Detailed analysis of captured phishing page
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T16103E731B0702D7F024B83D4B2306B9EF193934FC6635296D3F587593BEADA1E8165A8 |
|
CONTENT
ssdeep
|
768:tZhuuyEEMVh8S4iZVXxTVjFPeRcpVhe9WK:HhNyEEMVh8GZVXVeRcpm4K |
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
8951ea16edc539e1 |
|
VISUAL
aHash
|
000000000000ffff |
|
VISUAL
dHash
|
9cc8d2d292d43323 |
|
VISUAL
wHash
|
40604a6a4a0effff |
|
VISUAL
colorHash
|
39006200008 |
|
VISUAL
cropResistant
|
7df18d6589110921,8170ce2148445048,28020833333b332b,96ccd2d2d29296dc,5d63e76727213131 |
• Threat: Credential harvesting phishing kit
• Target: SafePal users
• Method: Fake login form stealing user credentials
• Exfil: Data sent via JavaScript form submission
• Indicators: Domain mismatch, forms detected, obfuscated JavaScript
• Risk: HIGH - Immediate credential theft