Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T16DC1E77155219CB340A3D6E0BAE9F76B71C5C2AACB09560192DCA39D0FFBD82ED210E5 |
|
CONTENT
ssdeep
|
96:gc2ET3hZ4zjHsCTRMB8CT5LibDOBdH2P6vqFhmcHLZQXdntmwD0u8mQ8vrS3eeKN:OM3hZAHlRMB8CVm8aEcHLZQtnDyK5r51 |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
b3734c4c7673584c |
|
VISUAL
aHash
|
00ffffe7e7ffffff |
|
VISUAL
dHash
|
0808324c4c300000 |
|
VISUAL
wHash
|
00ecfce4070f0f0f |
|
VISUAL
colorHash
|
070000001c0 |
|
VISUAL
cropResistant
|
0c28324c0c100000,0000004040400080 |
• Threat: Credential harvesting phishing attack
• Target: Microsoft OneDrive users
• Method: Fake OneDrive login page stealing email addresses
• Exfil: Data sent to /personal/genaro_rubio_ruiz_signify_com/_layouts/15/guestaccess.aspx?share=EUQNxH0Mm6JNqZek0PX58poBdThQJdF0uVc_HRDVaWvIGg
• Indicators: Domain mismatch, obfuscated JavaScript, form submission, suspicious form actions
• Risk: HIGH - Immediate credential theft
Pages with identical visual appearance (based on perceptual hash)
Found 10 other scans for this domain