Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T1F521671240981D3F550350EA8610F10CE29BC26F9F470B05B6F4161D97E7E86C46139B |
|
CONTENT
ssdeep
|
24:hLo2KndbKxQQQexNRHCwOjjHLTdbk+/H4LSc1G07ic0Z3kF+/xKD+/5:xKnZKG6TRALThkwYLT1z7iZUFwxKDw5 |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
9999666666669999 |
|
VISUAL
aHash
|
0018181818000000 |
|
VISUAL
dHash
|
00b2b2b230300000 |
|
VISUAL
wHash
|
3c3c3c3c18000000 |
|
VISUAL
colorHash
|
38400038000 |
|
VISUAL
cropResistant
|
80a262b22b3333c8,00b2b2b230300000 |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
JavaScript intercepts form submissions before they reach the fake backend. This allows real-time credential harvesting and validation without server round-trips.
Pages with identical visual appearance (based on perceptual hash)