Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T12152C52051548C37918759D7E2F0BF0BA3E1C349CA465A49BBF6C3881DF7C94DE5C2AA |
|
CONTENT
ssdeep
|
192:sClSTLjaExG/HJHJvLqhELFp9S+IcDTxaZgHj8O8se9wBl2IGwGpwMjM:SjaEwHJvLqhEFpMo/HhBl9G7pTo |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
cdc24a3cb783b4b2 |
|
VISUAL
aHash
|
f8f8f8fefef8f8f8 |
|
VISUAL
dHash
|
1111312636321312 |
|
VISUAL
wHash
|
f8f0f0f0f0d0f0f0 |
|
VISUAL
colorHash
|
07206000000 |
|
VISUAL
cropResistant
|
1111312636321312,a41b92adadd38098,e1e5a596aaeeb831 |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Victim is prompted for 2FA code after entering credentials. The code is intercepted and used by attacker to access victim's account in real-time.
Pages with identical visual appearance (based on perceptual hash)