Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T1B9441AF4935853F096874BD4F9715A0633A610EEFB924688C3B48AE0FBE2ED9D435C61 |
|
CONTENT
ssdeep
|
3072:MgDhHTa7jDw/4Q1pSBn1pSBy1pSB61pSBo1pSBafoi2cluAkYc1DI:NhW7jDw/47g7/to |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
ce6131ce8e2dcf30 |
|
VISUAL
aHash
|
00003c3c3c3c0000 |
|
VISUAL
dHash
|
aadce86969697904 |
|
VISUAL
wHash
|
007e7e7f7fbc0400 |
|
VISUAL
colorHash
|
39001000c00 |
|
VISUAL
cropResistant
|
8e8999e686a68799,aadce86969697904 |
• Threat: Phishing
• Target: bet365 users
• Method: Domain spoofing and social engineering.
• Exfil: Likely via WebSocket or other JS mechanisms to steal credentials or other personal data.
• Indicators: Domain mismatch, obfuscated JavaScript, recent domain age.
• Risk: HIGH
The attackers are using a domain that looks similar to the legitimate bet365 website in an attempt to trick users into believing they are on the official site.
The site uses tactics like special offers and urgent messages (like the one about bank card risk) to encourage users to interact and potentially enter personal information.
Pages with identical visual appearance (based on perceptual hash)