changenow-io[.]us

The domain changenow-io.us has been identified as a brand impersonation threat targeting Signal, a widely used encrypted messaging platform. Analysis confirms the domain was actively impersonating the legitimate cryptocurrency exchange service Changenow to deceive users into disclosing sensitive credentials or transferring digital assets. As of the latest assessment, the domain has been taken offline, though prior activity indicates a deliberate attempt to exploit trust in both the Signal brand and cryptocurrency exchange services. Infrastructure analysis reveals the domain was registered on November 14, 2025, through Devexpanse Ltd, a registrar with a history of association with high-risk domains. It resolved to the IP address 104.21.94.104, hosted on Cloudflare’s network (AS13335), a common obfuscation tactic to mask origin infrastructure. The domain was flagged by 18 of 95 security vendors on VirusTotal, indicating moderate to high confidence in its malicious nature. Additionally, it appeared on two security blocklists, PhishDestroy and PhishingDB, further corroborating its fraudulent intent. Notably, the domain lacked an SSL certificate, a red flag for user security and a deviation from standard practices for legitimate financial or communication platforms. Current status confirms the domain is offline, reducing immediate exposure risk. However, the infrastructure and registration patterns suggest potential for reemergence under a similar or altered domain. Organizations and users are advised to monitor for lookalike domains, particularly those mimicking cryptocurrency services or communication platforms. Network-level protections should be implemented to block known malicious IPs and domains associated with this threat actor. End-users should verify domain authenticity before interacting with any service claiming affiliation with Signal or Changenow, and report suspicious domains to relevant security teams for further investigation.