Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T1694308728388D67F20C793A89F36EA5AB3DEA054E522471582FDC79C5E83D90DD270D8 |
|
CONTENT
ssdeep
|
768:144w44YfXsgsSsgsCsGsAsLOsvshsLHs4sPgVKiREeOQiA6QXXEAkFHYIKxBx:144w44YIT3OBRJA0x4tX |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
be38c3699636c269 |
|
VISUAL
aHash
|
f783818781819f7e |
|
VISUAL
dHash
|
0433330d372324e4 |
|
VISUAL
wHash
|
ef81818581819fff |
|
VISUAL
colorHash
|
00000e00000 |
|
VISUAL
cropResistant
|
0433330d372324e4,80e4bcb8f0f830b8,2a524404cab43400,00b5331420b0b000,f0f6d6d696d6f0f0,0000808080808080 |
Victim enters username and password into fake login form. Credentials are captured via JavaScript and exfiltrated to attacker's server in real-time.
JavaScript intercepts form submissions before they reach the fake backend. This allows real-time credential harvesting and validation without server round-trips.