001k-exchange[.]club

Analysis of 001k-exchange.club shows a deliberately crafted fake exchange targeting Binance users. The domain was registered on October 25, 2025 through Dynadot LLC and resolves to 104.21.34.208, an address owned by Cloudflare (AS13335) in the United States. DNS resolution is handled by miki.ns.cloudflare.com and simon.ns.cloudflare.com, confirming the use of Cloudflare’s authoritative nameservers. The site served an SSL certificate issued by Google Trust Services (WE1), indicating a valid TLS handshake despite the malicious intent.

The page title, "001K.EXCHANGE - выгодный и безопасный обмен электронных валют," is presented in Russian and advertises a “profitable and safe exchange of electronic currencies,” a classic lure for cryptocurrency users. Gridinsoft assigned a trust score of 0 out of 100, reinforcing the high‑risk classification. VirusTotal scans recorded detections by 2 of 95 security vendors, and the domain appears on a single security blocklist as well as one AlienVault OTX pulse, evidencing limited but concrete threat intelligence sharing. PhishDestroy has already blocked the domain, and the current operational status is offline, suggesting the site may be intermittently active or taken down by mitigation efforts.

The impersonated brand is Binance, and the scam type is identified as a Fake Exchange, meaning the site likely attempts to harvest credentials or funds by mimicking legitimate Binance services. Defenders should add 001k-exchange.club to URL filtering and DNS block lists, monitor the associated IP and Cloudflare nameservers for any re‑registration or new subdomains, and enforce multi‑factor authentication for Binance accounts to mitigate credential harvesting. Continuous threat‑intel feeds should be consulted for any resurgence of the domain or related infrastructure, and incident response teams should be prepared to investigate any user reports of unauthorized Binance activity that reference this domain.