change-lly[.]com

PhishDestroy identifies change-lly.com as an active crypto drainer impersonating the legitimate Changelly crypto exchange platform. The domain leverages brand impersonation to deceive users into transferring cryptocurrency to attacker-controlled wallets under the guise of a legitimate exchange service. With a risk level currently under investigation, the threat remains active and poses a significant risk to users seeking cryptocurrency exchange services. The domain's use of a crypto drainer mechanism—designed to siphon funds during transactions—highlights the sophistication and malicious intent behind this campaign. Users interacting with this domain could face irreversible financial losses, as the drainer operates silently in the background during what appears to be a routine transaction. Immediate action is required to mitigate exposure to this threat. This domain was flagged with the following technical indicators and supporting data. The domain change-lly.com resolves to IP address 176.125.242.151 and is registered through Dynadot Inc. The SSL certificate is issued by Let's Encrypt, which does not inherently indicate maliciousness but is commonly abused for low-cost TLS encryption. The domain was created on March 25, 2026, indicating it is a very recent registration, a common tactic among threat actors to avoid historical blocklists. As of the latest scan, VirusTotal shows 0 detections out of 95 engines, suggesting it remains largely undetected by current security tools. The page title, 'Changelly | Crypto Exchange,' is identical to the legitimate Changelly platform, reinforcing the impersonation angle. Trust scores and historical intelligence remain limited due to the domain's recent creation, but the combination of active status, low detection rate, and brand impersonation elevates the risk profile. Mitigation against this threat requires immediate defensive action. Organizations and security teams should block the domain change-lly.com and its associated IP address 176.125.242.151 at the network perimeter and DNS level to prevent user access. User awareness training should emphasize the dangers of clicking on links from untrusted sources or entering credentials on unfamiliar crypto exchange platforms. For crypto users, verify the authenticity of any exchange platform by directly navigating to the official URL or using bookmarked links—never through third-party links or advertisements. Security solutions should incorporate threat intelligence feeds that flag newly registered domains with low detection rates and those mimicking high-value brands like Changelly. Continuous monitoring of this domain is recommended, as detection rates may increase over time with wider exposure.