Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T153A1F01453443F4F959962B2D3602E94C3E2491EC7324D48B85EE72F2C8814AED7BAFC |
|
CONTENT
ssdeep
|
96:d3ydpvuLgNxCJlglAtyHL5Z1eQyrcb55f1SWfRPE3yDSznNyHJVwc5xyHAPbZz0B:/pQy051ns6P7iD |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
d393333199999999 |
|
VISUAL
aHash
|
4c243c3c00000000 |
|
VISUAL
dHash
|
194c686016000000 |
|
VISUAL
wHash
|
1c243c3cc0d4f0f0 |
|
VISUAL
colorHash
|
07018000600 |
|
VISUAL
cropResistant
|
194c686016000000 |
• Threat: Credential harvesting phishing kit
• Target: plala users in Japan
• Method: Fake login form stealing email and password
• Exfil: Data sent to suspicious PHP script
• Indicators: Domain mismatch, recent domain age, obfuscated JavaScript
• Risk: HIGH - Immediate credential theft
Pages with identical visual appearance (based on perceptual hash)
Found 2 other scans for this domain