Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T1C9630131734535AF017B94C0ACB0AF5571C7E3AEC6174150AEBCA2691FD3DA2F9098AE |
|
CONTENT
ssdeep
|
1536:6XWK0lR0143OXtMMok7idqL6HJaN6SC6dGOe3lrLNrLhgLJ5L+7LK:6XSoXtMMobcUhGXsK |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
8153de2df640a55b |
|
VISUAL
aHash
|
00004840033b7fff |
|
VISUAL
dHash
|
d0d0d29a92d6f300 |
|
VISUAL
wHash
|
000848ea0b3bffff |
|
VISUAL
colorHash
|
0fc00000000 |
|
VISUAL
cropResistant
|
f2e890e292a1c1c8,92d6d6d6d3f00014,ec7cc0c286c76638,d6d8d29a9a92d6d3 |
• Threat: Phishing targeting users of a financial trading platform
• Target: Individuals interested in online trading and investments
• Method: Website using a look-alike domain attempting to steal credentials
• Exfil: Data exfiltration suspected via Websocket URLs and form submission to Baidu
• Indicators: Domain name contains brand name with the subdomain 'pc', WebSocket URLs, form actions to Baidu, obfuscated JavaScript
• Risk: HIGH - Potential for credential theft and financial loss
Pages with identical visual appearance (based on perceptual hash)