Phishing Analysis: Microsoft

Visual Capture

Detection Info

https://u8slotei.authlnk.com/login/a20XqKnKx0Piq0L6cU5ZaaZ693BBa8yV9ziF

Detected Brand

Microsoft

Country

International

Confidence

95%

HTTP Status

200

Report ID

87958df2-526…

Analyzed

2026-02-12 23:53

Content Hashes (HTML Similarity)

Used to detect similar phishing pages based on HTML content

Algorithm	Hash Value
CONTENT TLSH	T1D641243060548C27918391F17AB07F0B299AC309DA775D85B7E993BB6AD5DA4CC002A5
CONTENT ssdeep	48:YoHZA04uL5to4iatHRHBYzUS9ocmy1aFDgCESBw:NAAGZ9L2E/r

Visual Hashes (Screenshot Similarity)

Used to detect visually similar phishing pages based on screenshots

Algorithm	Hash Value
VISUAL pHash	9c4b6326d999cccc
VISUAL aHash	180018181d1f0f9f
VISUAL dHash	7161713331347939
VISUAL wHash	191818181f1f1fff
VISUAL colorHash	07001000180
VISUAL cropResistant	7161713331347939

Code Analysis

Risk Score 50/100

Threat Level ALTO

⚠️ Phishing Confirmed

🎣 Credential Harvester

🔬 Threat Analysis Report

• Threat: Phishing
• Target: Microsoft users
• Method: Impersonation and credential harvesting
• Exfil: /link-action/a20XqKnKx0Piq0L6cU5ZaaZ693BBa8yV9ziF
• Indicators: Unrelated domain, password request.
• Risk: High

🔐 Credential Harvesting Forms

📤 Form Action Targets

/link-action/a20XqKnKx0Piq0L6cU5ZaaZ693BBa8yV9ziF

📊 Risk Score Breakdown

Total Risk Score

95/100

Contributing Factors

Domain Mismatch

The domain u8slotei.authlnk.com does not belong to Microsoft.

Password Request

The page is asking for the user's password, a classic sign of phishing.

Branding impersonation

Impersonating the Microsoft branding to deceive the user.

🔬 Comprehensive Threat Analysis

Threat Type

Credential Harvesting Kit

Target

Microsoft users (International)

Attack Method

Brand impersonation + credential harvesting forms

Exfiltration Channel

HTTP POST to backend

Risk Assessment

MEDIUM - Automated credential harvesting with HTTP POST to backend

⚠️ Indicators of Compromise

Kit types: Credential Harvester

🏢 Brand Impersonation Analysis

Impersonated Brand

Microsoft

Official Website

null

Fake Service

Microsoft login

⚔️ Attack Methodology

Primary Method: Credential Harvesting

The attacker aims to steal the user's Microsoft account credentials by creating a fake login page that closely resembles the official Microsoft login. The user enters their password, and the attacker captures it.

Secondary Method: Spear Phishing (Potential)

The presence of a specific target email address suggests this could be spear phishing, targeting specific individuals within the Wroclaw government. The attacker may have had prior knowledge or targeted the user.