alternative-financepartners[.]com
“Buy & Sell Bitcoin, Ethereum | Cryptocurrency Exchange | A F P”
alternative-financepartners.com — Contenuto non disponibile (HTTP 502). Simulazione del marchio: Ethereum; Tipo di truffa: Fake Exchange. Riepilogo delle prove: VirusTotal 2/93 (SOCRadar, URLQuery); PhishDestroy score 56/100.
L’analisi dettagliata di PhishDestroy AI resta in inglese per preservare il rapporto forense originale.
Analysis of alternative-financepartners.com shows a short‑lived infrastructure that was created on February 21, 2026 and subsequently taken offline before the report date of July 24, 2026. The domain resolves to IP address 45.152.162.78, which is registered to AS200019 ALEXHOST SRL in France. The site presented a page titled "Buy & Sell Bitcoin, Ethereum | Cryptocurrency Exchange | A F P," a title that aligns with the reported scam type of a fake cryptocurrency exchange and explicitly targets the Ethereum brand. Technical fingerprints collected from the landing page include a Node.js back‑end, client‑side libraries such as Chart.js, Vue.js and Nuxt.js, as well as Cloudflare CDN, jsDelivr asset delivery, HSTS enforcement and a Facebook Pixel tag.
The SSL certificate is identified as "E7," indicating a publicly visible TLS certificate, but no further trust indicators were observed. VirusTotal scans recorded detections by 2 of 93 security vendors, and the domain appears on a single blocklist operated by PhishDestroy, confirming that at least some security products consider the site malicious. While the domain is currently offline, its brief activity window suggests an opportunistic credential‑stealing or fund‑extraction campaign aimed at users seeking to trade Ethereum.
The evidence does not reveal the exact phishing pages or credential capture mechanisms, leaving the precise attack flow uncertain. Defenders should continue to block the domain and its associated IP address at perimeter filters, monitor DNS logs for any re‑registration attempts, and incorporate the observed technology stack into heuristic rules for detecting similar fake exchange sites. Continuous threat‑intel feeds should be consulted for any resurgence of the domain or related infrastructure, and users should be warned against any unsolicited offers referencing Ethereum trading on sites matching the observed page title.
Pipeline di risposta alle minacce
Stato della lista di blocco pubblica
Tecnologie · 9 identified
JavaScript runtime built on Chrome V8 engine for server-side development.
Progressive JavaScript framework for building user interfaces.
Hybrid Vue framework for server-side rendering and static sites.
Web infrastructure and security company providing CDN, DDoS mitigation, and DNS services.
www.cloudflare.comFree public CDN for open-source projects, serving files from npm and GitHub.
HTTP Strict Transport Security — forces browsers to use HTTPS connections only.
Conversion-tracking pixel by Meta — logs page views and custom events to Facebook/Instagram ad accounts.
www.facebook.comAnalisi di VirusTotal
Dati e relazioni esterne
Questo sito ti ha influenzato in qualche modo?
Se hai inserito credenziali dell'account, informazioni personali o di pagamento oppure hai scaricato un file da questo dominio, agisci immediatamente. Di seguito sono riportate le risorse per aiutarti a segnalare l'incidente e proteggerti.
Segnalalo alle autorità locali
Seleziona il tuo Paese per ottenere contatti ufficiali del crimine informatico o creare una bozza di reclamo →.
Verifica qualsiasi dominio
Analisi delle minacce utilizzando blocklist archiviate, WHOIS, DNS e prove di scansione pubblica
Scansiona oraSegnala un tentativo di phishing
Segnala i domini sospetti al nostro database delle minacce — proteggi la comunità
SegnalaFeed in tempo reale sulle minacce
Segnalazioni recenti di phishing e modifiche osservate della disponibilità
MonitoraRimani informato, rimani al sicuro
Controlla le minacce in tempo reale oppure contesta questa segnalazione se ritieni che si tratti di un falso positivo