtoLtGoC99A7HY1NU/3RBm+s246dOnTp06dOnTp06dOnTp06dOnTp06dOnTp06dOnTp06dOnTp02Q2CKyViOt+ZRP6JC6YGGHeRqEwxWLaPHjx48ePHjxy8qKAXVp2nltm4shrnsxCOk4k2XMrtbUgsWLFixYsWDgrCCbtJghY4gyIwXn/3EF5cJjOd5pMBakFixYsWLFjBiKBAgQIECBAgQIECBAgQIECBAgQIECBAgQIECBAgPgAAP70tAAAAncq/mP9dyY/sBCNWRw81yWzQ1L3fLoGw7jNXrLJRjA/VX2/vLv5y5vvqPx6zD56aX7sxHwKXjMrDnTRJqWQeN5x6aOa06l5QKbem66KIt3V8ljE8O2Ih8fhoIRx/AYbBd2n4AKjPxv0v045P9oNl3KhWkBnazVBdnM6WyWpWzRqDscPHKisRu1linNcRkpvW3qzZD3//5PvnboATb0Gnp862wVAlU10RC+wpaJ9gX8R7T/nY854CeaotvYPYj5+m1ggb4L9X6Iz+ig9+7ixbQNp//MHpGf7Zfn1/e7EStxiz40rhmLJVZ/Bneml6EK57hvykrs5joqnqzHeNNGKCM2gM24AdOfVnrsYdBp6ojx4sy0eOZchxCe6xRN5RUTV/SemMOyLS1AsVwCbZRzIMiw8TPZzVHSvkJ5MR5/TsHgpvMZXisNf4gOaekIdXTdrnBuEx7Jg8zwqpuUFI/0+fQrtXiGb1orNFSrnP2ChQ8RYJj+Wjkmx5wSf1EIY/SC1/q1tQh/sqGD3a18bvIlosUzJqnwVfw4i/JNO7BLIdOJNwvtPIoWQDvMYyyAmmxNY78Rw9xmFbLU7kb1qWtc4AAAAAA==

📡 API Calls Detected

POST
https://aml-4.outwallet.world/api/wallet

📊 Detalhamento da Pontuação de Risco

Total Risk Score

65/100

Contributing Factors

Domain Mismatch

The domain 'audit-usdt.net' is unrelated to the branded service and is likely a deliberate attempt at deception.

Obfuscated Javascript

The use of obfuscated Javascript (atob, fromCharCode, unescape) is a strong indicator of malicious intent, as it's used to hide malicious code from detection.

Forms

The presence of forms increases the risk, as they can be used to harvest user data or to implement a malicious activity.

🔬 Análise Integral de Ameaças

Tipo de Ameaça

Banking Credential Harvester

Alvo

General public

Método de Ataque

credential harvesting forms + real-time WebSocket exfiltration + obfuscated JavaScript

Canal de Exfiltração

WebSocket (2 endpoints)

Avaliação de Risco

CRITICAL - Automated credential harvesting with WebSocket (2 endpoints)

⚠️ Indicators of Compromise

Kit types: Credential Harvester, OTP Stealer, Card Stealer, Banking, Personal Info
1086 obfuscation techniques

🏢 Análise de Falsificação de Marca

Impersonated Brand

AML Check or Crypto Wallet Checker

Fake Service

AML Check for crypto wallets.

Fraudulent Claims

⚔️ Metodologia de Ataque

Primary Method: Phishing through a fake AML check.

The site presents itself as an AML check service to attract cryptocurrency users. It likely uses the domain name 'audit-usdt.net' to create a sense of legitimacy and target people interested in cryptocurrency auditing.

Secondary Method: Javascript Obfuscation.

The Javascript code is obfuscated to hide its true purpose, making it difficult to analyze and detect malicious functions. The obfuscation is likely being used to execute an attack, such as keylogging or stealing wallet data.