ffloat[.]net

Domain ffloat.net has been flagged for hosting a generic crypto-drainer phishing kit masquerading as a 'FFloat Guide' conversion service. The page title and content are entirely in Russian, indicating a target audience likely interested in cryptocurrency conversion or arbitrage. No specific brand is impersonated beyond the generic term 'FFloat,' suggesting the operators are leveraging a newly minted term to avoid immediate detection. The kit’s purpose is to trick visitors into connecting crypto wallets and signing malicious transactions that drain balances. The domain was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED on April 17, 2026, and is currently resolving to IP 188.114.97.3 via a Let's Encrypt SSL certificate. The domain remains unflagged on VirusTotal with 1/95 detections as of this report. No known blocklist entries or Google Safe Browsing (GSB) flags have been recorded to date, indicating low prior visibility in threat intelligence feeds.

PhishDestroy identifies ffloat.net as a high-risk crypto-drainer operation based on multiple technical indicators. The domain was created on April 17, 2026, and is registered under NICENIC INTERNATIONAL GROUP CO., LIMITED. It resolves to IP address 188.114.97.3 and uses a valid SSL certificate issued by Let's Encrypt. The site currently shows zero detections on VirusTotal (1/95 engines), and no presence in public blocklists or GSB denylists has been detected. The page content—titled 'FFloat Guide | Конвертация криптовалюты в фиат'—suggests a Russian-language lure targeting users seeking crypto-to-fiat conversion tools. The absence of prior detection flags and the new domain registration strongly indicate a recently deployed, likely automated phishing campaign with minimal footprint in threat intelligence platforms.

As of this report, ffloat.net remains active and is actively serving the crypto-drainer payload. No takedown or remediation has been observed, and the domain continues to resolve normally. Given the zero VirusTotal detection rate and lack of blocklist presence, the risk to users remains elevated and unmitigated. PhishDestroy advises users to avoid visiting ffloat.net and to verify any similar sites using our platform before interacting. The current threat level is classified as 'under_investigation' pending further intelligence updates. Users who may have already visited the site are urged to revoke any wallet connections made via browser extensions or dApps, and to monitor their transaction histories for unauthorized transfers.