{"report_id":"3d374f14-45ff-4b78-988e-95dd53e1e322","version":0,"status":"done","tags":[],"date":"2026-08-28T14:41:59Z","url":{"schema":"http","addr":"web-changenow.to/","fqdn":"web-changenow.to","domain":"web-changenow.to","tld":"to"},"ip":{"addr":"217.60.195.241","port":0,"asn":31549,"as":"Aria Shatel PJSC","country":"United Arab Emirates","country_code":"AE"},"final":{"url":{"schema":"https","addr":"web-changenow.to/","fqdn":"web-changenow.to","domain":"web-changenow.to","tld":"to"},"title":"ChangeNOW: Instant Non-Custodial Crypto Swaps \u0026 Exchange","dom":{"size":18052,"mime_type":"text/html; charset=utf-8","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (6215)","md5":"6d1aa41f1de34e8cd19486cc99645087","sha1":"8ed473161a4da2f55f89a65cfc51c848361fc8ea","sha256":"d2c1f5cbe0d97d2e832197ab8ac48e9b5cf6a1e9b384b160ebebd47f018b1e42","sha512":"e62682847e7ef61875e4d926c9ba4460d2c28a28c073c29d1598a19081f0e23d3bc79a94bdc96fb8f91dabd656e6d383faeb1816101d13d1a1d2c242ab7073e9","ssdeep":"192:Oy38uVcdWwcgQLVYpbAXlQCiYYoEk0DHt/xLXxejYlIJwNoyiM8iCLVVySnA/ykZ:O2AFlQLibzPNk0N/xLBOjLTto","tlshash":"e282f7a7b6a08a3707d604403a7893daa36b80d7c6119a763b7d445d2fcdd6d082fbcd","dom_hash":"domhash2147ea15a1a2198ce478d7ed94965d22","first_seen":"2026-08-28T13:25:19.145783Z","last_seen":"2026-08-28T14:42:10.487306Z","times_seen":2,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"web-changenow.to/","fqdn":"web-changenow.to","domain":"web-changenow.to","tld":"to"},"ip":{"addr":"217.60.195.241","port":0,"asn":31549,"as":"Aria Shatel PJSC","country":"United Arab Emirates","country_code":"AE"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-10-02T14:41:59Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":2}},"detection":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-28","alert":"Sinkholed","trigger":"web-changenow.to","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-08-28","alert":"Phishing Block","trigger":"web-changenow.to","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null},"summary":[{"fqdn":"web-changenow.to","ip":{"addr":"217.60.195.241","port":443,"asn":31549,"as":"Aria Shatel PJSC","country":"United Arab Emirates","country_code":"AE"},"domain_registered":"unknown","domain_rank":0,"first_seen":"2026-08-28T13:25:15.252802Z","last_seen":"2026-08-28T13:25:15.252802Z","alert_count":4,"request_count":2,"received_data":18948,"sent_data":1008,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"OpenResty:1.31.1.1","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"web-changenow.to/","fqdn":"web-changenow.to","domain":"web-changenow.to","tld":"to"},"ip":{"addr":"217.60.195.241","port":443,"asn":31549,"as":"Aria Shatel PJSC","country":"United Arab Emirates","country_code":"AE"},"introduction_type":"scriptElement","is_inline":true,"md5":"b639d1eb23445bcee770f7442e4beccc","sha1":"0e0fd0e545a12f9c9c948fb18508fa9e37ab3394","sha256":"5114bf5436544841d0a9006435d109b9b7c32513a051d5873e4772a74dfa4540","sha512":"73735419ce1584e840500258efe557b6b1e5dba89bd02f55db8457451159f5ab52f12ea5cf4df35c08034c0e8e0b284a146acbc6af3d7534bec75a3a6ec35c48","ssdeep":"","tlshash":"f7e07d2930c200351373456533b741461123270bc45d8b12795fc4951f24c55044210c","size":303,"data":"","first_seen":"2026-08-28T13:25:19.149374Z","last_seen":"2026-08-28T14:42:10.498574Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"web-changenow.to/","fqdn":"web-changenow.to","domain":"web-changenow.to","tld":"to"},"ip":{"addr":"217.60.195.241","port":443,"asn":31549,"as":"Aria Shatel PJSC","country":"United Arab Emirates","country_code":"AE"},"introduction_type":"scriptElement","is_inline":true,"md5":"7fbbbcd06d3b7e69f4fddbcad065f6b2","sha1":"98afb6a48eecaf2a3ff24a24d0584cd4136cdd8a","sha256":"55c9fa6ec8edcd459ebfc0b64ae1446b806b277f2642e72ea63423d54916aa3c","sha512":"f4d82563706cfda3c4184a528f3390cab8aa02484328637826b05913942f1953a155bb8c5c5c54aed1218ecc147df812700b6cf29a94b1be5e4a063c9072101b","ssdeep":"","tlshash":"3f90021e083650d918540c55021a5928186aa7402194c28d54040915408109d59494e0","size":39,"data":"","first_seen":"2026-08-28T13:25:19.150424Z","last_seen":"2026-08-28T14:42:10.512651Z","times_seen":2,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"web-changenow.to/assets/favicon/favicon.png","fqdn":"web-changenow.to","domain":"web-changenow.to","tld":"to"},"ip":{"addr":"217.60.195.241","port":443,"asn":31549,"as":"Aria Shatel PJSC","country":"United Arab Emirates","country_code":"AE"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://web-changenow.to/","date":"2026-08-28T14:41:33.887Z","timestamp":1787928093887,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"web-changenow.to","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 05 Aug 2026 12:42:52 GMT","end":"Tue, 03 Nov 2026 12:42:51 GMT"},"fingerprint":{"sha1":"8A:D3:40:ED:5C:F7:2F:09:DA:0C:A7:2B:94:56:75:5D:B0:E2:E1:79","sha256":"40:35:56:99:3B:58:39:D4:32:E5:39:49:2E:E8:4E:34:DD:F9:06:C7:D8:B9:15:7D:33:29:0B:52:F5:43:3B:50"}}},"request":{"raw":"GET /assets/favicon/favicon.png HTTP/1.1\r\nHost: web-changenow.to\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://web-changenow.to/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty/1.31.1.1\r\nDate: Fri, 28 Aug 2026 14:41:47 GMT\r\nContent-Type: image/png\r\nContent-Length: 537\r\nConnection: keep-alive\r\nLast-Modified: Tue, 04 Aug 2026 16:31:38 GMT\r\nETag: \"6a7213ea-219\"\r\nAccept-Ranges: bytes\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"OpenResty:1.31.1.1","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]}],"data":{"size":537,"size_decoded":781,"mime_type":"image/png","magic":"PNG image data, 28 x 28, 8-bit colormap, non-interlaced","md5":"f64fbd7c97afa2fc37ce845a1a4743e0","sha1":"44aaf7fedac851f75011bc45de06ae0b497ae9df","sha256":"5784271fc2ab8b324db7e832a6b6cd9e1f99e28087ccd7543f8b780e11cea4d2","sha512":"1984a4d774567c36df3209a35b828275875135ca5de63a492cb2333226dd338efeeb8346d5a2e5bc5fc161d8088363993a10119a9399aa27771b3fada6d3cec2","ssdeep":"","tlshash":"cff005ba13d04d6b80d33078193956dcf594cd06535019b751d7b8174c33530d7cc595","first_seen":"2026-08-28T13:25:19.148295Z","last_seen":"2026-08-28T14:42:10.491511Z","times_seen":2,"resource_available":false,"data":null}},"time_used":82,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":82,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-28","alert":"Sinkholed","trigger":"web-changenow.to","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-08-28","alert":"Phishing Block","trigger":"web-changenow.to","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"web-changenow.to/","fqdn":"web-changenow.to","domain":"web-changenow.to","tld":"to"},"ip":{"addr":"217.60.195.241","port":443,"asn":31549,"as":"Aria Shatel PJSC","country":"United Arab Emirates","country_code":"AE"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-08-28T14:41:33.331Z","timestamp":1787928093331,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"mlkem768x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"web-changenow.to","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Wed, 05 Aug 2026 12:42:52 GMT","end":"Tue, 03 Nov 2026 12:42:51 GMT"},"fingerprint":{"sha1":"8A:D3:40:ED:5C:F7:2F:09:DA:0C:A7:2B:94:56:75:5D:B0:E2:E1:79","sha256":"40:35:56:99:3B:58:39:D4:32:E5:39:49:2E:E8:4E:34:DD:F9:06:C7:D8:B9:15:7D:33:29:0B:52:F5:43:3B:50"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: web-changenow.to\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: openresty/1.31.1.1\r\nDate: Fri, 28 Aug 2026 14:41:47 GMT\r\nContent-Type: text/html\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nLast-Modified: Thu, 13 Aug 2026 18:32:54 GMT\r\nETag: W/\"6a7e0dd6-45f7\"\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"OpenResty:1.31.1.1","description":"OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine.","website":"https://openresty.org","common_platform_enumeration":"","icon":"OpenResty.svg","categories":["Web servers"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":17911,"size_decoded":5170,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (6155)","md5":"3de69374ecd24123479d81a5aceae3da","sha1":"d4cd35a5281d39e207ee2defcc298c31da034637","sha256":"55e58d9a9cb6a78e777800beec722a0f7721074cb23a555caaebbd72aa3a9afe","sha512":"215b8a00afff4c219db434177360bb7314b3d03c631479a7aefd0e31b925fcb23717496abaf31c53a3136da57837d358124421cb3ca4235144bce8490bb17501","ssdeep":"192:Q78uVcdWwcgkLVYpbAXlQCUQBQYoEk0DHtfxLXhe7glIFQNoyiM8iCLVVySnA/y6:QlAFlkLibHM3Nk0NfxLxmzLTto","tlshash":"d382e6677aa04a3707d604402a7993cab36b80d3c6119a763b7d845d2fcd96d483fbce","first_seen":"2026-08-28T13:25:19.147096Z","last_seen":"2026-08-28T14:42:10.494661Z","times_seen":2,"resource_available":false,"data":null}},"time_used":229,"timings":{"blocked":-1,"dns":29,"connect":25,"send":0,"wait":138,"receive":0,"ssl":37},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-08-28","alert":"Phishing Block","trigger":"web-changenow.to","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-28","alert":"Sinkholed","trigger":"web-changenow.to","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}}]}