VirusTotal
10 / 91
“Rango Exchange | Swap Anything Anywhere”
rangi.exchange — İçerik kullanılamıyor. Marka kimliğine bürünme: Across; Dolandırıcılık türü: Fake Exchange. Kanıt özeti: VirusTotal 10/91 (ADMINUSLabs, alphaMountain.ai, BitDefender, Chong Lua Dao, ESET); Spamhaus DBL_PHISH; PhishDestroy score 93/100. Kayıt kuruluşu: NiceNIC.
Özgün adli kaydı korumak için aşağıdaki ayrıntılı PhishDestroy AI analizi İngilizce bırakılmıştır.
Analysis as of July 23 2026 indicates that rangi.exchange was registered through NiceNIC International Group Co., Limited on 21 February 2026 and is currently taken offline. The domain resolves to 104.21.24.198, an address owned by Cloudflare, Inc. (AS13335) located in the United States. DNS resolution uses Cloudflare’s authoritative nameservers dean.ns.cloudflare.com and sonia.ns.cloudflare.com, and the site was served over HTTP/3 without an SSL/TLS certificate, confirming the absence of encryption. Infrastructure fingerprints show a Node.js application stack running Express, with embedded YouTube references, consistent with a typical web‑based crypto‑exchange front end.
The page title returned by the server is “Rango Exchange | Swap Anything Anywhere,” which aligns with the classified scam type “Fake Exchange” and the claim that the site impersonates the brand “across.” Security telemetry reports that 14 of 93 VirusTotal scanners flagged the domain, and it appears on three external blocklists. Independent blocklist providers PhishDestroy, MetaMask, and SEAL have listed the domain as malicious, reinforcing the risk assessment. The Gridinsoft trust score of 0 out of 100 further reflects a lack of legitimacy. No SSL certificate, combined with the low trust score and multiple vendor detections, suggests the site was likely used to lure victims into depositing cryptocurrency under false pretenses.
Because the site is offline, active exploitation cannot be confirmed, but the observed infrastructure and detection history indicate a high‑confidence fraudulent operation. Defenders should continue to block the domain at network perimeter and DNS layers, monitor for any re‑registration attempts, and advise users to avoid any unsolicited communications referencing “Rango Exchange” or the “across” brand. Ongoing threat‑intel feeds should be checked for new indicators that might associate the IP address or Cloudflare name servers with similar scams.
Bu ana bilgisayar için saklanmış tarayıcı-karşı-tarayıcı gözlemleri ile Keitaro tarzı trafik dağıtım sistemleri için gerçek zamanlı parmak izi kontrolü.
Tarayıcı notu: unavailable: raw=connection_error; http=0; via=http_proxy; error=SOCKSHTTPConnectionPool(host='rangi.exchange', port=80): Max retries exceeded with url: / (Caused by NewConnectionError(
For this gTLD, the registrar above operates under an ICANN accreditation agreement. The links below provide the official fee schedule and current DNS abuse compliance guidance.
RAA §3.18 establishes abuse-contact and handling requirements. This report can document stored outbound notices and later technical observations; it does not by itself establish receipt, investigation, remediation, or contractual non-compliance.
Edge-IP itibarı bu etki alanıyla ilişkilendirilmez.
dean.ns.cloudflare.comsonia.ns.cloudflare.comLocation describes the IP network.
18 recorded events. These records describe collected evidence, outgoing notifications and publication; they do not confirm a complete investigation or a takedown.
We scan suspicious URLs, inspect public results and send evidence through the appropriate abuse-reporting channels. The dated events above show what is recorded for this domain. The directory below explains the wider workflow.
Capture the rendered page, requests and visible infrastructure.
Compare the available engine results and retain the analysis timestamp.
Check whether Google currently lists the URL as unsafe.
Inspect a public scan and its recorded network and classification data.
Look for indicator references and related community intelligence.
Compare archived captures and preserve historical context.
Look for matching indicators and associated threat records.
Inspect certificate records and related hostnames.
Compare security resolver responses and record observed blocking.
Inspect the public DNS, TLS, HTTP and technology surface.
Security services used for scanning, reputation checks and reporting are listed below. A service being listed is not evidence that it received, accepted or acted on this particular domain. Recorded submissions appear in the notification history above.
1 topluluk üyesi tarafından bildirildi; ilk görülme 21.01.2026
Hesap kimlik bilgilerini, kişisel bilgileri veya ödeme bilgilerini girdiyseniz ya da bu alan adından bir dosya indirdiyseniz hemen harekete geçin. Aşağıda olayı bildirmenize ve kendinizi korumanıza yardımcı olacak kaynaklar bulunmaktadır.
resmi siber suç iletişim bilgileri veya şikayet taslağı oluştur → almak için ülkenizi seçin.
Template-based draft · optional AI wording assistance requires separate consent
Saklanan engelleme listesi, WHOIS, DNS ve genel tarama kanıtlarını kullanarak tehdit analizi
Şimdi TaraŞüpheli alan adlarını tehdit veritabanımıza bildirin — topluluğu koruyun
BildirSon kimlik avı raporları ve gözlemlenen kullanılabilirlik değişiklikleri
İzleCanlı tehditleri izleyin veya bunun yanlış bir uyarı olduğunu düşünüyorsanız bu kayda itiraz edin