Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T1F141B7713256A52B014387543A70BFC2DA806FEDDE2BD910F2F5904763DAF81EC842AC |
|
CONTENT
ssdeep
|
24:hHClqv4unRSPShPIKkPq4/xehZDs0xWIJwUQpdkVxI3wDH+qBqN6xDXGr4ESz3a4:tv4unRu1xmZI0xGkVi3me/6xDWU5 |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
a6664d19764c1977 |
|
VISUAL
aHash
|
00e7e7e7e7ffffff |
|
VISUAL
dHash
|
0c0c0c4d4d8c0c00 |
|
VISUAL
wHash
|
00e7c7c7e30300ff |
|
VISUAL
colorHash
|
06000038000 |
|
VISUAL
cropResistant
|
0c0c4d4d4d8c0d00,0000003434300000 |
Victim is prompted for 2FA code after entering credentials. The code is intercepted and used by attacker to access victim's account in real-time.
JavaScript intercepts form submissions before they reach the fake backend. This allows real-time credential harvesting and validation without server round-trips.
Pages with identical visual appearance (based on perceptual hash)