Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T140432AF93D44B5561BA291D3B0AF365BB33A146F250C59B06060DEE970F84D9502BF8F |
|
CONTENT
ssdeep
|
768:byWuU/s1yPWulxS/u8n+892rtfqBXZz6jFLQiP8CHU+dcAX8U00uRe5VL5SxHyOe:EwgyOloQzZs8oWQbp |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
9f5ad0c252721e1f |
|
VISUAL
aHash
|
fcbf0f071f3fef8f |
|
VISUAL
dHash
|
cc307c0d78701a1a |
|
VISUAL
wHash
|
7c030707073f8f8f |
|
VISUAL
colorHash
|
07000000e00 |
|
VISUAL
cropResistant
|
cc307c0d78701a1a,45453b98c42b5145 |
• Threat: Credential harvesting phishing kit
• Target: Trezor users internationally
• Method: Fake download page for Trezor Suite app
• Exfil: Data sent via obfuscated JavaScript
• Indicators: Free hosting, obfuscated JS, mismatched URL
• Risk: HIGH - Potential for malware distribution
Pages with identical visual appearance (based on perceptual hash)