verizon[.]vnijsac[.]cc

On 23 July 2026, the domain verizon.vnijsac.cc was observed to be offline but retained indicators of a brand‑impersonation campaign targeting x.com. The domain was registered on 21 February 2026 through Gname.com Pte. Ltd. and resolves to the IP address 188.114.96.3, which is announced by AS13335 Cloudflare, Inc. and geolocated to the United States. DNS resolution uses the Cloudflare nameservers bayan.ns.cloudflare.com and uma.ns.cloudflare.com. No TLS certificate was presented; HTTP requests return the default nginx page with the title “Welcome to nginx!”.

The absence of HTTPS and the generic server banner suggest a placeholder or abandoned hosting environment rather than a fully operational phishing front‑end. Threat‑intelligence aggregators flagged the domain: 16 of 93 security vendors on VirusTotal raised detections, and the domain appears on a single blocklist, currently listed by PhishDestroy. The Gridinsoft trust score is 0 out of 100, indicating a high likelihood of malicious intent. The scam type is catalogued as “Brand Impersonation” with the specific target identified as x.com.

While the site is currently offline, the infrastructure components—Cloudflare IP, registrar, and lack of TLS—remain reusable for future malicious deployments. Analysts should monitor the registrar Gname.com for additional domains created in the same period, and watch for re‑appearance of the same IP address or nameservers in newly observed malicious URLs. Defensive controls should block DNS resolution for verizon.vnijsac.cc and enforce URL filtering based on the observed indicators. Continuous VirusTotal re‑scans and blocklist updates are recommended to capture any resurgence of activity.