Detailed analysis of captured phishing page
No screenshot available
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T143B3DB30C6F65D7BA47C7289EAC8E74151A7C3C3F3866BF6619491EE8A40D05CC43ADA |
|
CONTENT
ssdeep
|
1536:K7ONB8lG0XD48lG0XihUM689wGXsMvkYG:SE8lG0XD48lG0XihUM689wGXsMa |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
bb39ccc6fe11c1c0 |
|
VISUAL
aHash
|
0f0f0f0fffffffbf |
|
VISUAL
dHash
|
3b3bdb3f28412820 |
|
VISUAL
wHash
|
00090901bfbfbf9f |
|
VISUAL
colorHash
|
07e00008000 |
|
VISUAL
cropResistant
|
3b3bdb3f28412820,9e9e9a9999321327,1f93b793232f6b0f,3736333733492b07,49cdcdcdcdcd4943 |
• Threat: Phishing targeting Correos (Spanish postal service) customers.
• Target: Correos customers, especially in Spain, expecting a package delivery.
• Method: The page imitates the Correos website, prompting users to enter their tracking number.
• Exfil: Likely to harvest entered information (tracking numbers, possibly more). The exfiltration point is unknown but the entered data will be stored on a fraudulent server.
• Indicators: The URL domain is not associated with Correos, using a generic server, which raises suspicions.
• Risk: HIGH - The attempt to steal package tracking details can lead to further phishing attacks.
Pages with identical visual appearance (based on perceptual hash)