SafeMode - Analysis: 36593657.com:8989

Captura Visual

No screenshot available

Informações de Detecção

https://36593657.com:8989

Detected Brand

Unknown

Country

International

Confiança

100%

HTTP Status

200

Report ID

f2ad99c0-595…

Analyzed

2026-03-17 03:18

Final URL (after redirects)

https://36593657.com:8989/verify-page/index.html

Hashes de Conteúdo (Similaridade HTML)

Used to detect similar phishing pages based on HTML content

Algorithm	Hash Value
CONTENT TLSH	T1BAC13371C05B292BF90381E8B1B0DB1F62D3434ED782095592FD026677CFD51F91A9DA
CONTENT ssdeep	96:FuwK6S8LUfANuZsdFYTYcBZbEYTPdp2sclJnaWLlIJQ6B:y6SJouZs3kBNTPdp2sclJnak2Qg

Hashes Visuais (Similaridade de Captura)

Used to detect visually similar phishing pages based on screenshots

Algorithm	Hash Value
VISUAL pHash	dbb107cb3c0d81b6
VISUAL aHash	ffffffffdc280000
VISUAL dHash	f2cada3329d15166
VISUAL wHash	7fefffdb98080000
VISUAL colorHash	0e0000001c0
VISUAL cropResistant	f2f3cad0b32b35d9,8c6cacdcd86a7e5c,f87e7f7ffffebdaa,7f7f3e36797c7e7f,2b2835d950516364,210830b2b2320c11,11043232b2300c21

Análise de Código

Risk Score 88/100

Nível de Ameaça ALTO

⚠️ Phishing Confirmed

🎣 Credential Harvester 🎣 OTP Stealer 🎣 Card Stealer 🎣 Banking 🎣 Personal Info

🔬 Threat Analysis Report

• Ameaça: Tentativa de phishing
• Alvo: Desconhecido
• Método: Engenharia social, roubo de credenciais
• Exfil: Potencialmente, dados enviados via formulários, JS ofuscado
• Indicadores: Domínio não relacionado, ofuscação, captcha
• Risco: Alto

🔒 Obfuscation Detected

fromCharCode
document.write

🎯 Kit Endpoints

https://36593657.com:8989/verify-page/theme/default/layer.css?v=3.1.0

📊 Detalhamento da Pontuação de Risco

Total Risk Score

90/100

Contributing Factors

Suspicious Domain

Unusual domain with no known brand association.

Obfuscated JavaScript

JavaScript obfuscation is frequently used to hide malicious code.

Forms Detected

Forms are likely used to steal credentials.

CAPTCHA

Suspicious Captcha implementation

🔬 Análise Integral de Ameaças

Tipo de Ameaça

Banking Credential Harvester

Alvo

General public

Método de Ataque

credential harvesting forms + obfuscated JavaScript

Canal de Exfiltração

Form submission (backend endpoint not detected - likely JavaScript-based)

Avaliação de Risco

CRITICAL - Automated credential harvesting with Form submission (backend endpoint not detected - likely JavaScript-based)

⚠️ Indicators of Compromise

Kit types: Credential Harvester, OTP Stealer, Card Stealer, Banking, Personal Info
6 obfuscation techniques

🏢 Análise de Falsificação de Marca

Impersonated Brand

Unknown

Fake Service

Unknown

⚔️ Metodologia de Ataque

Primary Method: Credential Harvesting

The site likely attempts to steal login credentials or other sensitive information through forms and a misleading CAPTCHA. Obfuscation is used to hide the malicious activity.