verizon[.]tfxnjf[.]cc

Analysis indicates that the domain verizon.tfxnjf.cc was registered on 21 February 2026 through Gname.com Pte. Ltd. and is currently taken offline. The authoritative nameservers dolly.ns.cloudflare.com and keenan.ns.cloudflare.com resolve the domain to the IP address 172.67.163.17, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. No TLS certificate was observed; the HTTP response returned the generic page title “Welcome to nginx!”. The Gridinsoft trust score is 0 out of 100, reflecting a maximum risk rating from that engine. VirusTotal reports that 15 of 93 scanned security vendors flagged the domain, confirming malicious intent.

The domain appears on one public security blocklist and has been specifically blocked by PhishDestroy as a brand‑impersonation campaign targeting x.com. The scam type is recorded as Brand Impersonation, and the intelligence highlights that the site imitates the brand x.com, although the page content has not been publicly disclosed beyond the default nginx title. Defenders should treat the host as malicious despite its offline status. Immediate actions include adding 172.67.163.17 to network‑level deny lists, enforcing DNS filtering for the exact FQDN, and confirming that any existing URL or content filters block the domain.

Because the domain uses Cloudflare’s infrastructure, future subdomains may be spun up rapidly; continuous monitoring of the registrar Gname.com for new registrations resembling the pattern should be instituted. The lack of SSL suggests that traffic is unencrypted, which could be leveraged for man‑in‑the‑middle interception if the site reappears, so TLS inspection policies should be applied. Organizations should also update internal threat intel feeds with the observed detection count and blocklist references to improve cross‑environment detection. Continuous review of any alerts related to x.