Detailed analysis of captured phishing page
No screenshot available
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T1FC0123F038416877C4D481C02E77A31636E086A9F7570B1063D682BD0FD5F72CD80684 |
|
CONTENT
ssdeep
|
12:hNMy7FUknqkegSLh1nWbgngD4UQpeKFKH9tj5ccQSp:hiCLAhLgIeUKH9jc4p |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
e666999926666699 |
|
VISUAL
aHash
|
ffffe7e7e7e7ffff |
|
VISUAL
dHash
|
0c304d4d4d4d300c |
|
VISUAL
wHash
|
3020000000000000 |
|
VISUAL
colorHash
|
07200030000 |
|
VISUAL
cropResistant
|
0c304d4d4d4d300c,337160dce8696843 |
• Threat: Phishing/Credential Harvesting
• Target: Unspecified (General Video Users)
• Method: Impersonation of a generic meeting platform
• Exfil: Likely credentials/tokens via the CTA button
• Indicators: Extremely recent domain, lack of legitimate branding
• Risk: High due to credential theft potential
Site creates false urgency to participate in a meeting, likely serving a malicious executable upon clicking the join button.
Leverages the common use of remote meeting tools to lure users.
Pages with identical visual appearance (based on perceptual hash)