Phishing Analysis: Microsoft

Captura Visual

Informações de Detecção

https://u8slotei.authlnk.com/login/a20XqKnKx0Piq0L6cU5ZaaZ693BBa8yV9ziF

Detected Brand

Microsoft

Country

International

Confidence

95%

HTTP Status

200

Report ID

87958df2-526…

Analyzed

2026-02-12 23:53

Hashes de Conteúdo (Similaridade HTML)

Used to detect similar phishing pages based on HTML content

Algorithm	Hash Value
CONTENT TLSH	T1D641243060548C27918391F17AB07F0B299AC309DA775D85B7E993BB6AD5DA4CC002A5
CONTENT ssdeep	48:YoHZA04uL5to4iatHRHBYzUS9ocmy1aFDgCESBw:NAAGZ9L2E/r

Hashes Visuais (Similaridade de Captura)

Used to detect visually similar phishing pages based on screenshots

Algorithm	Hash Value
VISUAL pHash	9c4b6326d999cccc
VISUAL aHash	180018181d1f0f9f
VISUAL dHash	7161713331347939
VISUAL wHash	191818181f1f1fff
VISUAL colorHash	07001000180
VISUAL cropResistant	7161713331347939

Análise de Código

Risk Score 50/100

Threat Level ALTO

⚠️ Phishing Confirmed

🎣 Credential Harvester

🔬 Threat Analysis Report

• Ameaça: Phishing
• Alvo: Usuários do Microsoft
• Método: Falsificação e coleta de credenciais
• Exfil: /link-action/a20XqKnKx0Piq0L6cU5ZaaZ693BBa8yV9ziF
• Indicadores: Domínio não relacionado, pedido de senha.
• Risco: Alto

🔐 Credential Harvesting Forms

📤 Form Action Targets

/link-action/a20XqKnKx0Piq0L6cU5ZaaZ693BBa8yV9ziF

📊 Detalhamento da Pontuação de Risco

Total Risk Score

95/100

Contributing Factors

Domain Mismatch

The domain u8slotei.authlnk.com does not belong to Microsoft.

Password Request

The page is asking for the user's password, a classic sign of phishing.

Branding impersonation

Impersonating the Microsoft branding to deceive the user.

🔬 Análise Integral de Ameaças

Tipo de Ameaça

Credential Harvesting Kit

Alvo

Microsoft users (International)

Método de Ataque

Brand impersonation + credential harvesting forms

Canal de Exfiltração

HTTP POST to backend

Avaliação de Risco

MEDIUM - Automated credential harvesting with HTTP POST to backend

⚠️ Indicators of Compromise

Kit types: Credential Harvester

🏢 Análise de Falsificação de Marca

Impersonated Brand

Microsoft

Official Website

null

Fake Service

Microsoft login

⚔️ Metodologia de Ataque

Primary Method: Credential Harvesting

The attacker aims to steal the user's Microsoft account credentials by creating a fake login page that closely resembles the official Microsoft login. The user enters their password, and the attacker captures it.

Secondary Method: Spear Phishing (Potential)

The presence of a specific target email address suggests this could be spear phishing, targeting specific individuals within the Wroclaw government. The attacker may have had prior knowledge or targeted the user.