Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T1CB453A0832523611C1A79097D93F2585A239D04B940A84D8BF3C8BF71FA9F99D67BF36 |
|
CONTENT
ssdeep
|
12288:NMZVQXN6JNVAXd/jTsBHR92jOTFYs60g2vH9Q/SjQsKF20hNm15A:06deVAXdHsH92jOTF/6WH9ySL5A |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
8e86a3b1f1e1ac8e |
|
VISUAL
aHash
|
ff1410383c102020 |
|
VISUAL
dHash
|
4c6d657071704840 |
|
VISUAL
wHash
|
ff04103f3e382020 |
|
VISUAL
colorHash
|
0f000000e00 |
|
VISUAL
cropResistant
|
4c6d657071704840 |
• Ameaça: Ataque de phishing para roubo de credenciais
• Alvo: Usuários do Bet365
• Método: Página de login falsa para roubar nomes de usuário e senhas
• Exfil: Dados enviados para /login_action
• Indicators: Domínio incompatível, formulário de login falso, Javascript ofuscado (eval, fromCharCode, unescape)
• Risco: CRÍTICO - Roubo de credenciais em tempo real
Pages with identical visual appearance (based on perceptual hash)