Touchstone.

A changing payment address is usually fine

Some services mint a fresh receiving address per request. Compared against a registry entry it looks like a hijacked endpoint.

What to do: Probe the same endpoint twice. If the address changes between calls it is routing, not drift. Only a stable address that differs from the registry is worth flagging.

Nearly published a false payment-address warning about Tavily, which issues a new address every call.