Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T13FD10EB29408AD3B53A3C3E9B7F1A34BB792C585C987028A91F6C35D1FD3DA1DC12256 |
|
CONTENT
ssdeep
|
96:DRCNHNnoGyPs44mGjZzmjK4yYeywq0w2mzClPhUbTuGWVBrGobuJczfO:DRCBmFbOQ/pcTBrhW |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
fe7e1e81a1616d84 |
|
VISUAL
aHash
|
809c8080ffffffff |
|
VISUAL
dHash
|
1238200338202024 |
|
VISUAL
wHash
|
80808080f3f3fff7 |
• Threat: Website defacement/brand impersonation
• Target: GMX users
• Method: Displaying GMX branding on a blogspot page
• Exfil: No data exfiltration observed, but potentially could be used for future attacks
• Indicators: Free hosting, domain mismatch
• Risk: MEDIUM - Brand impersonation, potential for future phishing or malware attacks
Pages with identical visual appearance (based on perceptual hash)
Found 2 other scans for this domain