verizon[.]ygfa[.]cc

This domain, verizon.ygfa.cc, is flagged for brand impersonation targeting x.com, a major social media platform. Analysis indicates the infrastructure was designed to deceive users into believing they were interacting with legitimate x.com services, likely through credential harvesting or account takeover attempts. The page title 'Welcome to nginx!' suggests a default server configuration, often indicative of hastily deployed phishing infrastructure or misconfigured hosting environments. Infrastructure analysis reveals the following technical indicators: the domain resolves to IP address 104.21.34.97, hosted on Cloudflare's network (AS13335). It lacks an SSL certificate, increasing the likelihood of interception or detection by security mechanisms. The domain was registered on February 21, 2026, through Gname.com Pte. Ltd., and is currently flagged by 17 out of 95 security vendors on VirusTotal. It appears on one security blocklist and is explicitly blocked by at least one threat intelligence feed. The creation date is notably in the future, which may indicate either a data entry error or an attempt to evade detection through obfuscation. As of the latest assessment, verizon.ygfa.cc has been taken offline, reducing immediate risk to end users. However, the infrastructure remains registered and could be reactivated or repurposed for similar campaigns. The use of Cloudflare's network complicates attribution and takedown efforts due to the provider's widespread legitimate use. Organizations and individuals are advised to monitor for related domains or IPs, particularly those leveraging the same registrar or hosting provider. Blocking the IP 104.21.34.97 at the network level may mitigate residual risk from potential re-emergence of this or associated infrastructure.