Phishing Analysis
Detailed analysis of captured phishing page
Visual Capture
Detection Info
https://hems.standard.us-east-1.oortstorages.com/11.znc
Detected Brand
Microsoft
Country
International
Confidence
96%
HTTP Status
200
Report ID
3283efe0-c80…
Analyzed
2026-01-30 07:35
Content Hashes (HTML Similarity)
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T1A1919572A02488275183CAECF775BB4B73858245C7871F6876FC436B6AD9C9AEC11298 |
|
CONTENT
ssdeep
|
96:nmYgMSbxJReqcRIqoHihlJA20zotK1TKyX82P+tJ6j0+NJStY:uV8qcyNHihQ3zo41WyX8Y+v6jv/SC |
Visual Hashes (Screenshot Similarity)
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
c9dc43622e34d4f3 |
|
VISUAL
aHash
|
f0f8fc9aa9490f3f |
|
VISUAL
dHash
|
e2b0b0365189d970 |
|
VISUAL
wHash
|
f0f8fc98a149053f |
|
VISUAL
colorHash
|
07042008000 |
|
VISUAL
cropResistant
|
e2b0b0365189d970 |
Code Analysis
Risk Score
81/100
Threat Level
ALTO
⚠️ Phishing Confirmed
🎣 Credential Harvester
Telegram Exfiltration
🔬 Threat Analysis Report
• Threat: Phishing
• Target: Microsoft users
• Method: Impersonation and credential harvesting
• Exfil: Telegram
• Indicators: Mismatched domain, Obfuscated code, Forms detected, Telegram Token.
• Risk: High
🔒 Obfuscation Detected
- atob
- fromCharCode
🔑 Telegram Bot Tokens (1)
- 8512508257:AAG5...BooiQntA
💬 Telegram Chat IDs (1)
- 8095963069
📊 Risk Score Breakdown
Total Risk Score
90/100
Contributing Factors
Domain Mismatch
Domain is not related to Microsoft
Exfiltration Target (Telegram)
Telegram bot token detected
Obfuscation
atob and fromCharCode found, indicating code obfuscation
Forms
7 forms were detected
🔬 Comprehensive Threat Analysis
Threat Type
Credential Harvesting Kit
Target
Microsoft users (International)
Attack Method
Brand impersonation + credential harvesting forms + obfuscated JavaScript
Exfiltration Channel
Telegram Bot (8512508257:AAG5tOj42...)
Risk Assessment
CRITICAL - Automated credential harvesting with Telegram Bot (8512508257:AAG5tOj42...)
⚠️ Indicators of Compromise
- 1 Telegram bot token(s)
- Kit types: Credential Harvester
- 18 obfuscation techniques
🏢 Brand Impersonation Analysis
Impersonated Brand
Microsoft
Official Website
microsoft.com
Fake Service
Microsoft Login
⚔️ Attack Methodology
Primary Method: Credential Harvesting
The site is designed to steal Microsoft account credentials. The user is tricked into entering their login information, which is then sent to the attacker.
Secondary Method: JavaScript Obfuscation
JavaScript code obfuscation is used to hide malicious activity and make it more difficult for security tools to detect the phishing attempt. This also hinders manual analysis.
📡 Telegram Command & Control Infrastructure
Bot Token (Masked)
8512508257:AAG5...BooiQntA
Bot ID
8512508257
Group/Chat ID
8095963069
Operator Language
Unknown
💬 Message Templates (3)
| ID | Portuguese | English | Trigger |
|---|---|---|---|
🌐 Infrastructure Indicators of Compromise
Domain Information
Domain
hems.standard.us-east-1.oortstorages.com
Registered
2023-04-20
Registrar
Unknown
Status
Active
🔬 JavaScript Deep Analysis
Total Code Size
26 bytes
🔐 Obfuscation Detected
- : None
🤖 AI-Extracted Threat Intelligence
Similar Websites
Pages with identical visual appearance (based on perceptual hash)
Microsoft
https://godisgreat1000x-hub.github.io/admin.html
Jun 14, 2026
Microsoft
https://ipfs.io/ipfs/bafkreihaivssupqnrfgsz3bgr4u2ru33ebfyl6...
Mar 23, 2026
Microsoft
https://ipfs.io/ipfs/bafkreid3urbc3qfzmtmkc62d3lo3yqtfrrl6z6...
Feb 03, 2026
Microsoft
https://usc1.contabostorage.com/49e32ba1adfe4deca189b7647db7...
Jan 30, 2026
Microsoft
https://hems.standard.us-east-1.oortstorages.com/11.znc
Jan 25, 2026
Scan History for hems.standard.us-east-1.oortstorages.com
Found 1 other scan for this domain
"I Never Thought It Would Happen to Me"
That's what 2.3 million victims say every year. Don't wait to become a statistic.