Detailed analysis of captured phishing page
No screenshot available
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T1D223723071006D7B450FDA8DBC446F4E325BF31AD80B29611EEA67E96FF2D11B60725A |
|
CONTENT
ssdeep
|
768:Mfjl4+68N6w8CCJAwCM4EHlzPByaY8MGJKdPyB5NkpuTvr996joZVEYbUxwAds/8:UT6KO/CIHRC8zw6B5NkpuTvr996joZVs |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
dc536766cc998c64 |
|
VISUAL
aHash
|
e0e0f8f8f8f8f0f0 |
|
VISUAL
dHash
|
0008101030200400 |
|
VISUAL
wHash
|
e0e0f8f8f0f8e0f0 |
|
VISUAL
colorHash
|
07000000180 |
|
VISUAL
cropResistant
|
0008101030200400 |
• Threat: Credential harvesting phishing kit
• Target: Google users
• Method: Fake login form stealing email and password
• Exfil: Data sent to unknown server via './login.php'
• Indicators: Domain mismatch, obfuscated JavaScript, relatively new domain
• Risk: HIGH - Immediate credential theft
Pages with identical visual appearance (based on perceptual hash)