verizon[.]com-vddv[.]cc

Analysis indicates that the fully qualified domain verizon.com-vddv.cc was registered through Gname.com Pte. Ltd. on 16 December 2025. The domain resolves to the Cloudflare address 172.67.215.168, located in the United States and advertised under ASN 13335, confirming that the attacker is leveraging Cloudflare’s edge network for content delivery and possibly to obscure origin. The nameservers marty.ns.cloudflare.com and rafe.ns.cloudflare.com further confirm the use of Cloudflare’s DNS service. No TLS certificate is presented; the HTTP response returns only the generic title “Welcome to nginx!”, suggesting that the site either served a default web server banner or was taken down.

The domain is currently marked as offline, yet it remains listed on at least one public security blocklist and has been actively blocked by the PhishDestroy platform. A Gridinsoft trust score of 0 out of 100 reinforces the assessment that the site is highly malicious. VirusTotal scans show that 16 of 95 antivirus and URL‑reputation vendors flag the domain as malicious, providing independent corroboration of its threat profile. The listed scam type is “Brand Impersonation” and the domain explicitly impersonates the brand x.com, indicating an intent to deceive users who may expect communications from the legitimate x.com service.

Because the site lacks a valid SSL certificate, any data exchanged would be transmitted in clear text, increasing the risk of credential harvesting if a phishing page were present. At present, no additional payloads, download links, or malicious scripts have been observed, leaving the exact phishing flow uncertain. Defenders should continue to block verizon.com-vddv.cc at the DNS and proxy layers, monitor for any re‑appearance on cloud‑based hosting services, and watch for similarly structured domains that combine a known brand name with unrelated TLDs. Ongoing vigilance is advised, especially for traffic targeting the x.