SafeMode - Analysis: hems.standard.us-east-1.oortstorages.com

Captura Visual

Screenshot of hems.standard.us-east-1.oortstorages.com

Información de Detección

https://hems.standard.us-east-1.oortstorages.com/11.znc

Detected Brand

Microsoft

Country

Unknown

Confianza

95%

HTTP Status

200

Report ID

2666fffd-868…

Analyzed

2026-01-25 18:07

Hashes de Contenido (Similitud HTML)

Used to detect similar phishing pages based on HTML content

Algorithm	Hash Value
CONTENT TLSH	T1A1919572A02488275183CAECF775BB4B73858245C7871F6876FC436B6AD9C9AEC11298
CONTENT ssdeep	96:nmYgMSbxJReqcRIqoHihlJA20zotK1TKyX82P+tJ6j0+NJStY:uV8qcyNHihQ3zo41WyX8Y+v6jv/SC

Hashes Visuales (Similitud de Captura)

Used to detect visually similar phishing pages based on screenshots

Algorithm	Hash Value
VISUAL pHash	c9dc43622e34d4f3
VISUAL aHash	f0f8fc9aa9490f3f
VISUAL dHash	e2b0b0365189d970
VISUAL wHash	f0f8fc98a149053f
VISUAL colorHash	07042008000
VISUAL cropResistant	e2b0b0365189d970

Análisis de Código

Risk Score 81/100

Nivel de Amenaza ALTO

⚠️ Phishing Confirmed

🎣 Credential Harvester

Telegram Exfiltration

🔒 Obfuscation Detected

atob
fromCharCode

🔑 Telegram Bot Tokens (1)

8512508257:AAG5...BooiQntA

💬 Telegram Chat IDs (1)

8095963069

📊 Desglose de Puntuación de Riesgo

Total Risk Score

81/100

Contributing Factors

Active Phishing Kit

Detected Credential Harvester kit with 7 form fields for data collection.

Obfuscation Techniques

18 obfuscation techniques detected, indicating attempts to evade detection and analysis.

Telegram Bot Integration

Detected 1 Telegram bot for real-time exfiltration of harvested credentials.

Suspicious Domain

Domain 'hems.standard.us-east-1.oortstorages.com' mimics cloud storage services but is not associated with the impersonated brand.

🔬 Análisis Integral de Amenazas

Tipo de Amenaza

Credential Theft (Fake Microsoft Login)

Objetivo

Microsoft users (International)

Canal de Exfiltración

Telegram Bot

🏢 Análisis de Suplantación de Marca

Impersonated Brand

Microsoft

Official Website

https://www.microsoft.com

Fake Service

Microsoft account login

⚔️ Metodología de Ataque

Primary Method: Credential Harvesting

The phishing kit presents a fake Microsoft login page to capture user credentials. Submitted data is intercepted in real-time and exfiltrated via a Telegram bot to the attacker.