Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T1E603843611518EBF1193D6F4F365AF7BB388DB44C627AB06E2F893261BC6C41CE61224 |
|
CONTENT
ssdeep
|
384:HXq4W65zs+SEl4hpX5gbK+bKW6I3Ew9LXBucgvX7PCFbYc+4lNr62ct4LcDOqmN:HXqs5gSbK+bKWZJ/cWNhTIOqmN |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
9616e9e93cde9441 |
|
VISUAL
aHash
|
0000040400ffffff |
|
VISUAL
dHash
|
86cceca4a4330333 |
|
VISUAL
wHash
|
0004161450ffffff |
|
VISUAL
colorHash
|
1b202010000 |
|
VISUAL
cropResistant
|
d4d433c880b08080,80a080b434b080a0,8080e030b0808080,a000a8ecaca88080,000823e0f4c81340,0033331b23031333,96ccccececaca483 |
• Threat: Cryptocurrency investment scam phishing kit
• Target: German citizens looking for investment opportunities
• Method: Fake registration form steals name, email, phone number, and potentially payment information
• Exfil: Data is likely sent to a server via a PHP script (validation/thankyou.php)
• Indicators: Newly registered domain, obfuscated JavaScript, promises of high returns, and a form for personal information
• Risk: HIGH - Potential for financial loss and identity theft