EN ES PT

Phishing Analysis

Detailed analysis of captured phishing page

Back to Stats

Captura Visual

Screenshot of www.engelhardtschmuck.de

Informações de Detecção

https://www.engelhardtschmuck.de/hgbutdj/bla1wet/dguyksx/log-in/index.php
Detected Brand
DKB
Country
International
Confidence
95%
HTTP Status
200
Report ID
eb9af0d1-f4c…
Analyzed
2026-03-14 01:39

Hashes de Conteúdo (Similaridade HTML)

Used to detect similar phishing pages based on HTML content

Algorithm Hash Value
CONTENT TLSH
T13EA197131B04993F79CB899C8F35962AB1DF958BE766238011F6CB3981C3EC2DE58C18
CONTENT ssdeep
96:aGvEFaHyWUBGzRBYLg6Hw74FWClR2SxNZWXPurXI5lsqRj:aiE03mwUFRRp94G4Ll

Hashes Visuais (Similaridade de Captura)

Used to detect visually similar phishing pages based on screenshots

Algorithm Hash Value
VISUAL pHash
e3b6489c63b6499c
VISUAL aHash
ffffffe7ffffff00
VISUAL dHash
800c0c4d004000d0
VISUAL wHash
20830303c0fccf00
VISUAL colorHash
070000001c0
VISUAL cropResistant
800c0c4d0c000000,00100c32b2320c30,6090906080d0d02c

Análise de Código

Risk Score 53/100
Threat Level ALTO
⚠️ Phishing Confirmed
🎣 Credential Harvester

🔬 Threat Analysis Report

• Ameaça: Roubo de credenciais
• Alvo: DKB Bank
• Método: Falsificação através de uma página de login falsa.
• Exfil: Provavelmente para um servidor externo através da ação do formulário (infos.php).
• Indicadores: Formulário de login que imita o design do DKB.
• Risco: ALTO

🔐 Credential Harvesting Forms

🔒 Obfuscation Detected

  • fromCharCode

📡 API Calls Detected

  • ./sse-server.php

📤 Form Action Targets

  • infos.php

📊 Detalhamento da Pontuação de Risco

Total Risk Score
90/100

Contributing Factors

Suspicious Form
Presence of a login form on a domain unrelated to the target brand.
Domain Mismatch
The domain does not match the target brand, indicating an attempt at impersonation.
Credential Harvesting
The website is designed to capture sensitive login information.

🔬 Análise Integral de Ameaças

Tipo de Ameaça
Credential Harvesting Kit
Alvo
DKB users (International)
Método de Ataque
Brand impersonation + credential harvesting forms + obfuscated JavaScript
Canal de Exfiltração
HTTP POST to backend
Avaliação de Risco
MEDIUM - Automated credential harvesting with HTTP POST to backend

⚠️ Indicators of Compromise

  • Kit types: Credential Harvester
  • 2 obfuscation techniques

🏢 Análise de Falsificação de Marca

Impersonated Brand
DKB
Fake Service
DKB Banking Login

⚔️ Metodologia de Ataque

Primary Method: Credential Harvesting

The attacker sets up a fake login page that mimics DKB's website. Users are tricked into entering their credentials, which are then harvested.

🌐 Indicadores de Compromisso de Infraestrutura

Domain Information

Domain
engelhardtschmuck.de
Registered
None
Registrar
None
Status
None

🤖 AI-Extracted Threat Intelligence

Similar Websites

Pages with identical visual appearance (based on perceptual hash)

Screenshot
DKB
https://alfa-production-1ab8.up.railway.app/
Abr 08, 2026
 Screenshot
DKB
https://aktivierung-hilfe.com/
Abr 07, 2026
 Screenshot
DKB
http://web2fadesystemlog-aktiv.up.railway.app/
Mar 19, 2026
 Screenshot
DKB - Deutsche Kreditbank
https://dogsabordo.com.br/agax/
Fev 13, 2026
No screenshot
DKB
https://mpktvrdosin.sk/jva/DKB_new
Jan 01, 2026
😰
"Nunca pensei que aconteceria comigo"
Isso dizem os 2,3 milhões de vítimas a cada ano. Não espere para ser uma estatística.