# PhishDestroy threat dossier — change-lly.com ================================================================ Fetched: 2026-04-26 17:01:26 UTC Canonical: https://phishdestroy.io/domain/change-lly.com/ ## VERDICT ---------------------------------------------------------------- CRITICAL THREAT — DO NOT VISIT Composite threat score: 100/100 (PhishDestroy scoring — see methodology below) Scam classification: Fake Exchange ## DETECTION EVIDENCE ---------------------------------------------------------------- VirusTotal: 10/95 security vendors flagged this domain Flagging vendors: ADMINUSLabs, BitDefender, Chong Lua Dao, CRDF, CyRadar, G-Data, Kaspersky, Lionic, Sophos, Webroot URLQuery: 2 detections ## INFRASTRUCTURE ---------------------------------------------------------------- IP address: 176.125.242.151 Registrar: Dynadot Inc Nameservers: ns1.dyna-ns.net, ns2.dyna-ns.net Registered: 2026-03-25 Page title: Changelly | Crypto Exchange HTTP response: 200 ## TLS CERTIFICATE ---------------------------------------------------------------- Issuer: Let's Encrypt / R13 Expires: 2026-06-23 Status: INVALID chain Fingerprint: cc7d97f068fdee2979435e8a7812f83ee6c1df3b52e2942271c6264580ed737f Subject Alternative Names (related infrastructure — often same operator): - www.change-lly.com ## ABUSE-REPORT HISTORY (evidence of registrar non-response) ---------------------------------------------------------------- Status: pending notification queue. No abuse reports filed yet — this domain is waiting for the next cycle of our automated abuse-reporter. ## TIMELINE ---------------------------------------------------------------- Domain registered: 2026-03-25 (per WHOIS / CT — may reflect a renewal or transfer date, not first-ever registration) First detected: 2026-04-26 17:03:19 UTC (by PhishDestroy tracker) First reported: 2026-04-26 14:04:56 UTC (abuse notice filed) Last verified: 2026-04-26 19:50:02 UTC Current status: ACTIVE / observable ## EXTERNAL CORROBORATION (third-party evidence) ---------------------------------------------------------------- URLScan.io: https://urlscan.io/result/019dca17-95ae-76ba-8f65-edb472714d26/ URLQuery: https://urlquery.net/report/8759631c-85a9-4fcf-8d9a-ce1e1d75d76c Wayback Machine: https://web.archive.org/web/*/change-lly.com crt.sh CT logs: https://crt.sh/?q=%25.change-lly.com Google transparency: https://transparencyreport.google.com/safe-browsing/search?url=change-lly.com AlienVault OTX: https://otx.alienvault.com/indicator/domain/change-lly.com URLhaus: https://urlhaus.abuse.ch/host/change-lly.com/ ## ANALYST NARRATIVE ---------------------------------------------------------------- [Generated: 2026-04-26 17:05:00 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.] PhishDestroy identifies change-lly.com as an active crypto drainer impersonating the legitimate Changelly crypto exchange platform. The domain leverages brand impersonation to deceive users into transferring cryptocurrency to attacker-controlled wallets under the guise of a legitimate exchange service. With a risk level currently under investigation, the threat remains active and poses a significant risk to users seeking cryptocurrency exchange services. The domain's use of a crypto drainer mechanism—designed to siphon funds during transactions—highlights the sophistication and malicious intent behind this campaign. Users interacting with this domain could face irreversible financial losses, as the drainer operates silently in the background during what appears to be a routine transaction. Immediate action is required to mitigate exposure to this threat. This domain was flagged with the following technical indicators and supporting data. The domain change-lly.com resolves to IP address 176.125.242.151 and is registered through Dynadot Inc. The SSL certificate is issued by Let's Encrypt, which does not inherently indicate maliciousness but is commonly abused for low-cost TLS encryption. The domain was created on March 25, 2026, indicating it is a very recent registration, a common tactic among threat actors to avoid historical blocklists. As of the latest scan, VirusTotal shows 0 detections out of 95 engines, suggesting it remains largely undetected by current security tools. The page title, 'Changelly | Crypto Exchange,' is identical to the legitimate Changelly platform, reinforcing the impersonation angle. Trust scores and historical intelligence remain limited due to the domain's recent creation, but the combination of active status, low detection rate, and brand impersonation elevates the risk profile. Mitigation against this threat requires immediate defensive action. Organizations and security teams should block the domain change-lly.com and its associated IP address 176.125.242.151 at the network perimeter and DNS level to prevent user access. User awareness training should emphasize the dangers of clicking on links from untrusted sources or entering credentials on unfamiliar crypto exchange platforms. For crypto users, verify the authenticity of any exchange platform by directly navigating to the official URL or using bookmarked links—never through third-party links or advertisements. Security solutions should incorporate threat intelligence feeds that flag newly registered domains with low detection rates and those mimicking high-value brands like Changelly. Continuous monitoring of this domain is recommended, as detection rates may increase over time with wider exposure. ## EVIDENCE HASHES ---------------------------------------------------------------- PhishDestroy Case ID: PD-20260426-08B018 Favicon MD5: e0da15098c6d64922d622e38e8396dbf TLS cert SHA-256: cc7d97f068fdee2979435e8a7812f83ee6c1df3b52e2942271c6264580ed737f ## SCORING METHODOLOGY ---------------------------------------------------------------- Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates: - VirusTotal positive ratio - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus, CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB) - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor) - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.) - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing - URLScan / URLQuery verdicts - Brand-impersonation heuristics (DOM analysis of forms, logos, wording) - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures) - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...) - Free-TLS vs paid-cert ratio (throwaway infrastructure signal) - Registrar/hosting abuse history (this registrar's track record) - Human researcher sign-off (volunteer takedown team) A domain present in our database is ALREADY flagged. A low VT count by itself does NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their first 7–30 days while actively draining wallets. Always cross-reference the composite score and the individual indicators above, not just VT. ## CORRECTIONS / APPEALS ---------------------------------------------------------------- Full HTML report: https://phishdestroy.io/domain/change-lly.com/ JSON API: https://api.destroy.tools/v1/check?domain=change-lly.com Appeal a flag: https://phishdestroy.io/appeals/ (responded to within 48 hours, FP rate <0.01%) Submit a report: https://t.me/PhishDestroy_bot About PhishDestroy: volunteer-driven open-source threat-intelligence platform. Tracked: 131,000+ phishing domains. Confirmed takedowns: 91,000+. Site: https://phishdestroy.io