Phishing Analysis
Detailed analysis of captured phishing page
Visual Capture
No screenshot available
Detection Info
https://www.efmhyj.com/start/
Detected Brand
TikTok Shop
Country
International
Confidence
100%
HTTP Status
200
Report ID
99447a20-8b8…
Analyzed
2026-01-25 00:08
Final URL (after redirects)
https://www.efmhyj.com/start/#/index
Content Hashes (HTML Similarity)
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T147E30C70D695613B063389E4A4722F4FB2D7F31ECA97890067FC43D96FEBC95AA04486 |
|
CONTENT
ssdeep
|
1536:nqV0Ak55xRcHS9ZP9rQVW3UT6CLyMrGc9sPtM42blAjR7I2MumevZhfGGq+QGjVJ:nKic27I2MumevZhfGGq+QGK2 |
Visual Hashes (Screenshot Similarity)
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
f6a51add62a80376 |
|
VISUAL
aHash
|
00ff77c3e6feff00 |
|
VISUAL
dHash
|
c56cec8f4c48352d |
|
VISUAL
wHash
|
00ff6641e6fed700 |
|
VISUAL
colorHash
|
06e00008000 |
|
VISUAL
cropResistant
|
4d6cec8f4c482535,0000009393820080,010c686969697434,3535253d3db9edec |
Code Analysis
Risk Score
100/100
Threat Level
BAJO
🎣 Credential Harvester
🎣 OTP Stealer
🎣 Card Stealer
🎣 Banking
🎣 Personal Info
🔬 Threat Analysis Report
• Threat: Suspicious e-commerce site with domain unrelated to brand
• Target: Online shoppers
• Method: Potentially selling counterfeit goods or conducting other deceptive practices
• Exfil: No explicit data exfiltration detected, but potential for credit card or personal data theft if purchases are made
• Indicators: Unrelated domain, domain creation date in the future
• Risk: LOW - Potential for scam or poor quality products, but not direct credential theft
🔒 Obfuscation Detected
- atob
- fromCharCode
- unescape
- document.write
- unicode_escape
- base64_strings
📡 API Calls Detected
- /api/credit!config.action
- /api/credit!beforereapply.action
- /api/credit!pay.action
- /api/localuser!registerNoVerifcode.action
- /api/credit!bill.action
- /api/localuser!registerWithVerifcode.action
- /public/userOnlineChatController!unread.action
- /api/credit!histroy.action
- /api/category!sellerTree.action
- GET
- /api/credit!check.action
- /api/category!tree.action
- post
- /api/activity/lottery!getCurrentActivity.action
- /api/localuser!get.action
- /api/credit!apply.action
- /api/credit!beforepay.action
- api/newOnlinechat!unread.action
- api/syspara!getSyspara.action
- /api/jscode!execute.action
🔬 JavaScript Deep Analysis
Operator Language
Portuguese (0%)
Sophistication Level
Advanced
Total Code Size
4.8 MB
🔗 API Endpoints Detected
Other
32
WebSocket (Real-time)
1
🔐 Obfuscation Detected
- : Light
- : Light
- : Heavy
- : Moderate
Similar Websites
Pages with identical visual appearance (based on perceptual hash)
Unknown
https://cdn.gosafemode.com/screenshots/620a493ab40c.png
Apr 03, 2026
Unknown
https://cdn.gosafemode.com/screenshots/0dd104c2bbe7.png
Mar 29, 2026
Unknown
https://api.huiyi321.com/start/
Mar 08, 2026
Unknown
https://tiktok.1d2by.com/start/
Jan 29, 2026
No screenshot
Unknown
https://www.efmhyj.com/
Jan 22, 2026
Scan History for www.efmhyj.com
Found 2 other scans for this domain
"I Never Thought It Would Happen to Me"
That's what 2.3 million victims say every year. Don't wait to become a statistic.