verizon[.]vdwfl[.]cc

Analysis of verizon.vdwfl.cc, first observed on February 21 2026, shows a high‑risk brand‑impersonation campaign targeting the x.com brand. The domain resolves to the Cloudflare address 104.21.59.30, which is advertised as belonging to AS13335 Cloudflare, Inc. and is geolocated in the United States. The site returns HTTP 200 and presents the generic page title “Welcome to nginx!”, indicating that no custom landing page has been detected. The TLS certificate is issued by Google Trust Services under the WE1 intermediate, confirming the use of a legitimate certificate authority but offering no indication of malicious intent beyond the domain name itself. VirusTotal has recorded 17 detections out of 93 scanning engines, demonstrating that a minority of security vendors flag the domain as malicious.

The low Gridinsoft trust score of 0 / 100 further corroborates the suspicion. The registrar listed is Gname.com Pte. Ltd., a provider often associated with disposable or rapidly‑registered domains. Nameserver entries are “ignacio.ns.cloudflare.com” and “kristin.ns.cloudflare.com”, both standard Cloudflare resolvers, which do not reveal any dedicated infrastructure. The domain appears on a single public blocklist, PhishDestroy, confirming that at least one anti‑phishing service has taken action against it. No additional blocklist or Safe Browsing entries are presently recorded.

Because the page content beyond the title has not been publicly disclosed, the exact phishing vector—such as credential‑harvesting forms or malicious redirects—remains unknown. Defenders should therefore treat any traffic to verizon.vdwfl.cc as hostile. Recommended actions include adding the domain to outbound web‑filter deny lists, monitoring DNS queries for the IP 104.21.59.30, and correlating any authentication attempts on x.com with this host. Continuous re‑evaluation is advised, as additional detections or blocklist listings may emerge.