Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T10071AC709199EA3381A391E5AB724B2E32D08285DB5327140BF8D3DD5FEBEA8CE16044 |
|
CONTENT
ssdeep
|
48:nMyR/IDfkUGP8AvjLIusPY5cx5PDbW/ISpg/NNqqCU+LHV5pSWDVnNPCw32veV:nWzT3A7MusAexhDbWASpg14UQVlPFaeV |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
ccdc2e77a07322a3 |
|
VISUAL
aHash
|
001800ffff000000 |
|
VISUAL
dHash
|
54303396aa018201 |
|
VISUAL
wHash
|
809c1cffff420101 |
|
VISUAL
colorHash
|
38000038000 |
|
VISUAL
cropResistant
|
0010080c0c081000,54303396aa018201 |
• Threat: Bybit AML Check Phishing
• Target: Bybit users worldwide
• Method: Lures users with a fake AML check to steal credentials or personal information.
• Exfil: The site likely exfiltrates data via JavaScript form submission to an unknown destination.
• Indicators: New domain, domain doesn't match official site, generic TLD, form submission detected.
• Risk: HIGH - Potential credential or personal information theft.
Pages with identical visual appearance (based on perceptual hash)