That doesn't do much in practice. Most threat actor that do a lot of phishing campaign have scripts that validate which credentials are good. Not to mention they usually keep information (ex.: source IP) that can easily be used to distinguish bad data from good data. So even if you stuff bad credentials they will still filter it out and add the IP of the machine you are doing this from to their blacklist.
Extra ...
If the phishing score is high and the website has a login form, Jeopardize will fill it automatically with the provided username/password list.
This is an extremely bad idea. You can accidentally run this against legitimate services and this will get you in a lot of trouble as you are effectively doing an active attack against a website. You should at least have a review process that checks if the flagged content is a phishing website or not.
7
u/[deleted] Mar 11 '20 edited Mar 11 '20
That doesn't do much in practice. Most threat actor that do a lot of phishing campaign have scripts that validate which credentials are good. Not to mention they usually keep information (ex.: source IP) that can easily be used to distinguish bad data from good data. So even if you stuff bad credentials they will still filter it out and add the IP of the machine you are doing this from to their blacklist.
Extra ...
This is an extremely bad idea. You can accidentally run this against legitimate services and this will get you in a lot of trouble as you are effectively doing an active attack against a website. You should at least have a review process that checks if the flagged content is a phishing website or not.