EN ES PT

Phishing Analysis

Detailed analysis of captured phishing page

Back to Stats

Captura Visual

Screenshot of www.flow.page

Información de Detección

http://www.flow.page/ijhu7gyhj/
Detected Brand
AT&T
Country
USA
Confianza
100%
HTTP Status
200
Report ID
365299cd-1e1…
Analyzed
2026-02-01 00:18
Final URL (after redirects)
https://www.flow.page/ijhu7gyhj

Hashes de Contenido (Similitud HTML)

Used to detect similar phishing pages based on HTML content

Algorithm Hash Value
CONTENT TLSH
T1374283B671C16E2F932732C8B1C2F79EF483A20ACEC945C0B9BA06F693DACB58015555
CONTENT ssdeep
384:w1FcT+TXn18d/cB3B0dyCdNmfYXWKeW58GoCgj8YCCgtNC33:w1uTwXn1EcNtINmfS8GE8YgNC3

Hashes Visuales (Similitud de Captura)

Used to detect visually similar phishing pages based on screenshots

Algorithm Hash Value
VISUAL pHash
ea59da34ca35c835
VISUAL aHash
00001000000000ff
VISUAL dHash
e9e3f3f7e7e7cec9
VISUAL wHash
78793931330303ff
VISUAL colorHash
07038000000
VISUAL cropResistant
cd00c9c109c980d1,f9ebf3f3e7e7efcf

Análisis de Código

Risk Score 85/100
Nivel de Amenaza ALTO
⚠️ Phishing Confirmed
🎣 Credential Harvester 🎣 OTP Stealer 🎣 Card Stealer 🎣 Banking 🎣 Personal Info

🔬 Threat Analysis Report

• Amenaza: Suplantación
• Objetivo: Clientes de AT&T
• Método: Redirigiendo a los usuarios a un sitio malicioso.
• Exfil: Potencialmente recopilando credenciales después de proceder.
• Indicadores: Dominio no coincidente, logotipo de la marca.
• Riesgo: Alto

🔒 Obfuscation Detected

  • atob
  • eval
  • fromCharCode
  • hex_escape
  • unicode_escape
  • base64_strings

🎯 Kit Endpoints

  • http://www.flow.page/api/exfiltrate
  • https://flow.page/privacy-policy#notice-at-collection

📡 API Calls Detected

  • /api/social-validation/youtube?handle=
  • GET
  • /api/social-validation/facebook?handle=
  • POST

📊 Desglose de Puntuación de Riesgo

Total Risk Score
95/100

Contributing Factors

Domain Mismatch
The domain flow.page is completely unrelated to the brand being impersonated (AT&T).
Impersonation
The site displays the AT&T logo and branding to deceive users.
Obfuscation
JavaScript obfuscation techniques detected, a common tactic for malicious actors to hide their activity.

🔬 Análisis Integral de Amenazas

Tipo de Amenaza
Banking Credential Harvester
Objetivo
AT&T users (USA)
Método de Ataque
Brand impersonation + credential harvesting forms + obfuscated JavaScript
Canal de Exfiltración
Form submission (backend endpoint not detected - likely JavaScript-based)
Evaluación de Riesgo
CRITICAL - Automated credential harvesting with Form submission (backend endpoint not detected - likely JavaScript-based)

⚠️ Indicators of Compromise

  • Kit types: Credential Harvester, OTP Stealer, Card Stealer, Banking, Personal Info
  • 950 obfuscation techniques

🏢 Análisis de Suplantación de Marca

Impersonated Brand
AT&T
Official Website
https://www.att.com
Fake Service
AT&T Login

⚔️ Metodología de Ataque

Primary Method: Credential Harvesting

The site aims to trick users into entering their AT&T login credentials on a fake form, which are then harvested by the attackers.

Secondary Method: Redirection

The 'Click here to proceed' button could redirect users to another malicious page after the click.

🌐 Indicadores de Compromiso de Infraestructura

🦠 Malicious Files

Main File
main-cd00a71fdfaeeed7.js
File Size

Functions: submitForm()

📊 Diagrama de Flujo de Ataque

User fills <input name='username'> → submitForm() → fetch('http://www.flow.page/api/exfiltrate') → data sent to external server

🔬 JavaScript Deep Analysis

Operator Language
English (1%)
Total Code Size
2,7 MB

🔗 API Endpoints Detected

Other
49

🔐 Obfuscation Detected

  • : Light
  • : Moderate
  • : Moderate
  • : Heavy
  • : Light
  • : Heavy
  • : Light
  • : Light
  • : None
  • : Light
  • : None
  • : None
  • : Light
  • : None
  • : Light
  • : None
  • : Light
  • : Light
  • : None
  • : Light

🤖 AI-Extracted Threat Intelligence

📊 Attack Flow

User fills <input name='username'> → submitForm() → fetch('http://www.flow.page/api/exfiltrate') → data sent to external server

🎯 Malicious Files Identified

Main Drainer
main-cd00a71fdfaeeed7.js
File Size
45KB
Malicious Functions
  • submitForm()

Scan History for www.flow.page

Found 10 other scans for this domain

😰
"Nunca pensé que me pasaría a mí"
Esto dicen las 2.3 millones de víctimas cada año. No esperes a ser una estadística.