Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T1197143346461213713170EE8B5E57F0B286BC30ECA4354546ABC97D11BF7EE9FC16264 |
|
CONTENT
ssdeep
|
96:nXNweMfV+ke4Nb86lS4I0sbM+6s3NzkWqGM:XmewNnlSu8v7KWw |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
9fc864b662d909e6 |
|
VISUAL
aHash
|
bd18181d271fff00 |
|
VISUAL
dHash
|
7161713369727d73 |
|
VISUAL
wHash
|
bd39191d071fbf00 |
|
VISUAL
colorHash
|
070000001c0 |
|
VISUAL
cropResistant
|
716171336d737c39,3130323333363454 |
• Threat: Credential harvesting phishing kit
• Target: Microsoft users
• Method: Fake login form stealing email and password
• Exfil: Data sent to /landingpages/080e5b5e-8043-420a-ae8c-4a05b5e618d6/62ogiqkkozl-jg80ck1symzzhzarbbsldpchugedoeu
• Indicators: Domain mismatch, Javascript form submission, form action points to suspicious URL
• Risk: HIGH - Immediate credential theft
Pages with identical visual appearance (based on perceptual hash)
Found 10 other scans for this domain