Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T16DC1E77155219CB340A3D6E0BAE9F76B71C5C2AACB09560192DCA39D0FFBD82ED210E5 |
|
CONTENT
ssdeep
|
96:gc2ET3hZ4zjHsCTRMB8CT5LibDOBdH2P6vqFhmcHLZQXdntmwD0u8mQ8vrS3eeKN:OM3hZAHlRMB8CVm8aEcHLZQtnDyK5r51 |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
b3734c4c7673584c |
|
VISUAL
aHash
|
00ffffe7e7ffffff |
|
VISUAL
dHash
|
0808324c4c300000 |
|
VISUAL
wHash
|
00ecfce4070f0f0f |
|
VISUAL
colorHash
|
070000001c0 |
|
VISUAL
cropResistant
|
0c28324c0c100000,0000004040400080 |
• Amenaza: Ataque de phishing para robo de credenciales
• Objetivo: Usuarios de Microsoft OneDrive
• Método: Página de inicio de sesión falsa de OneDrive que roba direcciones de correo electrónico
• Exfil: Datos enviados a /personal/genaro_rubio_ruiz_signify_com/_layouts/15/guestaccess.aspx?share=EUQNxH0Mm6JNqZek0PX58poBdThQJdF0uVc_HRDVaWvIGg
• Indicators: Desajuste de dominio, JavaScript ofuscado, envío de formularios, acciones de formularios sospechosas
• Riesgo: ALTO - Robo inmediato de credenciales
Pages with identical visual appearance (based on perceptual hash)
Found 10 other scans for this domain