info-change[.]to

Info-change.to is a phishing domain that has been flagged by 15 out of 95 vendors on VirusTotal. Despite its current offline status, the domain was actively used to exploit SSL trust, leveraging a certificate issued by Let's Encrypt. This tactic is commonly used to lend credibility to malicious sites, making them appear legitimate to unsuspecting users. The domain was registered through the Government of Kingdom of Tonga, a detail that highlights the diverse and often obscure registrars utilized by threat actors.

The hosting IP for info-change.to is located in Russia, under the organization DDOS-GUARD LTD, known for hosting various controversial sites. This choice of hosting provider suggests a deliberate attempt to shield the domain from swift takedown efforts. The domain's creation in August 2025 and its detection by PhishDestroy in November 2025 indicate a relatively short lifespan, typical of phishing campaigns designed to evade detection and maximize impact within a narrow time window.

The presence of info-change.to on PhishDestroy's blocklist underscores its malicious nature, despite the page currently displaying a 404 Error. The use of SSL certificates from Let's Encrypt is a common strategy among cybercriminals to enhance the perceived security of their phishing sites, thereby increasing the likelihood of deceiving users. The rapid detection and subsequent takedown of this domain demonstrate the effectiveness of collaborative efforts between security vendors and blocklist maintainers in mitigating phishing threats.