verizon[.]vtoifde[.]cc

The domain verizon.vtoifde.cc, which impersonates x.com, has been taken offline. Despite its current status, it was flagged as malicious by 12 out of 93 vendors on VirusTotal, indicating a significant threat level before its takedown. The site was listed on one public blocklist, specifically PhishDestroy, which first detected the domain on January 28, 2026.

This domain was registered through Gname.com Pte. Ltd. and hosted on an IP address associated with Cloudflare, Inc. in the United States. Notably, the domain did not employ SSL encryption, which is a common characteristic of phishing sites aiming to avoid detection while capturing sensitive user data.

The page displayed a generic "Welcome to nginx!" message, which is often used as a placeholder. This suggests that the attackers might have been in the process of setting up their phishing operation or had already completed their malicious activities by the time of detection. The platform risk score was relatively low at 10 out of 100, potentially due to the swift takedown and limited exposure.

Phishing domains like verizon.vtoifde.cc exploit the critical period between domain registration and widespread detection by antivirus databases. PhishDestroy's proactive monitoring captured this threat early, highlighting the importance of upstream detection systems in identifying and mitigating risks before they proliferate.