Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T1F2023AE0C876C673149771F4D3751FD63EC08342C6525E0493F49B99BEAAD89DE22A38 |
|
CONTENT
ssdeep
|
96:n2JO+oUAGc16263QXz5OGUI9y/0puLdoX6z5OGOKm:6P7A0I9y/0puLdoiuKm |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
f84f134a13875b4e |
|
VISUAL
aHash
|
00fbf8ffc0c0ffcf |
|
VISUAL
dHash
|
c11702b295959b9d |
|
VISUAL
wHash
|
00d1f0ffc0c0ff4e |
|
VISUAL
colorHash
|
07401010000 |
|
VISUAL
cropResistant
|
808082c2c2c28080,9313629695979b9d,e9c1036397176222,1c3d4cc6799d8523,981f3ba1c5c5b909,070e4c4e0606c667,41694d6c5e5e7e3e |
• Amenaza: Sitio de phishing que suplanta a Amazon
• Objetivo: Usuarios de Amazon en todo el mundo
• Método: Sitio web falso de Amazon alojado en hosting gratuito
• Exfil: No hay formulario visible para la exfiltración de datos
• Indicadores: Hosting gratuito, dominio no coincidente, sin SSL
• Riesgo: ALTO - Potencial de robo de credenciales si hubiera formularios
Pages with identical visual appearance (based on perceptual hash)