Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T10071AC709199EA3381A391E5AB724B2E32D08285DB5327140BF8D3DD5FEBEA8CE16044 |
|
CONTENT
ssdeep
|
48:nMyR/IDfkUGP8AvjLIusPY5cx5PDbW/ISpg/NNqqCU+LHV5pSWDVnNPCw32veV:nWzT3A7MusAexhDbWASpg14UQVlPFaeV |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
ccdc2e77a07322a3 |
|
VISUAL
aHash
|
001800ffff000000 |
|
VISUAL
dHash
|
54303396aa018201 |
|
VISUAL
wHash
|
809c1cffff420101 |
|
VISUAL
colorHash
|
38000038000 |
|
VISUAL
cropResistant
|
0010080c0c081000,54303396aa018201 |
• Amenaza: Kit de phishing para robo de credenciales
• Objetivo: Usuarios de Bybit internacionalmente
• Método: Formulario falso de verificación AML que roba información sensible
• Exfil: Desconocido, probablemente enviado al servidor del atacante
• Indicadores: Dominio reciente, URL no coincidente, formulario sospechoso
• Riesgo: ALTO - Robo inmediato de credenciales y datos
Pages with identical visual appearance (based on perceptual hash)