Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T1C3223060A26898775193C3E2EAF1EF0F2392D705CB43168467F8D32D0FCAC65EC55669 |
|
CONTENT
ssdeep
|
96:TIS0EiWOasSMUJPm6nMle1Faj8ujWq0Y8Re34S3sQ7evcIJuzW3DfwQPO+Q5iiI:sfiZjPQBnWrli/3s9HdwQPOla |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
ecec6bec189a1a98 |
|
VISUAL
aHash
|
ffe3fffff7f3ff00 |
|
VISUAL
dHash
|
23275414164616cc |
|
VISUAL
wHash
|
db00ffbf3321d300 |
|
VISUAL
colorHash
|
07000038000 |
|
VISUAL
cropResistant
|
23275414164616cc |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Victim is prompted for 2FA code after entering credentials. The code is intercepted and used by attacker to access victim's account in real-time.