changenowx[.]com

Analysis of changenowx.com indicates an active high‑risk phishing infrastructure deployed on 130.12.180.128, a virtualized host located in the Netherlands and operated by Virtualine Technologies. The domain was registered on June 03, 2026 through Hosting Concepts B.V. d/b/a Registrar.eu and uses the default ina1.registrar.eu, ina2.registrar.eu, and ina3.registrar.eu name servers. No TLS certificate is presented, and the site returns HTTP 200 responses, suggesting a functional web server that may serve malicious content. Gridinsoft assigns a trust score of 0 out of 100, reflecting extreme suspicion.

VirusTotal scans have flagged the domain in 14 of 91 security vendor engines, and the domain appears on three public blocklists. Additional blocking is enforced by PhishDestroy, MetaMask, and SEAL, while AlienVault OTX lists the indicator in four separate threat pulses. These independent detections corroborate the presence of a credential‑harvesting operation, although the exact target brand or page title has not been disclosed in the available intelligence. Defenders should immediately add 130.12.180.128 and changenowx.com to deny‑list rules across perimeter firewalls, DNS resolvers, and proxy filters.

Continuous monitoring of the IP reputation and periodic re‑scans with multi‑engine services are advised to capture any evolution of the payload. Organizations using email or web gateway security should ensure that content‑inspection policies trigger on any outbound requests to this host, and incident response teams should be prepared to investigate potential credential submissions originating from the domain. The lack of SSL and the low trust score further simplify detection, but the rapid creation date underscores the need for rapid rule updates to mitigate exposure.