SafeMode - Analysis: secret-flirts.com

Visual Capture

Detection Info

https://secret-flirts.com/click.php?key=l2xlg8fitbamngc4wdrd

Detected Brand

eBay

Country

International

Confidence

95%

HTTP Status

200

Report ID

44aefc41-c8d…

Analyzed

2026-03-01 15:54

Content Hashes (HTML Similarity)

Used to detect similar phishing pages based on HTML content

Algorithm	Hash Value
CONTENT TLSH	T1EDE1CD31848296AB00D353E456639B97B2A09351DA578E2517F4C3FE4FDAF68CF0B522
CONTENT ssdeep	48:PzIavFKY9zvlwJd2gKeLWkhuaPo3xI0G9cbZjG9EwBmFideG9czyYhBSHbycUiGm:PJDJw2SHQPqmsczOFE09O4QA4iK5M

Visual Hashes (Screenshot Similarity)

Used to detect visually similar phishing pages based on screenshots

Algorithm	Hash Value
VISUAL pHash	e62699b1a6c6b331
VISUAL aHash	e700a5e7e7e7ffff
VISUAL dHash	0c312c0c0f0c0008
VISUAL wHash	e700e7e700243c3c
VISUAL colorHash	07000038040
VISUAL cropResistant	0c312c0c0f0c0008,c041f27614763b3b

Code Analysis

Risk Score 53/100

Threat Level ALTO

⚠️ Phishing Confirmed

🎣 Credential Harvester

🔬 Threat Analysis Report

• Threat: Impersonation
• Target: eBay users
• Method: Deceptive content to trick users
• Exfil: Unknown, but could lead to various scams
• Indicators: Domain mismatch, inappropriate content, obfuscation.
• Risk: High

🔒 Obfuscation Detected

fromCharCode

📊 Risk Score Breakdown

Total Risk Score

90/100

Contributing Factors

Domain unrelated to brand

The domain has no relation to eBay.

Impersonation

Uses the eBay logo and brand, but offers different content.

Obfuscation

Obfuscation was detected which is a common technique to hide malicious code.

Suspicious Content

Sexually suggestive and not related to the brand's services.

🔬 Comprehensive Threat Analysis

Threat Type

Credential Harvesting Kit

Target

eBay users (International)

Attack Method

Brand impersonation + obfuscated JavaScript

Exfiltration Channel

Form submission (backend endpoint not detected - likely JavaScript-based)

Risk Assessment

MEDIUM - Automated credential harvesting with Form submission (backend endpoint not detected - likely JavaScript-based)

⚠️ Indicators of Compromise

Kit types: Credential Harvester
2 obfuscation techniques

🏢 Brand Impersonation Analysis

Impersonated Brand

eBay

Official Website

ebay.com

Fake Service

Dating service, likely for adult content.

⚔️ Attack Methodology

Primary Method: Brand impersonation

The site uses the eBay logo and branding to lure victims into thinking they are interacting with the legitimate company. Then uses a sexual suggestive content to make the user stay.