Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T118D3753492441A3D552787E8F691F778509A8389C63F9A2EF3FC13714B89C5AAC336D8 |
|
CONTENT
ssdeep
|
768:VOkZURp7jN96RCYzF80i+lhhXlB2VJN5lWwWREdQDc//kcuExZ/waVxMMi4pmIuA:VOkZUb74dtrl6 |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
9669cd969a3a3934 |
|
VISUAL
aHash
|
3878002c3e3e3e3e |
|
VISUAL
dHash
|
d0c0c0ccc4c4c4c4 |
|
VISUAL
wHash
|
6078202c3e7e7e3e |
|
VISUAL
colorHash
|
38000007000 |
|
VISUAL
cropResistant
|
d0c0c0ccc4c4c4c4 |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Malicious code is obfuscated using 18 techniques to evade detection by security scanners and make reverse engineering more difficult.
Drainer supports multiple blockchain networks and checks for high-value tokens on each chain before executing drain operations.
Pages with identical visual appearance (based on perceptual hash)