changeily[.]at

This domain, changeily.at, is identified as a high-risk generic phishing site impersonating the Changelly cryptocurrency exchange platform. Analysis indicates the domain is designed to deceive users into believing they are accessing a legitimate instant swap service for BTC to USDT conversions. The page title, 'Changelly Crypto Exchange | Instant BTC to USDT Swap | changeily.at,' explicitly mimics the branding of the authentic Changelly service, suggesting the presence of a credential-harvesting and crypto-draining kit targeting unsuspecting victims. Infrastructure analysis reveals multiple technical indicators of malicious activity. The domain was registered on February 21, 2024, through Hosting Concepts B.V. d/b/a Registrar.eu and resolves to the IP address 158.94.209.135. Detection metrics show that 14 out of 95 security vendors on VirusTotal flag this domain as malicious, while it appears on three distinct security blocklists. The SSL certificate is issued under the 'antiddos/flowproxy' label, a common obfuscation technique used to mask malicious infrastructure. Additionally, the domain is blocked by multiple security mechanisms, including browser-based transaction validators and phishing detection systems. As of the latest assessment, changeily.at has been taken offline, likely in response to security vendor interventions and blocklist inclusions. However, the domain's infrastructure remains registered, posing a residual risk of reactivation or migration to alternative domains. Users who interacted with this domain are advised to revoke any connected wallet permissions, rotate credentials, and monitor for unauthorized transactions. The use of Nginx as the underlying web server technology further suggests the deployment of a pre-configured phishing kit, increasing the likelihood of rapid redeployment under a new domain.