Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T14C7144306050216743570DD979F97B0E39ABC30EDA8314642A9C93991BF3FF4DD19259 |
|
CONTENT
ssdeep
|
96:nqZeo444hBqJke4Nbt6lS4I0sjM+36ucKGM:KeFNYlSuyvkQ |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
99b3e7c94c662233 |
|
VISUAL
aHash
|
ffff3e1818181800 |
|
VISUAL
dHash
|
f8f8f8b0b2b2b28a |
|
VISUAL
wHash
|
ffff7f1c18181800 |
|
VISUAL
colorHash
|
13c00008000 |
|
VISUAL
cropResistant
|
e0e0f0f0f0f0f070,a2e0faa0333380a2,f8f8f8b0b2b2b28a |
• Threat: Credential harvesting phishing
• Target: Microsoft users
• Method: Fake login form stealing email and password
• Exfil: Form data is submitted to /landingpages/99897ef0-5700-48f4-9c83-b686955ea6bc/ib0iuixfi4xtahuqdsqgc1btkdjfeoe-xqxnf9ei4aa
• Indicators: Domain mismatch (www.webfun.website instead of microsoft.com), JavaScript form submission
• Risk: HIGH - Immediate credential theft
Pages with identical visual appearance (based on perceptual hash)
Found 10 other scans for this domain