changemly[.]com

This domain is flagged as a generic phishing threat under active investigation, specifically targeting cryptocurrency users through impersonation of a legitimate exchange platform. Analysis indicates the domain presents itself as a low-fee crypto and altcoin swap service, a common tactic to lure victims into disclosing sensitive credentials or transferring funds to attacker-controlled wallets. Infrastructure analysis reveals the following technical indicators: VirusTotal reports 0/95 detections, suggesting the domain has not yet been widely flagged by security vendors. The domain was registered on February 21, 2026, through NiceNIC International Group Co., Limited, and resolves to the IP address 104.21.51.100. The SSL certificate is issued by Google Trust Services, and the site employs Node.js, Express, Cloudflare Browser Insights, Cloudflare, and HTTP/3 technologies. Despite its low detection rate, the domain appears on 2 security blocklists (PhishDestroy and OISD) and has a Gridinsoft trust score of 0/100. The creation date in 2026 is anomalous, as it predates the current date, which may indicate domain squatting or an attempt to evade detection by appearing aged. Mitigation steps for this threat type include immediate blocking of the domain and its associated IP (104.21.51.100) at the network perimeter. Organizations should update endpoint protection rules to flag any attempts to access changemly.com or related infrastructure. Users should be educated on recognizing phishing tactics, particularly those impersonating cryptocurrency platforms, and advised to verify domain registration dates and SSL certificates before interacting with financial services. Security teams should monitor for credential theft or unauthorized transactions following exposure to this domain. Given the use of Cloudflare, additional scrutiny of traffic patterns to similar domains is recommended to identify potential evasion techniques.