Phishing Analysis
Detailed analysis of captured phishing page
Visual Capture
Detection Info
Content Hashes (HTML Similarity)
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T1EBF1CE31E244C91B7251C9A4F6B1BB9A3B459385D70B0B70F6F0A23ABDC9CB04D942ED |
|
CONTENT
ssdeep
|
96:zNo9+uvTBSTST8FKF1fiPhevO9dShcFSTqM8V8+hucyBF+uuuup:zN6rQeQmfiPovO9dt0z8FvyM |
Visual Hashes (Screenshot Similarity)
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
dd88333366669999 |
|
VISUAL
aHash
|
f0f8f8f0f8f0f0f0 |
|
VISUAL
dHash
|
0010302430000000 |
|
VISUAL
wHash
|
e0f8f8f0f8e0f0e0 |
|
VISUAL
colorHash
|
07000000180 |
|
VISUAL
cropResistant
|
0010302430000000 |
Code Analysis
🔬 Threat Analysis Report
• Threat: Credential Phishing
• Target: Microsoft users
• Method: Impersonation via malicious website
• Exfil: Unknown, likely to a server controlled by the attacker.
• Indicators: Domain mismatch, JavaScript Obfuscation, Form Present.
• Risk: HIGH
🔒 Obfuscation Detected
- fromCharCode
- unicode_escape
- base64_strings
📊 Risk Score Breakdown
Contributing Factors
🔬 Comprehensive Threat Analysis
⚠️ Indicators of Compromise
- Kit types: Credential Harvester, Banking
- 14 obfuscation techniques
🏢 Brand Impersonation Analysis
⚔️ Attack Methodology
Primary Method: Credential Harvesting
The attacker aims to steal Microsoft account credentials through a fake login page. The form fields collect the user's email or phone number. When the user enters their information and clicks 'Next', the data is captured, and then possibly forwarded to the real Microsoft sign-in page to maintain appearance.
Secondary Method: JavaScript-Based Theft
Obfuscated JavaScript is likely used to intercept the entered credentials before the form submits.
🌐 Infrastructure Indicators of Compromise
Domain Information
🤖 AI-Extracted Threat Intelligence
Similar Websites
Pages with identical visual appearance (based on perceptual hash)
Scan History for supp0rt.ca
Found 4 other scans for this domain
