SafeMode - Analysis: mez.ink

Captura Visual

Información de Detección

https://mez.ink/attservicehomeredirect

Detected Brand

AT&T / Yahoo

Country

USA

Confianza

100%

HTTP Status

200

Report ID

d1d5bf62-37f…

Analyzed

2026-02-17 10:50

Hashes de Contenido (Similitud HTML)

Used to detect similar phishing pages based on HTML content

Algorithm	Hash Value
CONTENT TLSH	T1562229F3628820BA7103F7C8B619771CF113696CFB51C6A4DBB74BA1765AD6CD01288B
CONTENT ssdeep	192:7R+XnBMtVYFma9eJTeXV2rHQJHJClVAVTVvvOrtkSEG1bRvkX4zIzFz4PqtfYpmx:7RiBMtVIeJTeXV2rQJpClVAVTVvvOrt4

Hashes Visuales (Similitud de Captura)

Used to detect visually similar phishing pages based on screenshots

Algorithm	Hash Value
VISUAL pHash	dc9b1c3433cc93cc
VISUAL aHash	18183c1800001818
VISUAL dHash	30927170160c3230
VISUAL wHash	ffffff7d00001800
VISUAL colorHash	38000e00000
VISUAL cropResistant	002491c4ecf40200,a2802f2b93809a68,30927170160c3230

Análisis de Código

Risk Score 100/100

Nivel de Amenaza ALTO

⚠️ Phishing Confirmed

🎣 Credential Harvester 🎣 OTP Stealer 🎣 Card Stealer 🎣 Banking 🎣 Personal Info

🔥 Firebase Backend

🔬 Threat Analysis Report

• Amenaza: Phishing de credenciales
• Objetivo: Usuarios de AT&T / Yahoo
• Método: Suplantación e urgencia
• Exfil: Punto final de Firebase (probablemente).
• Indicadores: Discordancia de dominio, llamada a la acción, alojado en mez.ink.
• Riesgo: ALTO

🔒 Obfuscation Detected

atob
eval
fromCharCode
unescape
unicode_escape
base64_strings

🎯 Kit Endpoints

https://nextjs.org/docs/messages/ssg-fallback-true-export
https://nextjs.org/docs/messages/
https://super-3e9a1-default-rtdb.asia-southeast1.firebasedatabase.app
http://f
https://mez.ink/_next/static/chunks/74260-3f44d603eab7bcd7.js
https://t.me/+JVEFsNFIZhswZjc1
https://www.facebook.com/sharer/sharer.php?u=
https://reactjs.org/
https://connect.facebook.net/en_US/fbevents.js
https://mez.ink/terms-and-conditions/indonesia
https://mezink.onelink.me/I54r/app
https://a@b
https://connect.facebook.net/en_US/sdk.js
https://play.google.com/store/apps/details?id=life.getsuper.droid
https://mez.ink/_next/static/chunks/50341-4e6a8dc746e57f83.js
https://mez.ink/_next/static/chunks/profile-page-59a5b1c9cd864fe5.js
https://radix-ui.com/primitives/docs/components/${t.docsSlug}`;return
https://mez.ink/privacy-policy/indonesia
https://тест
https://nextjs.org/docs/messages/client-side-exception-occurred
https://a
https://a/c%20d?a=1&c=3
https://mui.com/production-error/?code=
https://mez.ink/_next/static/chunks/pages/_app-7f4af3ab5f552133.js
https://mez.ink/blog/
https://evilmartians.com/chronicles/postcss-8-plugin-migration
https://cdn.mxpnl.com
https://mez.ink/_next/static/chunks/25744-bcc4bf8a64fb4c8c.js
https://mez.ink/_next/static/chunks/71693-c75476bc0b703fe3.js
https://mez.ink/_next/static

📡 API Calls Detected

https://www.google.com/ccm/geo
https://calendly.com/tarunvalecha
https://t.me/+JVEFsNFIZhswZjc1
https://play.google.com/store/apps/details?id=life.getsuper.droid
https://api.ipify.org?format=json
https://mez.ink/terms-and-conditions/indonesia
https://mez.ink/blog/
POST
GET
https://mez.ink/privacy-policy/indonesia

☁️ Cloud Backend

Firebase: super-3e9a1.firebaseapp.com

📊 Desglose de Puntuación de Riesgo

Total Risk Score

90/100

Contributing Factors

Domain Mismatch

The domain mez.ink does not match the target brand.

Obfuscation

Javascript is obfuscated.

Brand Impersonation

The page impersonates AT&T / Yahoo to collect user credentials.

Request for sensitive data

The page tries to trick users to log in, likely to steal credentials.

🔬 Análisis Integral de Amenazas

Tipo de Amenaza

Banking Credential Harvester

Objetivo

AT&T / Yahoo users (USA)

Método de Ataque

Brand impersonation + obfuscated JavaScript

Canal de Exfiltración

Firebase Database

Evaluación de Riesgo

CRITICAL - Automated credential harvesting with Firebase Database

⚠️ Indicators of Compromise

Kit types: Credential Harvester, OTP Stealer, Card Stealer, Banking, Personal Info
1424 obfuscation techniques

🏢 Análisis de Suplantación de Marca

Impersonated Brand

AT&T

Official Website

att.com, yahoo.com

Fake Service

AT&T / Yahoo account login

Fraudulent Claims

⚔️ Metodología de Ataque

Primary Method: Credential Harvesting Phishing

The attacker uses a look-alike page on a non-AT&T/Yahoo domain to lure users into submitting their credentials. This is achieved by creating urgency via messaging about needed account updates.