EN ES PT

Phishing Analysis

Detailed analysis of captured phishing page

Back to Stats

Visual Capture

Screenshot of authentication.ms

Detection Info

https://authentication.ms/rQ0RGMdkjQA?/domain=rwe.com?teams=Collaborative-Teams
Detected Brand
RWE
Country
International
Confidence
100%
HTTP Status
200
Report ID
a357609b-16b…
Analyzed
2026-02-14 00:01

Content Hashes (HTML Similarity)

Used to detect similar phishing pages based on HTML content

Algorithm Hash Value
CONTENT TLSH
T18FD1DE7150409D3B4282C7E4B3B56B4F3394C346EA97565A67F8C79C0EF3E26CC1A226
CONTENT ssdeep
96:nIpkCGTHRPyekrwkMQ1s39TbJG9KjsWsjOd0U2gs0sjO4OVJQ6Q6ynQjNsjOh:9/k8ai9TbJG9aTYOVJQyyQjF

Visual Hashes (Screenshot Similarity)

Used to detect visually similar phishing pages based on screenshots

Algorithm Hash Value
VISUAL pHash
9d4b6326cc999966
VISUAL aHash
18001818191f0f9f
VISUAL dHash
7161733331727d38
VISUAL wHash
191818181f1f1fff
VISUAL colorHash
070000001c0
VISUAL cropResistant
7161733331727d38

Code Analysis

Risk Score 70/100
Threat Level ALTO
⚠️ Phishing Confirmed
🎣 Credential Harvester 🎣 OTP Stealer 🎣 Personal Info

🔬 Threat Analysis Report

• Threat: Credential Phishing
• Target: RWE customers
• Method: Impersonation via fake login page
• Exfil: Stolen credentials
• Indicators: Domain mismatch, login form
• Risk: High

🎯 Kit Endpoints

  • https://passwordreset.microsoftonline.com/?ru=https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000001-0000-cff1-ce00-970932493300&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=1&msaredir=1&client-request-id=d98292e6-fa3f-ce32-3192-21bc5137cc6d&protectedtoken=true&domain_hint=rwe.com&nonce=685457438764.ec82d3ed-b372-7cd6-3e42-fcfc13352e79&state=dWxyaWNoLmxhbmdlbkByd2UuY29t#
  • https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000001-0000-cff1-ce00-631128914347&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=1&msaredir=1&client-request-id=d98292e6-fa3f-ce32-7761-21bc5137cc6d&protectedtoken=true&domain_hint=rwe.com&nonce=399817968273.ec82d3ed-b372-7cd6-3e42-fcfc13352e79&state=dWxyaWNoLmxhbmdlbkByd2UuY29t#
  • https://login.microsoftonline.com/common/login#
  • https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000001-0000-cff1-ce00-517499771447&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=1&msaredir=1&client-request-id=d98292e6-fa3f-ce32-8937-21bc5137cc6d&protectedtoken=true&domain_hint=rwe.com&nonce=230375388384.ec82d3ed-b372-7cd6-3e42-fcfc13352e79&state=dWxyaWNoLmxhbmdlbkByd2UuY29t#

📊 Risk Score Breakdown

Total Risk Score
90/100

Contributing Factors

Domain Mismatch
The domain 'authentication.ms' does not belong to RWE. This is a primary phishing indicator.
Impersonation of Brand
The site attempts to mimic the RWE login page.
Requests Sensitive Information
The site requests login credentials.

🔬 Comprehensive Threat Analysis

Threat Type
Two-Factor Authentication Stealer
Target
RWE users (International)
Attack Method
Brand impersonation
Exfiltration Channel
Form submission (backend endpoint not detected - likely JavaScript-based)
Risk Assessment
HIGH - Automated credential harvesting with Form submission (backend endpoint not detected - likely JavaScript-based)

⚠️ Indicators of Compromise

  • Kit types: Credential Harvester, OTP Stealer, Personal Info

🏢 Brand Impersonation Analysis

Impersonated Brand
RWE
Official Website
https://www.rwe.com/
Fake Service
RWE Login

⚔️ Attack Methodology

Primary Method: Credential Harvesting

The attackers are using a fake login page to collect the victim's RWE login credentials (email address and password).

🌐 Infrastructure Indicators of Compromise

Domain Information

Domain
authentication.ms
Registered
Unknown
Registrar
Unknown
Status
Active

🤖 AI-Extracted Threat Intelligence

Similar Websites

Pages with identical visual appearance (based on perceptual hash)

Screenshot
RWE
https://auth.properties/E.0n0B4aTckMr8iLg?/tasks/rwehome/Pla...
Apr 22, 2026
 Screenshot
Hays
https://authentication.ms/7KAoO-G-jwCpMv6ZYA?0b80-4d97-86d7-...
Feb 13, 2026
 Screenshot
RWE
https://auth-secure.me/Tp4fhL9s_WfsYzyMGQ
Jan 10, 2026

Scan History for authentication.ms

Found 10 other scans for this domain

😰
"I Never Thought It Would Happen to Me"
That's what 2.3 million victims say every year. Don't wait to become a statistic.