changeliy[.]at

Analysis of the domain changeliy.at indicates that it was registered on 21 February 2026 through Hosting Concepts B.V. d/b/a Registrar.eu and is currently taken offline. DNS resolution points to the IPv4 address 158.94.209.135, which is assigned to AS202412 (Omegatech LTD) in the Netherlands. The authoritative name servers are ns1.openprovider.nl, ns2.openprovider.be, and ns3.openprovider.eu, indicating use of the OpenProvider DNS service. The web server responds with Nginx but presents no SSL/TLS certificate, meaning traffic is unencrypted and susceptible to interception. The only content retrieved before takedown was a page titled “Fast Crypto Exchange | BTC to USDT,” suggesting an attempt to lure victims into a cryptocurrency transaction scam.

VirusTotal records show that six out of ninety‑three scanning engines flagged the domain, reinforcing the malicious assessment. Independent reputation services assign a Gridinsoft trust score of zero out of one hundred, and the domain is listed on a single security blocklist. PhishDestroy has also added it to its blocklist. These signals collectively indicate a high confidence that the site was used for phishing or fraud. Uncertainty remains regarding the exact phishing kit or the full set of victim targeting methods, as no additional page content or traffic logs have been released.

Defenders should continue to block the domain and its associated IP address at perimeter and DNS filtering layers. Monitoring for any re‑registration of the same name or reuse of the hosting infrastructure is advisable. Because the site lacks HTTPS, any inadvertent access could expose credentials or financial information; users should be warned not to interact with URLs matching changeliy.at or the resolved IP. Ongoing intelligence gathering should include periodic rescans on VirusTotal and inclusion of the IP in threat‑intel feeds.