Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T186A37A33411935274437C6D130A55B3BE2E69E5FFA970A010EECD7EA1BFACA0B45B11A |
|
CONTENT
ssdeep
|
768:YPmebUXLz4NP3+mZY9svblTOCVr0vSYQfr2a81uGqhPiiSL:RLz4NP/y9svbliCdvos8 |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
d361e9361d6992c5 |
|
VISUAL
aHash
|
006470202e0e797e |
|
VISUAL
dHash
|
98ccc4caecccc3d4 |
|
VISUAL
wHash
|
006470382e0effff |
|
VISUAL
colorHash
|
38000038000 |
|
VISUAL
cropResistant
|
04324c4c4c4c2008,98ccc4caecccc3d4 |
• Amenaza: Fraude financiero / Phishing
• Objetivo: Plataforma EuroQuantum
• Método: Suplantación con formulario de captura de datos
• Exfil: Endpoint /api/lead
• Indicadores: JS ofuscado, formulario de registro sospechoso
• Riesgo: Alto (robo de datos/estafa)
The site gathers names, emails, and phone numbers to supply criminal networks with targets for investment scams.
Uses obfuscation to evade static security scanning of API calls.