Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T17C139534A3114E72D04383ECA331631B7CE7D236CA03A64552F9939EAFD7D96DDA2588 |
|
CONTENT
ssdeep
|
768:BVDT9C22U01Eac81BVFJc2vZa4Se99ov7lJJcTZgs/r7W3nImz8K9aedBTIhX:BVf9C22U01DDhJcYov7lJJcTZgs/r7WY |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
bc99c7c7892c6938 |
|
VISUAL
aHash
|
fbffc3dbdfe7e7e7 |
|
VISUAL
dHash
|
231c3636344c054c |
|
VISUAL
wHash
|
b9ffc3c3df0000c3 |
|
VISUAL
colorHash
|
07400000180 |
|
VISUAL
cropResistant
|
231c3636344c054c |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Victim is prompted for 2FA code after entering credentials. The code is intercepted and used by attacker to access victim's account in real-time.