Phishing Analysis
Detailed analysis of captured phishing page
Captura Visual
Información de Detección
https://registrosaqui.com/
Detected Brand
CMR Puntos
Country
International
Confianza
100%
HTTP Status
200
Report ID
fa360e0c-892…
Analyzed
2026-01-27 18:49
Hashes de Contenido (Similitud HTML)
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T1514153318545C93B5693A6A49321DF2AB1D3C613CB0318A5B2F993ED9BD7D85CDD028C |
|
CONTENT
ssdeep
|
48:sHhHcpnifS6uM6hRx1fRYwiMucL+CDQyS:CaiS6uM6hIk+1 |
Hashes Visuales (Similitud de Captura)
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
e6dc997174c43199 |
|
VISUAL
aHash
|
ffffe7c3c3c3e7e7 |
|
VISUAL
dHash
|
8c140c4d0e0e4c0c |
|
VISUAL
wHash
|
42c7c3c3c3c3e3c3 |
|
VISUAL
colorHash
|
07600006000 |
|
VISUAL
cropResistant
|
8c140c4d0e0e4c0c,100c32b2b2320c10,0929696577b4da5a |
Análisis de Código
Risk Score
81/100
Nivel de Amenaza
ALTO
⚠️ Phishing Confirmed
🎣 Credential Harvester
🎣 OTP Stealer
🔬 Threat Analysis Report
• Amenaza: Kit de phishing para robo de credenciales.
• Objetivo: Usuarios de CMR Puntos.
• Método: Formulario de inicio de sesión falso para robar credenciales.
• Exfil: Punto de exfiltración de datos desconocido.
• Indicators: Dominio registrado recientemente, JavaScript ofuscado, formularios detectados.
• Risk: ALTO - El robo de credenciales es inminente.
🔒 Obfuscation Detected
- fromCharCode
- base64_strings
📡 API Calls Detected
- https://api.ipify.org?format=json
- /submit.php
- POST
📊 Desglose de Puntuación de Riesgo
Total Risk Score
100/100
Contributing Factors
Active Phishing Kit
Detected Credential Harvester and OTP Stealer kits with real-time form interception for RUT and Clave Internet fields.
Obfuscation Techniques
19 obfuscation techniques detected, indicating deliberate evasion of detection and analysis.
Brand Impersonation
Impersonates CMR Puntos, a known financial loyalty program, targeting sensitive user credentials.
Malicious JavaScript
Inclusion of pusher.min.js (0.07 MB) with potential for dynamic payload delivery or exfiltration.
🔬 Análisis Integral de Amenazas
Tipo de Amenaza
Two-Factor Authentication Stealer
Objetivo
CMR Puntos users (International)
Método de Ataque
Brand impersonation + credential harvesting forms + obfuscated JavaScript
Canal de Exfiltración
Form submission (backend endpoint not detected - likely JavaScript-based)
Evaluación de Riesgo
CRITICAL - Automated credential harvesting with Form submission (backend endpoint not detected - likely JavaScript-based)
⚠️ Indicators of Compromise
- Kit types: Credential Harvester, OTP Stealer
- 19 obfuscation techniques
🏢 Análisis de Suplantación de Marca
Impersonated Brand
CMR Puntos
Official Website
https://www.cmrpuntos.cl
Fake Service
CMR Puntos account login and management
⚔️ Metodología de Ataque
Primary Method: Credential Harvesting
The phishing kit captures RUT (Chilean national ID) and internet Banking password (Clave Internet) via a fake login form. Data is likely exfiltrated in real-time to an attacker-controlled server for immediate account takeover.
Secondary Method: OTP Stealer
The kit includes functionality to intercept one-time passwords (OTPs) sent via SMS or authentication apps, enabling bypass of two-factor authentication for CMR Puntos accounts.
🌐 Indicadores de Compromiso de Infraestructura
Domain Information
Dominio
registrosaqui.com
Registered
2026-01-18 22:44:09+00:00
Registrar
Tecnocratica Centro de Datos, S.L.
Estado
Recently registered (8 days old)
🦠 Malicious Files
Main File
File Size
JavaScript file with potential for credential exfiltration or dynamic payload delivery.
📊 Diagrama de Flujo de Ataque
┌──────────────────────────────────────────────────────────┐
│ 1. VICTIM RECEIVES PHISHING EMAIL │
│ - Email mimics CMR Puntos branding │
│ - Contains link to fake login page │
└────────────────────┬─────────────────────────────────────┘
│
▼
┌──────────────────────────────────────────────────────────┐
│ 2. VICTIM VISITS FAKE CMR PUNTOS SITE │
│ - Fake page replicates legitimate Banking portal │
└────────────────────┬─────────────────────────────────────┘
│
▼
┌──────────────────────────────────────────────────────────┐
│ 3. CREDENTIAL HARVESTING │
│ - Victim enters login credentials │
│ - Data captured via fake form │
└────────────────────┬─────────────────────────────────────┘
│
▼
┌──────────────────────────────────────────────────────────┐
│ 4. DATA EXFILTRATION │
│ - Credentials sent via HTTP POST │
│ - Standard form submission to attacker server │
└──────────────────────────────────────────────────────────┘
🔬 JavaScript Deep Analysis
Total Code Size
68,7 KB
🔗 API Endpoints Detected
Other
5
🔐 Obfuscation Detected
- : Light
🤖 AI-Extracted Threat Intelligence
📊 Attack Flow
┌──────────────────────────────────────────────────────────┐
│ 1. VICTIM RECEIVES PHISHING EMAIL │
│ - Email mimics CMR Puntos branding │
│ - Contains link to fake login page │
└────────────────────┬─────────────────────────────────────┘
│
▼
┌──────────────────────────────────────────────────────────┐
│ 2. VICTIM VISITS FAKE CMR PUNTOS SITE │
│ - Fake page replicates legitimate Banking portal │
└────────────────────┬─────────────────────────────────────┘
│
▼
┌──────────────────────────────────────────────────────────┐
│ 3. CREDENTIAL HARVESTING │
│ - Victim enters login credentials │
│ - Data captured via fake form │
└────────────────────┬─────────────────────────────────────┘
│
▼
┌──────────────────────────────────────────────────────────┐
│ 4. DATA EXFILTRATION │
│ - Credentials sent via HTTP POST │
│ - Standard form submission to attacker server │
└──────────────────────────────────────────────────────────┘
🎯 Malicious Files Identified
Similar Websites
Pages with identical visual appearance (based on perceptual hash)
"Nunca pensé que me pasaría a mí"
Esto dicen las 2.3 millones de víctimas cada año. No esperes a ser una estadística.