Detailed analysis of captured phishing page
No screenshot available
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T1BC5252B3A0416E3F0297A2DBF661237E9282834DC49A06157BF94B0B4EE3F92DC59517 |
|
CONTENT
ssdeep
|
192:QyAIIoao8pw4q5sUv0W2tWBDbnGAUSbbszs6:LAIIoYqK5gDjGbWsP |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
c5b33f3e63090c33 |
|
VISUAL
aHash
|
00fcfefcfcf87000 |
|
VISUAL
dHash
|
c0c0d0c0c0e0e080 |
|
VISUAL
wHash
|
00fcfefcfcf83000 |
|
VISUAL
colorHash
|
00400038000 |
|
VISUAL
cropResistant
|
e0e0ece0e0e0e0ec,c0c0d0c0c0e0e080 |
⢠Threat: Financial Scam/Investment Fraud
⢠Target: Financial/Crypto Investors
⢠Method: Deceptive marketing/Social engineering
⢠Exfil: Unknown (JavaScript form submission)
⢠Indicators: Obfuscated JS code, 60-day old domain, unrealistic growth promises
⢠Risk: Medium
Site serves as a lure to capture leads for financial fraud.
Form submission sends data to external endpoint using obfuscated JavaScript.