SafeMode - Analysis: mitramitecancelacion.on-forge.com

Visual Capture

No screenshot available

Detection Info

https://mitramitecancelacion.on-forge.com/seguroalli

Detected Brand

Bancolombia

Country

Colombia

Confidence

100%

HTTP Status

200

Report ID

5e3ab66a-19b…

Analyzed

2026-01-25 23:52

Content Hashes (HTML Similarity)

Used to detect similar phishing pages based on HTML content

Algorithm	Hash Value
CONTENT TLSH	T1FCC2CAB0225306E663BBC9F4B3597F2578D5E3ABC44B80C8A5B550788FC7E7CAB09560
CONTENT ssdeep	384:+xXhPh1VljnIykz+o2vQ/F1k2cKvXjcW1+9hT0fbJ:WXhp1VpIyk+o2ve1k2cK/j5o9E1

Visual Hashes (Screenshot Similarity)

Used to detect visually similar phishing pages based on screenshots

Algorithm	Hash Value
VISUAL pHash	fbc1d48cc78e90a5
VISUAL aHash	ffc9c5e1a3858181
VISUAL dHash	671b19494f1d1d5d
VISUAL wHash	ffcbc1e1e3858181
VISUAL colorHash	07600008000
VISUAL cropResistant	671b19494f1d1d5d,6b7a5cdcc9899892,0f3f6ecf9b31e164,8e156c654b2acbcf,b57c783870073f78,b02b6765714e59f3,4e430d2643419080

Code Analysis

Risk Score 85/100

Threat Level BAJO

🎣 Credential Harvester 🎣 OTP Stealer 🎣 Banking

🔬 Threat Analysis Report

• Threat: Potential data harvesting through obfuscated JavaScript and form submissions.
• Target: Bancolombia users.
• Method: Unknown. The site appears to be a partner.
• Exfil: Unknown at this time.
• Indicators: Unusual TLD, obfuscated JavaScript, old domain.
• Risk: LOW - While the TLD is unusual and there is obfuscated Javascript, the domain does appear related.

🔒 Obfuscation Detected

atob
fromCharCode
unescape
document.write
base64_strings

📡 API Calls Detected

/proceso/llamada
/proceso/chat

📊 Risk Score Breakdown

Total Risk Score

100/100

Contributing Factors

Active Phishing Kit

Detected Credential Harvester, OTP Stealer, and Banking kits targeting financial institutions.

Obfuscation Techniques

26 obfuscation techniques detected in JavaScript files, indicating evasion of static analysis.

Brand Impersonation

Impersonates Bancolombia, a major financial institution, increasing victim trust.

Malicious JavaScript

Malicious JavaScript file (app-DD_cA9BU.js) with obfuscation, sized at 0.32 MB.

🔬 Comprehensive Threat Analysis

Threat Type

Banking Credential Harvester

Target

Bancolombia users (Colombia)

Attack Method

obfuscated JavaScript

Exfiltration Channel

Unknown

Risk Assessment

CRITICAL - Automated credential harvesting with Unknown

⚠️ Indicators of Compromise

Kit types: Credential Harvester, OTP Stealer, Banking
26 obfuscation techniques

🏢 Brand Impersonation Analysis

Impersonated Brand

Bancolombia

Official Website

https://www.bancolombia.com

Fake Service

Account verification or security update

⚔️ Attack Methodology

Primary Method: Credential Harvesting

The phishing kit captures login credentials entered by victims on a fake Bancolombia portal. The credentials are likely transmitted in real-time to an attacker-controlled server for immediate exploitation.

Secondary Method: OTP Interception

The kit includes functionality to steal one-time passwords (OTPs) sent via SMS or authentication apps, enabling attackers to bypass multi-factor authentication (MFA) protections.