verizon[.]ygfe[.]cc

Analysis indicates that verizon.ygfe.cc was deployed as a brand‑impersonation resource targeting the x.com brand. The domain was registered on 21 February 2026 through Gname.com Pte. Ltd. and is hosted on Cloudflare infrastructure, as evidenced by the authoritative nameservers hayes.ns.cloudflare.com and jill.ns.cloudflare.com and the resolved address 188.114.97.3, which belongs to AS13335 Cloudflare, Inc. in the United States. No TLS certificate was observed; the HTTP response returned the default server page title "Welcome to nginx!", suggesting that the site was either stripped of content before takedown or never delivered a custom landing page.

The Gridinsoft trust score of 0 / 100 classifies the domain as highly malicious, and VirusTotal recorded 15 detections out of 93 scanned security vendors, reinforcing the malicious assessment. The domain appears on one external security blocklist and has been actively blocked by the PhishDestroy feed, confirming that defensive communities have already taken mitigation steps. Current operational status is offline, but the registration and hosting details remain static, indicating potential for rapid re‑activation.

Uncertainties include the exact phishing kit used, the specific payload or credential‑harvesting mechanisms, and whether additional sub‑domains were employed. Defenders should immediately add verizon.ygfe.cc to URL filtering and DNS‑based blocklists, monitor Cloudflare‑originated traffic for similar brand‑impersonation patterns, and enforce TLS‑only policies to reject non‑encrypted connections. Continuous re‑scanning of the domain’s IP address and associated nameservers is advised to detect any resurgence or reuse in future campaigns.