SafeMode - Analysis: ryanair.top

Captura Visual

Información de Detección

http://ryanair.top

Detected Brand

Ryanair

Country

International

Confianza

100%

HTTP Status

200

Report ID

f7ec2644-38f…

Analyzed

2026-01-27 19:02

Final URL (after redirects)

https://ryanair.top/

Hashes de Contenido (Similitud HTML)

Used to detect similar phishing pages based on HTML content

Algorithm	Hash Value
CONTENT TLSH	T1AEC283B06214513BA11796C7AF22773936FBB1FEE9BA0100E3FD46909BE4DD9AC23444
CONTENT ssdeep	384:83WtqY+SAaudOgU74CyZdwq/e2oxRYXT+64ylFOU0KX2Cc8HYc1RcWc66hT:8YAaum/y7w32GRYXTrlFH0KvYwUT

Hashes Visuales (Similitud de Captura)

Used to detect visually similar phishing pages based on screenshots

Algorithm	Hash Value
VISUAL pHash	92922d6de99696e2
VISUAL aHash	02646c6c4000407e
VISUAL dHash	96cdcd8d9268d4d4
VISUAL wHash	47447c7e60047e7e
VISUAL colorHash	38007000000
VISUAL cropResistant	e89862c4cda2e6e8,96cdcd8d9268d4d4

Análisis de Código

Risk Score 88/100

Nivel de Amenaza ALTO

⚠️ Phishing Confirmed

🎣 Credential Harvester 🎣 OTP Stealer 🎣 Banking 🎣 Personal Info

🔬 Threat Analysis Report

• Amenaza: Estafa de airdrop de criptomonedas suplantando a Ryanair
• Objetivo: Individuos interesados en Ryanair y criptomonedas
• Método: Airdrop falso para recopilar información o fondos del usuario
• Exfil: Probablemente recopilando información de billetera de criptomonedas o dirigiendo a los usuarios a sitios de phishing
• Indicadores: Dominio no oficial, dominio nuevo, promesas de criptomonedas e impersonación de marca
• Riesgo: ALTO - Potencial de pérdida financiera a través de estafa de criptomonedas

🔒 Obfuscation Detected

atob
base64_strings

📡 API Calls Detected

https://lite-api.jup.ag/tokens/v2/search?query=
POST

📊 Desglose de Puntuación de Riesgo

Total Risk Score

100/100

Contributing Factors

Active Phishing Kit

Detected Credential Harvester, OTP Stealer, and Banking kits with real-time interception capabilities.

High Obfuscation

38 obfuscation techniques detected in JavaScript files, indicating evasion of static analysis.

Brand Impersonation

Domain ryanair.top impersonates Ryanair, a well-known airline brand, to deceive victims.

Suspicious Claims

Detected fake claims of free crypto rewards and urgency tactics ('Hurry up!') to manipulate victims.

🔬 Análisis Integral de Amenazas

Tipo de Amenaza

Banking Credential Harvester

Objetivo

Ryanair users (International)

Método de Ataque

Brand impersonation + obfuscated JavaScript

Canal de Exfiltración

Form submission (backend endpoint not detected - likely JavaScript-based)

Evaluación de Riesgo

CRITICAL - Automated credential harvesting with Form submission (backend endpoint not detected - likely JavaScript-based)

⚠️ Indicators of Compromise

Kit types: Credential Harvester, OTP Stealer, Banking, Personal Info
38 obfuscation techniques

🏢 Análisis de Suplantación de Marca

Impersonated Brand

Ryanair

Official Website

https://www.ryanair.com

Fake Service

Free cryptocurrency token distribution

Fraudulent Claims

⚔️ Metodología de Ataque

Primary Method: CRYPTO_SCAM

The campaign lures victims with fake crypto rewards, likely tricking them into connecting wallets (e.g., MetaMask, Phantom) to drain funds via malicious smart contract interactions or token approvals.

Secondary Method: CREDENTIAL_HARVESTING

While no forms were detected, the presence of a Credential Harvester kit suggests potential hidden fields or dynamic form injection to capture login credentials or OTPs.

🌐 Indicadores de Compromiso de Infraestructura

Domain Information

Dominio

ryanair.top

Registered

2026-01-19 21:11:23+00:00

Registrar

PDR Ltd. d/b/a PublicDomainRegistry.com

Estado

Recently registered (7 days old)

🦠 Malicious Files

Main File

File Size

Contains obfuscated JavaScript with 38 detected obfuscation techniques, likely for evasion and malicious payload delivery.

📊 Diagrama de Flujo de Ataque

┌──────────────────────────────────────────────────────────┐
│ 1. VICTIM RECEIVES PHISHING LURE                          │
│    - Fake Ryanair crypto promotion email/link            │
└────────────────────┬─────────────────────────────────────┘
                     │
                     ▼
┌──────────────────────────────────────────────────────────┐
│ 2. VICTIM LANDS ON FAKE RYANAIR PAGE                     │
│    - Mimics legitimate Ryanair site                      │
│    - Displays crypto investment scam                     │
└────────────────────┬─────────────────────────────────────┘
                     │
                     ▼
┌──────────────────────────────────────────────────────────┐
│ 3. VICTIM ENTERS CRYPTO WALLET DETAILS                   │
│    - Fake form requests wallet credentials               │
│    - May include "investment" amount fields              │
└────────────────────┬─────────────────────────────────────┘
                     │
                     ▼
┌──────────────────────────────────────────────────────────┐
│ 4. DATA EXFILTRATION                                     │
│    - Form submits via HTTP POST                          │
│    - Wallet details sent to attacker server              │
└──────────────────────────────────────────────────────────┘

🔬 JavaScript Deep Analysis

Operator Language

English (1%)

Sophistication Level

Basic

Total Code Size

620,5 KB

🔗 API Endpoints Detected

Other

64

Helius RPC

1

Solana RPC

2

Telegram API

1

🔐 Obfuscation Detected

: Heavy
: Light
: Light

🤖 AI-Extracted Threat Intelligence

📊 Attack Flow

┌──────────────────────────────────────────────────────────┐
│ 1. VICTIM RECEIVES PHISHING LURE                          │
│    - Fake Ryanair crypto promotion email/link            │
└────────────────────┬─────────────────────────────────────┘
                     │
                     ▼
┌──────────────────────────────────────────────────────────┐
│ 2. VICTIM LANDS ON FAKE RYANAIR PAGE                     │
│    - Mimics legitimate Ryanair site                      │
│    - Displays crypto investment scam                     │
└────────────────────┬─────────────────────────────────────┘
                     │
                     ▼
┌──────────────────────────────────────────────────────────┐
│ 3. VICTIM ENTERS CRYPTO WALLET DETAILS                   │
│    - Fake form requests wallet credentials               │
│    - May include "investment" amount fields              │
└────────────────────┬─────────────────────────────────────┘
                     │
                     ▼
┌──────────────────────────────────────────────────────────┐
│ 4. DATA EXFILTRATION                                     │
│    - Form submits via HTTP POST                          │
│    - Wallet details sent to attacker server              │
└──────────────────────────────────────────────────────────┘