Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T1B72286F7E1041069074B5669E2333DE6C483A38ECDCB184750A5C2AEB6D7ABDB16731B |
|
CONTENT
ssdeep
|
96:TQ1I1qTc+mATA5DgBz7pRLmqTIOVX3VJXJaPGLxA6+fvC6+fvReD7I:k6ET1T04nrfHbAv/I |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
95151d1d1d0d2daf |
|
VISUAL
aHash
|
0000ffffffffffff |
|
VISUAL
dHash
|
b2a80ca80c100000 |
|
VISUAL
wHash
|
00000000c0d0f0f0 |
|
VISUAL
colorHash
|
06000003c00 |
|
VISUAL
cropResistant
|
b2a80ca80c100000,1337b5b4b6666667,41219189452391c9,1884448810202040 |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
Malicious code is obfuscated using 253 techniques to evade detection by security scanners and make reverse engineering more difficult.
Found 10 other scans for this domain