ff-app[.]org

Analysis indicates that ff-app.org is an active high-risk domain flagged as a cryptocurrency scam targeting users of the FixedFloat platform. The domain was registered on April 26, 2026, through Dynadot Inc and currently resolves to the IP address 176.125.242.151, hosted by Alexhost SRL in Moldova. Infrastructure analysis reveals the use of nameservers ns1.dyna-ns.net and ns2.dyna-ns.net, and the web server is identified as Nginx. The site presents itself with the page title 'FixedFloat: Swap Your Crypto Easily,' suggesting an intent to impersonate the legitimate FixedFloat cryptocurrency exchange service. The domain is actively blocked by three security blocklists, including PhishDestroy, MetaMask, and SEAL, and holds a Scamadviser trust score of 11/100 and a Gridinsoft trust score of 0/100. While VirusTotal reports that 3 out of 91 security vendors detect this domain as malicious, this count should be interpreted cautiously, as detection coverage may not reflect the full scope of the threat. The domain remains operational as of July 12, 2026, returning an HTTP 200 status code and utilizing a Let's Encrypt SSL certificate, which does not inherently validate the site's legitimacy. Defenders should treat ff-app.org as a confirmed malicious domain associated with cryptocurrency fraud. Immediate action is recommended, including blocking the domain and IP at the network perimeter, alerting users to the threat, and monitoring for related infrastructure, such as additional domains registered through the same registrar or resolving to the same IP range. The exact mechanics of the scam—whether it involves credential harvesting, wallet-draining scripts, or fraudulent transactions—remain unconfirmed due to the absence of deeper page-level analysis. However, the combination of brand impersonation, low trust scores, and active blocklisting strongly supports its classification as a high-risk crypto scam.