Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T16AF1EAA1A95495B7E18187E8F2B1D559724F9165CBB70A08D3ECCF582FE5E80CC43D90 |
|
CONTENT
ssdeep
|
96:2X9S/3TD8sbb17KBdBurpURmHjs0VAylzJj8nfgNbTO2gvrWKeA6VHD4X4Ks:+S8sY91k40VdOnfgNbKFTWKeDHDK4D |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
b838c6ce38cec339 |
|
VISUAL
aHash
|
ffcfcfc3cfcfffff |
|
VISUAL
dHash
|
309c9c969c986210 |
|
VISUAL
wHash
|
dfcecec24f4f0000 |
|
VISUAL
colorHash
|
07007200000 |
|
VISUAL
cropResistant
|
309c9c969c986210,ffff7f9f9fffff69,87a7ad2f2627e647 |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
JavaScript intercepts form submissions before they reach the fake backend. This allows real-time credential harvesting and validation without server round-trips.
Pages with identical visual appearance (based on perceptual hash)