changelly[.]casa

This domain, changelly.casa, is flagged as a high-risk brand impersonation threat specifically targeting eBay users. Analysis indicates the site mimics a cryptocurrency exchange platform, presenting itself under the page title 'Cryptocurrency Exchange - Crypto & Altcoin Swap Platform with Lowest Fees.' The intent appears to deceive visitors into engaging with fraudulent financial transactions, likely harvesting credentials or facilitating unauthorized fund transfers under the guise of a legitimate service. Infrastructure analysis reveals multiple technical indicators of compromise. The domain resolves to IP address 62.60.226.213, hosted under AS214351 (FEMO IT SOLUTIONS LIMITED) in Germany. It was registered on October 10, 2025, through Porkbun LLC, a registrar frequently associated with newly created suspicious domains. Google Safe Browsing explicitly flags changelly.casa as a phishing site, while VirusTotal reports 18 out of 95 security vendors detecting malicious activity. The domain appears on four security blocklists, including PhishDestroy, Polkadot, Enkrypt, and Codeesura. Notably, the site lacks an SSL certificate, leaving all data transmissions unencrypted and vulnerable to interception. As of the latest assessment, changelly.casa has been taken offline, reducing immediate exposure risk. However, the domain remains registered and could be reactivated or repurposed by threat actors. Users who interacted with the site prior to its removal may still face residual risks, including credential theft or malware exposure. Organizations and individuals are advised to block the domain and associated IP at the network level, monitor for related phishing campaigns, and educate users on recognizing brand impersonation tactics in cryptocurrency-related scams.