Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T11B73A5704246461AE697E1C0FE329F4A93858345C2074D6CB7F36927FE8ED74ED3A6A0 |
|
CONTENT
ssdeep
|
1536:x4ccsK4usrGbSntyVAwIUL2rdgh6XEiReeekeee8eeeQeeefeeeZeeepeeefeeeG:TUv/i |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
db95dae2a1c8cca2 |
|
VISUAL
aHash
|
ff001808091800fd |
|
VISUAL
dHash
|
793830535ba33919 |
|
VISUAL
wHash
|
ff08183969d880ff |
|
VISUAL
colorHash
|
00038000000 |
|
VISUAL
cropResistant
|
2041696161490078,8080c02b29a08080,3939393939399201,3838305b5ba3b939 |
• Amenaza: Phishing
• Objetivo: Credenciales financieras
• Método: Portal bancario falso
• Exfil: POST mediante JavaScript
• Indicadores: Dominio reciente, código ofuscado
• Riesgo: Crítico
Uses a fraudulent banking portal to trick users into entering credentials.
Uses 'anchor-trustbnk' to mimic a legitimate financial entity.