EN ES PT

Phishing Analysis

Detailed analysis of captured phishing page

Back to Stats

Captura Visual

Screenshot of www.flow.page

Informações de Detecção

http://www.flow.page/ijhu7gyhj/
Detected Brand
AT&T
Country
USA
Confiança
100%
HTTP Status
200
Report ID
365299cd-1e1…
Analyzed
2026-02-01 00:18
Final URL (after redirects)
https://www.flow.page/ijhu7gyhj

Hashes de Conteúdo (Similaridade HTML)

Used to detect similar phishing pages based on HTML content

Algorithm Hash Value
CONTENT TLSH
T1374283B671C16E2F932732C8B1C2F79EF483A20ACEC945C0B9BA06F693DACB58015555
CONTENT ssdeep
384:w1FcT+TXn18d/cB3B0dyCdNmfYXWKeW58GoCgj8YCCgtNC33:w1uTwXn1EcNtINmfS8GE8YgNC3

Hashes Visuais (Similaridade de Captura)

Used to detect visually similar phishing pages based on screenshots

Algorithm Hash Value
VISUAL pHash
ea59da34ca35c835
VISUAL aHash
00001000000000ff
VISUAL dHash
e9e3f3f7e7e7cec9
VISUAL wHash
78793931330303ff
VISUAL colorHash
07038000000
VISUAL cropResistant
cd00c9c109c980d1,f9ebf3f3e7e7efcf

Análise de Código

Risk Score 85/100
Nível de Ameaça ALTO
⚠️ Phishing Confirmed
🎣 Credential Harvester 🎣 OTP Stealer 🎣 Card Stealer 🎣 Banking 🎣 Personal Info

🔬 Threat Analysis Report

• Ameaça: Falsificação de identidade
• Alvo: Clientes da AT&T
• Método: Redirecionando usuários para um site malicioso.
• Exfil: Potencialmente coletando credenciais após prosseguir.
• Indicadores: Domínio incompatível, logotipo da marca.
• Risco: Alto

🔒 Obfuscation Detected

  • atob
  • eval
  • fromCharCode
  • hex_escape
  • unicode_escape
  • base64_strings

🎯 Kit Endpoints

  • http://www.flow.page/api/exfiltrate
  • https://flow.page/privacy-policy#notice-at-collection

📡 API Calls Detected

  • /api/social-validation/youtube?handle=
  • GET
  • /api/social-validation/facebook?handle=
  • POST

📊 Detalhamento da Pontuação de Risco

Total Risk Score
95/100

Contributing Factors

Domain Mismatch
The domain flow.page is completely unrelated to the brand being impersonated (AT&T).
Impersonation
The site displays the AT&T logo and branding to deceive users.
Obfuscation
JavaScript obfuscation techniques detected, a common tactic for malicious actors to hide their activity.

🔬 Análise Integral de Ameaças

Tipo de Ameaça
Banking Credential Harvester
Alvo
AT&T users (USA)
Método de Ataque
Brand impersonation + credential harvesting forms + obfuscated JavaScript
Canal de Exfiltração
Form submission (backend endpoint not detected - likely JavaScript-based)
Avaliação de Risco
CRITICAL - Automated credential harvesting with Form submission (backend endpoint not detected - likely JavaScript-based)

⚠️ Indicators of Compromise

  • Kit types: Credential Harvester, OTP Stealer, Card Stealer, Banking, Personal Info
  • 950 obfuscation techniques

🏢 Análise de Falsificação de Marca

Impersonated Brand
AT&T
Official Website
https://www.att.com
Fake Service
AT&T Login

⚔️ Metodologia de Ataque

Primary Method: Credential Harvesting

The site aims to trick users into entering their AT&T login credentials on a fake form, which are then harvested by the attackers.

Secondary Method: Redirection

The 'Click here to proceed' button could redirect users to another malicious page after the click.

🌐 Indicadores de Compromisso de Infraestrutura

🦠 Malicious Files

Main File
main-cd00a71fdfaeeed7.js
File Size

Functions: submitForm()

📊 Diagrama de Fluxo de Ataque

User fills <input name='username'> → submitForm() → fetch('http://www.flow.page/api/exfiltrate') → data sent to external server

🔬 JavaScript Deep Analysis

Operator Language
English (1%)
Total Code Size
2,7 MB

🔗 API Endpoints Detected

Other
49

🔐 Obfuscation Detected

  • : Light
  • : Moderate
  • : Moderate
  • : Heavy
  • : Light
  • : Heavy
  • : Light
  • : Light
  • : None
  • : Light
  • : None
  • : None
  • : Light
  • : None
  • : Light
  • : None
  • : Light
  • : Light
  • : None
  • : Light

🤖 AI-Extracted Threat Intelligence

📊 Attack Flow

User fills <input name='username'> → submitForm() → fetch('http://www.flow.page/api/exfiltrate') → data sent to external server

🎯 Malicious Files Identified

Main Drainer
main-cd00a71fdfaeeed7.js
File Size
45KB
Malicious Functions
  • submitForm()

Scan History for www.flow.page

Found 10 other scans for this domain

😰
"Nunca pensei que aconteceria comigo"
Isso dizem os 2,3 milhões de vítimas a cada ano. Não espere para ser uma estatística.