verizon[.]vfdq[.]cc

On 21 February 2026 the domain verizon.vfdq.cc was registered through Gname.com Pte. Ltd. and immediately pointed to the Cloudflare‑owned address 172.67.194.200, which resides in the United States under ASN 13335 (Cloudflare, Inc.). The domain is configured with the Cloudflare authoritative nameservers hayes.ns.cloudflare.com and jill.ns.cloudflare.com. No TLS certificate is presented; HTTP requests return the default “Welcome to nginx!” page, indicating an unconfigured web server rather than a credential‑harvesting front‑end. The domain is classified as a brand‑impersonation campaign targeting the x.com brand, as indicated by the supplied intelligence. A trust scoring service assigned a score of 0 out of 100, reflecting extreme suspiciousness.

VirusTotal scans show that 14 of 95 antivirus or URL‑reputation engines flag the domain as malicious, and the domain appears on at least one external security blocklist. PhishDestroy has also added the domain to its blocklist. The site was taken offline prior to this report, and its current status is listed as offline. Because the HTTP response is limited to a generic Nginx landing page, no additional phishing payload or credential‑collection mechanisms have been observed, leaving the exact malicious behavior uncertain. Nonetheless, the combination of a low trust score, multiple vendor detections, blocklist entries, and the explicit brand‑impersonation label warrants continued mitigation.

Defensive teams should ensure that the domain and its resolving IP address are blocked at DNS filtering, proxy, and firewall layers. Continuous monitoring of the Cloudflare IP range for any re‑use of the same address in future campaigns is advised. Analysts should also check for any resurgence of the domain on threat‑intel feeds, especially those that track brand‑impersonation activity against x.com, and verify that internal users are not redirected to the site through compromised DNS or proxy configurations.