c-hangenow[.]com

This domain is flagged as a high-risk generic phishing threat targeting cryptocurrency users. Analysis indicates it operates as a fraudulent crypto swap platform, mimicking legitimate exchange services to deceive victims into disclosing wallet credentials or transferring funds to attacker-controlled addresses. The domain poses a direct financial risk through social engineering and credential harvesting tactics. Infrastructure analysis reveals the domain was registered on April 26, 2026, through Dynadot Inc, with current resolution to IP address 176.125.242.151. Security vendor detections show 17 out of 95 engines on VirusTotal flagging the domain as malicious. The domain appears on three security blocklists and is actively blocked by wallet security extensions and anti-phishing tools. Gridinsoft assigns a trust score of 0/100, while detected technologies include Nginx web server software. The page title 'ChangeNOW | Swap Crypto' directly impersonates a legitimate cryptocurrency exchange platform. Mitigation requires immediate blocking of the domain and associated IP address across all network security controls. Users should verify crypto exchange URLs through official sources before transactions, enable multi-factor authentication on all financial accounts, and monitor wallet addresses for unauthorized access attempts. Security teams should investigate connected infrastructure for additional phishing domains registered through the same registrar or resolving to the same IP range. Transaction monitoring systems should flag any cryptocurrency transfers to addresses previously associated with this domain.