verizon[.]tugknd[.]cc

Analysis of verizon.tugknd.cc indicates a newly registered domain used for brand impersonation of x.com. The domain was created on 21 February 2026 and points to the IP address 188.114.96.3, which is owned by AS13335 Cloudflare, Inc., located in the United States. Both authoritative nameservers—lorna.ns.cloudflare.com and michael.ns.cloudflare.com—are Cloudflare‑provided, suggesting the operator leveraged Cloudflare’s CDN and DNS services to hide the true origin. No TLS certificate was observed; the HTTP response returned the generic title “Welcome to nginx!”, confirming that the site was serving a default nginx page rather than a branded login portal. The Gridinsoft trust scoring system assigned a score of 0 out of 100, reflecting a high confidence of malicious intent.

VirusTotal reports that 16 of 93 scanning engines flagged the domain, providing independent corroboration of suspicious behavior. Additionally, the domain appears on a single public security blocklist and has been actively blocked by PhishDestroy, indicating that at least one external mitigation service has taken action against it. The registrar listed is Gname.com Pte. Ltd., a known registrar that often appears in malicious registrations. Current status is offline, which may be a temporary takedown or a deliberate shutdown after a short campaign.

Defenders should treat verizon.tugknd.cc as a confirmed brand‑impersonation threat. Recommended actions include adding the domain to outbound and inbound URL filtering policies, updating DNS‑based blocklists with the observed IP and nameserver pairs, and monitoring for newly created domains that share the same registrar or similar lexical patterns. Because the underlying Cloudflare infrastructure can be reused for other malicious sites, continuous monitoring of the IP 188.114.96.3 and related sub‑domains is advised.