Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T14441760050091E37E04320ECB7919156E1F6C344CB667988B6F94EED1BD5CDDDB3BA19 |
|
CONTENT
ssdeep
|
48:rW8cwYwFwSwo170N/iu5vBUSB2WavBGQ7BOhsl/Eo:l9BEvKSav7BOho/Eo |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
b2333333339c9999 |
|
VISUAL
aHash
|
e7e7ffe7ffffffff |
|
VISUAL
dHash
|
4d4d0c0c0c000000 |
|
VISUAL
wHash
|
24242424e4fcfcfc |
|
VISUAL
colorHash
|
07000030040 |
|
VISUAL
cropResistant
|
4d4d0c0c0c000000 |
• Threat: Credential harvesting phishing attack
• Target: Orange Romania customers
• Method: Fake webmail login form to steal email and password
• Exfil: Unknown - likely to a malicious server
• Indicators: Domain mismatch, impersonates Orange brand
• Risk: HIGH - Immediate credential theft
Pages with identical visual appearance (based on perceptual hash)