Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T130523231910CAD3E5187C3E0EB72333663A4D287EA5B051985FD877C4F96D99EC23698 |
|
CONTENT
ssdeep
|
192:4xTxdMSdOeCy9ROCE0OCO6nbOlO6oJ3COpOy80OltOHvCT:RiHCyDnmbyQxH |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
95946863b7679931 |
|
VISUAL
aHash
|
001e0e7e6e2e001c |
|
VISUAL
dHash
|
e434d4ecdcdae672 |
|
VISUAL
wHash
|
001e0e7f6e7f121e |
|
VISUAL
colorHash
|
302010000c0 |
|
VISUAL
cropResistant
|
10cce271d86c9e9f,e8d4ccece8b0c4f0,e434d4ecdcdae672 |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Victim is prompted for 2FA code after entering credentials. The code is intercepted and used by attacker to access victim's account in real-time.
Pages with identical visual appearance (based on perceptual hash)