Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T167F2D753635432260BD30196766143CFF77E8148B75302A960FEC26C47D7998CB7BAAB |
|
CONTENT
ssdeep
|
768:Ymd44tRzCON+JZwWaxuenR4KE6bV15qw9SbDkQprpeAY9X8D3KHdLd+:r44tIjJZwVnLEyV1obQ4rp5YdQodZ+ |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
edec9293989292ec |
|
VISUAL
aHash
|
fff3f3f3f3000000 |
|
VISUAL
dHash
|
33e7e7e7e7f32069 |
|
VISUAL
wHash
|
fff3f3f3f3000000 |
|
VISUAL
colorHash
|
00e00000000 |
|
VISUAL
cropResistant
|
38e7e7e7e7e7e7e3,404049495a494d09,4c4909a81113cac2,4644d5949488c505,0020303014696969 |
• Threat: Credential harvesting phishing
• Target: Binance users
• Method: Imitation of the Binance login page to steal credentials.
• Exfil: Data is likely sent via Javascript form submission
• Indicators: Domain name with brand name, non-standard .org TLD.
• Risk: HIGH - The site attempts to steal login credentials.