verizon[.]ovyms[.]icu

Analysis indicates that the domain verizon.ovyms.icu was registered on 21 February 2026. The domain resolves to the IP address 104.21.53.132, which is owned by Cloudflare, Inc. (AS13335) and geolocated in the United States. The TLS certificate presented for the host is identified as WE1, which does not correspond to a recognized brand certificate and suggests a generic or self‑signed issuance. The domain is currently marked as offline, which may be a temporary takedown or a deliberate shutdown after a campaign.

VirusTotal records show that 15 of 93 scanning engines have flagged the domain as malicious, indicating a moderate level of consensus among security vendors. The domain is listed on at least one public blocklist and is actively blocked by the PhishDestroy service, further confirming its classification as a phishing‑related resource. The available data does not include a page title, specific brand impersonation, or details about the phishing kit used, so the exact content of the site remains unknown. Defenders should continue to block traffic to the IP address and domain, monitor for any re‑appearance of the host, and consider adding the domain to internal deny lists.

Given the Cloudflare hosting, any future redeployment could use the same IP range, so correlation with other suspicious Cloudflare‑hosted domains is advisable. Organizations that rely on the Verizon brand should educate users about unsolicited login requests and enforce multi‑factor authentication to mitigate credential harvesting attempts. The evidence suggests a credible phishing operation, but the offline status limits immediate observation; ongoing reconnaissance is recommended to capture any revived infrastructure.