bitupchange[.]io

Analysis of the domain bitupchange.io indicates it was actively impersonating a cryptocurrency exchange platform targeting Ethereum users. Registered on July 3, 2025, through NiceNIC International Group Co., Limited, the domain resolved to the IP address 188.114.97.3, which is hosted on Cloudflare's infrastructure (AS13335) in the United States. The SSL certificate was issued by Google Trust Services under the identifier WE1, a common configuration for Cloudflare-protected sites. Detection data reveals elevated risk: Gridinsoft assigned a trust score of 1 out of 100, while Scamadviser mirrored this assessment with an identical score. The domain appeared on one security blocklist and was flagged by 15 of 95 security vendors on VirusTotal, suggesting broad recognition of its malicious nature.

AlienVault OTX recorded the domain in one threat intelligence pulse, further corroborating its association with fraudulent activity. PhishDestroy explicitly blocked the domain, and it was subsequently taken offline by the time of this report. The page title, 'Buy & Sell Bitcoin, Ethereum | Cryptocurrency Exchange | bitupchange,' explicitly positioned the site as a cryptocurrency exchange, aligning with the 'Crypto Scam' classification provided in the intelligence. Technologies detected on the domain included Chart.js, jsDelivr, Facebook Pixel, cdnjs, and Cloudflare Browser Insights, which are commonly used in both legitimate and malicious sites but do not inherently indicate intent. The nameservers, brian.ns.cloudflare.com and penny.ns.cloudflare.com, are consistent with Cloudflare's standard configuration.

Defenders should treat this domain as part of a broader pattern of cryptocurrency-related brand impersonation. The use of Cloudflare infrastructure is notable, as it may obscure the true origin of the hosting. While the domain is currently offline, organizations should monitor for re-registration or similar domains leveraging the same registrar or hosting patterns.