c-hangenow[.]com

PhishDestroy identifies c-hangenow[.]com as an active crypto-phishing domain under investigation for impersonating ChangeNOW, a legitimate cryptocurrency swap platform. The site presents itself as a crypto exchange but is designed to deceive users into surrendering private keys or funds under the guise of ‘swap services.’ The risk level is currently marked as ‘under_investigation’ while intelligence is gathered, but the page remains live and accessible. Technical indicators show the domain was registered through Dynadot Inc on March 26, 2026, and resolves to IP address 176.125.242.151. SSL encryption is provided via a Let’s Encrypt certificate, which confirms HTTPS connectivity but does not validate legitimacy. VirusTotal currently reports 0/95 detections, indicating it has evaded traditional antivirus engines so far. While no takedown has occurred yet, the absence of detection does not equate to safety — the domain is still active and poses a credible threat to cryptocurrency users. This domain exhibits multiple red flags typical of phishing operations targeting crypto users. It mimics a well-known service (ChangeNOW) by mirroring the ‘Swap Crypto’ branding, a tactic used to exploit user trust. The recent domain creation date (only months old) is a common characteristic of disposable phishing infrastructure designed for short-term operations. The hosting IP, 176.125.242.151, is not associated with official ChangeNOW infrastructure, which typically operates under controlled, reputable hosting providers. Registrar Dynadot Inc is legitimate, but domain squatting and impersonation are frequent abuses within their platform. The SSL certificate from Let’s Encrypt is valid but does not authenticate the site’s identity — it only secures the connection between the user and the server, which an attacker can easily obtain. The 0/95 detection score on VirusTotal suggests evasion of signature-based scanners, a common behavior among newly deployed phishing sites waiting to be cataloged. No evidence yet exists of this domain appearing on major blocklists such as PhishTank, OpenPhish, or Google Safe Browsing, but this does not negate the threat — phishing sites often operate undetected until reports accumulate. Users are strongly advised to avoid visiting c-hangenow[.]com and to treat any communication referencing this domain with extreme caution. If a user has already visited the site, they should not enter wallet addresses, private keys, or seed phrases. Cryptocurrency transactions should only be conducted on verified, official platforms with verified SSL certificates and long-standing reputations. Users should report this domain to their security vendors, browser security teams, and platforms like PhishTank or Google Safe Browsing to accelerate takedown. It is also recommended to scan local devices for malware in case of credential theft attempts. Always verify URLs through official channels before interacting. Due to the active status and low detection rate, this domain remains a credible threat vector for crypto theft and should be treated as untrusted until conclusive evidence of legitimacy is provided.