change-web3[.]space

change-web3.space was registered through Name.com, Inc. on December 18 2025 and is currently reported as taken offline. The authoritative nameservers ns1.vercel-dns.com and ns2.vercel-dns.com resolve the domain to the IP address 64.29.17.1, which belongs to Amazon.com, Inc. (AS16509) in the United States. No TLS certificate is presented, indicating that the site did not serve HTTPS traffic during the observation period. The page title returned by HTTP requests is “Web2 → Web3 | Polkadot”, and the domain is listed as impersonating the brand “across” while being categorized as a crypto‑scam.

Google Safe Browsing flags the site for social engineering, and ten of ninety‑three VirusTotal scanners marked the domain as malicious, reinforcing the suspicion of abuse. The domain appears on four public security blocklists, including PhishDestroy, Polkadot, Enkrypt, and Codeesura, and the Gridinsoft trust score is 0 out of 100, reflecting a lack of reputation. Evidence from these feeds confirms that the infrastructure was used to lure victims toward fraudulent Web3 or Polkadot‑related content.

Because the site is presently offline, active payloads cannot be confirmed, and the exact content of the landing page beyond the title remains unknown. Defenders should continue to block the IP 64.29.17.1 and the domain name at perimeter and DNS layers, monitor for re‑hosting of the same content on other Vercel DNS configurations, and add the observed indicators to internal threat intel feeds. Ongoing surveillance of the registrar Name.com and the Amazon hosting environment is advisable to detect any rapid redeployment of similar impersonation campaigns.