Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T17423F83119E46B2716D342C1A360E65FE3D5B144F27AC79AF2DAC31B26C1E44C87EB68 |
|
CONTENT
ssdeep
|
768:oWZdBKq8kftlPBvbNs74L7BiMVd8Eh9OjrwKHOArfo70bba0+5h5NdCLKNeouKSh:oWXBKq8UPBTNsMBbX8EhIwOOArfc0bbb |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
946bb494ebb086f8 |
|
VISUAL
aHash
|
ff000000067e1e76 |
|
VISUAL
dHash
|
71f0ccd0dcccfccc |
|
VISUAL
wHash
|
ff180000667e7e7e |
|
VISUAL
colorHash
|
01000000030 |
|
VISUAL
cropResistant
|
0001816363890006,8494c0f4b0881e5a,a62466a424327236,31f0ccf0ccecbccc |
• Ameaça: Phishing
• Alvo: Investidores em Criptomoedas
• Método: Suplantação e envio de formulários
• Exfil: JavaScript com ofuscação, provavelmente exfiltrando credenciais do usuário
• Indicadores: JavaScript ofuscado, envio de formulário, falta de correspondência da marca.
• Risco: Alto
The site uses a form to collect user's information. The Javascript is obfuscated indicating a possible malicious use.
Pages with identical visual appearance (based on perceptual hash)