Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T189121030A19FE4F28BA24F79BE55EB6CD1778399C7060E48336C354659D3D406A780AF |
|
CONTENT
ssdeep
|
96:nReE7vruHxpuPZMBVEgq1dc5iCWGyGjcbfv9cwlYH+eZ3Ifl0PwbK:ReE7XZM/Egqk6Giv9QYtYV |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
ed6d6d9292929293 |
|
VISUAL
aHash
|
c3c3c3ffffffffff |
|
VISUAL
dHash
|
1696962912480000 |
|
VISUAL
wHash
|
c3c3c3dfff4e0000 |
|
VISUAL
colorHash
|
07000600010 |
|
VISUAL
cropResistant
|
1696962912480000,202c20a026080020 |
• Threat: Credential harvesting phishing targeting FedEx users.
• Target: FedEx customers attempting to log in.
• Method: Fake FedEx login page on a non-FedEx domain to steal user IDs and passwords.
• Exfil: Form data is submitted via JavaScript to /landingpages/ac5c9c07-fe9d-4dc8-9780-8ff30d1206d7/j1cxrrh7-.
• Indicators: Domain mismatch (internetservicetech.com vs fedex.com), login form, JavaScript form submission.
• Risk: HIGH - Immediate credential theft.
Pages with identical visual appearance (based on perceptual hash)
Found 5 other scans for this domain