verizon[.]cyli[.]cc

The domain verizon.cyli.cc was registered on 21 February 2026 and is currently taken offline. Automated analysis shows the site hosted behind Cloudflare (IP 172.67.168.4, ASN 13335, United States) and presented a TLS certificate identified as WE1. The domain appears on a single public blocklist and was flagged by the PhishDestroy feed as a malicious phishing infrastructure.

VirusTotal scans report that 10 of 93 security vendors assigned a detection to the host, indicating that a minority of scanners consider the domain suspicious. No additional intelligence such as Safe Browsing warnings, OTX mentions, or page‑title metadata is available in the supplied data set. The limited visibility of the site—absence of page‑title and brand information—means that the exact phishing lure (e.g., credential‑stealing login page) cannot be confirmed.

However, the combination of a recent registration date, Cloudflare hosting, a non‑standard TLS certificate, and multiple vendor detections aligns with typical patterns observed in credential‑harvesting campaigns. Defenders should continue to block the domain at perimeter firewalls and DNS resolvers, monitor for any resurgence of activity from the same IP address, and consider adding the single blocklist entry to internal threat‑intelligence feeds. Because the domain is already offline, incident response teams can treat it as inactive but keep the indicator on watch lists until a longer retention period confirms the threat has fully disappeared.