Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T1EC43D7718388E77E10C392A8DB3BE75EB3DEA055D562870586FCC76C6E82D91DD220D4 |
|
CONTENT
ssdeep
|
768:G44u44RT2LAaOCFpLQ7yPYjJVcedXVjFHYIKxB3:G44u44eAvSUOGSqT4tJ |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
bc71c369b632c961 |
|
VISUAL
aHash
|
ffdf81818181ffff |
|
VISUAL
dHash
|
963a332d17333bf4 |
|
VISUAL
wHash
|
ef83818181819fff |
|
VISUAL
colorHash
|
00000e00000 |
|
VISUAL
cropResistant
|
963a332d17333bf4,80e4acb8f0f830b8,f0f2c6d696d6f0f0 |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
JavaScript intercepts form submissions before they reach the fake backend. This allows real-time credential harvesting and validation without server round-trips.