Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T19641B7713269A52B014387547A70BFC2DA806FEDDE2BD910F2F5904763DAF81EC846AC |
|
CONTENT
ssdeep
|
24:hHClqv4unRSPShPIKkPq4/xehZDs0xWIJwUQpmikVxI3wDH+qBqN6xDXGr4ESz3L:tv4unRu1xmZI0xPikVi3me/6xDWU5 |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
a6665919764c1977 |
|
VISUAL
aHash
|
00e7e7e7e7ffffff |
|
VISUAL
dHash
|
0c0c0c4d4d8c0c00 |
|
VISUAL
wHash
|
00e7e4e4e70700ff |
|
VISUAL
colorHash
|
06000038000 |
|
VISUAL
cropResistant
|
0c0c4d4d4d8c0d00,0000003434300000 |
Victim is prompted for 2FA code after entering credentials. The code is intercepted and used by attacker to access victim's account in real-time.
JavaScript intercepts form submissions before they reach the fake backend. This allows real-time credential harvesting and validation without server round-trips.
Pages with identical visual appearance (based on perceptual hash)