verizon[.]vnijsabj[.]cc

Analysis of verizon.vnijsabj.cc, observed on July 23 2026, indicates an active brand‑impersonation campaign targeting the x.com brand. The domain was registered on 21 February 2026 through Gname.com Pte. Ltd. and is hosted on Cloudflare infrastructure (AS13335) with the IP address 104.21.43.109 located in the United States. DNS resolution points to Cloudflare name servers jessica.ns.cloudflare.com and kianchau.ns.cloudflare.com, a common pattern for fast‑flux or abuse‑friendly hosting. No TLS certificate is presented; HTTP requests return the default nginx page titled “Welcome to nginx!”, suggesting the site is either a placeholder or has been taken offline after detection. Threat intelligence feeds have flagged the domain on a single security blocklist and it is listed as blocked by PhishDestroy.

The Gridinsoft trust score is 0 / 100, reflecting a high confidence of malicious intent. VirusTotal analysis shows that 15 of 93 scanners have raised detections, reinforcing the suspicion despite the domain’s current offline status. The lack of a valid SSL certificate, combined with the generic nginx response, limits the ability to assess any credential‑harvesting pages that may have been hosted previously. Uncertainty remains regarding the exact content that was served before the takedown, as no page capture or URL path details are available.

No evidence of additional infrastructure such as command‑and‑control servers, payloads, or associated phishing kits has been observed. Consequently, defenders should continue to monitor the IP 104.21.43.109 for any re‑use, enforce outbound filtering for URLs containing “verizon.vnijsabj.cc”, and add the domain to internal blocklists. Organizations that use the x.com brand should educate users about potential impersonation attempts and verify that any communications referencing “verizon.vnijsabj.cc” are fraudulent. Ongoing collection of HTTP archives and passive DNS data is recommended to capture any future re‑activation.