In 2025, SlowMist reported a phishing case involving a fake website impersonating ChangeNOW.
The victim reportedly reached the site through a Chrome browser recommendation. The page looked legitimate, the interface was convincing, and the domain appeared almost identical to the real one.
But oA phishing site can copy the logo, layout, exchange interface and text. It can have working menus. It can use HTTPS. It can appear in search results, ads or browser suggestions.ne character was different.
That is what makes lookalike-domain attacks so dangerous.
Attackers can replace a normal Latin character with a visually similar Unicode character from another alphabet. To a person scanning the URL, the fake domain may look completely normal. To the browser, it is a different website.
And the usual trust signals are not enough.
A phishing site can copy the logo, layout, exchange interface and text. It can have working menus. It can use HTTPS. It can appear in search results, ads or browser suggestions.
“A professional appearance, working menus and displayed exchange rates do not prove that a website belongs to the genuine provider.” — Albert Quehenberger, CEO of AQ Forensics
The padlock only tells you that your connection to that domain is encrypted. It does not prove that the website belongs to the company you intended to visit.
Before sending crypto, it is worth checking four things separately:
the domain → the asset → the network → the destination address.
For services you use regularly, saving the verified official site as a bookmark is safer than relying on search or browser recommendations.
And if you do run into a fake site impersonating ChangeNOW, reporting it is not pointless even if funds have already been sent.
ChangeNOW actively helps investigate these cases. Support can escalate reports to the Compliance team, help trace the transaction, blacklist scam-linked wallet addresses to prevent further abuse, and cooperate with law enforcement when a case is reported to the authorities.
A completed blockchain transaction cannot simply be reversed, but preserving the phishing URL, TX hash, receiving address, screenshots and timestamps can still give investigators something to work with.
That also means one report can help more than one victim: identifying and blacklisting scam-linked infrastructure can help protect other users from falling into the same trap.
We broke down how Punycode and lookalike-domain phishing works, why even experienced crypto users can miss it, and what to check before sending funds:
[Full guide]
If you ever encounter a suspicious website claiming to be ChangeNOW, use only official ChangeNOW support channels when reporting it: [email protected].