SafeMode - Analysis: app-atomic.at

Visual Capture

Detection Info

https://app-atomic.at/

Detected Brand

Atomic Wallet

Country

Unknown

Confidence

100%

HTTP Status

200

Report ID

73ed17cb-25c…

Analyzed

2026-08-29 12:04

Content Hashes (HTML Similarity)

Used to detect similar phishing pages based on HTML content

Algorithm	Hash Value
CONTENT TLSH	T11DA2A417934477AC0E620748BE2547FFA76DA4DCF22749E678EBC0781E908489937EC6
CONTENT ssdeep	384:qiI5A7L5EcTs9LIvd39kibc7FYYl5zMpGYJaVd:7I5+pTs9udMSYl5NYcb

Visual Hashes (Screenshot Similarity)

Used to detect visually similar phishing pages based on screenshots

Algorithm	Hash Value
VISUAL pHash	e59a99676b14174a
VISUAL aHash	ffffffe3e0e0c2c1
VISUAL dHash	90165887878e8692
VISUAL wHash	60ffffe3c0e0c0c0
VISUAL colorHash	0e400000180
VISUAL cropResistant	149f5887868e8692,59bcfe7efcfc7838,00000428b9994080,91979b1b1b87f133,9f9f1f1f1f9fdfff,8617130303030f3f,790f9f9888030000

Code Analysis

Risk Score 70/100

Threat Level ALTO

⚠️ Phishing Confirmed

🎣 Credential Harvester 🎣 OTP Stealer 🎣 Banking 🎣 Personal Info

🎯 Kit Endpoints

/login
/atomic-login-account

📡 API Calls Detected

POST

📊 Risk Score Breakdown

Total Risk Score

100/100

Contributing Factors

Active Phishing Kit

Detected kit types: Credential Harvester, OTP Stealer, Banking, Personal Info

🔬 Comprehensive Threat Analysis

Threat Type

Banking Credential Harvester

Target

Atomic Wallet users

Attack Method

Phishing webpage

Exfiltration Channel

Form submission (backend endpoint not detected - likely JavaScript-based)

Risk Assessment

HIGH - Automated credential harvesting with Form submission (backend endpoint not detected - likely JavaScript-based)

⚠️ Indicators of Compromise

Kit types: Credential Harvester, OTP Stealer, Banking, Personal Info

🏢 Brand Impersonation Analysis

Impersonated Brand

Atomic Wallet

Official Website

N/A

Fake Service

Banking/payment service

⚔️ Attack Methodology

Primary Method: Credential Harvesting

Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.

Secondary Method: Two-Factor Authentication Bypass

Victim is prompted for 2FA code after entering credentials. The code is intercepted and used by attacker to access victim's account in real-time.

🌐 Infrastructure Indicators of Compromise

Domain Information

Domain

app-atomic.at

Registered