Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T16C831AF55398A7F6428383D5A731174A73E6B0A9FE538B50C3E8C6DA5E52CE4CC2B484 |
|
CONTENT
ssdeep
|
768:zzlXM7Xjx5Vh8v/cyO1pyjcNRG1envzmaxoEEETJaF+w3DW5+tJvzmaxnEEEpJyO:ZI1b1max9QXzWYTmaxsmg |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
e849b595cdcdb148 |
|
VISUAL
aHash
|
fff880d0d8ffffff |
|
VISUAL
dHash
|
6a113333332623cc |
|
VISUAL
wHash
|
fbc0808090ffd3e7 |
|
VISUAL
colorHash
|
0e0000003c0 |
|
VISUAL
cropResistant
|
6a113333332623cc,070f49c5d4350932 |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Victim is prompted for 2FA code after entering credentials. The code is intercepted and used by attacker to access victim's account in real-time.
Pages with identical visual appearance (based on perceptual hash)