VirusTotal
9 / 92 engine detections
レポートを開く“Changelly | Crypto Exchange”
暗号資産ウォレットドレイナー: changelly-eng.com — 未検証. 証拠の概要: VirusTotal 9/92 (alphaMountain.ai, BitDefender, CRDF, Fortinet, G-Data); Spamhaus DBL_PHISH; 2 external…
元のフォレンジック記録を保持するため、下の PhishDestroy AI 詳細分析は英語のままです。
9 / 92 engine detections
レポートを開くDBL_PHISH
3 community references
レポートを開くprovider verdict: clean
レポートを開くNo threat flag
レポートを開くNo malicious flag
レポートを開くResults reflect each source’s collection time. Zero detections do not guarantee safety. OTX references are community publications.
PhishDestroy threat report
changelly-eng.com is a fraudulent site running a crypto wallet drainer under the guise of the legitimate Changelly exchange. It targets cryptocurrency holders who may be searching for exchange services and land on this impersonator instead. PhishDestroy first identified it on 2026-10-12, just six days after the domain was registered. As of 2026-10-19, DNS is inactive, meaning the site is no longer resolving, though the threat record remains active on blocklists.
The site presents itself as "Changelly | Crypto Exchange," mimicking the real platform's branding to earn the visitor's trust. Once a user connects their wallet — a standard step on any legitimate exchange — the embedded Angel Drainer kit takes over. Angel Drainer is a well-documented malicious toolkit that silently requests broad token approvals or signs transactions that transfer assets out of the victim's wallet to attacker-controlled addresses. The victim loses cryptocurrency and tokens without any obvious warning at the moment of interaction.
Nine of 92 engines on VirusTotal flagged this domain as malicious on 2026-10-12, with detections from alphaMountain.ai, BitDefender, CRDF, Fortinet, G-Data, Gridinsoft, Kaspersky, and Sophos. Spamhaus DBL lists it under the DBL_PHISH category, an independent phishing classification. The domain also appears on three OTX threat-intelligence pulses and is blocked by PhishDestroy, MetaMask, and SEAL. The page title aligns with the Changelly impersonation classification, and no conflicting signals were found in the available data.
The domain was registered on 2026-10-06 through Hosting Concepts B.V. d/b/a Registrar.eu. It resolved to an IP on the Omegatech LTD network in the Netherlands. The TLS certificate was issued by YE1. The domain's short lifespan between registration and first detection — six days — is consistent with throwaway infrastructure used in drainer campaigns.
If you visited this site and connected a wallet, immediately revoke all token approvals granted to any contract associated with it using a trusted approval-management tool. Transfer remaining assets to a fresh wallet address as a precaution, since a compromised approval cannot be undone by simply disconnecting. If you entered any credentials or personal information, treat them as compromised and change passwords on any related accounts. Security teams and wallet providers should ensure changelly-eng.com and its associated IP on Omegatech LTD are blocked at the network and application layer, and should monitor for successor domains using similar Changelly-themed naming patterns.
Last checked
ns3.openprovider.euLocation describes the IP network.
Saved certificate metadata. Certificate dates without a timezone are shown as stored. Transport encryption does not establish that the site is trustworthy.
An estimated time describes an observation window. It does not prove a registrar action or the exact moment a site became unavailable.
Dated changes retained by the monitor and source collectors. Newest observations appear first; source states are not proof of a takedown.
不明→dns_inactive
dns_nxdomain
不明→dns_inactive
dns_nxdomain
不明→dns_inactive
dns_nxdomain
不明→dns_inactive
dns_nxdomain
不明→dns_inactive
dns_nxdomain
不明→dns_inactive
dns_nxdomain
不明→dns_inactive
dns_nxdomain
dns_inactive
dns_nxdomain
3 community references
View sourceNo threat flag
View source9/92 engine detections
View sourcechangelly-eng.com
View source保存された類似ドメイン:79 件
Compare what a browser and a crawler receive, and check for Keitaro traffic routing.
changelly-eng.com
Listed domains receive at least one abuse report; this entry has no retained notification history.
このドメインを操作したり、個人情報を入力したり、暗号通貨ウォレットに接続したりした場合は、直ちに行動を起こしてください。インシデントを報告し、自分自身を守るのに役立つリソースを以下に示します。
サイバー犯罪の公式連絡先 または 苦情草稿を作成する → を取得するには、国を選択してください。
Template-based draft · optional AI wording assistance requires separate consent
Choose the steps that match what you shared. Keep a copy of this report alongside your own records.
推定では $51 billion 2024年に違法な暗号資産ウォレットへと流出した(source). もしあなたが changelly-eng.com — 今すぐ行動しましょう。
Wallet-specific steps below apply if you connected a wallet, signed a transaction, or exposed a wallet secret.
Stop using the suspicious site. Open the real service through its official app or an address you already trust.
によると、 FBI、最も重要な詳細はトランザクションデータです:
0x5856...35985)changelly-eng.com)たとえすべての詳細がわかっていなくても―― とにかく報告を提出する. 不完全な情報であっても、捜査には役立つ。
A report is not a guarantee of recovery or investigation, but prompt, accurate transaction data can help authorities and service providers trace the incident.
Further guidance: NIST · phishing responseFBI IC3 · reports & evidenceFTC · recovery scams
保存されたブロックリスト、WHOIS、DNS、および公開スキャン証拠を使用した脅威分析
今すぐスキャン不審なドメインを当社の脅威データベースに報告してください — コミュニティを守りましょう
レポート最近のフィッシングレポートと観察された可用性の変化
監視リアルタイムの脅威を監視するか、誤検知だと思われる場合はこのリストに異議を申し立ててください
This report combines saved page captures, registration and network records, scanner results and PhishDestroy reporting history. Each source keeps its own observation date. Open a source report to inspect the original result.
The AI-assisted analysis was written on . It describes the evidence available at that time; later source checks can change.
A capture documents what was shown. A scanner result records that provider’s assessment at the time of its check. Neither a valid certificate nor a zero-detection result is a guarantee of safety.