ChangeNOW

Crypto & web3changenow.ioInstant crypto exchange
Cert findings · 24 h
0
Cert findings · 7 days
11
9 reported or listed · 2 on phishing hosts
Registered lookalikes
90
17 listed by a source or an address list
Official domains
8
verified from ChangeNOW's own sites and records

Certificate findings for ChangeNOW

Updated hourly · 2026-11-05 10:53 UTC

DomainSpoof matched these hostnames, from public certificate logs, to ChangeNOW's name or to lookalike spellings of its official domains. Each was reported or listed by one of our sources, or resolved to an address on Spamhaus DROP or DomainSpoof's phishing-host list.

Published now · 24 findings, grouped by hostname

  1. changenow.st US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by MetaMaskMX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    changenow.st
    First seen
    2026-11-03 17:51 UTC
    First published
    2026-11-03 18:16 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-04 18:20 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1
    Valid 2026-09-05 14:09 UTC to 2026-12-04 15:06 UTC
    Logged 2026-11-03 17:49 UTC in IPng Networks Halloumi2026h2a, entry 1,283,982,283
    SHA-256 2d779bb0b2e57849a6ecac7f556d5c0d8d775527880fb0eebf8687ac0cb053fb
    Public key SHA-256 ef7a374ce65fcebef03d80d6cf6585f91787d126ae3a99f75a6a9ed1d904bccf
    Brand
    ChangeNOW
    Addresses
    104.21.53.222 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.219.89 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.53.222, 172.67.219.89): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    changenow.st
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-04 18:19 UTC

    Suggest a correction

  2. www.changenow-live.com US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareUnder changenow-live.com, listed by MetaMaskMX absentSPF missingDMARC missingRegistered 2 mo ago
    DetailsHide
    Hostname
    www.changenow-live.com
    First seen
    2026-11-02 15:46 UTC
    First published
    2026-11-02 16:54 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-04 16:58 UTC
    Listed
    MetaMask, listing changenow-live.com and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1
    Valid 2026-09-04 15:11 UTC to 2026-12-03 16:11 UTC
    Logged 2026-11-02 15:41 UTC in Google PlumbersArms2026h2, entry 1,634,371,804
    SHA-256 063fc48aafbe4680f54f5ff163346ca907b784a1216592bd4c3166dc1eb81ee6
    Public key SHA-256 54bf7f1650e8bb2c77ff12efe833e51ebd35b6e8b1528ad9fa4f01b5fb869adb
    Brand
    ChangeNOW
    Addresses
    104.21.96.60 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.173.154 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.96.60, 172.67.173.154): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    changenow-live.com
    Registered
    2026-09-04 · NameSilo, LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-04 16:53 UTC

    Suggest a correction

  3. changenow-live.com US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by MetaMaskMX absentSPF missingDMARC missingRegistered 2 mo ago
    DetailsHide
    Hostname
    changenow-live.com
    First seen
    2026-11-02 15:26 UTC
    First published
    2026-11-02 15:44 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-04 15:58 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-02 14:20 UTC to 2027-01-31 15:19 UTC
    Logged 2026-11-02 15:20 UTC in Google PlumbersArms2027h1, entry 574,671,690
    SHA-256 332b25c6fb801a94f15eac99e085d87aa0b7f5a07312afae50665d2281768824
    Public key SHA-256 87acccb2e0b6d3b332058bc40f642f14d9443d7cae79673d946f73dff373c4d6
    Brand
    ChangeNOW
    Addresses
    104.21.96.60 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.173.154 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.96.60, 172.67.173.154): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    changenow-live.com
    Registered
    2026-09-04 · NameSilo, LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-04 16:53 UTC

    Suggest a correction

  4. www.v2-changenow.at US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareUnder v2-changenow.at, listed by MetaMaskMX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    www.v2-changenow.at
    First seen
    2026-10-31 10:11 UTC
    First published
    2026-10-31 10:16 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-05 10:24 UTC
    Listed
    MetaMask, listing v2-changenow.at and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1
    Valid 2026-10-13 15:25 UTC to 2027-01-11 16:25 UTC
    Logged 2026-10-31 10:06 UTC in DigiCert Wyvern2027h1, entry 366,142,582
    SHA-256 c9515ca6b12b42c2c66a9079df013c944ef15f8cfc6f0e28ef8576d303a15e4f
    Public key SHA-256 4badcdbc6c8a8b3974befff80843cf8502afe1732a18cfa17a0589b85af94882
    Brand
    ChangeNOW
    Addresses
    104.21.47.244 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.174.143 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.47.244, 172.67.174.143): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    v2-changenow.at
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-04 13:27 UTC

    Suggest a correction

  5. v2-changenow.at US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by MetaMaskMX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    v2-changenow.at
    First seen
    2026-10-31 09:57 UTC
    First published
    2026-10-31 10:16 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-05 10:24 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by Sectigo Public Server Authentication CA DV E36 · precertificate
    Valid 2026-10-31 00:00 UTC to 2027-01-19 03:47 UTC
    Logged 2026-10-31 09:51 UTC in Let's Encrypt Sycamore2027h1, entry 869,376,333
    SHA-256 7ea53e81f72c0677c2ace4ce0608709d6fb08f5d43a52ae2f09491734ef1faa9
    Public key SHA-256 042a094fea67b4b0455621ad3b502fb06e80ac01d0b9956c5ec54a127023a177
    Brand
    ChangeNOW
    Addresses
    104.21.47.244 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.174.143 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.47.244, 172.67.174.143): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    v2-changenow.at
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-04 13:27 UTC

    Suggest a correction

  6. v3-changenow.org US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by MetaMaskMX absentSPF missingDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    v3-changenow.org
    First seen
    2026-10-30 22:11 UTC
    First published
    2026-10-30 22:50 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-04 22:58 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WR1 · precertificate
    Valid 2026-10-30 21:05 UTC to 2027-01-28 21:58 UTC
    Logged 2026-10-30 22:05 UTC in Geomys Tuscolo2027h1, entry 412,647,247
    SHA-256 3b9bdd857670d10076ec9d59b8211a3eb4ef15752a06e9d5be88239bb4f8ae3d
    Public key SHA-256 87784c2a2ef5e6cbe196bfa5cb19dd5a4526880c0e6c622883f128d6dac70884
    Brand
    ChangeNOW
    Addresses
    104.21.66.17 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.155.10 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.66.17, 172.67.155.10): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    v3-changenow.org
    Registered
    2026-07-04 · Hosting Concepts B.V. d/b/a Registrar.eu
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 06:43 UTC

    Suggest a correction

  7. www.v3-changenow.org US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareUnder v3-changenow.org, listed by MetaMaskMX absentSPF missingDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    www.v3-changenow.org
    First seen
    2026-10-30 22:11 UTC
    First published
    2026-10-30 22:50 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-04 22:58 UTC
    Listed
    MetaMask, listing v3-changenow.org and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WR1 · precertificate
    Valid 2026-10-30 21:05 UTC to 2027-01-28 21:58 UTC
    Logged 2026-10-30 22:05 UTC in Geomys Tuscolo2027h1, entry 412,645,585
    SHA-256 aa4893eb0d1ad32207139bfe3f493a3152a076f0bd6fac5a37aa1fc1b445c2ba
    Public key SHA-256 fbcd1629144e5c54701e10f025e43b6d8de541e5fcafb1a118e327f1275d2ae2
    Brand
    ChangeNOW
    Addresses
    104.21.66.17 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.155.10 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.66.17, 172.67.155.10): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    v3-changenow.org
    Registered
    2026-07-04 · Hosting Concepts B.V. d/b/a Registrar.eu
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 06:43 UTC

    Suggest a correction

  8. v2-changenow.to US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by MetaMaskMX absentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    v2-changenow.to
    First seen
    2026-10-30 11:31 UTC
    First published
    2026-10-30 11:47 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · delisted on 2026-11-04
    DNS
    Resolves · checked 2026-11-04 11:51 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-10-30 10:28 UTC to 2027-01-28 11:26 UTC
    Logged 2026-10-30 11:28 UTC in Geomys Tuscolo2027h1, entry 406,852,858
    SHA-256 106338d5ea022617bcad5d89ba8385f0a9b8c633ee42774ee59240d6d77df2bf
    Public key SHA-256 bc91f28a441ff00d59decd9e278f3c04806ae5c5d7b8b9c90bca53da184273db
    Brand
    ChangeNOW
    Addresses
    104.21.28.197 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.147.132 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.28.197, 172.67.147.132): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    v2-changenow.to
    Registered
    2026-04-27 · Tonic
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 06:43 UTC

    Suggest a correction

  9. www.v2-changenow.to US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareUnder v2-changenow.to, listed by MetaMaskMX absentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    www.v2-changenow.to
    First seen
    2026-10-30 11:31 UTC
    First published
    2026-10-30 11:47 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · delisted on 2026-11-04
    DNS
    Resolves · checked 2026-11-04 11:51 UTC
    Listed
    MetaMask, listing v2-changenow.to and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1
    Valid 2026-09-11 20:45 UTC to 2026-12-10 21:45 UTC
    Logged 2026-10-30 11:28 UTC in DigiCert Wyvern2026h2, entry 2,193,993,245
    SHA-256 2d57e07936b15e34a7b93082b4cfa72fda3ef013ae5e96bf2d3d3705a7e90766
    Public key SHA-256 c62bf51e5f41454352874f64b33057b19494de9c184d1dfb808d4d57b2d498ef
    Brand
    ChangeNOW
    Addresses
    104.21.28.197 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.147.132 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.28.197, 172.67.147.132): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    v2-changenow.to
    Registered
    2026-04-27 · Tonic
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 06:43 UTC

    Suggest a correction

  10. nowpayments.live US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by MetaMaskMX absentSPF missingDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    nowpayments.live
    First seen
    2026-10-28 00:00 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-05 08:59 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-10-27 22:58 UTC to 2027-01-25 23:56 UTC
    Logged 2026-10-27 23:58 UTC in DigiCert Wyvern2027h1, entry 326,307,249
    SHA-256 1a9590cf815ca4f37e2fe0871ae85836f9aa632eb61b893dfa980018c067ba89
    Public key SHA-256 dc99b608d5917471d58417e260d0bb9128a362b8103a245c0030954a3d8f191f
    Brand
    ChangeNOW
    Addresses
    104.21.65.112 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.145.38 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.65.112, 172.67.145.38): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    nowpayments.live
    Registered
    2026-07-01 · PDR Ltd. d/b/a PublicDomainRegistry.com
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 08:41 UTC

    Suggest a correction

  11. changenow.gr.com US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by MetaMask
    DetailsHide
    Hostname
    changenow.gr.com
    First seen
    2026-10-27 23:31 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-05 09:04 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WR1 · precertificate
    Valid 2026-10-27 22:29 UTC to 2027-01-25 23:25 UTC
    Logged 2026-10-27 23:29 UTC in DigiCert Wyvern2027h1, entry 326,017,229
    SHA-256 69ac23a18a80967815efb69310458aefbe3f2991b44b220ede63d9477f633765
    Public key SHA-256 047aabae5e1b91c23e255f7f39420497035421cb7162c39aeb4293083efadacb
    Brand
    ChangeNOW
    Addresses
    104.21.62.151 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.136.183 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.62.151, 172.67.136.183): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.

    Suggest a correction

  12. www.changenow.gr.com US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareUnder changenow.gr.com, listed by MetaMask
    DetailsHide
    Hostname
    www.changenow.gr.com
    First seen
    2026-10-27 23:31 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-05 08:59 UTC
    Listed
    MetaMask, listing changenow.gr.com and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WR1 · precertificate
    Valid 2026-10-27 22:29 UTC to 2027-01-25 23:25 UTC
    Logged 2026-10-27 23:29 UTC in DigiCert Wyvern2027h1, entry 326,017,229
    SHA-256 69ac23a18a80967815efb69310458aefbe3f2991b44b220ede63d9477f633765
    Public key SHA-256 047aabae5e1b91c23e255f7f39420497035421cb7162c39aeb4293083efadacb
    Brand
    ChangeNOW
    Addresses
    104.21.62.151 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.136.183 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.62.151, 172.67.136.183): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.

    Suggest a correction

  13. www.changenow-io.to SC · AS206264 · AMARUTU-TECHNOLOGY Amarutu …
    ListedPhishing hostUnder changenow-io.to, listed by MetaMask · Address hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 5 mo ago
    DetailsHide
    Hostname
    www.changenow-io.to
    First seen
    2026-10-27 22:57 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-05 09:04 UTC
    Listed
    MetaMask, listing changenow-io.to and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 31.220.1.30.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 31.220.1.30
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-10-27 21:54 UTC to 2027-01-25 21:54 UTC
    Logged 2026-10-27 22:53 UTC in IPng Networks Gouda2027h1, entry 241,903,482
    SHA-256 1001143b28c9cfeea75d1a245a6d74d7f78b0b88746090e8212bc354dbb8e9ce
    Public key SHA-256 a0a003587fc40f6f04465b15ce812c490f21e727b970bab9473df9ff5171a2e5
    Certificate
    Issued by YR2
    Valid 2026-11-02 19:23 UTC to 2027-01-31 19:23 UTC
    Logged 2026-11-02 20:21 UTC in Google ParcelYard2027h1, entry 577,866,154
    SHA-256 5046f96754c3533d314aa805650801a533ebd61236b1d0937e63e9e5b9ba06dd
    Public key SHA-256 4f2626c8359766855c48b34e603db8fda6c557e057d9c7ce33b034561ea0ef6e
    Brand
    ChangeNOW
    Addresses
    31.220.1.30 · Seychelles · AS206264 AMARUTU-TECHNOLOGY Amarutu Technology Ltd
    Domain
    changenow-io.to
    Registered
    2026-06-23 · Tonic
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 08:41 UTC

    Suggest a correction

  14. changenow-io.to SC · AS206264 · AMARUTU-TECHNOLOGY Amarutu …
    ListedPhishing hostListed by MetaMask · Address hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 5 mo ago
    DetailsHide
    Hostname
    changenow-io.to
    First seen
    2026-10-27 22:57 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-05 09:04 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 31.220.1.30.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 31.220.1.30
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-10-27 21:54 UTC to 2027-01-25 21:54 UTC
    Logged 2026-10-27 22:53 UTC in IPng Networks Gouda2027h1, entry 241,903,482
    SHA-256 1001143b28c9cfeea75d1a245a6d74d7f78b0b88746090e8212bc354dbb8e9ce
    Public key SHA-256 a0a003587fc40f6f04465b15ce812c490f21e727b970bab9473df9ff5171a2e5
    Certificate
    Issued by YR2
    Valid 2026-11-02 19:23 UTC to 2027-01-31 19:23 UTC
    Logged 2026-11-02 20:21 UTC in Google ParcelYard2027h1, entry 577,866,154
    SHA-256 5046f96754c3533d314aa805650801a533ebd61236b1d0937e63e9e5b9ba06dd
    Public key SHA-256 4f2626c8359766855c48b34e603db8fda6c557e057d9c7ce33b034561ea0ef6e
    Brand
    ChangeNOW
    Addresses
    31.220.1.30 · Seychelles · AS206264 AMARUTU-TECHNOLOGY Amarutu Technology Ltd
    Domain
    changenow-io.to
    Registered
    2026-06-23 · Tonic
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 08:41 UTC

    Suggest a correction

  15. changenow--io.com EE · AS203273 · NetCraftersOU NetCrafters OU
    ListedListed by MetaMaskMX absentSPF missingDMARC missingRegistered 2 mo ago
    DetailsHide
    Hostname
    changenow--io.com
    First seen
    2026-10-27 22:41 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-05 09:04 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-10-27 21:39 UTC to 2027-01-25 21:39 UTC
    Logged 2026-10-27 22:38 UTC in Google ParcelYard2027h1, entry 478,633,822
    SHA-256 04dde71476b8d7901b1a26557b6f9267abc1e44a803476fc9e75a3fa9809943a
    Public key SHA-256 11d0a4488f725298d08ae7609f02431673cf6960696e00bb20fb4426b3864cf7
    Brand
    ChangeNOW
    Addresses
    109.120.146.79 · Estonia · AS203273 NetCraftersOU NetCrafters OU
    Domain
    changenow--io.com
    Registered
    2026-08-26 · NameSilo, LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 08:41 UTC

    Suggest a correction

  16. changenow-btc.com SC · AS206264 · AMARUTU-TECHNOLOGY Amarutu …
    ListedListed by MetaMaskMX absentSPF missingDMARC missingRegistered 30 d ago
    DetailsHide
    Hostname
    changenow-btc.com
    First seen
    2026-10-27 22:41 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-05 09:04 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-10-27 21:40 UTC to 2027-01-25 21:40 UTC
    Logged 2026-10-27 22:39 UTC in Geomys Tuscolo2027h1, entry 375,440,817
    SHA-256 bc8d3236e55472ec9b10b6b8546be5e2bf630790528864e33fab584bbb23ff32
    Public key SHA-256 570dcb168788222c3be2955a4215a625af6d6911b7e6b024c736758282d19f51
    Brand
    ChangeNOW
    Addresses
    31.220.1.30 · Seychelles · AS206264 AMARUTU-TECHNOLOGY Amarutu Technology Ltd
    Domain
    changenow-btc.com
    Registered
    2026-10-06 · Hosting Concepts B.V. d/b/a Registrar.eu
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 08:41 UTC

    Suggest a correction

  17. www.changenow--io.com EE · AS203273 · NetCraftersOU NetCrafters OU
    ListedUnder changenow--io.com, listed by MetaMaskMX absentSPF missingDMARC missingRegistered 2 mo ago
    DetailsHide
    Hostname
    www.changenow--io.com
    First seen
    2026-10-27 22:41 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-05 09:06 UTC
    Listed
    MetaMask, listing changenow--io.com and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-10-27 21:39 UTC to 2027-01-25 21:39 UTC
    Logged 2026-10-27 22:38 UTC in Google ParcelYard2027h1, entry 478,633,822
    SHA-256 04dde71476b8d7901b1a26557b6f9267abc1e44a803476fc9e75a3fa9809943a
    Public key SHA-256 11d0a4488f725298d08ae7609f02431673cf6960696e00bb20fb4426b3864cf7
    Brand
    ChangeNOW
    Addresses
    109.120.146.79 · Estonia · AS203273 NetCraftersOU NetCrafters OU
    Domain
    changenow--io.com
    Registered
    2026-08-26 · NameSilo, LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 08:41 UTC

    Suggest a correction

  18. www.changenow-btc.com SC · AS206264 · AMARUTU-TECHNOLOGY Amarutu …
    ListedUnder changenow-btc.com, listed by MetaMaskMX absentSPF missingDMARC missingRegistered 30 d ago
    DetailsHide
    Hostname
    www.changenow-btc.com
    First seen
    2026-10-27 22:41 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-05 08:59 UTC
    Listed
    MetaMask, listing changenow-btc.com and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-10-27 21:40 UTC to 2027-01-25 21:40 UTC
    Logged 2026-10-27 22:39 UTC in Geomys Tuscolo2027h1, entry 375,440,817
    SHA-256 bc8d3236e55472ec9b10b6b8546be5e2bf630790528864e33fab584bbb23ff32
    Public key SHA-256 570dcb168788222c3be2955a4215a625af6d6911b7e6b024c736758282d19f51
    Brand
    ChangeNOW
    Addresses
    31.220.1.30 · Seychelles · AS206264 AMARUTU-TECHNOLOGY Amarutu Technology Ltd
    Domain
    changenow-btc.com
    Registered
    2026-10-06 · Hosting Concepts B.V. d/b/a Registrar.eu
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 08:41 UTC

    Suggest a correction

  19. eng-changenow.at SC · AS206264 · AMARUTU-TECHNOLOGY Amarutu …
    ListedListed by MetaMaskMX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    eng-changenow.at
    First seen
    2026-10-27 15:36 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-05 08:59 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-10-27 14:37 UTC to 2027-01-25 14:37 UTC
    Logged 2026-10-27 15:35 UTC in Geomys Tuscolo2027h1, entry 372,119,155
    SHA-256 33c7691707c364b20d01bedaf9fe60baa97295ad1559e5ae540ecc7a2b65ca7e
    Public key SHA-256 68ed710b4ffbd79d299c7ab5b1f9977377fb4ecc9280620045601c7d337be31b
    Brand
    ChangeNOW
    Addresses
    31.220.1.30 · Seychelles · AS206264 AMARUTU-TECHNOLOGY Amarutu Technology Ltd
    Domain
    eng-changenow.at
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 08:42 UTC

    Suggest a correction

  20. www.eng-changenow.at SC · AS206264 · AMARUTU-TECHNOLOGY Amarutu …
    ListedUnder eng-changenow.at, listed by MetaMaskMX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    www.eng-changenow.at
    First seen
    2026-10-27 15:36 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-05 08:59 UTC
    Listed
    MetaMask, listing eng-changenow.at and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-10-27 14:37 UTC to 2027-01-25 14:37 UTC
    Logged 2026-10-27 15:35 UTC in Geomys Tuscolo2027h1, entry 372,119,155
    SHA-256 33c7691707c364b20d01bedaf9fe60baa97295ad1559e5ae540ecc7a2b65ca7e
    Public key SHA-256 68ed710b4ffbd79d299c7ab5b1f9977377fb4ecc9280620045601c7d337be31b
    Brand
    ChangeNOW
    Addresses
    31.220.1.30 · Seychelles · AS206264 AMARUTU-TECHNOLOGY Amarutu Technology Ltd
    Domain
    eng-changenow.at
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 08:42 UTC

    Suggest a correction

  21. changenow.live US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by MetaMaskMX absentSPF missingDMARC rejectRegistered 7 y ago
    DetailsHide
    Hostname
    changenow.live
    First seen
    2026-10-27 09:41 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-05 09:02 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. We matched its certificate name
    3. Latest DNS check
    Certificate
    Logged in Google ParcelYard2027h1, entry 469,294,536
    SHA-256 7a8ca84d35a8624359d82c82c35df80d827606b968c18fb77a2e973f3069de74
    Brand
    ChangeNOW
    Addresses
    104.21.47.130 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.171.39 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.47.130, 172.67.171.39): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    changenow.live
    Registered
    2019-05-23 · MarkMonitor Inc.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    DMARC policy p=reject
    Checked
    2026-11-05 08:41 UTC

    Suggest a correction

  22. changenow.com.co SG · AS63949 · Akamai Connected Cloud3 addresses
    ReportedAkamai LinodeParking page · ParkLogicReported by PhishDestroyMX absentSPF missingDMARC missingRegistered 13 mo ago
    DetailsHide
    Hostname
    changenow.com.co
    First seen
    2026-10-27 05:36 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-05 05:24 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. We matched its certificate name
    3. Latest DNS check
    Certificate
    Logged in DigiCert Wyvern2027h1, entry 319,926,962
    SHA-256 82908cb4b08830f269e555bbd53260b9691762eab17b49c8bdc41cc928d0928b
    PhishDestroy
    Brand
    ChangeNOW
    Addresses
    172.236.104.43 · Singapore · AS63949 AKAMAI-LINODE-AP - Akamai Connected Cloud · Akamai Linode (cloud provider)
    172.236.104.157 · Singapore · AS63949 AKAMAI-LINODE-AP - Akamai Connected Cloud · Akamai Linode (cloud provider)
    172.238.172.122 · Singapore · AS63949 AKAMAI-LINODE-AP - Akamai Connected Cloud · Akamai Linode (cloud provider)
    Akamai Linode
    Akamai Linode (172.236.104.43, 172.236.104.157, 172.238.172.122): a cloud provider. It rents servers and addresses to its customers.
    Parking page · ParkLogic
    The registry delegates changenow.com.co to ParkLogic’s nameservers, which answer for it. ParkLogic: a parking service. It answers for names that are typically for sale or unused.
    Domain
    changenow.com.co
    Registered
    2025-10-26 · Hosting Concepts B.V. d/b/a Registrar.eu
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 08:26 UTC

    Suggest a correction

How certificate findings are selected

Reported: PhishTank or PhishDestroy reports the hostname as phishing. Listed: CERT Polska, MetaMask, USOM, MODA, NPA 165, JPCERT/CC, the AMF, the FSMA or BaFin lists it, in the source's own category. Phishing host: the name resolves to an address on DomainSpoof's phishing-host list, the addresses that hosted confirmed phishing in the last 48 hours. Spamhaus DROP: it resolves to an address on the Spamhaus DROP list. Same certificate: it shares a certificate with a finding and has listing evidence of its own, a report or listing by a source or its own Spamhaus DROP address.

DomainSpoof reads public certificate logs and the feeds on Sources every hour. A hostname matches ChangeNOW when a label carries the brand's name, by the rules on How it works. A lookalike spelling of an official domain matches too. A hostname with two kinds of finding is one row. Details shows the recorded checks, the source's claim and the check times available. How it works · Sources

More brands in Crypto & web3

All brands →