Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T1F6F2FAB0638890729247CBE8E3355B79B197106ECF234164E6F48BD997C1EFCCDA2685 |
|
CONTENT
ssdeep
|
384:HwSlh0R+lh0I1fNr7JI+Slh0R+lh0t6R2e1vFecABPUTcITxW3dZ9cU:QSZznftNdSZzh4KFec969cU |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
9933329b36999936 |
|
VISUAL
aHash
|
0e18181818181818 |
|
VISUAL
dHash
|
d832323230b2b230 |
|
VISUAL
wHash
|
6e183c3c3c3c3c3c |
|
VISUAL
colorHash
|
30200030000 |
|
VISUAL
cropResistant
|
fcf6dbdad8e6fcf0,ffffffe9e9ffffff,fffffff3f3ffffff,d832323230b2b230 |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Malicious code is obfuscated using 486 techniques to evade detection by security scanners and make reverse engineering more difficult.
Pages with identical visual appearance (based on perceptual hash)
Found 1 other scan for this domain