verizon[.]rtbhd[.]icu

Analysis indicates that the domain verizon.rtbhd.icu was registered on 14 December 2025 through the registrar Gname.com Pte. Ltd. The domain resolves to the IPv4 address 188.114.96.3, which belongs to Autonomous System AS13335 operated by Cloudflare, Inc. and is geolocated to the United States. The authoritative name servers are A.SHARE-DNS.COM and B.SHARE-DNS.NET, both commonly used by fast‑flux and abuse‑hosting services. The TLS certificate presented for the host is labeled “WE1”, which does not correspond to a recognized public‑trust authority and may be self‑signed or otherwise suspicious. The domain appears on a single public security blocklist and has been explicitly blocked by the PhishDestroy feed, confirming its inclusion in at least one defensive data source.

VirusTotal data show that 16 of 95 scanned security vendors flagged the domain, providing a detection ratio of roughly 17 percent, which is consistent with the elevated risk rating assigned to the indicator. The current status is reported as offline, suggesting that the hosting service has removed the site or that the operator has temporarily withdrawn the malicious payload. No additional evidence such as page title, brand impersonation details, or HTTP response codes is available in the supplied intelligence, leaving the exact content of the site unverified.

Defenders should continue to enforce blocking of the domain and its associated IP address, incorporate the name‑server pair into DNS‑watch lists, and monitor the AS13335 prefix for any resurgence of similar activity. Given the multi‑vendor detections and blocklist presence, any inbound or outbound traffic referencing verizon.rtbhd.icu should be treated as malicious until a thorough content inspection disproves the classification. Ongoing threat‑hunting queries against the Cloudflare network and Share‑DNS infrastructure are recommended to uncover potential related campaigns.