verizon[.]vlodq[.]cc

Analysis of verizon.vlodq.cc indicates a brand‑impersonation campaign targeting the x.com brand. The domain was registered through Gname.com Pte. Ltd. on 21 February 2026 and resolves to 104.21.60.183, an address owned by Cloudflare, Inc. (AS13335) located in the United States. Nameserver records point to lee.ns.cloudflare.com and virginia.ns.cloudflare.com, confirming Cloudflare’s DNS service. No TLS certificate is presented; HTTP requests return the default “Welcome to nginx!” page title, suggesting a bare web server without a custom landing page.

The site has been taken offline, but historical data show that 15 of 95 VirusTotal scanners flagged the domain as malicious, and it appears on a single security blocklist. PhishDestroy has already added the domain to its block list, and Gridinsoft assigns a trust score of 0 / 100, reflecting a high likelihood of abuse. The listed scam type is “Brand Impersonation,” with the explicit target identified as x.com. The limited detection footprint—one blocklist entry and moderate VirusTotal detection—suggests the campaign may have been short‑lived or limited in reach.

Defenders should continue to block the domain at perimeter controls, monitor Cloudflare‑owned IP ranges for similar activity, and update threat‑intel feeds with the indicator set (domain, IP, nameservers, registration details). Because the site is currently offline, active probing is unnecessary, but retrospective log analysis for connections to 104.21.60.183 after 21 February 2026 may reveal compromised credentials or attempted credential harvesting directed at x.com. Organizations using the x.com brand should educate users about unsolicited links that reference the brand and enforce multi‑factor authentication to mitigate potential credential reuse.