Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T1C1A2FE70D18031BB819741D89F31ABAB7391C16ECB1F6D446AF9C315CF9BD08A8A0E57 |
|
CONTENT
ssdeep
|
192:+v5k6iS169YnjarUvtFkRDcNLHbF4GUUB8WBmsa6e32M69HCsjarUvtFkRDcNLHf:+v66ik6Wn2SL7Ad32M6dCs2SL7Ad34 |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
92926d6969646d6d |
|
VISUAL
aHash
|
000e6e0e04000000 |
|
VISUAL
dHash
|
99ccec8c29020800 |
|
VISUAL
wHash
|
6e7e7e7e0c000000 |
|
VISUAL
colorHash
|
38e00000008 |
|
VISUAL
cropResistant
|
a4245306e4e254c1,99ccec8c29020800 |
• Amenaza: Phishing
• Objetivo: Usuarios de criptomonedas
• Método: Suplantación de identidad y contenido malicioso.
• Exfil: Potencialmente robo de detalles de billetera, claves privadas o credenciales.
• Indicadores: Alojamiento gratuito, javascript ofuscado, contenido relacionado con cripto.
• Riesgo: Alto
The attacker likely tries to lure users into providing their credentials, private keys, or other sensitive information, using the appearance of a crypto wallet site. The list of wallet issues and other functionalities can be used to trick users into providing their sensitive information. The obfuscated Javascript may also be aimed at stealing credentials or manipulating the wallet.
The obfuscated Javascript may inject malicious code to monitor keystrokes, steal credentials, or modify existing wallet extensions on the victim's device.
cdn.tailwindcss.comPages with identical visual appearance (based on perceptual hash)