Correo Argentino: six-signal cloaking and a chat requesting card details

What was observed and what remains unconfirmed

The investigation of Correo Argentino impersonation goes beyond a cloned landing page. The documented path combines a supposed “parcel release fee”, a chat asking for card number, expiry date and security code, and a parcel image personalized with the information entered. Another version of the same site presents an Excel-template store.

The important finding is the difference in presentation. Different visit profiles received either the data-requesting flow or a commercial façade. The decision logic was reconstructed by comparing behavior across profiles; the investigation did not validate a transaction with the card issuer.

A chat response does not establish bank authorization. Apparent instant card validation is treated as an inference. The page does not confirm charges or effective communication with the issuer.

The image bearing a name and address reinforces the parcel lure. What was observed was the personalized result appearing during the conversation, not an independently verified implementation of its internal generator. Previously withdrawn details about server files, administration and payment logic are not restored.

Technical summary of the documented flow

• Selective presentation: postal impersonation and a template shop under different access profiles.
• Conversational collection: a chat requesting full card details; apparent real-time checking, not verified with the issuer.
• Personalization: a parcel picture with the person's information and a label resembling handwriting.
• Observed brands: the investigation describes impersonation of Correo Argentino and Correo de Chile. It does not present those brands as participants in the fraud.

These components describe the visible path. They do not establish the kit's country of origin, its operator or the final destination of money. Nor do the cloaking signals measure the campaign's visitor or victim population.

Six signals in the cloaking reconstruction

The original note organizes the reconstruction into six signals. That structure is retained while separating observed behavior from explanations of implementation. This is neither a fresh execution of the kit nor independent certification of its code.

1. Device and traffic source. In the visits described, the fraudulent flow appeared on phones arriving from paid ads with their tracking parameters intact; desktop visits received a different presentation. The finding is limited to the profiles tested.
2. User-Agent and Client Hints. The reconstruction proposes a comparison of the declared browser and platform signals. Its example pairs an iPhone User-Agent with Windows or macOS signals; it does not establish the result for every possible profile.
3. DevTools signals. The analysis describes differences between window and visible-area dimensions, plus an Image-object getter and console.log check. These remain mechanisms described in the investigation, without restoring withdrawn internal details or adding evasion code.
4. Mouse movement. The article associates these events with exclusion from the fraudulent version and a “not a target” cookie. The former “for life” wording is not established by a limited observation period; no verified duration is claimed.
5. Automation fingerprints. The reconstruction describes comparison of the User-Agent with bot and testing-tool patterns, associated with withholding the fraudulent flow.
6. Persistence of a filter outcome. Repeated delivery of the façade for several days prompted the persistent IP-blocklist hypothesis. The note itself says its duration could not be verified. That inference is not equivalent to reading a server-side list.

Traffic origin is a separate hypothesis

The declared observations include distribution through Google Ads and Facebook Ads. A different, still-open question is whether affiliate networks connected to unauthorized football streaming supply a substantial share of the traffic. This case does not establish that origin or quantify its contribution.

The hypothesis proposes that one pool of visits could be distributed among a malicious APK, fake technical support and a phishing flow according to visitor profile. It is a possible business explanation, not a finding that all three destinations were observed in this investigation. The site's segmentation alone does not demonstrate an affiliate-network relationship.

Method, inferences and complementary reading

The source material presents the two site versions, ads, requests in the chat and the personalized image as the author's observations. Issuer validation, the blocklist and traffic origin have different evidential limits. Those limits must remain separate: a form response is not confirmation from a bank.

The October 7 review also removed an origin attribution and internal details unsupported by passive observation or public sources. This version preserves those decisions and reorganizes the text so that its summary does not claim more than its method.

For complementary reading, the CASHCLOAK LATAM report on ads and deceptive destinations distinguishes observation, assessment and attribution. This link does not demonstrate a common operator or infrastructure between the cases.

The downloadable version has been temporarily withdrawn while it is updated. The current content is the one on this page.