Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T1C14373529169963B21724BE9F76BAB96FF428086CCD3404FE1E9D35C1BE2CB1FC19214 |
|
CONTENT
ssdeep
|
1536:U2j0NgomuZeYxGv2IXr96y9g6+SjDxn6xDVc1qL:Uiqr96fDxGDVjL |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
de5e6961615c7492 |
|
VISUAL
aHash
|
80809c9cffffffff |
|
VISUAL
dHash
|
333c3c341c1c203c |
|
VISUAL
wHash
|
80808c9ceeeefee2 |
|
VISUAL
colorHash
|
070020001c0 |
|
VISUAL
cropResistant
|
333c3c341c1c203c |
• Ameaça: Falsificação de identidade e coleta de credenciais
• Alvo: Usuários do MetaMask
• Método: Blog hospedado no blogspot.com com conteúdo não relacionado ao MetaMask, provavelmente redirecionando para um site de phishing ou coletando informações.
• Exfil: Potencialmente através da busca do blogspot ou outros formulários.
• Indicadores: Domínio, conteúdo incompatível, ofuscação, ações do formulário.
• Risco: ALTO
The site uses a MetaMask related domain and impersonates a support site but talks about Robinhood issues to trick users into providing sensitive data, such as private keys, which can be stolen.
The site uses a free blogspot domain to host the content, a common tactic for phishing because it offers a degree of perceived trust.
Pages with identical visual appearance (based on perceptual hash)