changenow-swap[.]org

This domain, changenow-swap.org, poses a direct financial threat as a crypto drainer targeting users of the Across protocol through brand impersonation. The site mimics the legitimate ChangeNOW platform, presenting a fraudulent interface designed to trick victims into connecting wallets and authorizing transactions that siphon funds to attacker-controlled addresses. Infrastructure analysis reveals the domain was specifically crafted to exploit trust in cross-chain swap services, a tactic increasingly observed in targeted attacks against decentralized finance users.

Evidence confirms the malicious nature of changenow-swap.org through multiple technical indicators. The domain is flagged by 19 out of 95 security vendors on VirusTotal, with detections spanning phishing, malware distribution, and fraud categories. It appears on seven distinct security blocklists, including those maintained by wallet security providers and threat intelligence platforms. Registered on October 29, 2025, through CSL Computer Service Langenbach GmbH d/b/a joker.com, the domain resolves to IP address 91.92.243.31, hosted on AS202412 Omegatech LTD in the Netherlands. The SSL certificate (serial number E8) and page title 'ChangeNOW' further align with known impersonation patterns used in crypto drainer campaigns.

Users who visited changenow-swap.org or interacted with its content should immediately revoke any wallet authorizations granted to the site. Check connected applications in wallet settings and remove suspicious entries, particularly those requesting unlimited spend permissions. Scan devices for malware using updated security tools, as some drainer campaigns deploy secondary payloads. Monitor wallet activity for unauthorized transactions and consider migrating funds to a new address if compromise is suspected. Report the domain to relevant security teams and wallet providers to aid in broader mitigation efforts. Given the high-risk classification and offline status, remain vigilant for similar domains using slight variations of the brand name or swap-related terminology.