Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T11D72E831B061283F92DBC2FEF032AA422768E540D2070F75E57D639E19D6D19ED23669 |
|
CONTENT
ssdeep
|
192:5LvOCF4vxUP7v1vb5aOo7yk/sidGsx666661B8r6:hvOCgy7v1ro7yk/7dGsx66666Qr6 |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
9e43638cd99166b3 |
|
VISUAL
aHash
|
390000181f179f07 |
|
VISUAL
dHash
|
7161693331243a7c |
|
VISUAL
wHash
|
bf19091d1f17bf00 |
|
VISUAL
colorHash
|
070000001c1 |
|
VISUAL
cropResistant
|
7161693331243a7c |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Victim is prompted for 2FA code after entering credentials. The code is intercepted and used by attacker to access victim's account in real-time.