Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T1B9441AF4935853F096874BD4F9715A0633A610EEFB924688C3B48AE0FBE2ED9D435C61 |
|
CONTENT
ssdeep
|
3072:MgDhHTa7jDw/4Q1pSBn1pSBy1pSB61pSBo1pSBafoi2cluAkYc1DI:NhW7jDw/47g7/to |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
ce6131ce8e2dcf30 |
|
VISUAL
aHash
|
00003c3c3c3c0000 |
|
VISUAL
dHash
|
aadce86969697904 |
|
VISUAL
wHash
|
007e7e7f7fbc0400 |
|
VISUAL
colorHash
|
39001000c00 |
|
VISUAL
cropResistant
|
8e8999e686a68799,aadce86969697904 |
• Ameaça: Phishing
• Alvo: Usuários do bet365
• Método: Falsificação de domínio e engenharia social.
• Exfil: Provavelmente via WebSocket ou outros mecanismos de JS para roubar credenciais ou outros dados pessoais.
• Indicadores: Incompatibilidade de domínio, JavaScript ofuscado, idade recente do domínio.
• Risco: ALTO
The attackers are using a domain that looks similar to the legitimate bet365 website in an attempt to trick users into believing they are on the official site.
The site uses tactics like special offers and urgent messages (like the one about bank card risk) to encourage users to interact and potentially enter personal information.
Pages with identical visual appearance (based on perceptual hash)