verify-dns-id[.]to

The domain verify-dns-id.to was registered on 1 June 2026 through the Government of the Kingdom of Tonga. It is currently classified as a credential phishing site with a high risk rating and remains active as of 12 July 2026. The short lifespan and recent creation are consistent with a rapid‑deployment phishing campaign. Infrastructure analysis shows the domain resolves to the Cloudflare edge address 172.67.174.128, which is associated with Cloudflare, Inc. in Canada. The authoritative name servers are dawn.ns.cloudflare.com and ridge.ns.cloudflare.com, indicating the use of Cloudflare’s DNS service. A valid Let's Encrypt certificate (issuer E7) is present, enabling HTTPS connections without browser warnings. VirusTotal has recorded detections from six of ninety‑five scanning engines, providing independent confirmation of malicious intent. The site returns an HTTP 404 status, suggesting that the phishing landing page may be dynamically generated or temporarily removed. The domain appears on a single external blocklist and has been actively blocked by PhishDestroy, reinforcing the assessment of credential phishing activity. No additional artifacts such as malicious payloads or command‑and‑control endpoints have been observed, leaving the exact phishing workflow uncertain. Defenders should add verify-dns-id.to to network‑level deny lists and enforce DNS filtering to prevent resolution. Monitoring of the associated IP address for anomalous traffic patterns is advised, as is the deployment of TLS inspection to capture any encrypted credential exfiltration attempts. Continuous re‑evaluation of the domain’s status on threat‑intel feeds is recommended, given the potential for rapid re‑use of the underlying Cloudflare infrastructure.