verizon[.]bmhoz[.]icu

This domain, verizon.bmhoz.icu, is flagged as an elevated-risk credential-theft phishing site specifically impersonating X.com. Analysis indicates the infrastructure was established to harvest user login credentials through brand impersonation, a technique commonly employed in targeted social media account compromise campaigns. The threat type aligns with credential harvesting rather than generic phishing, given the explicit targeting of X.com authentication endpoints. Infrastructure analysis reveals multiple technical indicators corroborating malicious intent. The domain was registered on December 14, 2025, through Gname.com Pte. Ltd., a registrar frequently associated with recently observed phishing campaigns. It resolves to IP address 188.114.97.3, hosted on AS13335 (Cloudflare, Inc.) in the United States, a network segment often leveraged for bulletproof hosting of fraudulent sites. The domain appears on one security blocklist (PhishDestroy) and is detected by 14 out of 95 security vendors on VirusTotal, indicating moderate but non-negligible consensus regarding its malicious nature. Notably, the site lacks an SSL certificate and displays a default "Welcome to nginx!" page title, suggesting either incomplete deployment or deliberate obfuscation of its true purpose. Mitigation steps for this specific threat type include immediate blocking of the domain and its resolving IP (188.114.97.3) at network perimeter controls. Organizations should deploy indicators of compromise (IOCs) to endpoint detection systems to prevent user access. Given the credential-theft focus, affected entities should enforce password resets for any accounts potentially exposed to this domain, particularly those associated with X.com. Security teams are advised to monitor for anomalous authentication attempts originating from the identified IP range and to conduct retrospective log analysis for connections to verizon.bmhoz.icu. User awareness training should emphasize verification of domain authenticity before entering credentials, with specific guidance on identifying impersonation attempts targeting social media platforms.