Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T1EF235373A0444E7B02D385DB6A756F0EF2D7D648CA561A4697E8839E53C3D80CE33B92 |
|
CONTENT
ssdeep
|
768:8ho3Ol+ML+Ii8HbmStTr+TB9mH1Ceh4OPE3i:F4+IdJTr+1UH1CG4OPb |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
920ced32d62c69f6 |
|
VISUAL
aHash
|
0000003c2404ffff |
|
VISUAL
dHash
|
de72f1e84cdcac23 |
|
VISUAL
wHash
|
0000083e2e7effff |
|
VISUAL
colorHash
|
06e00000000 |
|
VISUAL
cropResistant
|
ac6864c1c9d1c6e6,eeccf6f87cf66fff,9088aaf0b8b00080,bdf26a6531f3c993,880151202a0b2324,ce32f1f9e86c4cdc |
• Threat: Phishing
• Target: Users interested in Stocks, Commodities, and Forex education
• Method: Data harvesting through a registration form.
• Exfil: Unknown
• Indicators: Domain name, form, disclaimer.
• Risk: High
The site uses a form to collect personal information (name, email, phone) to use for phishing campaigns
Pages with identical visual appearance (based on perceptual hash)