Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T14441F0F2C289A63762528AC6FF70B739F5D3018EF9411652C6F112FD03C9EB9D442A5A |
|
CONTENT
ssdeep
|
48:CpWxqnmsQ2HwvlFx6zk07m7roj7ao77ro6:9sAvlj6o7cnd/c6 |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
cfb333c73031c698 |
|
VISUAL
aHash
|
ef3c3c003c7c3000 |
|
VISUAL
dHash
|
4969792af165600a |
|
VISUAL
wHash
|
ff3c3c307c7c3c00 |
|
VISUAL
colorHash
|
00000000e00 |
|
VISUAL
cropResistant
|
3232b232b6323232,9c7c424c7e480c1e,4969792af165600a |
• Amenaza: Suplantación de identidad
• Objetivo: Usuarios de Bet365
• Método: Redireccionamiento a un dominio potencialmente malicioso.
• Exfil: Desconocido
• Indicadores: Coincidencia de dominio, táctica de urgencia, advertencia sobre dominio expirado.
• Riesgo: Alto
The attacker creates a look-alike website using the Bet365 logo and layout. The main purpose is to steal user credentials or redirect to a malicious site.
The attacker uses a similar domain name to trick the user into thinking this is legitimate.
Pages with identical visual appearance (based on perceptual hash)