SafeMode - Analysis: dhlitalia3.github.io

Captura Visual

Información de Detección

https://dhlitalia3.github.io/DHL

Detected Brand

DHL

Country

Unknown

Confianza

100%

HTTP Status

200

Report ID

63224eed-f4c…

Analyzed

2026-07-03 22:23

Final URL (after redirects)

https://dhlitalia3.github.io/DHL/

Hashes de Contenido (Similitud HTML)

Used to detect similar phishing pages based on HTML content

Algorithm	Hash Value
CONTENT TLSH	T1EF71FC30911A9D7F66D3C6D893F4975F32D2C745ED471741ABF8835A8AEBE80ED20280
CONTENT ssdeep	48:Ug9dukEYCoqKC9WfIJnlWaXeIZbVF6BchnwsJgQoYgZP67+G:nd/EPhnlW8ZZUBCwCnoPZP67+G

Hashes Visuales (Similitud de Captura)

Used to detect visually similar phishing pages based on screenshots

Algorithm	Hash Value
VISUAL pHash	e3668c99996666cc
VISUAL aHash	ffffe7e7ffe7e7ff
VISUAL dHash	30084d4d324d4d32
VISUAL wHash	0f0f07070f072727
VISUAL colorHash	070020001c0
VISUAL cropResistant	30084d4d324d4d32,222240d430008a43

Análisis de Código

Risk Score 75/100

Nivel de Amenaza ALTO

⚠️ Phishing Confirmed

🎣 Card Stealer

Telegram Exfiltration

🔑 Telegram Bot Tokens (1)

8191936030:AAFl...5kgMqnkg

📊 Desglose de Puntuación de Riesgo

Total Risk Score

80/100

Contributing Factors

Active Phishing Kit

Detected kit types: Card Stealer

Credential Harvesting

Credential harvesting detected with 1 form(s) capturing sensitive data

Telegram Exfiltration

Real-time data exfiltration via Telegram (1 bot token(s) exposed in client-side code)

🔬 Análisis Integral de Amenazas

Tipo de Amenaza

Banking Credential Harvester

Objetivo

DHL users

Método de Ataque

credential harvesting forms

Canal de Exfiltración

Telegram Bot (8191936030:AAFl4PoBp...)

Evaluación de Riesgo

HIGH - Automated credential harvesting with Telegram Bot (8191936030:AAFl4PoBp...)

⚠️ Indicators of Compromise

1 Telegram bot token(s)
Kit types: Card Stealer

🏢 Análisis de Suplantación de Marca

Impersonated Brand

DHL

Official Website

N/A

Fake Service

Banking/payment service

⚔️ Metodología de Ataque

Primary Method: Payment Card Theft

Victim enters credit/debit card details including CVV and expiration. Card data is captured and can be used for fraudulent transactions or sold on dark web markets.

Secondary Method: Client-Side Form Interception

JavaScript intercepts form submissions before they reach the fake backend. This allows real-time credential harvesting and validation without server round-trips.

📡 Infraestructura de Comando y Control Telegram

Bot Token (Masked)

8191936030:AAFl...5kgMqnkg

Bot ID

8191936030

Group/Chat ID

Unknown

Operator Language

Unknown

💬 Message Templates (3)

ID	Portugués	Inglés	Trigger

🌐 Indicadores de Compromiso de Infraestructura

Domain Information

Dominio

dhlitalia3.github.io

Registered

Unknown

Registrar

Unknown

Estado

Hosting platform (subdomain)

Hosting Information

Provider

Unknown

ASN

🤖 AI-Extracted Threat Intelligence

Similar Websites

Pages with identical visual appearance (based on perceptual hash)

DHL

https://dhlitalia2.github.io/DHL

Jul 03, 2026