Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T150728474A081BA3B41A745C3D762139BB3E64286C6422501E1FCE32C9BD7E49FF1A64F |
|
CONTENT
ssdeep
|
384:C44N2UELbyP+4ywe0DKZquYwakBWoNV8804kNP:C44NabyP+HwebZquskBlNV88PkV |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
8cb537869d9c9433 |
|
VISUAL
aHash
|
1600181818180000 |
|
VISUAL
dHash
|
d421303232303008 |
|
VISUAL
wHash
|
7e3c3c3c3c3c3030 |
|
VISUAL
colorHash
|
38000030000 |
|
VISUAL
cropResistant
|
d421303232303008 |
Fake Delta Executor site positioned to capture victims through SEO tactics, typosquatting, or paid advertising. Serves as entry point for multi-stage attacks including credential theft and malware distribution.
JavaScript intercepts form submissions before they reach the fake backend. This allows real-time credential harvesting and validation without server round-trips.