Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T181E27431C980627A009352D59E72E77BB3D46072D7679D0A83F98758CF8BF988C50EB6 |
|
CONTENT
ssdeep
|
384:egOy6W5NBXELiy/Y+nPacLT1GVmL6pZJXj6uzGPWLgpD:HjB7ZELk+Cu/Izr+ |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
92926d6969646d6d |
|
VISUAL
aHash
|
000e6e0e04000000 |
|
VISUAL
dHash
|
99ccec8c29020800 |
|
VISUAL
wHash
|
6f7f7f7f0c000000 |
|
VISUAL
colorHash
|
38e00000008 |
|
VISUAL
cropResistant
|
a4245306e4e254c1,99ccec8c29020800 |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Malicious code is obfuscated using 4 techniques to evade detection by security scanners and make reverse engineering more difficult.
Pages with identical visual appearance (based on perceptual hash)
Found 1 other scan for this domain