Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T1AB43E772C288E77E20C3C3A89B36AE5A739AA0D4E553470597FCC35C5F82D94CD265E8 |
|
CONTENT
ssdeep
|
768:244Q44B2ELcKN4EzEz+6PPjJxQWmXMXFHYIKxBl:244Q44NHopdKJcV4t3 |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
bc39c369b632c961 |
|
VISUAL
aHash
|
ffdf818781819fff |
|
VISUAL
dHash
|
9436332d17333fe4 |
|
VISUAL
wHash
|
e783818581819fff |
|
VISUAL
colorHash
|
06000c00000 |
|
VISUAL
cropResistant
|
9436332d17333fe4,80e4acb8f0f830b8,b0495999d9496994,62660c04a2985840,acadd321006068e0,0024a56232942600,f0f6d69696d6f0f0 |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Malicious code is obfuscated using 2 techniques to evade detection by security scanners and make reverse engineering more difficult.
Pages with identical visual appearance (based on perceptual hash)
Found 1 other scan for this domain