Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T17E519BB0A085DD3B419B9AC0A6711B4E36D6E38DDB834B039BF953AE3BD2C75CD14088 |
|
CONTENT
ssdeep
|
48:T4OhB/Grv34JcSFhpMffz2Xl8+RyJu5TMQDgm4+kS:TlCrv34JnMC3yJITRkokS |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
9999666666339999 |
|
VISUAL
aHash
|
0018181818181818 |
|
VISUAL
dHash
|
7830b2b2b2b26860 |
|
VISUAL
wHash
|
3c3c3c3c3c3c3c3c |
|
VISUAL
colorHash
|
070000101c0 |
|
VISUAL
cropResistant
|
7830b2b2b2b26860 |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Victim is prompted for 2FA code after entering credentials. The code is intercepted and used by attacker to access victim's account in real-time.
Pages with identical visual appearance (based on perceptual hash)