ff-exchange[.]app

Analysis of the domain ff-exchange.app, created on July 6 2025 and currently offline, shows that it was operated as a fraudulent cryptocurrency exchange front. The site resolved to IP 45.10.243.93, which belongs to AS57724 DDOS‑GUARD LTD in Russia. The domain is registered through Porkbun LLC and uses four Porkbun‑hosted nameservers: curitiba.ns.porkbun.com, fortaleza.ns.porkbun.com, maceio.ns.porkbun.com, and salvador.ns.porkbun.com. No TLS certificate was presented, and the HTTP response returned status code 200, indicating an unencrypted web service. The page title “ff-exchange.app | Cryptocurrency Exchanges Without Registration” aligns with the declared scam type “Fake Exchange”.

Reputation services have consistently flagged the domain. Four independent blocklists—PhishDestroy, Polkadot, Enkrypt, and Codeesura—have listed it, and Google Safe Browsing classifies the URL as a social‑engineering threat. VirusTotal recorded 17 positive detections out of 95 scanned vendors, reinforcing the malicious assessment. AlienVault OTX cites the domain in three separate threat‑intel pulses, further corroborating its malicious usage. Trust‑rating aggregators assign extremely low scores: Scamadviser 6/100 and Gridinsoft 0/100, reflecting a pervasive lack of credibility.

The evidence does not indicate the presence of a valid SSL certificate or any legitimate content, and the domain’s offline status suggests that the operators have removed the site, possibly in response to detection. However, the infrastructure—specifically the Russian‑based hosting provider and the use of a generic registrar—remains reusable for future campaigns. Defenders should block the domain and its resolving IP at network perimeters, update URL filtering lists with the four blocklist entries, and monitor for any re‑registration attempts under the same registrar. Continuous observation of the associated ASN (AS57724) for new domains exhibiting similar characteristics is also advised.