SafeMode - Analysis: smtp.romtelecom.net

Visual Capture

Detection Info

http://smtp.romtelecom.net/?horde=1t3vqihoks9rl96edcni1b3h20&

Detected Brand

Orange

Country

Romania

Confidence

100%

HTTP Status

200

Report ID

61762a60-26a…

Analyzed

2025-12-29 05:00

Final URL (after redirects)

https://smtp.romtelecom.net/?horde=1t3vqihoks9rl96edcni1b3h20&

Content Hashes (HTML Similarity)

Used to detect similar phishing pages based on HTML content

Algorithm	Hash Value
CONTENT TLSH	T14441760050091E37E04320ECB7919156E1F6C344CB667988B6F94EED1BD5CDDDB3BA19
CONTENT ssdeep	48:rW8cwYwFwSwo170N/iu5vBUSB2WavBGQ7BOhsl/Eo:l9BEvKSav7BOho/Eo

Visual Hashes (Screenshot Similarity)

Used to detect visually similar phishing pages based on screenshots

Algorithm	Hash Value
VISUAL pHash	b2333333339c9999
VISUAL aHash	e7e7ffe7ffffffff
VISUAL dHash	4d4d0c0c0c000000
VISUAL wHash	24242424e4fcfcfc

Code Analysis

Risk Score 70/100

Threat Level CRITICAL

⚠️ Phishing Confirmed

🎣 Credential Harvester 🎣 Banking 🎣 Personal Info

🔬 Threat Analysis Report

• Threat: Credential harvesting phishing targeting Orange Romania users.
• Target: Orange Romania customers.
• Method: Fake webmail login form to steal email and password.
• Exfil: Likely to a custom API or attacker-controlled server.
• Indicators: Domain mismatch, impersonating Orange brand.
• Risk: HIGH - Immediate credential theft.