cosmochanger[.]com

The domain cosmochanger.com is confirmed as an active phishing site specializing in crypto drainer operations targeting Ethereum users. Analysis indicates this infrastructure is designed to impersonate legitimate cryptocurrency exchange services, tricking victims into connecting wallets to malicious smart contracts that execute unauthorized token transfers. The site remains operational as of the latest verification, posing a high risk to users interacting with Ethereum-based assets. Infrastructure analysis reveals the domain was registered on October 20, 2025, through Cosmotown, Inc., and resolves to the IP address 188.114.97.3, hosted on Cloudflare's network (AS13335). Security vendors on VirusTotal have flagged this domain as malicious, with 16 of 95 engines detecting it as a threat. The domain appears on five distinct security blocklists, including PhishDestroy, Polkadot, Enkrypt, Codeesura, and PhishingDB. The SSL certificate is issued by Google Trust Services (WE1), a common characteristic of both legitimate and malicious sites leveraging Cloudflare's services. The page title, "Безопасный обмен криптовалют | CosmoChanger - Самый реактивный," translates to "Secure Cryptocurrency Exchange | CosmoChanger - The Most Reactive," further indicating an attempt to mimic trustworthy exchange platforms. Current risk assessment classifies this domain as high severity due to its active status, direct targeting of cryptocurrency users, and the irreversible nature of crypto transactions. Users are strongly advised to avoid interacting with cosmochanger.com and any associated links. Wallet providers and security teams should update blocklists to include this domain and its resolving IP address. Victims who may have connected wallets to this site should immediately revoke any suspicious smart contract approvals and transfer assets to a new, secure wallet. Monitoring for similar domains registered through Cosmotown, Inc., or resolving to the same IP infrastructure may help identify related threats.