verizon[.]txlrw[.]icu

The domain verizon.txlrw.icu was registered on 21 February 2026 and is currently listed as offline. VirusTotal records show that 12 of 93 scanned security vendors flagged the domain, indicating a moderate level of detection confidence. DNS resolution points to the IP address 172.67.196.123, which is owned by Cloudflare, Inc. (ASN 13335) and geolocated to the United States. The TLS certificate presented for the domain is identified as “WE1”, confirming that HTTPS services were provisioned.

The domain appears on a single security blocklist and has been explicitly blocked by the PhishDestroy feed, reinforcing the assessment that it was being used for malicious purposes. The available intelligence classifies the activity as generic phishing, but no additional details such as the targeted brand, page title, or underlying phishing kit have been disclosed. Consequently, the precise payload and victim‑interaction flow remain unknown.

Defenders should continue to block the domain and the associated IP address at network perimeter devices, update DNS filtering rules, and monitor for any resurgence of the host on other blocklists. Because the infrastructure relies on Cloudflare’s shared network, threat actors could potentially spin up new domains on the same IP range, so continuous reconnaissance of related sub‑domains and similar TLS fingerprints is recommended. Incident responders should also consider correlating logs for any recent outbound connections to 172.67.196.123 to identify possible exposure before the takedown.