Phishing Analysis
Detailed analysis of captured phishing page
Visual Capture
Detection Info
https://s.yam.com/mkvZg
Detected Brand
yamShare (Taiwanese Video Sharing Platform)
Country
Taiwan
Confidence
100%
HTTP Status
200
Report ID
45e515e3-6bbโฆ
Analyzed
2026-02-09 01:57
Content Hashes (HTML Similarity)
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T12D91B632D1502973687BC352EEE1524A4223DF9DE7130AE2CAD0053AD64CDADDCE60AD |
|
CONTENT
ssdeep
|
96:n909TBn9YLfqtqC8PLb8So8WZLhAyKGlg:y9TZmWLhJKGlg |
Visual Hashes (Screenshot Similarity)
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
99996666666698ce |
|
VISUAL
aHash
|
0018181818180000 |
|
VISUAL
dHash
|
00b2b23270703010 |
|
VISUAL
wHash
|
183c3c3c3c3c3c18 |
|
VISUAL
colorHash
|
38000000c00 |
|
VISUAL
cropResistant
|
b4b2b3b3b333b0f0,00b2b23270703010 |
Code Analysis
Risk Score
100/100
Threat Level
ALTO
โ ๏ธ Phishing Confirmed
๐ฃ Credential Harvester
๐ฃ OTP Stealer
๐ฃ Banking
๐ฃ Personal Info
๐ฌ Threat Analysis Report
โข Threat: Malware distribution/Suspicious activity
โข Target: yamShare users
โข Method: Malicious URL redirect/Clickjacking
โข Exfil: Unknown, but JavaScript indicates potential data exfiltration.
โข Indicators: Domain detected as malicious by CRDF; JavaScript obfuscation and form submission.
โข Risk: Alto
๐ Obfuscation Detected
- atob
- fromCharCode
- unescape
- hex_escape
- unicode_escape
- base64_strings
๐ก API Calls Detected
- https://stats.yam.com/y/collect/?
- GET
- https://www.google.com/ccm/geo
- POST
๐ Risk Score Breakdown
Total Risk Score
90/100
Contributing Factors
Malicious URL detection
The URL is flagged by CRDF as malicious.
JavaScript Obfuscation
Javascript is obfuscated to hide its content.
Form Submission detected
Forms can be utilized for malicious purposes.
๐ฌ Comprehensive Threat Analysis
Threat Type
Banking Credential Harvester
Target
yamShare (Taiwanese Video Sharing Platform) users (Taiwan)
Attack Method
obfuscated JavaScript
Exfiltration Channel
Form submission (backend endpoint not detected - likely JavaScript-based)
Risk Assessment
CRITICAL - Automated credential harvesting with Form submission (backend endpoint not detected - likely JavaScript-based)
โ ๏ธ Indicators of Compromise
- Kit types: Credential Harvester, OTP Stealer, Banking, Personal Info
- 163 obfuscation techniques
๐ข Brand Impersonation Analysis
Impersonated Brand
yamShare
Official Website
https://www.yam.com/
Fake Service
CRDF block page
Fraudulent Claims
โ๏ธ Attack Methodology
Primary Method: Malware distribution
The site is flagged as malicious, and it's likely serving a malicious payload. The obfuscated Javascript may also indicate clickjacking.
Secondary Method: Clickjacking
The site could be used to trick a user to click something on a different page or to redirect them elsewhere.
๐ Infrastructure Indicators of Compromise
Domain Information
Domain
s.yam.com
Registered
1996-02-14 05:00:00+00:00
Registrar
Unknown
Status
active
๐ฌ JavaScript Deep Analysis
Total Code Size
4.0ย KB
๐ API Endpoints Detected
Other
1
๐ Obfuscation Detected
- : None
๐ค AI-Extracted Threat Intelligence
Similar Websites
Pages with identical visual appearance (based on perceptual hash)
Scan History for s.yam.com
Found 10 other scans for this domain
"I Never Thought It Would Happen to Me"
That's what 2.3 million victims say every year. Don't wait to become a statistic.