SafeMode - Analysis: cfd.alpinainvestlimited.com

Captura Visual

Screenshot of cfd.alpinainvestlimited.com

Informações de Detecção

http://cfd.alpinainvestlimited.com

Detected Brand

Alpina Investments Limited

Country

International

Confiança

100%

HTTP Status

200

Report ID

67da2b6a-fbe…

Analyzed

2026-01-29 04:06

Final URL (after redirects)

https://cfd.alpinainvestlimited.com/sign-in

Hashes de Conteúdo (Similaridade HTML)

Used to detect similar phishing pages based on HTML content

Algorithm	Hash Value
CONTENT TLSH	T117B193621918915B13531EC2FFA37B4E32BBF17EDDA21C90E1BF83984ADADC4D429406
CONTENT ssdeep	96:n7zn9sUJ6KssbRsbRJ0ge3QXifzzaTDUTrT+23kuYsClRlKhzLo6ET:7LO2zRVsVPe3QX0YuHHYsYoBEj

Hashes Visuais (Similaridade de Captura)

Used to detect visually similar phishing pages based on screenshots

Algorithm	Hash Value
VISUAL pHash	b2333e7735c823c4
VISUAL aHash	0707070707070f0f
VISUAL dHash	2dadbdbdbdfdbd3c
VISUAL wHash	07070f0f0f0f1f1f
VISUAL colorHash	0b0002000c0
VISUAL cropResistant	968c8e8e889696c0,9e9e9e96de9e9efe,acdecace6e6e4e2e

Análise de Código

Risk Score 82/100

Nível de Ameaça ALTO

⚠️ Phishing Confirmed

🎣 Credential Harvester 🎣 OTP Stealer 🎣 Card Stealer 🎣 Banking 🎣 Personal Info

🔬 Threat Analysis Report

• Ameaça: Phishing de Credenciais
• Alvo: Usuários da Alpina Investments Limited
• Método: Falsificação através de uma página de login.
• Exfil: Potencialmente para locais desconhecidos via javascript ofuscado.
• Indicadores: Subdomínio suspeito, formulário solicitando credenciais, ofuscação.
• Risco: ALTO

🔒 Obfuscation Detected

fromCharCode
hex_escape
unicode_escape
base64_strings

📡 API Calls Detected

POST

📊 Detalhamento da Pontuação de Risco

Total Risk Score

85/100

Contributing Factors

Suspicious Subdomain

The 'cfd' subdomain is unusual and raises suspicion.

Obfuscated Javascript

Obfuscation is used to hide malicious code from detection.

Forms Collecting Credentials

The page is designed to capture sensitive login credentials.

🔬 Análise Integral de Ameaças

Tipo de Ameaça

Banking Credential Harvester

Alvo

Alpina Investments Limited users (International)

Método de Ataque

Brand impersonation + credential harvesting forms + obfuscated JavaScript

Canal de Exfiltração

Form submission (backend endpoint not detected - likely JavaScript-based)

Avaliação de Risco

CRITICAL - Automated credential harvesting with Form submission (backend endpoint not detected - likely JavaScript-based)

⚠️ Indicators of Compromise

Kit types: Credential Harvester, OTP Stealer, Card Stealer, Banking, Personal Info
35 obfuscation techniques

🏢 Análise de Falsificação de Marca

Impersonated Brand

Alpina Investments Limited

Fake Service

Login Portal

⚔️ Metodologia de Ataque

Primary Method: Credential Harvesting

The attacker aims to steal user credentials by creating a fake login page that mimics the appearance of the Alpina Investments Limited website. Users are tricked into entering their email and password, which the attacker then captures.