verifyone[.]one

Analysis of the domain verifyone.one, observed on July 19, 2026, indicates that it is actively being used for credential phishing. The domain was registered through NameSilo, LLC and delegated to Cloudflare nameservers vin.ns.cloudflare.com and elly.ns.cloudflare.com. DNS resolution points to IP 172.67.173.86, an address owned by Cloudflare, Inc. located in Canada. A TLS certificate issued by Google Trust Services (WE1) is present, and HTTPS requests return HTTP 403, while the page title displayed is “Just a moment…”. The site is currently listed as active and assigned a high risk rating. Threat‑intel feeds have marked the domain on three security blocklists and it is blocked by PhishDestroy, MetaMask, and SEAL. VirusTotal has processed the host with 91 scanning engines and reported no detections, but the lack of alerts does not constitute evidence of benign intent. The observable indicators—registration details, Cloudflare hosting, forced 403 response, and the generic “Just a moment…” title—are consistent with typical credential‑phishing infrastructure that relies on rapid domain turnover and CDN obfuscation. No additional content or phishing lure details have been disclosed, leaving the exact target brand or credential‑capture page unknown. Defenders should continue to block resolve-to‑IP traffic, add verifyone.one to URL filtering and sink‑hole lists, and monitor for any future changes in content or reputation. Ongoing collection of HTTP responses and potential phishing payloads is recommended to refine attribution and support takedown efforts.