verizon[.]mcnuo[.]icu

On July 23, 2026, verizon.mcnuo.icu was identified as a brand‑impersonation infrastructure targeting Verizon. The domain was registered on December 15 2025 through Gname.com Pte. Ltd. and resolves to 188.114.97.3, an address owned by AS13335 Cloudflare, Inc. in the United States. Both authoritative nameservers are hosted on Cloudflare (bailey.ns.cloudflare.com and etienne.ns.cloudflare.com). No TLS certificate is presented, indicating the site was served over plain HTTP or the certificate was removed before takedown.

The page title returned by the server is exactly “verizon.mcnuo.icu”, matching the domain string and providing no additional context. Reputation services have assigned a Gridinsoft trust score of 0 / 100, and the domain appears on a single security blocklist, specifically PhishDestroy. VirusTotal has recorded detections from 12 of 95 scanned engines, confirming that a subset of anti‑malware products recognize the host as malicious.

The site is currently offline, which limits real‑time verification of content, but historical data suggest it was used for brand impersonation. Defenders should add the domain and its IP address to outbound and inbound filtering rules, monitor DNS queries for the associated Cloudflare nameservers, and ensure that any internal references to Verizon‑related login portals are validated against known legitimate URLs. Continuous threat‑intel feeds should be consulted for any re‑use of the IP or similar sub‑domains, and incident response teams should treat any alerts involving this host as high‑confidence indicators of compromise.