verizon[.]bysv[.]cc

Analysis of verizon.bysv.cc shows a newly registered domain (created 21 February 2026) that is being used for brand impersonation of x.com. The domain resolves to the Cloudflare edge address 188.114.96.3, which is associated with AS13335 Cloudflare, Inc. in the United States. No TLS certificate is presented, and an HTTP request returns the default "Welcome to nginx!" page title, indicating that the site is presently serving only a generic web server banner. The registrar listed for the domain is Gname.com Pte. Ltd., and the authoritative name servers are collins.ns.cloudflare.com and dane.ns.cloudflare.com, both belonging to Cloudflare’s DNS infrastructure.

Threat intelligence sources have flagged the domain: sixteen of ninety‑three VirusTotal scanners reported malicious activity, and the domain appears on a single security blocklist. Gridinsoft assigns a trust score of 0 / 100, and the domain is currently blocked by the PhishDestroy sinkhole. The overall risk assessment is elevated, and the site status is offline at the time of reporting. Defenders should immediately add verizon.bysv.cc and its resolving IP 188.114.96.3 to deny‑list rules in perimeter firewalls, DNS filtering, and endpoint protection suites.

Continuous monitoring of the Cloudflare IP range for re‑hosting attempts is advised, as the infrastructure can be reused for future impersonation campaigns. Since no SSL certificate is present and the only visible content is the nginx default banner, further payload analysis is limited; however, the confirmed brand‑impersonation intent toward x.com suggests that any future content is likely to mimic login or credential‑collection pages. Organizations should advise users to verify URLs carefully and to rely on trusted channels when interacting with x.com services.