boomchange[.]com

boomchange.com entered the PhishDestroy evidence set on Feb 26, 2026. The stored content classification is fake exchange. The assembled evidence scores 100/100 (critical).

Seven independent sources are positive: VirusTotal, ScamSniffer, Polkadot, CryptoFirewall, Enkrypt, Codeesura, and Spamhaus DBL. VirusTotal recorded 11 detections among 91 engines: ADMINUSLabs, alphaMountain.ai, Chong Lua Dao, CyRadar, Forcepoint ThreatSeeker, Fortinet, Gridinsoft, Lionic, SOCRadar, Sophos, Webroot on Jul 27, 2026 at 02:24 UTC. ScamSniffer, Polkadot, CryptoFirewall, Enkrypt, and Codeesura listed the hostname in the external-blocklist snapshot on Aug 7, 2026 at 18:20 UTC. Spamhaus DBL: DBL_PHISH on Jul 14, 2026 at 02:38 UTC. The evidence is not unanimous. AlienVault OTX listed 16 community pulse references (not vendor detections) on Mar 1, 2026 at 03:08 UTC. URLQuery recorded no positive detection on Aug 9, 2025 at 15:24 UTC. Google Safe Browsing returned no flag on Mar 2, 2026 at 20:56 UTC. URLScan completed without a malicious verdict (score 0).

HTTP 200 was recorded on Aug 7, 2026 at 10:08 UTC. Registration records for the domain list Internet Domain Service BS Corp as the registrar and Feb 21, 2026 as the creation date. Registration preceded first observation by 5 days. At collection time, the hostname resolved to 89.249.49.141 on AS206264 (AMARUTU-TECHNOLOGY Amarutu Technology Ltd, SC). The associated network metadata labels the endpoint as AS206264 Amarutu Technology Ltd in Amsterdam, NL. The stored server header is LiteSpeed. Captured page title: “Instant Cryptocurrency Exchange | Boomchange”. DOM analysis completed on Jul 9, 2026 at 02:22 UTC; stored DOM score 95/100. The evidence archive retains 3 visual captures from PhishDestroy, URLScan, and URLQuery. IoC extraction completed on Jul 29, 2026 at 02:29 UTC; stored 0 format-validated wallet addresses and 0 Telegram indicators. TLS metadata lists DigiCert Inc / RapidSSL TLS RSA CA G1 as the certificate issuer; checked Mar 15, 2026 at 08:08 UTC.

No target brand has been confirmed from stored page content; hostname wording alone is not treated as brand evidence. Taken together, the page content and independent findings support classifying this hostname as fake exchange.