Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T153A1F01453443F4F959962B2D3602E94C3E2491EC7324D48B85EE72F2C8814AED7BAFC |
|
CONTENT
ssdeep
|
96:d3ydpvuLgNxCJlglAtyHL5Z1eQyrcb55f1SWfRPE3yDSznNyHJVwc5xyHAPbZz0B:/pQy051ns6P7iD |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
d393333199999999 |
|
VISUAL
aHash
|
4c243c3c00000000 |
|
VISUAL
dHash
|
194c686016000000 |
|
VISUAL
wHash
|
1c243c3cc0d4f0f0 |
|
VISUAL
colorHash
|
07018000600 |
|
VISUAL
cropResistant
|
194c686016000000 |
• Amenaza: Kit de phishing para robo de credenciales
• Objetivo: Usuarios de plala en Japón
• Método: Formulario falso que roba email y contraseña
• Exfil: Datos enviados a script PHP sospechoso
• Indicadores: Dominio no coincidente, dominio reciente, JavaScript ofuscado
• Riesgo: ALTO - Robo inmediato de credenciales
Pages with identical visual appearance (based on perceptual hash)
Found 2 other scans for this domain