exchange-upgrade[.]com

The domain exchange-upgrade.com has been identified as a brand impersonation phishing threat specifically targeting Facebook users. This domain is currently offline, having been taken down after security researchers flagged its malicious intent. The site was designed to deceive visitors into believing they were interacting with a legitimate Facebook-related service, but instead aimed to harvest sensitive credentials or personal information.

According to detailed intelligence, exchange-upgrade.com was created on June 29, 2025, through the registrar Cosmotown, Inc., and resolves to the IP address 198.12.80.250. The domain uses an SSL certificate issued by Let's Encrypt (R13) to appear legitimate. On VirusTotal, 13 out of 95 security vendors flagged this domain as malicious, and it appears on one security blocklist. Interestingly, the page title found was "Pi Blockchain, Community & Developer Platform | Pi Network," which suggests the phishing site may have been repurposed or used multiple lures to attract victims.

Given that exchange-upgrade.com is now offline, the immediate risk to users is low. However, PhishDestroy recommends that users who may have visited this domain or entered any credentials should change their Facebook password immediately and enable two-factor authentication. Always verify URLs carefully before entering login information, and report any suspicious domains to security teams. Staying vigilant against brand impersonation attacks is crucial, as cybercriminals continuously adapt their tactics.