Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T17423F83119E46B2716D342C1A360E65FE3D5B144F27AC79AF2DAC31B26C1E44C87EB68 |
|
CONTENT
ssdeep
|
768:oWZdBKq8kftlPBvbNs74L7BiMVd8Eh9OjrwKHOArfo70bba0+5h5NdCLKNeouKSh:oWXBKq8UPBTNsMBbX8EhIwOOArfc0bbb |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
946bb494ebb086f8 |
|
VISUAL
aHash
|
ff000000067e1e76 |
|
VISUAL
dHash
|
71f0ccd0dcccfccc |
|
VISUAL
wHash
|
ff180000667e7e7e |
|
VISUAL
colorHash
|
01000000030 |
|
VISUAL
cropResistant
|
0001816363890006,8494c0f4b0881e5a,a62466a424327236,31f0ccf0ccecbccc |
• Amenaza: Phishing
• Objetivo: Inversores en Criptomonedas
• Método: Suplantación y envío de formularios
• Exfil: JavaScript con ofuscación, probablemente exfiltrando credenciales de usuario
• Indicadores: JavaScript ofuscado, envío de formulario, falta de coincidencia de marca.
• Riesgo: Alto
The site uses a form to collect user's information. The Javascript is obfuscated indicating a possible malicious use.
Pages with identical visual appearance (based on perceptual hash)