verizon[.]akhklv[.]icu

Analysis indicates that the domain verizon.akhklv.icu was registered on February 21 2026 through Gname.com Pte. Ltd. The domain resolves to the IPv6 address 2606:4700:3034::6815:86c, which is owned by Cloudflare, Inc. (AS13335) and geolocated to the United States. The authoritative nameservers are rene.ns.cloudflare.com and treasure.ns.cloudflare.com, confirming the use of Cloudflare DNS. No TLS certificate is presented; HTTP connections return the default nginx page with the title “Welcome to nginx!”. The lack of a valid certificate reduces the ability to authenticate the site and is consistent with a temporary or disposable hosting setup. Security telemetry shows the domain is listed on a single blocklist and has been flagged by PhishDestroy.

On VirusTotal, 13 of 93 scanning engines returned a positive classification, indicating a moderate level of detection across vendors. The Gridinsoft trust score is 0 out of 100, reflecting an extremely low reputation. The site is identified as a brand impersonation campaign targeting the x.com brand, and the scam type is recorded as brand impersonation. The page title does not reveal any branding or login interface, and no additional content has been captured.

The current operational status is offline, which may be a takedown or a temporary suspension. However, the infrastructure elements—Cloudflare DNS, a newly registered domain, lack of TLS, and multiple vendor detections—suggest a deliberate attempt to mimic a legitimate brand for malicious purposes. Defenders should continue to block the domain at perimeter filters, monitor for any re‑registration or similar sub‑domains, and enforce strict TLS verification for outbound connections to protect users from potential credential harvesting. Threat intelligence feeds should be updated with the indicator set, including the domain name, IPv6 address, and associated nameservers, to improve detection across security tools.