Phishing Analysis
Detailed analysis of captured phishing page
Visual Capture
Detection Info
https://hems.standard.us-east-1.oortstorages.com/11.znc
Detected Brand
Microsoft
Country
Unknown
Confidence
95%
HTTP Status
200
Report ID
2666fffd-868…
Analyzed
2026-01-25 18:07
Content Hashes (HTML Similarity)
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T1A1919572A02488275183CAECF775BB4B73858245C7871F6876FC436B6AD9C9AEC11298 |
|
CONTENT
ssdeep
|
96:nmYgMSbxJReqcRIqoHihlJA20zotK1TKyX82P+tJ6j0+NJStY:uV8qcyNHihQ3zo41WyX8Y+v6jv/SC |
Visual Hashes (Screenshot Similarity)
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
c9dc43622e34d4f3 |
|
VISUAL
aHash
|
f0f8fc9aa9490f3f |
|
VISUAL
dHash
|
e2b0b0365189d970 |
|
VISUAL
wHash
|
f0f8fc98a149053f |
|
VISUAL
colorHash
|
07042008000 |
|
VISUAL
cropResistant
|
e2b0b0365189d970 |
Code Analysis
Risk Score
81/100
Threat Level
ALTO
⚠️ Phishing Confirmed
🎣 Credential Harvester
Telegram Exfiltration
🔒 Obfuscation Detected
- atob
- fromCharCode
🔑 Telegram Bot Tokens (1)
- 8512508257:AAG5...BooiQntA
💬 Telegram Chat IDs (1)
- 8095963069
📊 Risk Score Breakdown
Total Risk Score
81/100
Contributing Factors
Active Phishing Kit
Detected Credential Harvester kit with 7 form fields for data collection.
Obfuscation Techniques
18 obfuscation techniques detected, indicating attempts to evade detection and analysis.
Telegram Bot Integration
Detected 1 Telegram bot for real-time exfiltration of harvested credentials.
Suspicious Domain
Domain 'hems.standard.us-east-1.oortstorages.com' mimics cloud storage services but is not associated with the impersonated brand.
🔬 Comprehensive Threat Analysis
Threat Type
Credential Theft (Fake Microsoft Login)
Target
Microsoft users (International)
Exfiltration Channel
Telegram Bot
🏢 Brand Impersonation Analysis
Impersonated Brand
Microsoft
Official Website
https://www.microsoft.com
Fake Service
Microsoft account login
⚔️ Attack Methodology
Primary Method: Credential Harvesting
The phishing kit presents a fake Microsoft login page to capture user credentials. Submitted data is intercepted in real-time and exfiltrated via a Telegram bot to the attacker.
Secondary Method: Obfuscation and Evasion
The kit employs 18 obfuscation techniques to hide malicious JavaScript code, complicating detection and analysis by security tools and researchers.
📡 Telegram Command & Control Infrastructure
Bot Token (Masked)
8512508257:AAG5...BooiQntA
Bot ID
8512508257
Group/Chat ID
8095963069
Operator Language
Unknown
💬 Message Templates (3)
| ID | Portuguese | English | Trigger |
|---|---|---|---|
🌐 Infrastructure Indicators of Compromise
Domain Information
Domain
hems.standard.us-east-1.oortstorages.com
Registered
2025-03-11 14:20:35+00:00
Registrar
GoDaddy.com, LLC
Status
Active (319 days old)
🦠 Malicious Files
Main File
File Size
Contains code for credential harvesting and Telegram bot integration.
🔌 External APIs Abused
telegram
- chat_id: Detected
- bot_token: Detected
🔬 JavaScript Deep Analysis
Total Code Size
26 bytes
🔐 Obfuscation Detected
- : None
🤖 AI-Extracted Threat Intelligence
🎯 Malicious Files Identified
🌐 External APIs Abused
- telegram
Similar Websites
Pages with identical visual appearance (based on perceptual hash)
Microsoft
https://godisgreat1000x-hub.github.io/admin.html
Jun 14, 2026
Microsoft
https://ipfs.io/ipfs/bafkreihaivssupqnrfgsz3bgr4u2ru33ebfyl6...
Mar 23, 2026
Microsoft
https://ipfs.io/ipfs/bafkreid3urbc3qfzmtmkc62d3lo3yqtfrrl6z6...
Feb 03, 2026
Microsoft
https://usc1.contabostorage.com/49e32ba1adfe4deca189b7647db7...
Jan 30, 2026
Microsoft
https://hems.standard.us-east-1.oortstorages.com/11.znc
Jan 30, 2026
Scan History for hems.standard.us-east-1.oortstorages.com
Found 1 other scan for this domain
"I Never Thought It Would Happen to Me"
That's what 2.3 million victims say every year. Don't wait to become a statistic.