Phishing Analysis
Detailed analysis of captured phishing page
Captura Visual
Informações de Detecção
https://registrosaqui.com/
Detected Brand
CMR Puntos
Country
International
Confiança
100%
HTTP Status
200
Report ID
fa360e0c-892…
Analyzed
2026-01-27 18:49
Hashes de Conteúdo (Similaridade HTML)
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T1514153318545C93B5693A6A49321DF2AB1D3C613CB0318A5B2F993ED9BD7D85CDD028C |
|
CONTENT
ssdeep
|
48:sHhHcpnifS6uM6hRx1fRYwiMucL+CDQyS:CaiS6uM6hIk+1 |
Hashes Visuais (Similaridade de Captura)
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
e6dc997174c43199 |
|
VISUAL
aHash
|
ffffe7c3c3c3e7e7 |
|
VISUAL
dHash
|
8c140c4d0e0e4c0c |
|
VISUAL
wHash
|
42c7c3c3c3c3e3c3 |
|
VISUAL
colorHash
|
07600006000 |
|
VISUAL
cropResistant
|
8c140c4d0e0e4c0c,100c32b2b2320c10,0929696577b4da5a |
Análise de Código
Risk Score
81/100
Nível de Ameaça
ALTO
⚠️ Phishing Confirmed
🎣 Credential Harvester
🎣 OTP Stealer
🔬 Threat Analysis Report
• Ameaça: Kit de phishing para roubo de credenciais.
• Alvo: Usuários do CMR Puntos.
• Método: Formulário de login falso para roubar credenciais.
• Exfil: Ponto de exfiltração de dados desconhecido.
• Indicators: Domínio registrado recentemente, JavaScript ofuscado, formulários detectados.
• Risk: ALTO - O roubo de credenciais é iminente.
🔒 Obfuscation Detected
- fromCharCode
- base64_strings
📡 API Calls Detected
- https://api.ipify.org?format=json
- /submit.php
- POST
📊 Detalhamento da Pontuação de Risco
Total Risk Score
100/100
Contributing Factors
Active Phishing Kit
Detected Credential Harvester and OTP Stealer kits with real-time form interception for RUT and Clave Internet fields.
Obfuscation Techniques
19 obfuscation techniques detected, indicating deliberate evasion of detection and analysis.
Brand Impersonation
Impersonates CMR Puntos, a known financial loyalty program, targeting sensitive user credentials.
Malicious JavaScript
Inclusion of pusher.min.js (0.07 MB) with potential for dynamic payload delivery or exfiltration.
🔬 Análise Integral de Ameaças
Tipo de Ameaça
Two-Factor Authentication Stealer
Alvo
CMR Puntos users (International)
Método de Ataque
Brand impersonation + credential harvesting forms + obfuscated JavaScript
Canal de Exfiltração
Form submission (backend endpoint not detected - likely JavaScript-based)
Avaliação de Risco
CRITICAL - Automated credential harvesting with Form submission (backend endpoint not detected - likely JavaScript-based)
⚠️ Indicators of Compromise
- Kit types: Credential Harvester, OTP Stealer
- 19 obfuscation techniques
🏢 Análise de Falsificação de Marca
Impersonated Brand
CMR Puntos
Official Website
https://www.cmrpuntos.cl
Fake Service
CMR Puntos account login and management
⚔️ Metodologia de Ataque
Primary Method: Credential Harvesting
The phishing kit captures RUT (Chilean national ID) and internet Banking password (Clave Internet) via a fake login form. Data is likely exfiltrated in real-time to an attacker-controlled server for immediate account takeover.
Secondary Method: OTP Stealer
The kit includes functionality to intercept one-time passwords (OTPs) sent via SMS or authentication apps, enabling bypass of two-factor authentication for CMR Puntos accounts.
🌐 Indicadores de Compromisso de Infraestrutura
Domain Information
Domínio
registrosaqui.com
Registered
2026-01-18 22:44:09+00:00
Registrar
Tecnocratica Centro de Datos, S.L.
Estado
Recently registered (8 days old)
🦠 Malicious Files
Main File
File Size
JavaScript file with potential for credential exfiltration or dynamic payload delivery.
📊 Diagrama de Fluxo de Ataque
┌──────────────────────────────────────────────────────────┐
│ 1. VICTIM RECEIVES PHISHING EMAIL │
│ - Email mimics CMR Puntos branding │
│ - Contains link to fake login page │
└────────────────────┬─────────────────────────────────────┘
│
▼
┌──────────────────────────────────────────────────────────┐
│ 2. VICTIM VISITS FAKE CMR PUNTOS SITE │
│ - Fake page replicates legitimate Banking portal │
└────────────────────┬─────────────────────────────────────┘
│
▼
┌──────────────────────────────────────────────────────────┐
│ 3. CREDENTIAL HARVESTING │
│ - Victim enters login credentials │
│ - Data captured via fake form │
└────────────────────┬─────────────────────────────────────┘
│
▼
┌──────────────────────────────────────────────────────────┐
│ 4. DATA EXFILTRATION │
│ - Credentials sent via HTTP POST │
│ - Standard form submission to attacker server │
└──────────────────────────────────────────────────────────┘
🔬 JavaScript Deep Analysis
Total Code Size
68,7 KB
🔗 API Endpoints Detected
Other
5
🔐 Obfuscation Detected
- : Light
🤖 AI-Extracted Threat Intelligence
📊 Attack Flow
┌──────────────────────────────────────────────────────────┐
│ 1. VICTIM RECEIVES PHISHING EMAIL │
│ - Email mimics CMR Puntos branding │
│ - Contains link to fake login page │
└────────────────────┬─────────────────────────────────────┘
│
▼
┌──────────────────────────────────────────────────────────┐
│ 2. VICTIM VISITS FAKE CMR PUNTOS SITE │
│ - Fake page replicates legitimate Banking portal │
└────────────────────┬─────────────────────────────────────┘
│
▼
┌──────────────────────────────────────────────────────────┐
│ 3. CREDENTIAL HARVESTING │
│ - Victim enters login credentials │
│ - Data captured via fake form │
└────────────────────┬─────────────────────────────────────┘
│
▼
┌──────────────────────────────────────────────────────────┐
│ 4. DATA EXFILTRATION │
│ - Credentials sent via HTTP POST │
│ - Standard form submission to attacker server │
└──────────────────────────────────────────────────────────┘
🎯 Malicious Files Identified
Similar Websites
Pages with identical visual appearance (based on perceptual hash)
"Nunca pensei que aconteceria comigo"
Isso dizem os 2,3 milhões de vítimas a cada ano. Não espere para ser uma estatística.