Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T1B9441AF4935853F096874BD4F9715A0633A610EEFB924688C3B48AE0FBE2ED9D435C61 |
|
CONTENT
ssdeep
|
3072:MgDhHTa7jDw/4Q1pSBn1pSBy1pSB61pSBo1pSBafoi2cluAkYc1DI:NhW7jDw/47g7/to |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
ce6131ce8e2dcf30 |
|
VISUAL
aHash
|
00003c3c3c3c0000 |
|
VISUAL
dHash
|
aadce86969697904 |
|
VISUAL
wHash
|
007e7e7f7fbc0400 |
|
VISUAL
colorHash
|
39001000c00 |
|
VISUAL
cropResistant
|
8e8999e686a68799,aadce86969697904 |
• Amenaza: Phishing
• Objetivo: Usuarios de bet365
• Método: Suplantación de dominio e ingeniería social.
• Exfil: Probablemente a través de WebSocket u otros mecanismos de JS para robar credenciales u otros datos personales.
• Indicadores: Coincidencia de dominio, JavaScript ofuscado, antigüedad de dominio reciente.
• Riesgo: ALTO
The attackers are using a domain that looks similar to the legitimate bet365 website in an attempt to trick users into believing they are on the official site.
The site uses tactics like special offers and urgent messages (like the one about bank card risk) to encourage users to interact and potentially enter personal information.
Pages with identical visual appearance (based on perceptual hash)