verizon[.]ygfi[.]cc

Analysis of verizon.ygfi.cc indicates the domain is currently offline but was actively used for a brand-impersonation campaign targeting the x.com brand. The domain was registered on 21 February 2026 through Gname.com Pte. Ltd. and resolves to the Cloudflare edge address 172.67.134.3, which is associated with ASN 13335 (Cloudflare, Inc.) and located in the United States. The authoritative nameservers are devin.ns.cloudflare.com and liberty.ns.cloudflare.com, confirming the use of Cloudflare’s DNS infrastructure. No TLS certificate was presented at the time of inspection, meaning the site served only HTTP content.

The HTTP response delivered an Nginx default page with the title “Welcome to nginx!”, providing no evidence of a credential‑capture interface or branding elements. Reputation signals are uniformly negative: the domain appears on one security blocklist, has a Gridinsoft trust score of 0 / 100, and is listed as blocked by PhishDestroy. VirusTotal scans recorded 12 detections out of 93 antivirus engines, reinforcing the malicious classification. The observed evidence aligns with the reported scam type of brand impersonation, but the exact phishing landing page content was not captured before the takedown, leaving the specific lure or credential‑harvesting mechanism uncertain.

Defenders should continue to block the domain at perimeter filters, monitor for any re‑registration of the same second‑level name, and consider adding the IP address 172.67.134.3 to deny‑list rules if not already covered by Cloudflare‑wide controls. Because the domain uses Cloudflare’s shared infrastructure, additional scrutiny of other subdomains hosted on the same IP may be warranted. Ongoing threat‑intel feeds should be consulted for any resurgence of this indicator, and any internal logs that reference requests to verizon.ygfi.cc should be investigated for possible user exposure before the takedown.