changg-nnow[.]com

Analysis of changg-nnow.com indicates a confirmed phishing domain leveraging Cloudflare infrastructure. The domain, registered on February 21, 2026, is currently offline with a 522 connection timeout error, as reflected in its page title. Infrastructure analysis reveals it resolves to 188.114.97.3, an IP address within Cloudflare's network (AS13335), a common hosting choice for phishing campaigns due to its proxy services and ease of setup. The domain appears on one security blocklist, and eight of 93 security vendors on VirusTotal flagged it as malicious prior to takedown.

Its SSL certificate is classified as WE1, a low-trust indicator often associated with automated or low-effort deployments. The domain was blocked by PhishDestroy, a specialized anti-phishing service, further corroborating its fraudulent intent. While the exact phishing target or lure type remains unconfirmed due to the site's current offline status, the combination of detection vendor flags, blocklist presence, and Cloudflare-hosted infrastructure strongly supports classification as a phishing domain.

Defenders should treat this domain as compromised and include it in blocklists, particularly for organizations using Cloudflare IP ranges. No evidence suggests persistence or active redirects, but monitoring for re-emergence under the same or similar infrastructure is recommended. The domain's brief lifespan (five months from registration to takedown) aligns with typical phishing campaign timelines.