Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T17193A5B86AD8476A4918C78EC5DB6DEC6089E1CEC804804FF7B57A93C2B8D749C78747 |
|
CONTENT
ssdeep
|
768:mq/fstwtYtxfLtmtctXU1yD2YADVlbqtU2GcLpp2aOdjqcLH:mztwtYtttmtctdKRAtU/v |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
9db693596b21cc26 |
|
VISUAL
aHash
|
0f1f171b19180818 |
|
VISUAL
dHash
|
183c363233b31260 |
|
VISUAL
wHash
|
8f9f9f9b19181838 |
|
VISUAL
colorHash
|
39006000040 |
|
VISUAL
cropResistant
|
8981c168b0b05c4c,2f1753292c2c6ecf,853038092c24b3b3,183c363233b31260 |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
JavaScript intercepts form submissions before they reach the fake backend. This allows real-time credential harvesting and validation without server round-trips.
Pages with identical visual appearance (based on perceptual hash)