SafeMode - Analysis: ryanair.top

Captura Visual

Informações de Detecção

http://ryanair.top

Detected Brand

Ryanair

Country

International

Confiança

100%

HTTP Status

200

Report ID

f7ec2644-38f…

Analyzed

2026-01-27 19:02

Final URL (after redirects)

https://ryanair.top/

Hashes de Conteúdo (Similaridade HTML)

Used to detect similar phishing pages based on HTML content

Algorithm	Hash Value
CONTENT TLSH	T1AEC283B06214513BA11796C7AF22773936FBB1FEE9BA0100E3FD46909BE4DD9AC23444
CONTENT ssdeep	384:83WtqY+SAaudOgU74CyZdwq/e2oxRYXT+64ylFOU0KX2Cc8HYc1RcWc66hT:8YAaum/y7w32GRYXTrlFH0KvYwUT

Hashes Visuais (Similaridade de Captura)

Used to detect visually similar phishing pages based on screenshots

Algorithm	Hash Value
VISUAL pHash	92922d6de99696e2
VISUAL aHash	02646c6c4000407e
VISUAL dHash	96cdcd8d9268d4d4
VISUAL wHash	47447c7e60047e7e
VISUAL colorHash	38007000000
VISUAL cropResistant	e89862c4cda2e6e8,96cdcd8d9268d4d4

Análise de Código

Risk Score 88/100

Nível de Ameaça ALTO

⚠️ Phishing Confirmed

🎣 Credential Harvester 🎣 OTP Stealer 🎣 Banking 🎣 Personal Info

🔬 Threat Analysis Report

• Ameaça: Golpe de airdrop de criptomoedas se passando por Ryanair
• Alvo: Indivíduos interessados em Ryanair e criptomoedas
• Método: Airdrop falso para coletar informações ou fundos do usuário
• Exfil: Provavelmente coletando informações de carteira de criptomoedas ou direcionando usuários para sites de phishing
• Indicadores: Domínio não oficial, domínio novo, promessas de criptomoedas e representação de marca
• Risco: ALTO - Potencial de perda financeira por meio de golpe de criptomoedas

🔒 Obfuscation Detected

atob
base64_strings

📡 API Calls Detected

https://lite-api.jup.ag/tokens/v2/search?query=
POST

📊 Detalhamento da Pontuação de Risco

Total Risk Score

100/100

Contributing Factors

Active Phishing Kit

Detected Credential Harvester, OTP Stealer, and Banking kits with real-time interception capabilities.

High Obfuscation

38 obfuscation techniques detected in JavaScript files, indicating evasion of static analysis.

Brand Impersonation

Domain ryanair.top impersonates Ryanair, a well-known airline brand, to deceive victims.

Suspicious Claims

Detected fake claims of free crypto rewards and urgency tactics ('Hurry up!') to manipulate victims.

🔬 Análise Integral de Ameaças

Tipo de Ameaça

Banking Credential Harvester

Alvo

Ryanair users (International)

Método de Ataque

Brand impersonation + obfuscated JavaScript

Canal de Exfiltração

Form submission (backend endpoint not detected - likely JavaScript-based)

Avaliação de Risco

CRITICAL - Automated credential harvesting with Form submission (backend endpoint not detected - likely JavaScript-based)

⚠️ Indicators of Compromise

Kit types: Credential Harvester, OTP Stealer, Banking, Personal Info
38 obfuscation techniques

🏢 Análise de Falsificação de Marca

Impersonated Brand

Ryanair

Official Website

https://www.ryanair.com

Fake Service

Free cryptocurrency token distribution

Fraudulent Claims

⚔️ Metodologia de Ataque

Primary Method: CRYPTO_SCAM

The campaign lures victims with fake crypto rewards, likely tricking them into connecting wallets (e.g., MetaMask, Phantom) to drain funds via malicious smart contract interactions or token approvals.

Secondary Method: CREDENTIAL_HARVESTING

While no forms were detected, the presence of a Credential Harvester kit suggests potential hidden fields or dynamic form injection to capture login credentials or OTPs.

🌐 Indicadores de Compromisso de Infraestrutura

Domain Information

Domínio

ryanair.top

Registered

2026-01-19 21:11:23+00:00

Registrar

PDR Ltd. d/b/a PublicDomainRegistry.com

Estado

Recently registered (7 days old)

🦠 Malicious Files

Main File

File Size

Contains obfuscated JavaScript with 38 detected obfuscation techniques, likely for evasion and malicious payload delivery.

📊 Diagrama de Fluxo de Ataque

┌──────────────────────────────────────────────────────────┐
│ 1. VICTIM RECEIVES PHISHING LURE                          │
│    - Fake Ryanair crypto promotion email/link            │
└────────────────────┬─────────────────────────────────────┘
                     │
                     ▼
┌──────────────────────────────────────────────────────────┐
│ 2. VICTIM LANDS ON FAKE RYANAIR PAGE                     │
│    - Mimics legitimate Ryanair site                      │
│    - Displays crypto investment scam                     │
└────────────────────┬─────────────────────────────────────┘
                     │
                     ▼
┌──────────────────────────────────────────────────────────┐
│ 3. VICTIM ENTERS CRYPTO WALLET DETAILS                   │
│    - Fake form requests wallet credentials               │
│    - May include "investment" amount fields              │
└────────────────────┬─────────────────────────────────────┘
                     │
                     ▼
┌──────────────────────────────────────────────────────────┐
│ 4. DATA EXFILTRATION                                     │
│    - Form submits via HTTP POST                          │
│    - Wallet details sent to attacker server              │
└──────────────────────────────────────────────────────────┘

🔬 JavaScript Deep Analysis

Operator Language

English (1%)

Sophistication Level

Basic

Total Code Size

620,5 KB

🔗 API Endpoints Detected

Other

64

Helius RPC

1

Solana RPC

2

Telegram API

1

🔐 Obfuscation Detected

: Heavy
: Light
: Light

🤖 AI-Extracted Threat Intelligence

📊 Attack Flow

┌──────────────────────────────────────────────────────────┐
│ 1. VICTIM RECEIVES PHISHING LURE                          │
│    - Fake Ryanair crypto promotion email/link            │
└────────────────────┬─────────────────────────────────────┘
                     │
                     ▼
┌──────────────────────────────────────────────────────────┐
│ 2. VICTIM LANDS ON FAKE RYANAIR PAGE                     │
│    - Mimics legitimate Ryanair site                      │
│    - Displays crypto investment scam                     │
└────────────────────┬─────────────────────────────────────┘
                     │
                     ▼
┌──────────────────────────────────────────────────────────┐
│ 3. VICTIM ENTERS CRYPTO WALLET DETAILS                   │
│    - Fake form requests wallet credentials               │
│    - May include "investment" amount fields              │
└────────────────────┬─────────────────────────────────────┘
                     │
                     ▼
┌──────────────────────────────────────────────────────────┐
│ 4. DATA EXFILTRATION                                     │
│    - Form submits via HTTP POST                          │
│    - Wallet details sent to attacker server              │
└──────────────────────────────────────────────────────────┘