Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T1A8E17431B00C5D3F518643D8A371773A738781CADD4A0614A7F4CB2E9BA7ED9DD6A8A0 |
|
CONTENT
ssdeep
|
96:aQx3C3y2kaym5cQXiUbOYJI2Et0xjvphcEPgNVZqvp2hDJq1O+TwT:Rx3QHkay0nSDYG2txjBhD2qB2hQnwT |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
b9381e46636b1e1e |
|
VISUAL
aHash
|
00df8fc1efffffff |
|
VISUAL
dHash
|
8636391b0b040800 |
|
VISUAL
wHash
|
008181c1c3e7fffe |
|
VISUAL
colorHash
|
07000038000 |
|
VISUAL
cropResistant
|
863e1b0b1f040800,0094814656568114 |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
JavaScript intercepts form submissions before they reach the fake backend. This allows real-time credential harvesting and validation without server round-trips.