nowchange[.]cyou

The domain nowchange.cyou was registered on December 02, 2025 through Web Commerce Communications Limited and presently resolves to the Cloudflare address 104.21.62.242, which is associated with AS13335 in the United States. No SSL certificate is presented for the host, and the Gridinsoft trust score is recorded as 0 out of 100, indicating a lack of credibility. The public page title returned by the site is "Instant Cryptocurrency Exchange | Best Rates & Lowest Fees | ChangeNOW," which is consistent with a generic cryptocurrency‑exchange lure. The domain appears on four independent security blocklists and is explicitly listed as blocked by PhishDestroy, Polkadot, Enkrypt, and Codeesura.

In the Open Threat Exchange, the domain is referenced in fifteen separate threat‑intel pulses, reinforcing its identification as a malicious indicator. VirusTotal analysis shows that sixteen of ninety‑five scanning engines flagged the domain, further confirming its suspicious nature. The nameservers in use—terry.ns.cloudflare.com and uma.ns.cloudflare.com—are typical of Cloudflare‑hosted services, but the combination of the lack of TLS, low trust score, and multiple detections suggests the infrastructure is being leveraged for phishing rather than legitimate commerce. The domain is currently taken offline, yet historical records and the blocklist presence mean that remnants of its activity may still be observed in network traffic.

Defenders should continue to block nowchange.cyou at perimeter controls, monitor DNS queries for the associated IP address, and consider adding the domain to internal blacklists if not already present. Ongoing observation of the hosting provider (Cloudflare) for any re‑use of the same IP range in future campaigns is advisable, and any inbound connections to the identified nameservers should be logged and investigated.