{"report_id":"0024d5fe-7575-46d5-8067-756300c185b7","version":6,"status":"done","tags":[],"date":"2026-06-06T23:17:48Z","url":{"schema":"http","addr":"changenowx.com","fqdn":"changenowx.com","domain":"changenowx.com","tld":"com"},"ip":{"addr":"130.12.180.128","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"final":{"url":{"schema":"https","addr":"changenowx.com/","fqdn":"changenowx.com","domain":"changenowx.com","tld":"com"},"title":"ChangeNOW — The Ultimate Crypto Exchange | changenow io","dom":{"size":27424,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (447)","md5":"e9e8641ca113c19ebfa8fc67c10ed154","sha1":"0613b266bcc83492ceb7a1ad9e495c7742624409","sha256":"1f018590de7449b6808d3c715e44ced21990efdcbfb4e63287de091fe6ae6b34","sha512":"ce6be607d7188123da6b2433ca2f60493ab76d4e62f54f38a448faf266c285c5c168476b17adf66e3c40b7cc08ce4e135a1c4cf19ede576d91ec8216ba3e9076","ssdeep":"384:WyI4GaYoYUMf+YxFS39tZI5uUPtFtCInHulMgEy9Dg:W3TJoHMf+YxFSO510gkxg","tlshash":"9ac29876b1b3217361a391a137e7538b6766e057c90a87153bfc82988fc5c94ce27b8c","dom_hash":"domhashe6fe3ac40c7ba691cc62b48c478f14b7","first_seen":"2026-06-06T23:17:52.369865Z","last_seen":"2026-06-06T23:17:52.369865Z","times_seen":1,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"changenowx.com","fqdn":"changenowx.com","domain":"changenowx.com","tld":"com"},"ip":{"addr":"130.12.180.128","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-07-11T23:17:48Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"z0yflva4pidy47h"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":4}},"detection":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-06-06","alert":"Sinkholed","trigger":"changenowx.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-06-06","alert":"Phishing Block","trigger":"changenowx.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-06","alert":"Sinkholed","trigger":"changenowx.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-06","alert":"Sinkholed","trigger":"changenowx.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null},"summary":[{"fqdn":"changenowx.com","ip":{"addr":"130.12.180.128","port":443,"asn":0,"as":"","country":"","country_code":"zz"},"domain_registered":"2026-06-02","domain_rank":0,"first_seen":"2026-06-06T23:17:48.926409Z","last_seen":"2026-06-06T23:17:48.926409Z","alert_count":12,"request_count":3,"received_data":30534,"sent_data":1379,"comment":"","tags":null,"fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"changenowx.com/","fqdn":"changenowx.com","domain":"changenowx.com","tld":"com"},"ip":{"addr":"130.12.180.128","port":443,"asn":0,"as":"","country":"","country_code":"zz"},"introduction_type":"scriptElement","is_inline":true,"md5":"08ba28fddf9ba12a6941d886af4aeb62","sha1":"78a8745646aa723651cea429fb2243178c68db1d","sha256":"c63614f35b62688abc008cc80f471189650602530c24483d0edfae31b89770af","sha512":"b4c3d8aea3abd8e1e6390960cdd8617ae5a0403a86d50fbcbbda60cbb6d6550ed694f6fc4b21ad42cd7965a0eb8799d9641066a29ef944852701bc3d1e96e695","ssdeep":"","tlshash":"2b21ce1db7f7122560a3613d5b8b7240663260232c0bfc1e7a4c8394cfb6569b666f18","size":1415,"data":"","first_seen":"2026-06-06T23:17:52.374679Z","last_seen":"2026-06-06T23:29:27.888558Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"changenowx.com/","fqdn":"changenowx.com","domain":"changenowx.com","tld":"com"},"ip":{"addr":"130.12.180.128","port":443,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-06-06T23:17:27.399Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P384-SHA384","protocol":"TLSv1.3","cert":{"subject":{"commonName":"changenowx.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 02 Jun 2026 11:44:43 GMT","end":"Mon, 31 Aug 2026 11:44:42 GMT"},"fingerprint":{"sha1":"7B:55:E0:A2:36:4C:ED:9C:2A:42:3D:C0:BF:49:EE:F2:0F:96:34:BB","sha256":"17:E8:FD:8D:C6:2E:69:98:C8:5D:C6:7C:3E:54:F7:38:2F:C5:9A:BC:51:D1:96:D2:72:D6:06:9A:52:8A:B3:84"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: changenowx.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: openresty\r\ndate: Sat, 06 Jun 2026 23:17:27 GMT\r\ncontent-type: text/html\r\nvary: Accept-Encoding\r\nlast-modified: Tue, 02 Jun 2026 12:45:54 GMT\r\netag: W/\"6a1ed082-6b1d\"\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":27421,"size_decoded":0,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (447)","md5":"a14f85214475e2bdb648b26122bcf3ef","sha1":"d562c16897a5bd2d614d45b594d58aebc6d61c06","sha256":"d4ee19011fd41d4687ab0915e004f734b4b3c3c326cb16cc501e5c7e97090d64","sha512":"da75e951a09652a64e55ed372ad4bbb7e96900cde2a8b692ec76100b628b9f438b5beae9b6f18150462dd6d38c29192379267d4a2dfaa7e3d3f5bc4d2266b56b","ssdeep":"384:xUI4GaYoDUMf+YxFS39tZJWuUPtFtCInHulMgEy9Dg:xlTJowMf+YxFS7W10gkxg","tlshash":"a7c29876b1b3217360a791a137e7538b6766e057c90a87153bfc82988fc5c94ce27b8c","first_seen":"2026-06-06T23:17:52.372296Z","last_seen":"2026-06-06T23:29:27.885848Z","times_seen":2,"resource_available":false,"data":null}},"time_used":330,"timings":{"blocked":79,"dns":15,"connect":20,"send":0,"wait":172,"receive":0,"ssl":41},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-06-06","alert":"Sinkholed","trigger":"changenowx.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-06-06","alert":"Phishing Block","trigger":"changenowx.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-06","alert":"Sinkholed","trigger":"changenowx.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-06","alert":"Sinkholed","trigger":"changenowx.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"changenowx.com/apple-touch-icon-180x180-1.webp","fqdn":"changenowx.com","domain":"changenowx.com","tld":"com"},"ip":{"addr":"130.12.180.128","port":443,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://changenowx.com/","date":"2026-06-06T23:17:28.178Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P384-SHA384","protocol":"TLSv1.3","cert":{"subject":{"commonName":"changenowx.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 02 Jun 2026 11:44:43 GMT","end":"Mon, 31 Aug 2026 11:44:42 GMT"},"fingerprint":{"sha1":"7B:55:E0:A2:36:4C:ED:9C:2A:42:3D:C0:BF:49:EE:F2:0F:96:34:BB","sha256":"17:E8:FD:8D:C6:2E:69:98:C8:5D:C6:7C:3E:54:F7:38:2F:C5:9A:BC:51:D1:96:D2:72:D6:06:9A:52:8A:B3:84"}}},"request":{"raw":"GET /apple-touch-icon-180x180-1.webp HTTP/1.1\r\nHost: changenowx.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://changenowx.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: openresty\r\ndate: Sat, 06 Jun 2026 23:17:28 GMT\r\ncontent-type: image/webp\r\ncontent-length: 1942\r\nlast-modified: Tue, 02 Jun 2026 12:45:54 GMT\r\netag: \"6a1ed082-796\"\r\nx-cache-status: HIT\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]}],"data":{"size":1942,"size_decoded":0,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"8ac03768d1cf65ba50c9d6f4503620a8","sha1":"cfb2faa92a735430b30101f03c75eda1d516081f","sha256":"ec1c78db5cc9914174a6d4aeec190e14ecf0f7c442865166bbf70f500802dfdf","sha512":"4ba0d5b28353cedf94e7231c9170061e870046a1ea581c5b919ebe62d15acf3f5b39cfde12b5979930e77756a835349454fd14080c942cbfd6ced703d4f5ea7f","ssdeep":"","tlshash":"9541087e20b71d4dd3a85e284bb19f1e8995460909cb8140a95b9b1ca77ef33a057cca","first_seen":"2025-11-13T06:14:08.540129Z","last_seen":"2026-07-27T04:58:59.528845Z","times_seen":45,"resource_available":false,"data":null}},"time_used":20,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":20,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-06-06","alert":"Sinkholed","trigger":"changenowx.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-06","alert":"Sinkholed","trigger":"changenowx.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-06-06","alert":"Phishing Block","trigger":"changenowx.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-06","alert":"Sinkholed","trigger":"changenowx.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"changenowx.com/favicon-16x16.png","fqdn":"changenowx.com","domain":"changenowx.com","tld":"com"},"ip":{"addr":"130.12.180.128","port":443,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://changenowx.com/","date":"2026-06-06T23:17:28.185Z","timestamp":0,"http_version":"","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P384-SHA384","protocol":"TLSv1.3","cert":{"subject":{"commonName":"changenowx.com","organization":""},"issuer":{"commonName":"YE1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 02 Jun 2026 11:44:43 GMT","end":"Mon, 31 Aug 2026 11:44:42 GMT"},"fingerprint":{"sha1":"7B:55:E0:A2:36:4C:ED:9C:2A:42:3D:C0:BF:49:EE:F2:0F:96:34:BB","sha256":"17:E8:FD:8D:C6:2E:69:98:C8:5D:C6:7C:3E:54:F7:38:2F:C5:9A:BC:51:D1:96:D2:72:D6:06:9A:52:8A:B3:84"}}},"request":{"raw":"GET /favicon-16x16.png HTTP/1.1\r\nHost: changenowx.com\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,*/*\r\nAccept-Language: en-US,en;q=0.5\r\nAccept-Encoding: gzip, deflate, br\r\nDNT: 1\r\nConnection: keep-alive\r\nReferer: https://changenowx.com/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 OK\r\nserver: openresty\r\ndate: Sat, 06 Jun 2026 23:17:28 GMT\r\ncontent-type: image/png\r\ncontent-length: 433\r\nlast-modified: Tue, 02 Jun 2026 12:45:54 GMT\r\netag: \"6a1ed082-1b1\"\r\nx-cache-status: HIT\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":433,"size_decoded":0,"mime_type":"image/png","magic":"PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced","md5":"5ac8e3aa2431153d5d10439aad9cf8d5","sha1":"9d39102b3f776cdb485f0e886111d3a1f3341f39","sha256":"d5bd4c28ab0b340efcde1a5f8091af51de93bf3a6daa677e250f104ba2edb791","sha512":"994b6abccfb8a067366362fe5361607094f879a4bc0ffc16247ffe78952fcc12626850f555bddcd1659fb938f9ef1b5ed3582f7fe0466ce2c15571c3523fad2a","ssdeep":"","tlshash":"47e023a166c7ab9c768d003f428e8524941c622e848c412c2c0315415296615a0b6fde","first_seen":"2025-12-19T16:36:33.420211Z","last_seen":"2026-07-27T04:58:59.531671Z","times_seen":55,"resource_available":false,"data":null}},"time_used":20,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":20,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-06-06","alert":"Sinkholed","trigger":"changenowx.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"hagezi","sensor_type":"DNS","title":"Hagezi Threat Feed","description":"Hagezi Threat Feed","scan_date":"2026-06-06","alert":"Sinkholed","trigger":"changenowx.com","verdict":"malicious","severity":"medium","comment":"","link":"https://github.com/hagezi/dns-blocklists","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-06-06","alert":"Sinkholed","trigger":"changenowx.com","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-06-06","alert":"Phishing Block","trigger":"changenowx.com","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}}]}