SafeMode - Analysis: dhl-presentation.com

Captura Visual

Informações de Detecção

https://dhl-presentation.com/setup/

Detected Brand

DHL

Country

International

Confiança

100%

HTTP Status

200

Report ID

17e31285-9ed…

Analyzed

2026-01-26 00:11

Hashes de Conteúdo (Similaridade HTML)

Used to detect similar phishing pages based on HTML content

Algorithm	Hash Value
CONTENT TLSH	T19B22953023441E3E5A2BC698F6A4B31E619BE388D62F915CE2AF027557C7D82DC375D8
CONTENT ssdeep	192:HSB6lsI1nqPDSMsP2F+7eezgXRwXCCY/1Y2hCYOSsNu:HSUls5L+gXRwXCCYtYXYr

Hashes Visuais (Similaridade de Captura)

Used to detect visually similar phishing pages based on screenshots

Algorithm	Hash Value
VISUAL pHash	9b4d34326d98c667
VISUAL aHash	000c3c3c203c1c00
VISUAL dHash	0448405042793902
VISUAL wHash	103c3c3c3c3c3c30
VISUAL colorHash	38006000018
VISUAL cropResistant	0448405042793902

Análise de Código

Risk Score 76/100

Nível de Ameaça ALTO

⚠️ Phishing Confirmed

🎣 Credential Harvester 🎣 OTP Stealer 🎣 Banking 🎣 Personal Info

🔬 Threat Analysis Report

• Ameaça: Phishing da DHL visando o acesso à conta.
• Alvo: Usuários da DHL.
• Método: Solicitação falsa de licença e caminho de acesso.
• Exfil: Provavelmente credenciais e potencialmente outros dados para um ponto final desconhecido.
• Indicadores: URL do site não oficial, domínio recente, ofuscação detectada e detecção de envio de formulário javascript.
• Risco: ALTO - Roubo de credenciais.

🔒 Obfuscation Detected

fromCharCode
unicode_escape

🎯 Kit Endpoints

/login

📡 API Calls Detected

https://t.me/zephyrscamasupportbot

📊 Detalhamento da Pontuação de Risco

Total Risk Score

100/100

Contributing Factors

Active Phishing Kit

Detected Credential Harvester, OTP Stealer, and Personal Info harvesting kits targeting DHL users.

High Obfuscation

17 obfuscation techniques detected in JavaScript files, indicating evasion of static analysis.

Brand Impersonation

Domain and content impersonate DHL, a high-value logistics brand, increasing trust exploitation.

Suspicious Form Fields

Form fields labeled 'Votre licence' and 'Chemin d'accès' suggest credential harvesting for unauthorized access.

🔬 Análise Integral de Ameaças

Tipo de Ameaça

Banking Credential Harvester

Alvo

DHL users (International)

Método de Ataque

Brand impersonation + obfuscated JavaScript

Canal de Exfiltração

Unknown

Avaliação de Risco

HIGH - Automated credential harvesting with Unknown

⚠️ Indicators of Compromise

Kit types: Credential Harvester, OTP Stealer, Banking, Personal Info
17 obfuscation techniques

🏢 Análise de Falsificação de Marca

Impersonated Brand

DHL

Official Website

https://www.dhl.com

Fake Service

Account verification or license validation

Fraudulent Claims

⚔️ Metodologia de Ataque

Primary Method: Credential Harvesting

The phishing kit captures user credentials through fake form fields ('Votre licence', 'Chemin d accès'). Data is likely exfiltrated via HTTP POST requests to a command-and-control server.

Secondary Method: OTP Stealer

The kit includes functionality to intercept one-time passwords (OTPs), enabling attackers to bypass multi-factor authentication on compromised accounts.