SafeMode - Analysis: resnepost.dynv6.net

Visual Capture

Detection Info

https://resnepost.dynv6.net/Banqu_postal/Banque_postale/index.html.html

Detected Brand

La Banque Postale

Country

International

Confidence

100%

HTTP Status

200

Report ID

4fb2ccc5-033…

Analyzed

2026-02-13 12:12

Content Hashes (HTML Similarity)

Used to detect similar phishing pages based on HTML content

Algorithm	Hash Value
CONTENT TLSH	T1DBD1866490086A67C1C381E8F7F2AB1B75A0C348D74367009AFD935DABDBCE8C6461E9
CONTENT ssdeep	192:IJpZIIIIIFDrPLMoCWD+S7uK0LzLBGtpnkVdiLB9:ITZIIIIIlPLvCWDZuldepn6did9

Visual Hashes (Screenshot Similarity)

Used to detect visually similar phishing pages based on screenshots

Algorithm	Hash Value
VISUAL pHash	f19ed0e0e0931f0f
VISUAL aHash	e0e0e0e0e0e0e0e0
VISUAL dHash	8080480086828080
VISUAL wHash	f8f8fcf0e0e0e0e0
VISUAL colorHash	02007000000
VISUAL cropResistant	5072530002020202,282494a6929651ca,0000600c940c0000

Code Analysis

Risk Score 90/100

Threat Level ALTO

⚠️ Phishing Confirmed

🎣 Credential Harvester 🎣 Card Stealer

Telegram Exfiltration

🔬 Threat Analysis Report

• Threat: Credential Phishing
• Target: La Banque Postale users
• Method: Impersonation and credential harvesting
• Exfil: Telegram bot
• Indicators: Mismatched domain, form for credentials
• Risk: High

🔑 Telegram Bot Tokens (1)

8528800223:AAFA...ukk9FdJs

📊 Risk Score Breakdown

Total Risk Score

90/100

Contributing Factors

Suspicious Domain

The domain is not associated with La Banque Postale.

Credential Harvesting Form

The page contains a form requesting sensitive information (identifier).

🔬 Comprehensive Threat Analysis

Threat Type

Banking Credential Harvester

Target

La Banque Postale users (International)

Attack Method

Brand impersonation

Exfiltration Channel

Telegram Bot (8528800223:AAFAP6kMi...)

Risk Assessment

CRITICAL - Automated credential harvesting with Telegram Bot (8528800223:AAFAP6kMi...)

⚠️ Indicators of Compromise

1 Telegram bot token(s)
Kit types: Credential Harvester, Card Stealer

🏢 Brand Impersonation Analysis

Impersonated Brand

La Banque Postale

Official Website

null

Fake Service

Login

⚔️ Attack Methodology

Primary Method: Credential Phishing

The attacker creates a fake login page that mimics the appearance of La Banque Postale. Users are tricked into entering their credentials, which are then harvested by the attacker.