verizon[.]finokdb[.]cc

The domain verizon.finokdb.cc was registered on January 19, 2026 through Gname.com Pte. Ltd. and resolved to the IP address 104.21.78.229, which belongs to Cloudflare, Inc. (AS13335) and is geolocated in the United States. The site presented the generic HTTP response title "Welcome to nginx!" and did not present an SSL certificate, indicating a lack of transport encryption. Nameserver records point to A.SHARE-DNS.COM and B.SHARE-DNS.NET, a configuration commonly seen in transient phishing infrastructure. The domain was classified as a brand impersonation targeting the brand x.com, and the scam type was explicitly listed as brand impersonation.

Detection services flagged the domain, with 15 of 93 VirusTotal scanners marking it as malicious, and it appears on a single external security blocklist. PhishDestroy listed the domain as blocked, and the Gridinsoft trust scoring system assigned a score of 0 out of 100, reflecting an extremely low reputation. The site is currently offline, limiting immediate observation, and no SSL certificate was available for further fingerprinting.

While the page content beyond the title has not been captured, the combination of a brand‑targeted domain, Cloudflare hosting, low trust score, and multiple vendor detections strongly suggests a malicious phishing operation. Defenders should continue to block the domain at perimeter controls, monitor related subdomains under the finokdb.cc second‑level domain, and consider adding the IP address 104.21.78.229 to deny‑list entries, acknowledging that Cloudflare may host other legitimate traffic. Ongoing intelligence collection should focus on any re‑activation attempts, variations in the subdomain pattern, and correlation with other observed phishing campaigns targeting x.com.