verizon[.]vlmfe[.]cc

On 23 July 2026, the domain verizon.vlmfe.cc was observed to be taken offline. The domain was registered on 21 February 2026 through Gname.com Pte. Ltd. and resolves to the Cloudflare‑owned address 172.67.218.3, which belongs to AS13335 in the United States. DNS resolution uses the Cloudflare authoritative nameservers dalary.ns.cloudflare.com and jaxson.ns.cloudflare.com. No TLS certificate is presented; an HTTP request returns the default nginx page titled “Welcome to nginx!”. The site is classified as a brand‑impersonation campaign targeting the x.com brand.

Gridinsoft assigned a trust score of 0 out of 100, indicating a high likelihood of malicious intent. VirusTotal analysis shows that 15 of 95 scanning engines flagged the domain as malicious. The domain appears on a single external blocklist and is actively blocked by the PhishDestroy service. The lack of an SSL certificate, combined with the generic nginx page, suggests the infrastructure is being used solely for hosting malicious content rather than serving a legitimate web service.

At present, the only confirmed indicator is the association with the x.com brand; no further payload, phishing page, or credential‑harvesting functionality has been publicly disclosed. Defenders should continue to monitor the IP address 172.67.218.3 for any resurgence of activity, enforce blocking of the domain and its host IP in network and endpoint controls, and add the domain to local threat intelligence feeds. Because the domain is already offline, any future re‑registration should be treated as suspicious until verified. Ongoing correlation with other Cloudflare‑hosted infrastructure may reveal additional related campaigns.