Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T17E9234708300586F1AC2FAC5DBE2BE1B4171C9E7E60E1ECDA1A85E0D4FC6B61C9D6395 |
|
CONTENT
ssdeep
|
192:/OE4pT70b/IJJyGlFEOxgR7VicJtZEHoqTn57VOxICNmUs6m+J2JBn0L0uZzJGT1:mA/8DlqI8sn0L0utRSeLM |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
ee6a1115676b4b4c |
|
VISUAL
aHash
|
00fff1e1f3ffffff |
|
VISUAL
dHash
|
6827c5c7666825c4 |
|
VISUAL
wHash
|
0091f1e1b1bf9f70 |
|
VISUAL
colorHash
|
07400000180 |
|
VISUAL
cropResistant
|
6a25c1c7666825c4,0000000000000000,070f397c753f7bce,6383990c0f0be933 |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Malicious code is obfuscated using 2 techniques to evade detection by security scanners and make reverse engineering more difficult.
Pages with identical visual appearance (based on perceptual hash)
Found 4 other scans for this domain