SafeMode - Analysis: agosbitline.shop

Visual Capture

Detection Info

https://agosbitline.shop/

Detected Brand

Agos Bitline (Fictitious)

Country

International

Confidence

100%

HTTP Status

200

Report ID

b7c13906-53a…

Analyzed

2026-07-21 11:13

Content Hashes (HTML Similarity)

Used to detect similar phishing pages based on HTML content

Algorithm	Hash Value
CONTENT TLSH	T1FCE2B732B100763B5197D3C9B3A2F71AA2E39249EB560406E2FDC3AD1BE3D54DA33516
CONTENT ssdeep	768:7Sky5NjO3sPCbH/iNS7sOy2+y9BH4crIe:PuCAS7sOy2+UBH4crIe

Visual Hashes (Screenshot Similarity)

Used to detect visually similar phishing pages based on screenshots

Algorithm	Hash Value
VISUAL pHash	c363bc1ced2cc1a3
VISUAL aHash	000000000000ffff
VISUAL dHash	92ccc8c2caccac00
VISUAL wHash	0064fc70003cffff
VISUAL colorHash	310000001c0
VISUAL cropResistant	088080024c888000,928cc8c2c2c8cc4c

Code Analysis

Risk Score 76/100

Threat Level ALTO

⚠️ Phishing Confirmed

🎣 Credential Harvester 🎣 Banking 🎣 Personal Info

🔬 Threat Analysis Report

• Threat: Phishing / Data Harvesting
• Target: User Credentials & PII
• Method: Deceptive Trading Platform landing page
• Exfil: Form submission via hidden JS
• Indicators: Obfuscated JS, .shop domain
• Risk: High

🔒 Obfuscation Detected

unescape
document.write

🎯 Kit Endpoints

login

📡 API Calls Detected

POST
/api/o1x7

📊 Risk Score Breakdown

Total Risk Score

85/100

Contributing Factors

Obfuscation

Use of unescape and document.write to hide code execution.

Domain

.shop TLD is highly characteristic of short-lived scams.

🔬 Comprehensive Threat Analysis

Threat Type

Banking Credential Harvester

Target

Agos Bitline (Fictitious) users (International)

Attack Method

credential harvesting forms + obfuscated JavaScript

Exfiltration Channel

Form submission (backend endpoint not detected - likely JavaScript-based)

Risk Assessment

HIGH - Automated credential harvesting with Form submission (backend endpoint not detected - likely JavaScript-based)

⚠️ Indicators of Compromise

Kit types: Credential Harvester, Banking, Personal Info
8 obfuscation techniques

🏢 Brand Impersonation Analysis

Impersonated Brand

Agos Bitline

Fake Service

Automated AI Trading Platform

Fraudulent Claims

⚔️ Attack Methodology

Primary Method: Credential/PII Harvesting

The site uses a deceptive landing page to entice users to register for non-existent trading services to capture PII.

Secondary Method: JavaScript Obfuscation

Used to evade automated scanners and hide the destination of form data.

🌐 Infrastructure Indicators of Compromise

Domain Information