Phishing Analysis
Detailed analysis of captured phishing page
Visual Capture
Detection Info
Content Hashes (HTML Similarity)
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T1E4410E7140047C3F5583A3D8DB71A78AF3DAC202CE67160262FDE30D0ED6D46CCA9A98 |
|
CONTENT
ssdeep
|
48:tGkvGcC97INc9JcBfosio88anYBqOBs4adBadxf2:tBGb9sNgJcfG7d++dwdxf2 |
Visual Hashes (Screenshot Similarity)
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
b3e2cc1d76e21919 |
|
VISUAL
aHash
|
ffffffe70000ffff |
|
VISUAL
dHash
|
94294c0d08180008 |
|
VISUAL
wHash
|
70e6e4e40000ffff |
|
VISUAL
colorHash
|
070000001c0 |
|
VISUAL
cropResistant
|
8c102848304d4d30,0000000000000000,00100c32b2b20c20,08831a1a1a180800 |
Code Analysis
🔬 Threat Analysis Report
• Threat: Credential Phishing
• Target: DKB Bank customers
• Method: Impersonation and credential harvesting
• Exfil: ./Asstes/php/config/func.php
• Indicators: Domain mismatch, obfuscation, form actions.
• Risk: Critical
🔐 Credential Harvesting Forms
🔒 Obfuscation Detected
- fromCharCode
📤 Form Action Targets
- ./Asstes/php/config/func.php
📊 Risk Score Breakdown
Contributing Factors
🔬 Comprehensive Threat Analysis
⚠️ Indicators of Compromise
- Kit types: Credential Harvester
- 2 obfuscation techniques
🏢 Brand Impersonation Analysis
⚔️ Attack Methodology
Primary Method: Credential Harvesting
The attacker is using a phishing site to trick users into entering their DKB login credentials, which are then harvested and can be used to access their accounts. The form submits data to a php script located at a suspicious path.
Secondary Method: Impersonation
The phishing site is designed to look like the legitimate DKB login page, including the use of DKB's logo and branding, to increase the likelihood of users entering their credentials.
🌐 Infrastructure Indicators of Compromise
Domain Information
🤖 AI-Extracted Threat Intelligence
Similar Websites
Pages with identical visual appearance (based on perceptual hash)
Scan History for biancacastrogomes1769819760631.2292159.meusitehostgator.com.br
Found 3 other scans for this domain
