Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T15041642040684C27E44795DCA3F4A34A32418685CB131F04A7F48BAFBAEFE54CE902C8 |
|
CONTENT
ssdeep
|
48:T8DChNaz24vp4K7pZMr9nIHFO/N70tlWtoAV2:T8uhNazht776mC2 |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
9999666699996666 |
|
VISUAL
aHash
|
0000181818180000 |
|
VISUAL
dHash
|
304cb2b2b2320c20 |
|
VISUAL
wHash
|
ff009999999900ff |
|
VISUAL
colorHash
|
070000001c0 |
|
VISUAL
cropResistant
|
8a88d2cac033339a,304cb2b2b2320c20 |
• Amenaza: Intento de phishing
• Objetivo: No especificado
• Método: Suplantación de identidad a través de un formulario de inicio de sesión.
• Exfil: Es probable que los datos se envíen a un bot de Telegram (8308741389:AAGU2vnidFSlDKqGP1ijGyWte13nYPXP9_A).
• Indicadores: Coincidencia de dominio, ofuscación de Javascript, envío de formulario.
• Riesgo: Alto
The attacker is using a fake login form to collect usernames and passwords.
Stolen credentials are likely sent to a Telegram bot for unauthorized access.
| ID | Portuguese | English | Trigger |
|---|---|---|---|
Pages with identical visual appearance (based on perceptual hash)