Phishing Analysis
Detailed analysis of captured phishing page
Captura Visual
Información de Detección
https://mydhl.kinsta.cloud/dhl_panel/
Detected Brand
DHL
Country
International
Confianza
100%
HTTP Status
200
Report ID
28a8813c-db0…
Analyzed
2026-02-09 00:03
Final URL (after redirects)
https://mydhl.kinsta.cloud/dhl_panel/details.php?lang=fi
Hashes de Contenido (Similitud HTML)
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T16F816330501DA87F44A3A2DC9F74AB8AF7CAC204CE67470352EC938D6AD7C83CD5594A |
|
CONTENT
ssdeep
|
96:mGb9sNYWgA9L7eAGAXsSUARphSvhSOhSAIVr:mGb9sNvxFUARpwvwOwAIF |
Hashes Visuales (Similitud de Captura)
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
9e9934368b3e8b1c |
|
VISUAL
aHash
|
00003c3c3c3c0000 |
|
VISUAL
dHash
|
2d04717171710e20 |
|
VISUAL
wHash
|
003f3c3cffbf0000 |
|
VISUAL
colorHash
|
07400030000 |
|
VISUAL
cropResistant
|
8092828282828245,2d04717171710e20 |
Análisis de Código
Risk Score
96/100
Nivel de Amenaza
ALTO
⚠️ Phishing Confirmed
🎣 Credential Harvester
🎣 OTP Stealer
Telegram Exfiltration
🔬 Threat Analysis Report
• Amenaza: Phishing
• Objetivo: Clientes de DHL
• Método: Recopilación de credenciales
• Exfil: Telegram
• Indicadores: Dominio sospechoso, código ofuscado, formulario PHP
• Riesgo: Alto
🔐 Credential Harvesting Forms
🔒 Obfuscation Detected
- fromCharCode
- js_packer
📤 Form Action Targets
- ./Asstes/php/config/func.php
🔑 Telegram Bot Tokens (1)
- 8048230660:AAFl...Pqdwoy78
💬 Telegram Chat IDs (1)
- -1001814885404
📊 Desglose de Puntuación de Riesgo
Total Risk Score
90/100
Contributing Factors
Active Phishing Kit
Form actions to a potentially malicious PHP script.
Obfuscation
Code Obfuscation detected to hide functionality.
Domain Suspicious
Domain is not the official DHL domain.
🔬 Análisis Integral de Amenazas
Tipo de Amenaza
Two-Factor Authentication Stealer
Objetivo
DHL users (International)
Método de Ataque
Brand impersonation + credential harvesting forms + obfuscated JavaScript
Canal de Exfiltración
Telegram Bot (8048230660:AAFlP8e3t...) + HTTP POST to backend
Evaluación de Riesgo
CRITICAL - Automated credential harvesting with Telegram Bot (8048230660:AAFlP8e3t...) + HTTP POST to backend
⚠️ Indicators of Compromise
- 1 Telegram bot token(s)
- Kit types: Credential Harvester, OTP Stealer
- 27830 obfuscation techniques
🏢 Análisis de Suplantación de Marca
Impersonated Brand
DHL
Official Website
https://www.dhl.com
Fake Service
DHL Login
⚔️ Metodología de Ataque
Primary Method: Credential Harvesting
The site is designed to collect user credentials. The form submits data to a PHP script, likely to steal entered information.
📡 Infraestructura de Comando y Control Telegram
Bot Token (Masked)
8048230660:AAFl...Pqdwoy78
Bot ID
8048230660
Group/Chat ID
-1001814885404
Operator Language
Unknown
💬 Message Templates (3)
| ID | Portugués | Inglés | Trigger |
|---|---|---|---|
🌐 Indicadores de Compromiso de Infraestructura
Domain Information
Dominio
mydhl.kinsta.cloud
Registered
2018-02-21
Registrar
None
Estado
None
🤖 AI-Extracted Threat Intelligence
Similar Websites
Pages with identical visual appearance (based on perceptual hash)
Scan History for mydhl.kinsta.cloud
Found 1 other scan for this domain
"Nunca pensé que me pasaría a mí"
Esto dicen las 2.3 millones de víctimas cada año. No esperes a ser una estadística.