verizon[.]vtoifdt[.]cc

Analysis indicates that the domain verizon.vtoifdt.cc was actively impersonating X.com (formerly Twitter) as part of a brand-impersonation phishing campaign. The domain was registered on February 21, 2026, through Gname.com Pte. Ltd. and resolved to the IP address 104.21.31.27, hosted on Cloudflare's network (AS13335). No SSL certificate was present at the time of assessment, increasing the likelihood of interception or manipulation of user data. The page title, 'Welcome to nginx!', suggests the server was misconfigured or intentionally left in a default state, possibly to avoid immediate detection while infrastructure was being tested or deployed.

Despite this, 13 of 93 security vendors on VirusTotal flagged the domain as malicious, and it appears on at least one security blocklist. The domain was taken offline following detection and blocking by PhishDestroy, though the exact timeline of its operational period remains unclear. Infrastructure analysis reveals the use of Cloudflare nameservers (kehlani.ns.cloudflare.com and marek.ns.cloudflare.com), a common tactic to obscure hosting origins and evade takedowns.

The absence of an SSL certificate and the generic page title further align with low-effort or rapidly deployed phishing infrastructure. Defenders should treat this domain as confirmed malicious and prioritize blocking resolutions to 104.21.31.27, as well as monitoring for related domains registered through the same registrar or leveraging Cloudflare's network for similar campaigns. While the exact content of the phishing page is not yet analyzed, the domain's classification as a brand-impersonation scam targeting X.com is supported by the available evidence.