changenow[.]ink

On July 25, 2026, analysis of the domain changenow.ink was performed. The domain was registered on July 19, 2025 through Hosting Concepts B.V. d/b/a Registrar.eu and is hosted on an IP address 45.61.136.175, which resolves to a United States location identified as FranTech Solutions. The authoritative name servers are ns1.openprovider.nl, ns2.openprovider.be, and ns3.openprovider.eu, indicating the use of Openprovider infrastructure. An HTTPS service is present, secured by a Let’s Encrypt certificate (identifier YE2) and the web server returns HTTP status code 200. The page title returned by the server is "Redirecting...", which is consistent with a typical phishing redirection page, though the content of the landing page has not been captured.

Threat intelligence feeds flag the domain as high‑risk generic phishing. Fifteen of ninety‑three VirusTotal scanners have raised detections, and the domain appears on one public blocklist. The blocklist is operated by PhishDestroy, which currently blocks the domain. The risk assessment classifies the domain as active with a high confidence level.

Defenders should add the IP address 45.61.136.175 and the domain name to deny‑list or firewall rules, monitor DNS queries for the three Openprovider name servers, and enforce TLS inspection to capture the redirected payload. Continuous re‑scanning with multi‑engine services is recommended to track any changes in detection rates. Because the site returns a generic redirect response, any inbound traffic to the domain should be treated as malicious. The combination of recent registration, high‑risk classification, active blocklist listing, and multiple vendor detections supports a recommendation to block and monitor this infrastructure.