verizon[.]com-bap[.]com

This domain, verizon.com-bap.com, is a confirmed credential harvesting site designed to impersonate X.com, a high-profile social media platform. The site likely targets users with fake login prompts or account verification requests to steal authentication credentials, session tokens, or personal information. Given the domain's structure and known impersonation tactics, it poses an elevated risk to individuals and organizations, particularly those with active X.com accounts or affiliated business services. Analysis of the domain reveals multiple technical indicators of malicious intent. The domain was registered on February 21, 2026, through Dominet (HK) Limited, a registrar frequently associated with abusive registrations. It resolves to the IPv6 address 2606:4700:3035::6815:5bb0, hosted on infrastructure belonging to AS13335 (Cloudflare, Inc.), which is commonly leveraged to obfuscate attacker origins. The domain is flagged by 17 out of 95 security vendors on VirusTotal, and it appears on at least one security blocklist. Additionally, the SSL certificate issued by Google Trust Services (WE1) and the default "Welcome to nginx!" page title suggest an incomplete or hastily deployed phishing kit, potentially indicative of a larger campaign. Users who have visited verizon.com-bap.com or interacted with its content should take immediate remedial action. If credentials were entered, reset passwords for X.com and any other accounts where the same credentials may have been reused. Enable multi-factor authentication (MFA) where available to mitigate unauthorized access. Review account activity for signs of compromise, such as unauthorized posts, messages, or linked applications. Organizations should monitor network logs for connections to the domain or its associated IP address (2606:4700:3035::6815:5bb0) and block both at the perimeter. If personal or financial information was submitted, consider reporting the incident to relevant authorities and monitoring for signs of identity theft or fraud.