Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T13622B76190AA5D3F121782D9ABFA3F13A7A7C746C6D20119C2FD97CD0FE9D10DA03528 |
|
CONTENT
ssdeep
|
192:nntKc1WzPnHMnRumGqnR4Y06GY4tc4t7eo3o2hH:ntne/snRumGqnR4Y06GnV13oeH |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
e3339c62920e9dd9 |
|
VISUAL
aHash
|
e7e1e0e1e1e1e1ff |
|
VISUAL
dHash
|
0f4f534d4d4d4787 |
|
VISUAL
wHash
|
e5e1a0a0e1e0e1ff |
• Threat: Credential phishing targeting SwissPass users.
• Target: Individuals with SwissPass accounts.
• Method: A fake login page is used to steal email and password.
• Exfil: Unknown - likely exfiltrated to a remote server.
• Indicators: Domain does not match the official SwissPass website, and is a mybluehost.me subdomain. There is a login form present.
• Risk: HIGH - Immediate credential theft is possible.
Pages with identical visual appearance (based on perceptual hash)
Found 4 other scans for this domain