nowcharge[.]cfd

This domain is flagged as a high-risk brand impersonation threat targeting Binance, a major cryptocurrency exchange platform. Analysis indicates the domain was designed to deceive users into believing they are interacting with a legitimate cryptocurrency exchange service, as evidenced by its page title, 'Instant Cryptocurrency Exchange | Best Rates & Lowest Fees | ChangeNOW,' which closely mimics authentic exchange platforms. The intent is likely to harvest user credentials, private keys, or facilitate fraudulent transactions under the guise of low-fee trading services. Infrastructure analysis reveals the domain nowcharge.cfd was registered on January 22, 2026, through Global Domain Group LLC, a registrar frequently associated with abusive registrations. It resolves to the IP address 62.60.226.213, geolocated in Germany under AS214351 (FEMO IT SOLUTIONS LIMITED), an autonomous system with a history of hosting malicious domains. The domain lacks an SSL certificate, increasing the risk of interception during data transmission. Detection metrics further confirm its malicious nature: 19 out of 95 security vendors on VirusTotal flag the domain, and it appears on three independent security blocklists. Additionally, the domain has been proactively blocked by multiple threat intelligence feeds, reinforcing its classification as a confirmed phishing asset. Mitigation against this threat requires a multi-layered approach tailored to cryptocurrency-related phishing. Users should verify domain authenticity by cross-referencing official exchange URLs and checking for SSL encryption (HTTPS) before entering credentials. Organizations should implement domain-based blocking at the network level, particularly for domains registered through high-risk registrars or resolving to suspicious autonomous systems. Cryptocurrency wallet providers are advised to integrate real-time threat intelligence feeds to detect and block interactions with known malicious domains. Given the domain's current offline status, continuous monitoring for re-emergence under similar naming conventions or infrastructure is recommended.