changenowi[.]to

Analysis of the domain changenowi.to indicates an active credential‑phishing operation targeting users of the ChangeNOW cryptocurrency swap service. The domain was registered on 25 June 2026 through a registrar listed as the Government of Kingdom of Tonga and remains active. DNS resolution points to IP 130.12.180.128, which belongs to ASN AS202412 operated by Omegatech LTD in Germany. The web server presents Nginx with OpenResty and serves content over a valid Let’s Encrypt certificate (issuer YE2). An HTTP 200 response is returned for the landing page whose title reads “ChangeNOW | Swap Crypto”. Infrastructure evidence shows the domain is hosted on DNS servers a.dnspod.com, b.dnspod.com and c.dnspod.com. Reputation data includes a Gridinsoft trust score of 0 / 100 and three of ninety‑one VirusTotal scanners flagging the site. The domain appears on three external blocklists, including PhishDestroy, MetaMask and SEAL, confirming its malicious classification. While the page content has not been publicly analysed, the combination of a recent creation date, targeted brand name in the title, and credential‑phishing label suggests the site is designed to harvest login credentials for ChangeNOW. Defenders should block DNS resolution to 130.12.180.128, add the domain to URL filtering rules, and monitor for any authentication attempts to ChangeNOW that originate from this IP range. Additional investigation of the host infrastructure and any associated traffic is recommended to determine the full scope of the campaign.