changelly[.]asia

Analysis as of July 23 2026 indicates that the domain changelly.asia, registered through Porkbun LLC on 10 October 2025, is currently offline but was previously used for a wallet/seed phishing campaign impersonating eBay. The site presented a page titled “Cryptocurrency Exchange – Crypto & Altcoin Swap Platform with Lowest Fees,” suggesting a cryptocurrency lure. DNS resolution points to IP 62.60.226.213 located in Germany and associated with AS214351 FEMO IT SOLUTIONS LIMITED. No TLS certificate was observed, meaning communications were unencrypted.

The domain is listed on three public blocklists—PhishDestroy, ScamSniffer, and Enkrypt—and appears on three additional security blocklists, reinforcing its malicious reputation. VirusTotal records show that 13 of 95 scanned security vendors flagged the domain, providing further corroboration. Reputation services assign low trust scores: Scamadviser rates the domain 35/100 and Gridinsoft rates it 0/100. The authoritative nameservers are curitiba.ns.porkbun.com, fortaleza.ns.porkbun.com, maceio.ns.porkbun.com, and salvador., all hosted by the registrar’s infrastructure.

The combination of a high‑risk classification, brand impersonation of eBay, and the wallet/seed phishing objective suggests credential or private‑key harvesting attempts. Uncertainty remains around the current activity level because the site is offline; however, the infrastructure—IP address and nameserver configuration—may be reused for future campaigns. Defenders should block DNS resolution to 62.60.226.213, add the domain and its nameservers to URL filtering and email security policies, monitor for any newly registered domains using the same registrar and similar naming patterns, and enforce multi‑factor authentication for eBay accounts to mitigate credential compromise. Continuous monitoring of the listed blocklists and periodic re‑scanning of the domain, should it reappear, are recommended.