Detailed analysis of captured phishing page
No screenshot available
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T16E2132A7D189A019B6438960B773B7A6B3010E8082466D7576E071F3F9CC8788BB639C |
|
CONTENT
ssdeep
|
24:B5bNAspFRhvnZ7IMo/22523dxGj6gHxBMIMX6h0gBMim7:7RpFDnhIMu23rc/ZG7 |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
b33333333326cccc |
|
VISUAL
aHash
|
e7e7f7e7e7ffffff |
|
VISUAL
dHash
|
4a4c0c0c0c000000 |
|
VISUAL
wHash
|
04000000c3ffffff |
|
VISUAL
colorHash
|
07001010180 |
|
VISUAL
cropResistant
|
4a4c0c0c0c000000 |
The OTP Stealer kit captures one-time passwords (OTPs) in real-time by intercepting input fields or API calls. This allows attackers to bypass multi-factor authentication (MFA) and gain unauthorized access to victim accounts.
The Card Stealer kit harvests payment card details (e.g., card number, CVV, expiry date) by mimicking legitimate checkout forms or injecting malicious scripts into compromised pages.
Here's a generic ASCII art attack flow diagram for the described phishing attack:
```
┌──────────────────────────────────────────────────────────┐
│ 1. VICTIM RECEIVES PHISHING LURE │
│ - Fake Banking alert redirects to malicious site │
└────────────────────┬─────────────────────────────────────┘
│
▼
┌──────────────────────────────────────────────────────────┐
│ 2. FAKE LOGIN PAGE DISPLAYED │
│ - Victim enters Banking credentials │
└────────────────────┬─────────────────────────────────────┘
│
▼
┌──────────────────────────────────────────────────────────┐
│ 3. OTP REQUEST TRIGGERED │
│ - Attacker initiates real OTP to victim's device │
└────────────────────┬─────────────────────────────────────┘
│
▼
┌──────────────────────────────────────────────────────────┐
│ 4. OTP INTERCEPTION │
│ - Victim enters OTP on fake page │
│ - OTP captured by attacker │
└────────────────────┬─────────────────────────────────────┘
│
▼
┌──────────────────────────────────────────────────────────┐
│ 5. DATA EXFILTRATION │
│ - Credentials and OTP sent via HTTP POST │
└──────────────────────────────────────────────────────────┘
```
Here's a generic ASCII art attack flow diagram for the described phishing attack:
```
┌──────────────────────────────────────────────────────────┐
│ 1. VICTIM RECEIVES PHISHING LURE │
│ - Fake Banking alert redirects to malicious site │
└────────────────────┬─────────────────────────────────────┘
│
▼
┌──────────────────────────────────────────────────────────┐
│ 2. FAKE LOGIN PAGE DISPLAYED │
│ - Victim enters Banking credentials │
└────────────────────┬─────────────────────────────────────┘
│
▼
┌──────────────────────────────────────────────────────────┐
│ 3. OTP REQUEST TRIGGERED │
│ - Attacker initiates real OTP to victim's device │
└────────────────────┬─────────────────────────────────────┘
│
▼
┌──────────────────────────────────────────────────────────┐
│ 4. OTP INTERCEPTION │
│ - Victim enters OTP on fake page │
│ - OTP captured by attacker │
└────────────────────┬─────────────────────────────────────┘
│
▼
┌──────────────────────────────────────────────────────────┐
│ 5. DATA EXFILTRATION │
│ - Credentials and OTP sent via HTTP POST │
└──────────────────────────────────────────────────────────┘
```
Pages with identical visual appearance (based on perceptual hash)
Found 3 other scans for this domain