seongsu-exchange[.]kr

Analysis of seongsu-exchange.kr indicates a high‑risk, active malicious infrastructure. The domain was registered on May 23, 2026 and immediately returned an HTTP 301 response. DNS resolution points to 172.67.180.23, an IP owned by Cloudflare, Inc., which is commonly leveraged to hide attacker origins. The site presents the page title "MONEYBOX 성수역점 | 20개국 환전 & 짐보관소," matching the declared scam type of a fake exchange. Security telemetry shows the domain appears on three blocklists and is explicitly blocked by PhishDestroy, MetaMask, and SEAL. A Gridinsoft trust score of 0/100 further signals malicious intent. VirusTotal reports one of ninety‑one scanning engines flagging the domain, and AlienVault OTX references the domain in a single threat pulse. The SSL certificate is issued by Let’s Encrypt (E7), offering no indication of legitimacy. While the exact page content has not been captured, the combination of recent registration, redirection behavior, blocklist presence, low trust score, and detection by multiple security products strongly suggests the domain is being used for a counterfeit exchange operation. Defenders should add the domain to deny lists, monitor DNS queries for the associated IP, and consider sinkholing traffic to prevent victim exposure. Continuous re‑evaluation is advised in case the infrastructure evolves.