EN ES PT

Phishing Analysis

Detailed analysis of captured phishing page

Back to Stats

Visual Capture

Screenshot of 8ujoo-4.pages.dev

Detection Info

https://8ujoo-4.pages.dev/gp/video/detail/B0CGS8FJDS/ref=atv_dp_amz_c_TS8274d9_1_5?language=zh
Detected Brand
Amazon Prime Video
Country
International
Confidence
100%
HTTP Status
200
Report ID
404836bb-80b…
Analyzed
2026-03-17 03:39

Content Hashes (HTML Similarity)

Used to detect similar phishing pages based on HTML content

Algorithm Hash Value
CONTENT TLSH
T1A924D7F39290107712278BCAF57E675D31E3B21EEF0696809AF4076C5FE2D46A52B834
CONTENT ssdeep
1536:hG74Z4jhNHrR3dO0ZzvV/YcUp2aoQe0eJr5967nH6jmc6jfq6jsePn/rzvcGg20G:2ggTLRz8OlB+hiqRz

Visual Hashes (Screenshot Similarity)

Used to detect visually similar phishing pages based on screenshots

Algorithm Hash Value
VISUAL pHash
94956bcba5d0d2d4
VISUAL aHash
ff1e1e1617150000
VISUAL dHash
fafcf4f4e6ed6d46
VISUAL wHash
ff3f1f1f37150000
VISUAL colorHash
32c01008000
VISUAL cropResistant
808082d2d2c28080,e109391948a929b1,61f1d0d8d8cc86e7,fafcf4f4e6ed6d46

Code Analysis

Risk Score 100/100
Threat Level ALTO
⚠️ Phishing Confirmed
🎣 Credential Harvester 🎣 OTP Stealer 🎣 Card Stealer 🎣 Banking 🎣 Personal Info

🔬 Threat Analysis Report

• Threat: Phishing
• Target: Amazon Prime Video users
• Method: Impersonation via a fake login
• Exfil:  The forms likely collect login credentials
• Indicators: Free hosting, Amazon Prime Video interface.
• Risk: High

🔐 Credential Harvesting Forms

🔒 Obfuscation Detected

  • atob
  • eval
  • fromCharCode
  • unescape
  • unicode_escape
  • base64_strings

🎯 Kit Endpoints

  • /ref=nav_logo
  • /gp/video/collection/newandupcoming?jic=8%7CEgNhbGw%3D
  • /gp/video/collection/primerolatino?jic=8%7CEgNhbGw%3D
  • https://logistics.amazon.com/marketing?utm_source=amzn&utm_medium=footer&utm_campaign=home
  • https://email.aboutamazon.com/l/637851/2020-10-29/pd87g?utm_source=gateway&utm_medium=amazonfooters&utm_campaign=newslettersubscribers&utm_content=amazonnewssignup
  • /gp/video/collection/mgForYou?jic=8%7CEgNhbGw%3D
  • /gp/video/collection/Musicvideosandconcerts?jic=8%7CEgNhbGw%3D
  • https://sustainability.aboutamazon.com/?utm_source=gateway&utm_medium=footer&ref_=susty_footer
  • /gp/video/collection/BHM?jic=8%7CEgNhbGw%3D
  • /gp/video/collection/AccessibleCollection?jic=8%7CEgNhbGw%3D
  • /?ref_=footer_logo
  • /gp/video/collection/inspire-and-uplift?jic=8%7CEgNhbGw%3D
  • https://www.aboutamazon.com/?utm_source=gateway&utm_medium=footer&token=about
  • /gp/video/collection/Awards?jic=8%7CEgNhbGw%3D

📡 API Calls Detected

  • POST
  • /gp/video/acquisition/utilities/monitoring
  • GET
  • https://

📤 Form Action Targets

  • get
  • /gp/video/auth-redirect/ref=atv_dp_react_sign_in?signin=1&returnUrl=%2Fgp%2Fvideo%2Fdetail%2FB0CGRYRP99%2Fref%3Datv_dp_react_sign_in_return
  • /gp/video/search/ref=atv_nb_sug
  • /s/ref=nb_sb_noss
  • /gp/video/auth-redirect/ref=atv_wl_tog_sign_in

📊 Risk Score Breakdown

Total Risk Score
90/100

Contributing Factors

Free hosting
The domain is using free hosting (pages.dev), a common tactic for phishing.
Impersonation
The site mimics Amazon Prime Video's appearance.
Obfuscation
JavaScript obfuscation detected (atob, eval, fromCharCode), indicating an attempt to hide malicious code.

🔬 Comprehensive Threat Analysis

Threat Type
Banking Credential Harvester
Target
Amazon Prime Video users (International)
Attack Method
Brand impersonation + credential harvesting forms + obfuscated JavaScript
Exfiltration Channel
HTTP POST to backend
Risk Assessment
CRITICAL - Automated credential harvesting with HTTP POST to backend

⚠️ Indicators of Compromise

  • Kit types: Credential Harvester, OTP Stealer, Card Stealer, Banking, Personal Info
  • 128 obfuscation techniques

🏢 Brand Impersonation Analysis

Impersonated Brand
Amazon Prime Video
Official Website
amazon.com/primevideo
Fake Service
Amazon Prime Video

⚔️ Attack Methodology

Primary Method: Credential Harvesting

The attacker likely aims to steal Amazon Prime Video login credentials by presenting a fake login page that mimics the legitimate website's design and then captures entered usernames and passwords.

Secondary Method: JavaScript Obfuscation

The JavaScript code is obfuscated to make it harder to analyze and identify the phishing activities. This technique is often used to bypass security measures and prevent detection.

🌐 Infrastructure Indicators of Compromise

Domain Information

Domain
8ujoo-4.pages.dev
Registered
None
Registrar
None
Status
active

🤖 AI-Extracted Threat Intelligence

Scan History for 8ujoo-4.pages.dev

Found 10 other scans for this domain

😰
"I Never Thought It Would Happen to Me"
That's what 2.3 million victims say every year. Don't wait to become a statistic.