Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T1A651DF7B8054343703538ECE30ADB71EF6D3A54ED65B1C56A4B98BC94BD0C539D2A84D |
|
CONTENT
ssdeep
|
48:/Vbn9kpIL2vwoty3OZecBrCn9YPvLpKybq9bAYp3/MqgrHIJyhQxsKKJrHIJyQim:tbn9uIL2vdy3OZecgqPg6BqgroJymEJO |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
ad6d3b1212166d6d |
|
VISUAL
aHash
|
00db83ffffffffff |
|
VISUAL
dHash
|
4d32322c68d02829 |
|
VISUAL
wHash
|
008b8387bf7f1f03 |
• Threat: Domain squatting and brand impersonation, potentially for phishing.
• Target: Coinbase users and customers.
• Method: Displaying a landing page that states the domain 'coinbase-finances.com' has expired and needs renewal, potentially leading to fraudulent renewal requests or data harvesting.
• Exfil: Unclear at this stage, but likely to a scammer-controlled server if the user attempts renewal.
• Indicators: Domain name that impersonates Coinbase, a generic 'expired domain' message, and redirect to Hostinger.
• Risk: HIGH - Potential for credential theft and financial fraud if users attempt to renew the domain through the site.
Pages with identical visual appearance (based on perceptual hash)
Found 1 other scan for this domain