nodejsrepairs[.]org

Analysis of nodejsrepairs.org indicates a newly registered domain used for brand impersonation targeting the CloudChange NFT marketplace. The domain was created on February 21, 2026 and is registered through NameCheap, Inc., with authoritative nameservers dns1.namecheaphosting.com and dns2.namecheaphosting.com. DNS resolution returns the IPv4 address 198.54.115.94, which is hosted in the United States under ASN 22612 owned by Namecheap, Inc. The site lacks an SSL/TLS certificate, meaning it is served only over HTTP, which reduces transport‑layer security and is a common characteristic of many phishing infrastructures.

VirusTotal scans show that two of ninety‑three security vendors flagged the domain, providing limited but notable detection evidence. Independent blocklist services—including PhishDestroy, MetaMask, and SEAL—have already listed the domain, and it appears on three additional security blocklists, reinforcing the consensus that the domain is malicious. The page title retrieved from the live host reads "CloudChange - NFT Marketplace," confirming the intent to masquerade as a legitimate NFT platform.

Current operational status is offline, which limits immediate content inspection, and no further page‑level artifacts have been captured. Defenders should continue to block the domain and its associated IP address at network perimeters, add the host to URL filtering and anti‑phishing policies, and monitor for any resurgence of the domain or reuse of the hosting infrastructure. Observers should also watch for new domains registered with the same registrar and similar naming patterns, as the rapid creation date suggests a short‑lived campaign that may reappear under different identifiers.