Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T1B141B7B0E0384C63019296F4B3C4570A64C5D21FC7821D00A2FC9BE893FFC52ED79858 |
|
CONTENT
ssdeep
|
24:nl8CiQ4tKonEnobcoEDcomCh7BK6jHWAPnpV3BsYEiK3r+hHc7VD8q04Dr+k1OWW:nb4UFnKc3cJC1PnJsBiKbTJgyii2H5j5 |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
d884a64d7e94b569 |
|
VISUAL
aHash
|
7f7d7d5c484868e0 |
|
VISUAL
dHash
|
c1d1919199909199 |
|
VISUAL
wHash
|
7f7d7d5c484848e0 |
|
VISUAL
colorHash
|
0ee00010000 |
|
VISUAL
cropResistant
|
c1d1919199909199,36396cc8c8989a6c,d3e1c1c5013379dd,27222381899923e3,1a1a1b1f0f8f8703,c3c38f4fe7b57575 |
• Threat: Credential harvesting phishing
• Target: DHL customers
• Method: Fake DHL login page stealing usernames and passwords.
• Exfil: Unknown, likely a custom API or a compromised server.
• Indicators: Domain name doesn't match the official DHL domain, presence of a login form, use of 'fromCharCode' obfuscation.
• Risk: HIGH - Credentials theft.
Pages with identical visual appearance (based on perceptual hash)
Found 9 other scans for this domain