Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T1CBA210649A95A83709A7C5D1A1F6AF0E33D7032EE7334E0142FE879E4FC5C81E866578 |
|
CONTENT
ssdeep
|
384:Z6yJCYEDipEk4VmEDiL9cQ1YysEYEDsJsEcEDsJsEknufqxWufq2NdWp0WxrWGDm:Zl4lRGJo/o8IqdWp0WRWkm |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
e3331c4ccccce363 |
|
VISUAL
aHash
|
0007e4fbfbffff00 |
|
VISUAL
dHash
|
743c480080888000 |
|
VISUAL
wHash
|
0007e0f8f8ffff00 |
|
VISUAL
colorHash
|
07000010003 |
|
VISUAL
cropResistant
|
f43c080082888000,3434b03474744448,6398889ac0ca7901 |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Malicious code is obfuscated using 4 techniques to evade detection by security scanners and make reverse engineering more difficult.
Pages with identical visual appearance (based on perceptual hash)
Found 1 other scan for this domain