Phishing Analysis
Detailed analysis of captured phishing page
Captura Visual
Información de Detección
Hashes de Contenido (Similitud HTML)
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T1E4410E7140047C3F5583A3D8DB71A78AF3DAC202CE67160262FDE30D0ED6D46CCA9A98 |
|
CONTENT
ssdeep
|
48:tGkvGcC97INc9JcBfosio88anYBqOBs4adBadxf2:tBGb9sNgJcfG7d++dwdxf2 |
Hashes Visuales (Similitud de Captura)
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
b3e2cc1d76e21919 |
|
VISUAL
aHash
|
ffffffe70000ffff |
|
VISUAL
dHash
|
94294c0d08180008 |
|
VISUAL
wHash
|
70e6e4e40000ffff |
|
VISUAL
colorHash
|
070000001c0 |
|
VISUAL
cropResistant
|
8c102848304d4d30,0000000000000000,00100c32b2b20c20,08831a1a1a180800 |
Análisis de Código
🔬 Threat Analysis Report
• Amenaza: Phishing de credenciales
• Objetivo: Clientes de DKB Bank
• Método: Suplantación de identidad y recopilación de credenciales
• Exfil: ./Asstes/php/config/func.php
• Indicadores: Coincidencia de dominio, ofuscación, acciones de formulario.
• Riesgo: Crítico
🔐 Credential Harvesting Forms
🔒 Obfuscation Detected
- fromCharCode
📤 Form Action Targets
- ./Asstes/php/config/func.php
📊 Desglose de Puntuación de Riesgo
Contributing Factors
🔬 Análisis Integral de Amenazas
⚠️ Indicators of Compromise
- Kit types: Credential Harvester
- 2 obfuscation techniques
🏢 Análisis de Suplantación de Marca
⚔️ Metodología de Ataque
Primary Method: Credential Harvesting
The attacker is using a phishing site to trick users into entering their DKB login credentials, which are then harvested and can be used to access their accounts. The form submits data to a php script located at a suspicious path.
Secondary Method: Impersonation
The phishing site is designed to look like the legitimate DKB login page, including the use of DKB's logo and branding, to increase the likelihood of users entering their credentials.
🌐 Indicadores de Compromiso de Infraestructura
Domain Information
🤖 AI-Extracted Threat Intelligence
Similar Websites
Pages with identical visual appearance (based on perceptual hash)
Scan History for biancacastrogomes1769819760631.2292159.meusitehostgator.com.br
Found 3 other scans for this domain
