Changelly

Crypto & web3changelly.comInstant crypto exchange
Cert findings · 24 h
0
Cert findings · 7 days
12
6 reported or listed · 6 on phishing hosts
Registered lookalikes
81
12 listed by a source or an address list
Official domains
9
verified from Changelly's own sites and records

Certificate findings for Changelly

Updated hourly · 2026-11-05 10:53 UTC

DomainSpoof matched these hostnames, from public certificate logs, to Changelly's name or to lookalike spellings of its official domains. Each was reported or listed by one of our sources, or resolved to an address on Spamhaus DROP or DomainSpoof's phishing-host list.

Published now · 21 findings, grouped by hostname

  1. www.changellyswap.com US · AS214036 · ULTAHOST-AS Ultahost, Inc.
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 2 d ago
    DetailsHide
    Hostname
    www.changellyswap.com
    First seen
    2026-11-03 12:11 UTC
    First published
    2026-11-03 13:19 UTC
    DNS
    Resolves · checked 2026-11-04 13:32 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 192.142.55.235.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 192.142.55.235
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-03 11:07 UTC to 2027-02-01 11:07 UTC
    Logged 2026-11-03 12:05 UTC in Let's Encrypt Willow2027h1, entry 913,096,739
    SHA-256 afbf985f75d7ae845d3953cb8cc724c5bbdef05752d4aed226ef7458b5b77713
    Public key SHA-256 184f037fa00c8838e0f382771800680aaeae06677ba1d53d108172b5426e8f63
    Brand
    Changelly
    Addresses
    192.142.55.235 · United States · AS214036 ULTAHOST-AS Ultahost, Inc.
    Domain
    changellyswap.com
    Registered
    2026-11-03 · Gransy, s.r.o.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-04 13:27 UTC

    Suggest a correction

  2. changellyswap.com US · AS214036 · ULTAHOST-AS Ultahost, Inc.
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 2 d ago
    DetailsHide
    Hostname
    changellyswap.com
    First seen
    2026-11-03 12:11 UTC
    First published
    2026-11-03 13:19 UTC
    DNS
    Resolves · checked 2026-11-04 13:32 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 192.142.55.235.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 192.142.55.235
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-11-03 11:09 UTC to 2027-02-01 11:09 UTC
    Logged 2026-11-03 12:08 UTC in Let's Encrypt Willow2027h1, entry 913,142,197
    SHA-256 449a41cb8818a40d71c0b2f68a44c8042dec0fb9dab3525740aa5e794c8f0f72
    Public key SHA-256 f5976be1b2142aa84f7fba0cc0d506bd626110fdfe5909adce0a649256728e6d
    Brand
    Changelly
    Addresses
    192.142.55.235 · United States · AS214036 ULTAHOST-AS Ultahost, Inc.
    Domain
    changellyswap.com
    Registered
    2026-11-03 · Gransy, s.r.o.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-04 13:27 UTC

    Suggest a correction

  3. changelly.com.lc US · AS13335 · Cloudflare, Inc.4 addresses
    ListedCloudflareListed by MetaMaskMX absentSPF missingDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    changelly.com.lc
    First seen
    2026-11-01 18:41 UTC
    First published
    2026-11-01 19:10 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-04 19:20 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-01 17:38 UTC to 2027-01-30 18:36 UTC
    Logged 2026-11-01 18:38 UTC in IPng Networks Gouda2027h1, entry 287,603,676
    SHA-256 62f3b46e29a8f92395d38a1ccdc79caa24b90a87769d344015db6e9fa2c45119
    Public key SHA-256 763bd2028e162470bc83dfbbe544493bf7859343616f48893aadcbd69245286b
    Brand
    Changelly
    Addresses
    104.21.56.234 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.137.176 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:3032::6815:38ea
    2606:4700:3034::ac43:89b0
    Cloudflare
    Cloudflare (104.21.56.234, 172.67.137.176): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    changelly.com.lc
    Registered
    2026-07-06 · Hosting Concepts B.V. d/b/a Registrar.eu
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-04 19:26 UTC

    Suggest a correction

  4. eu-changelly.com.im US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by MetaMaskMX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    eu-changelly.com.im
    First seen
    2026-11-01 03:20 UTC
    First published
    2026-11-01 03:57 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-05 04:01 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by Sectigo Public Server Authentication CA DV E36 · precertificate
    Valid 2026-11-01 00:00 UTC to 2027-01-22 01:43 UTC
    Logged 2026-11-01 03:18 UTC in Let's Encrypt Willow2027h1, entry 874,304,628
    SHA-256 06011008eae22bafef78cf20140145702a04c572d2682c2bb917271d4f8befad
    Public key SHA-256 355c6c45ab98f76f250f2056dc6e1fd393b6587637334868dddcf5c7b374b348
    Brand
    Changelly
    Addresses
    104.21.24.113 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.218.91 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.24.113, 172.67.218.91): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    eu-changelly.com.im
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 05:03 UTC

    Suggest a correction

  5. v3-changelly.com US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by MetaMaskMX absentSPF missingDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    v3-changelly.com
    First seen
    2026-10-31 00:21 UTC
    First published
    2026-10-31 00:45 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-05 00:55 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-10-30 23:16 UTC to 2027-01-29 00:15 UTC
    Logged 2026-10-31 00:16 UTC in Let's Encrypt Sycamore2027h1, entry 863,615,570
    SHA-256 63386eb67a8ce4038a8b40e7c9ab28c38d2a1d97deac3a6f9f678306a0561970
    Public key SHA-256 f93e1b31d4a65e781052081f6804784bb96bb19d4fe0d86481b7826f43f0d245
    Brand
    Changelly
    Addresses
    104.21.65.130 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.145.126 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.65.130, 172.67.145.126): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    v3-changelly.com
    Registered
    2026-07-04 · Hosting Concepts B.V. d/b/a Registrar.eu
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 06:43 UTC

    Suggest a correction

  6. www.v3-changelly.com US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareUnder v3-changelly.com, listed by MetaMaskMX absentSPF missingDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    www.v3-changelly.com
    First seen
    2026-10-31 00:21 UTC
    First published
    2026-10-31 00:45 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-05 00:55 UTC
    Listed
    MetaMask, listing v3-changelly.com and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WR1 · precertificate
    Valid 2026-10-30 23:17 UTC to 2027-01-29 00:14 UTC
    Logged 2026-10-31 00:17 UTC in IPng Networks Halloumi2027h1, entry 316,912,502
    SHA-256 77ccfe05f8708f71c581b294a23b6e61781aab9ad2c26a2a617c64968ea5e101
    Public key SHA-256 9764dee45a265002a4e70bd5b9b452df9b5451a670ab1c6a685f6b12acca207d
    Brand
    Changelly
    Addresses
    104.21.65.130 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.145.126 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.65.130, 172.67.145.126): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    v3-changelly.com
    Registered
    2026-07-04 · Hosting Concepts B.V. d/b/a Registrar.eu
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 06:43 UTC

    Suggest a correction

  7. changelly-ex-change.gr.com US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by MetaMask
    DetailsHide
    Hostname
    changelly-ex-change.gr.com
    First seen
    2026-10-30 22:05 UTC
    First published
    2026-10-30 22:50 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-04 22:58 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-10-30 21:02 UTC to 2027-01-28 21:02 UTC
    Logged 2026-10-30 22:01 UTC in Google PlumbersArms2027h1, entry 529,964,108
    SHA-256 68e824101b70bcafcc4332754c42ccfdb6d5bcdaed733204e6ae4a229b879a72
    Public key SHA-256 7669b65904ed38bf27c48c2f17c1f690dd4be2c0e6a6e3332d28839e7e4a8c8a
    Brand
    Changelly
    Addresses
    104.21.22.216 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.207.32 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.22.216, 172.67.207.32): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.

    Suggest a correction

  8. info-changelly.to US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by MetaMaskMX absentSPF missingDMARC missingRegistered 5 mo ago
    DetailsHide
    Hostname
    info-changelly.to
    First seen
    2026-10-30 04:20 UTC
    First published
    2026-10-30 04:55 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-05 05:01 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-10-30 03:16 UTC to 2027-01-28 03:16 UTC
    Logged 2026-10-30 04:14 UTC in IPng Networks Halloumi2027h1, entry 308,520,964
    SHA-256 c981627d1168a11ba9781ba861ad8099de234f26fea6df6b0b3f226b672e0708
    Public key SHA-256 838d1babdb5d74169b6008ef081beeb076b65c918ebcf9651fa9d6c66f708001
    Brand
    Changelly
    Addresses
    104.21.95.125 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.144.243 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.95.125, 172.67.144.243): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    info-changelly.to
    Registered
    2026-06-06 · Tonic
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 06:43 UTC

    Suggest a correction

  9. www.changelly-en.at US · AS13335 · Cloudflare, Inc.4 addresses
    ListedCloudflareUnder changelly-en.at, listed by MetaMaskMX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    www.changelly-en.at
    First seen
    2026-10-28 17:20 UTC
    First published
    2026-10-28 18:18 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-04 18:30 UTC
    Listed
    MetaMask, listing changelly-en.at and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-10-28 16:21 UTC to 2027-01-26 16:21 UTC
    Logged 2026-10-28 17:19 UTC in DigiCert Wyvern2027h1, entry 336,797,168
    SHA-256 f993474604642574635f26e9234db1abc4ecfa352958c6d2be98cfc8afc823db
    Public key SHA-256 011eebd68f63f5da52b84e7ef7b575f7cabbddde05d81753dc1f28de03ef44d9
    Brand
    Changelly
    Addresses
    104.21.47.86 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.145.251 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:3031::ac43:91fb
    2606:4700:3035::6815:2f56
    Cloudflare
    Cloudflare (104.21.47.86, 172.67.145.251): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    changelly-en.at
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 06:44 UTC

    Suggest a correction

  10. changelly-en.at US · AS13335 · Cloudflare, Inc.4 addresses
    ListedCloudflareListed by MetaMaskMX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    changelly-en.at
    First seen
    2026-10-28 09:26 UTC
    First published
    2026-10-28 10:00 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-05 10:08 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-10-28 08:25 UTC to 2027-01-26 08:25 UTC
    Logged 2026-10-28 09:24 UTC in DigiCert Wyvern2027h1, entry 332,119,061
    SHA-256 18ef54a4a7b2279452e32d03c1c89fe3ea202719379093ec8bb5c7a596ef2783
    Public key SHA-256 a0614a12a3e339710df62e5e36939fecdbe9354f7e36ff862cc51e99f0b8e8b2
    Brand
    Changelly
    Addresses
    104.21.47.86 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.145.251 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:3031::ac43:91fb
    2606:4700:3035::6815:2f56
    Cloudflare
    Cloudflare (104.21.47.86, 172.67.145.251): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    changelly-en.at
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 06:44 UTC

    Suggest a correction

  11. changelly.com.mx US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by MetaMaskMX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    changelly.com.mx
    First seen
    2026-10-28 01:10 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-05 09:04 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by Cloudflare TLS Issuing ECC CA 4 · precertificate
    Valid 2026-10-28 00:59 UTC to 2027-01-22 16:22 UTC
    Logged 2026-10-28 01:09 UTC in Let's Encrypt Sycamore2027h1, entry 811,781,868
    SHA-256 1055de9a6a46f78528c01687ca93b41b69b301d08c4adcaba5ae0832276449b1
    Public key SHA-256 69ff0da43e8dc20ee86ec257089ae42ef78feb2d01c706a65a2d2006eda93c3f
    Brand
    Changelly
    Addresses
    104.21.21.173 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.199.167 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.21.173, 172.67.199.167): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    changelly.com.mx
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 08:41 UTC

    Suggest a correction

  12. www.changelly-eu.com SC · AS206264 · AMARUTU-TECHNOLOGY Amarutu …
    ListedPhishing hostUnder changelly-eu.com, listed by MetaMask · Address hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 30 d ago
    DetailsHide
    Hostname
    www.changelly-eu.com
    First seen
    2026-10-27 23:00 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-05 09:04 UTC
    Listed
    MetaMask, listing changelly-eu.com and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 31.220.1.30.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 31.220.1.30
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-10-27 22:00 UTC to 2027-01-25 22:00 UTC
    Logged 2026-10-27 22:59 UTC in IPng Networks Gouda2027h1, entry 241,946,678
    SHA-256 77167677bad6851a35d0ffe150ccdf650bbac4218d08f2b18e93b0a09e8b4c67
    Public key SHA-256 eceeb06360069b11ad6d7eb2877a853ce045051e63bce69dc3acb81186674c85
    Certificate
    Issued by YR2 · precertificate
    Valid 2026-11-02 19:30 UTC to 2027-01-31 19:30 UTC
    Logged 2026-11-02 20:28 UTC in Let's Encrypt Sycamore2027h1, entry 909,511,867
    SHA-256 145fb31215b9fd11531ea5d3f67a9ed9e93b27bca66521b68cd6c153a74f4242
    Public key SHA-256 6f20aa6049e0fdddac17ca939768e24842a523c710d89d66e6e90b019a14d021
    Brand
    Changelly
    Addresses
    31.220.1.30 · Seychelles · AS206264 AMARUTU-TECHNOLOGY Amarutu Technology Ltd
    Domain
    changelly-eu.com
    Registered
    2026-10-06 · Hosting Concepts B.V. d/b/a Registrar.eu
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 08:41 UTC

    Suggest a correction

  13. changelly-eu.com SC · AS206264 · AMARUTU-TECHNOLOGY Amarutu …
    ListedPhishing hostListed by MetaMask · Address hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 30 d ago
    DetailsHide
    Hostname
    changelly-eu.com
    First seen
    2026-10-27 23:00 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-05 09:04 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 31.220.1.30.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 31.220.1.30
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-10-27 22:00 UTC to 2027-01-25 22:00 UTC
    Logged 2026-10-27 22:59 UTC in IPng Networks Gouda2027h1, entry 241,946,678
    SHA-256 77167677bad6851a35d0ffe150ccdf650bbac4218d08f2b18e93b0a09e8b4c67
    Public key SHA-256 eceeb06360069b11ad6d7eb2877a853ce045051e63bce69dc3acb81186674c85
    Certificate
    Issued by YR2 · precertificate
    Valid 2026-11-02 19:30 UTC to 2027-01-31 19:30 UTC
    Logged 2026-11-02 20:28 UTC in Let's Encrypt Sycamore2027h1, entry 909,511,867
    SHA-256 145fb31215b9fd11531ea5d3f67a9ed9e93b27bca66521b68cd6c153a74f4242
    Public key SHA-256 6f20aa6049e0fdddac17ca939768e24842a523c710d89d66e6e90b019a14d021
    Brand
    Changelly
    Addresses
    31.220.1.30 · Seychelles · AS206264 AMARUTU-TECHNOLOGY Amarutu Technology Ltd
    Domain
    changelly-eu.com
    Registered
    2026-10-06 · Hosting Concepts B.V. d/b/a Registrar.eu
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 08:41 UTC

    Suggest a correction

  14. us-changelly.com US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by MetaMaskMX absentSPF missingDMARC missingRegistered 3 mo ago
    DetailsHide
    Hostname
    us-changelly.com
    First seen
    2026-10-27 23:00 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-05 09:07 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1
    Valid 2026-09-30 12:00 UTC to 2026-12-29 12:59 UTC
    Logged 2026-10-27 22:58 UTC in IPng Networks Halloumi2026h2a, entry 1,272,060,241
    SHA-256 e7bb931f4b8ff83d3972f0b4c6326dda5d54efdc71a429c9df3251b83846fc82
    Public key SHA-256 e88c8b6bf5b73a8c9274c0f2a7348cbbb9c2f44b6a6e94edaaa6ccdeb38f3011
    Brand
    Changelly
    Addresses
    104.21.27.191 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.143.119 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.27.191, 172.67.143.119): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    us-changelly.com
    Registered
    2026-08-02 · Hosting Concepts B.V. d/b/a Registrar.eu
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 08:41 UTC

    Suggest a correction

  15. www.changellydex.to SC · AS206264 · AMARUTU-TECHNOLOGY Amarutu …
    ListedPhishing hostUnder changellydex.to, listed by MetaMask · Address hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    www.changellydex.to
    First seen
    2026-10-27 22:57 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-05 09:01 UTC
    Listed
    MetaMask, listing changellydex.to and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 31.220.1.30.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 31.220.1.30
    4. Latest DNS check
    Certificate
    Issued by YE1
    Valid 2026-10-27 21:55 UTC to 2027-01-25 21:55 UTC
    Logged 2026-10-27 22:54 UTC in Google PlumbersArms2027h1, entry 479,511,136
    SHA-256 3afdfe6cfeb89a7e58cbcaa49d689c5eac56e0d4bfab837f87e7a593414a88f9
    Public key SHA-256 af82664e3ca7d02f6850b49fcbf6af708da90ad6771ad160fa4011c3e3bb9c92
    Certificate
    Issued by YR2 · precertificate
    Valid 2026-11-02 19:23 UTC to 2027-01-31 19:23 UTC
    Logged 2026-11-02 20:22 UTC in IPng Networks Gouda2027h1, entry 296,191,230
    SHA-256 0c58d8f5c5360ccb89580e676d3ad6732797bce9d58f47deb2e2f0c1f1448fb6
    Public key SHA-256 1d3daf931622620ae5dd0c83054471eae889b745351202b0ae3f395aef576551
    Brand
    Changelly
    Addresses
    31.220.1.30 · Seychelles · AS206264 AMARUTU-TECHNOLOGY Amarutu Technology Ltd
    Domain
    changellydex.to
    Registered
    2026-07-20 · Tonic
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 08:41 UTC

    Suggest a correction

  16. changellydex.to SC · AS206264 · AMARUTU-TECHNOLOGY Amarutu …
    ListedPhishing hostListed by MetaMask · Address hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    changellydex.to
    First seen
    2026-10-27 22:57 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-05 09:04 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 31.220.1.30.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 31.220.1.30
    4. Latest DNS check
    Certificate
    Issued by YE1
    Valid 2026-10-27 21:55 UTC to 2027-01-25 21:55 UTC
    Logged 2026-10-27 22:54 UTC in Google PlumbersArms2027h1, entry 479,511,136
    SHA-256 3afdfe6cfeb89a7e58cbcaa49d689c5eac56e0d4bfab837f87e7a593414a88f9
    Public key SHA-256 af82664e3ca7d02f6850b49fcbf6af708da90ad6771ad160fa4011c3e3bb9c92
    Certificate
    Issued by YR2 · precertificate
    Valid 2026-11-02 19:23 UTC to 2027-01-31 19:23 UTC
    Logged 2026-11-02 20:22 UTC in IPng Networks Gouda2027h1, entry 296,191,230
    SHA-256 0c58d8f5c5360ccb89580e676d3ad6732797bce9d58f47deb2e2f0c1f1448fb6
    Public key SHA-256 1d3daf931622620ae5dd0c83054471eae889b745351202b0ae3f395aef576551
    Brand
    Changelly
    Addresses
    31.220.1.30 · Seychelles · AS206264 AMARUTU-TECHNOLOGY Amarutu Technology Ltd
    Domain
    changellydex.to
    Registered
    2026-07-20 · Tonic
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 08:41 UTC

    Suggest a correction

  17. v2-changelly.com US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by MetaMaskMX absentSPF missingDMARC missingRegistered 2 mo ago
    DetailsHide
    Hostname
    v2-changelly.com
    First seen
    2026-10-27 18:15 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-05 09:01 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-10-27 17:14 UTC to 2027-01-25 18:12 UTC
    Logged 2026-10-27 18:14 UTC in Google ParcelYard2027h1, entry 475,515,804
    SHA-256 8eefd4f5abd9d09730480c2ef930ee60c7bf61df48bb7fa19088797062689bbc
    Public key SHA-256 d48d3f86841691de3a208ec2748037e1fd83677f8f6659bdfc17baf0cf1a87d4
    Brand
    Changelly
    Addresses
    104.21.13.102 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.199.211 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.13.102, 172.67.199.211): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    v2-changelly.com
    Registered
    2026-08-29 · NameSilo, LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 08:41 UTC

    Suggest a correction

How certificate findings are selected

Reported: PhishTank or PhishDestroy reports the hostname as phishing. Listed: CERT Polska, MetaMask, USOM, MODA, NPA 165, JPCERT/CC, the AMF, the FSMA or BaFin lists it, in the source's own category. Phishing host: the name resolves to an address on DomainSpoof's phishing-host list, the addresses that hosted confirmed phishing in the last 48 hours. Spamhaus DROP: it resolves to an address on the Spamhaus DROP list. Same certificate: it shares a certificate with a finding and has listing evidence of its own, a report or listing by a source or its own Spamhaus DROP address.

DomainSpoof reads public certificate logs and the feeds on Sources every hour. A hostname matches Changelly when a label carries the brand's name, by the rules on How it works. A lookalike spelling of an official domain matches too. A hostname with two kinds of finding is one row. Details shows the recorded checks, the source's claim and the check times available. How it works · Sources

More brands in Crypto & web3

All brands →