Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T1429132D051E85E23405366E0BFE1AB1A23E5C1E2D8421648C7F493AD5FEFC40ED975A5 |
|
CONTENT
ssdeep
|
48:T6CKBLI/b1I1dtbn4vCcjYAlTn5CrxVRHswU5OjK4OD5gMMMMM0cYNXElSQAwTZJ:T6fQb6n4acjYAl5ClUHX5zuXElSQ2dJ8 |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
9999666699999999 |
|
VISUAL
aHash
|
0000181818180000 |
|
VISUAL
dHash
|
200cb2b2b2b20c10 |
|
VISUAL
wHash
|
03033b3b1f1f0f0f |
|
VISUAL
colorHash
|
07000038000 |
|
VISUAL
cropResistant
|
8e808e8e8696a2a2,200cb2b2b2b20c10 |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
JavaScript intercepts form submissions before they reach the fake backend. This allows real-time credential harvesting and validation without server round-trips.
| ID | Portuguese | English | Trigger |
|---|---|---|---|
Pages with identical visual appearance (based on perceptual hash)
Found 10 other scans for this domain