cha-ngenow[.]com

PhishDestroy identifies cha-ngenow.com as a crypto phishing domain actively impersonating the legitimate ChangeNOW cryptocurrency swap and exchange platform to deceive users into divulging sensitive wallet credentials or transferring funds to attacker-controlled addresses. The threat is classified as a high-risk impersonation phishing campaign targeting cryptocurrency users, leveraging brand recognition to exploit trust and facilitate financial theft.

This domain was flagged through automated threat intelligence and remains active as of the latest scan. VirusTotal currently reports 2 out of 95 security vendors detecting malicious content, indicating low detection coverage despite clear malicious intent. The domain was registered on April 08, 2026, through Dynadot Inc, resolving to IP address 176.125.242.151 under a valid Let’s Encrypt SSL certificate. As of now, no public blocklists or trust score platforms have flagged this domain, highlighting a critical window of exposure for potential victims.

To mitigate risk, users should avoid interacting with cha-ngenow.com and verify any crypto-related website by checking the official domain (changenow.io) and confirming the use of HTTPS with a validated certificate. Enable multi-factor authentication on all crypto accounts and use hardware wallets or reputable exchange interfaces for transactions. Report this domain to your antivirus vendor, browser safety extensions, and relevant cybersecurity platforms to increase detection coverage and protect others from falling victim to this impersonation scam.