Save Page WE website saver

Save Page WE is a chrome extension used by phishers to clone a target website and save it as a single HTML file.

Unlike HTTrack (another commonly used tool):

  • It's a browser extension so doesn't require any additional tools to be installed.
  • It saves pages as a single HTML file (with all assets embedded in it) which makes the resulting kit more portable and easier to deploy.

References

Recent Detections

None found yet

We've not seen any sites matching this indicator yet. Try scanning a site you think matches this rule:

IOK Rule (edit) 

title: Save Page WE website saver
description: |
  Save Page WE is a chrome extension used by phishers to clone a target website and save it as a single HTML file.
  
  Unlike HTTrack (another commonly used tool):
  * It's a browser extension so doesn't require any additional tools to be installed.
  * It saves pages as a single HTML file (with all assets embedded in it) which makes the resulting kit more portable and easier to deploy.
references:
  - https://chrome.google.com/webstore/detail/save-page-we/dhhpefjklgkmgeafimnjhojgjamoafof
related:
  - id: httrack

detection:
  cssComment:
    html|contains: "/*savepage-url="

  metaComments:
    html|contains:
      - "<meta name=\"savepage-url\" content=\""
      - "<meta name=\"savepage-title\" content=\""
      - "<meta name=\"savepage-pubdate\" content=\""
      - "<meta name=\"savepage-from\" content=\""
      - "<meta name=\"savepage-date\" content=\""
      - "<meta name=\"savepage-state\" content=\""
      - "<meta name=\"savepage-version\" content=\""
      - "<meta name=\"savepage-comments\" content=\""
  condition: cssComment or metaComments

tags:
  - cloning