online-changnowe[.]at

Analysis of online-changnowe.at confirms it as a brand-impersonation phishing domain targeting Binance users, classified as a crypto scam. The domain was registered on February 21, 2026, and resolved to IP 188.114.96.3, hosted on Cloudflare infrastructure (AS13335) in the US. Nameservers dispute-ns1.key-systems.net and dispute-ns2.key-systems.net indicate potential registrar-level dispute actions. The site's SSL certificate is issued by WE1, a low-assurance provider commonly associated with malicious domains.

The page title, 'Changenow | Instant Crypto Exchange,' suggests an attempt to mimic legitimate cryptocurrency exchange services, though the exact content and functionality remain unconfirmed due to its offline status as of July 23, 2026. Security vendor detections include 15 flags on VirusTotal (95 vendors scanned) and a block by PhishDestroy. The domain appears on one security blocklist, and Gridinsoft assigns a trust score of 0/100, reinforcing its malicious classification. While the site is currently offline, defenders should treat any future resolution or reappearance under this domain as high-risk.

Organizations are advised to block the domain, IP, and associated SSL certificate (WE1) at perimeter defenses. Monitoring for related domains using similar naming patterns (e.g., 'changnowe') or infrastructure (Cloudflare, Key-Systems nameservers) may help preempt further impersonation attempts. No evidence links this domain to a known phishing kit or campaign beyond its crypto scam classification.