changelly[.]quest

The domain changelly.quest was registered on 21 November 2025 through Porkbun LLC and is currently taken offline. DNS resolution points to the IPv4 address 62.60.226.213, which is announced by AS214351 (FEMO IT SOLUTIONS LIMITED) and geolocated to Germany. No TLS certificate is presented for the host, and the site is served without HTTPS. The authoritative name servers are curitiba.ns.porkbun.com, fortaleza.ns.porkbun.com, maceio.ns.porkbun.com, and salvador.ns.porkbun.com.

Automated analysis by VirusTotal shows that 12 of 95 security scanners flagged the domain as malicious, indicating a moderate level of consensus among detection engines. The domain appears on a single security blocklist and is specifically blocked by the PhishDestroy feed, confirming that it has been identified as a phishing vector. Gridinsoft assigns the site a trust score of 0 out of 100, reinforcing its malicious classification. The page title returned from the site, “Cryptocurrency Exchange – Crypto & Altcoin Swap Platform with Lowest Fees,” does not reference the targeted brand, yet the intelligence explicitly states that the site impersonates Apple, placing it in the brand‑impersonation threat category.

Defenders should ingest the domain and its resolved IP into network blocklists, enforce outbound filtering for the associated nameservers, and monitor for re‑registration of similar variants. Because the site lacks TLS, any future activation would be observable via clear‑text HTTP requests, allowing rapid detection. Continuous correlation with phishing‑kit signatures and brand‑specific watchlists is recommended to reduce exposure to Apple‑related credential‑harvesting attempts.