changenow-exchange[.]org

The domain changenow-exchange.org was registered on February 21, 2026 and is currently listed as offline. Infrastructure analysis shows it resolves to the IPv4 address 91.92.243.31, which is hosted in the Netherlands and is announced by AS202412 belonging to Omegatech LTD. The site presents a page title of "ChangeNow | Easiest Crypto Exchange | Swap 1000+ Coins," indicating an attempt to mimic a legitimate cryptocurrency exchange service. The observed scam type is wallet/seed phishing, and the domain is flagged as impersonating across multiple brands, suggesting a broad targeting strategy.

The domain appears on four independent security blocklists—PhishDestroy, Polkadot, Enkrypt, and Codeesura—and has been referenced in fourteen AlienVault OTX threat‑intel pulses, underscoring its relevance to the wider threat‑intel community. VirusTotal scans show that sixteen of ninety‑three security vendors flagged the domain as malicious, providing additional corroboration of its hostile intent. The SSL certificate is rated E7, reflecting a low trust level.

Given the convergence of registration timing, hosting attribution, blocklist presence, OTX references, and multi‑vendor detections, defenders should treat any traffic to or from this domain as high‑risk. Recommended mitigation steps include adding the domain to network deny lists, monitoring for related IP activity, and ensuring endpoint protection solutions are updated to reflect the observed detections. Continuous observation is advised to capture any re‑emergence of the infrastructure, as the current offline status may be temporary.