⚠ PROOF OF CONCEPT — Exinity BugBounty Program --> YesWeHack — security research only Demonstration page for an open-redirect report. It is inert: no field is transmitted, stored or logged, and no form has an action. Not affiliated with Exinity, Alpari or FXTM.
Client Verification Portal
Secure session · Step 1 of 3
✓ Account created
2 Identity document
3 Proof of address

Verify your identity

To comply with regulatory requirements we need to confirm your identity before your account can be funded. Please upload a clear photograph of your passport and confirm the details below.

🛂

Upload your passport

JPG, PNG or PDF · max 10 MB · all four corners visible
Required by your local regulator for accounts holding client funds.

Confirm it's you

Your session expired while the documents were being prepared. Sign in again to submit your verification.

Demonstration only — nothing was captured, and nothing left this page. In a real attack every field above, plus the uploaded passport image, would be sent to the attacker's server.

WHAT THIS PAGE DEMONSTRATES

  1. The victim receives a link whose visible host is the genuine trading platform, under its real certificate:
    https://trade.alpari.com/assets/kyc/kyc_verification.html?token=any-invalid-value&redirectUrl=https%3A%2F%2Falparifxcompany.com%2F
  2. The page reads redirectUrl from the query string and passes it to redirect(), which sets window.location if the host matches its allow-list. No click and no session are required.
  3. The allow-list contains alparifxcompany.com, which is not registered — Verisign RDAP returns 404 and DNS returns NXDOMAIN. Anyone can register it for retail price.
  4. The victim lands on a page like this one, on a domain whose name reads as an official regional site of their broker, in the middle of the flow where handing over identity documents is exactly what they expect.