changenow[.]com[.]co

The domain changenow.com.co was observed on 23 July 2026 and is classified as a generic phishing site. At the time of analysis the domain was taken offline, returning an HTTP 404 response for the page title app.www.changenow.com.co. DNS resolution points to the address 198.18.0.6, which is served with a Let’s Encrypt R12 certificate. The domain was created on 26 October 2025 and is registered through Hosting Concepts B.V. d/b/a Registrar.eu. Its authoritative nameservers are ns1.openprovider.nl, ns2.openprovider.be and ns3.openprovider.eu.

The site has been blocked by PhishDestroy and appears on a single security blocklist. VirusTotal reports that 14 of 95 scanning engines flagged the domain as malicious. AlienVault OTX lists the domain in three separate threat‑intel pulses. Independent reputation services assign a trust score of 1 / 100 both on Scamadviser and Gridinsoft, reinforcing the high‑risk assessment. The combination of blocklist inclusion, multiple vendor detections, low trust scores and the presence of a dedicated SSL certificate suggests intentional abuse rather than an accidental misconfiguration.

The underlying IP address belongs to the 198.18.0.0/16 range, which is reserved for documentation and testing, indicating that the operator may be using a non‑public address space to host the malicious payload. No additional content, brand targeting, or phishing kit details are available from the current evidence set, leaving the exact phishing vector unclear. Defenders should proactively deny DNS resolution for changenow.com.co and the associated IP, enforce TLS inspection to capture any future reuse of the Let’s Encrypt certificate, and incorporate the 14 VirusTotal detection signatures into endpoint and network security policies. Continuous monitoring of OTX pulses and any re‑registration attempts is advised to detect resurgence of the infrastructure.