Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T19C51623180158E53988386E8E6B5970B37868396C74B1B045FF8937D6BD7D4ACE723E8 |
|
CONTENT
ssdeep
|
48:CTw9pchK0Ona/2IDZxkbbi0OnzdudU2g2dMjneIZHSb1pZ:wgTg2C0bOxb2kdEbZ |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
99cc663399cc6699 |
|
VISUAL
aHash
|
0000183c3c241800 |
|
VISUAL
dHash
|
000c3232324c3008 |
|
VISUAL
wHash
|
00001c1c3f273f3f |
|
VISUAL
colorHash
|
070000001c0 |
|
VISUAL
cropResistant
|
000c3232324c3008 |
• Ameaça: Kit de phishing para roubo de credenciais
• Alvo: Usuários da SCA
• Método: Formulário falso de validação de identidade que rouba o email
• Exfil: Dados enviados para bot do Telegram (token: 8595154854:AAGHZrQO6mO5et6cT57ZNIt1d0grzoBb-PU)
• Indicadores: Domínio não coincide, domínio recente, JavaScript ofuscado
• Risco: ALTO - Roubo imediato de credenciais
Pages with identical visual appearance (based on perceptual hash)
Found 1 other scan for this domain