ff-excnange[.]at

This domain, ff-excnange.at, is flagged as a brand impersonation threat targeting Binance, a major cryptocurrency exchange platform. The site masquerades as FixedFloat, an instant cryptocurrency exchange service, to deceive users into entering sensitive credentials or transferring assets to attacker-controlled wallets. Analysis indicates the domain is designed to exploit trust in established brands, likely deploying credential theft or crypto drainer techniques to compromise user accounts and funds. Infrastructure analysis reveals the domain was registered through Key-Systems GmbH and currently resolves to IP address 172.67.143.228, hosted on Cloudflare’s network (AS13335). Security vendors on VirusTotal flagged the domain with a detection score of 16/95, indicating moderate but consistent identification as malicious. The SSL certificate is issued by Google Trust Services (WE1), a common tactic to lend legitimacy to fraudulent sites. The domain appears on one security blocklist, and its page title, "FixedFloat | Instant cryptocurrency exchange," further supports the impersonation narrative. As of the latest assessment, ff-excnange.at has been taken offline, reducing immediate exposure to users. However, the domain remains registered, and historical patterns suggest similar infrastructure may be repurposed for future campaigns. Organizations and individuals are advised to monitor for related domains, particularly those mimicking cryptocurrency services or leveraging Cloudflare hosting. Users should verify exchange URLs directly through official sources and employ multi-factor authentication to mitigate credential theft risks. Persistent vigilance is recommended, as threat actors frequently rotate domains and infrastructure to evade detection.