verizon[.]qhvpo[.]icu

verizon.qhvpo.icu is a newly registered domain (creation date 2026-02-21) that has been used to impersonate Amazon in an e-commerce fraud campaign. The site presented a page title “Verizon Deals: Save on Phones, Internet, Accessories | Verizon,” indicating an attempt to blend Verizon branding with the targeted Amazon brand. Technical analysis shows the domain resolves to the IP address 188.114.96.3, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. The SSL certificate presented by the host is identified as WE1, but no further certificate details are available. Reputation services rate the domain extremely low: Scamadviser assigns a trust score of 1 / 100, and Gridinsoft reports a score of 0 / 100.

The domain has been added to one known security blocklist and is actively blocked by the PhishDestroy filtering service. VirusTotal scans returned 11 positive detections out of 93 vendor engines, reinforcing the malicious classification. The campaign is categorized as an “E-Commerce Scam,” and the only confirmed brand target is Amazon. The site has been taken offline as of the report date (2026-07-24), and no current HTTP response can be observed.

No additional evidence such as Safe Browsing alerts, Open Threat Exchange identifiers, or registrar details were provided. Uncertainty remains around the full scope of the phishing kit and whether additional infrastructure components share the same IP address, as Cloudflare often serves multiple unrelated customers. Defenders should continue to block the domain at DNS and proxy layers, monitor for any re-registration of the sub-domain pattern “*.qhvpo.icu,” and ingest the observed indicators (IP 188.114.96.3, SSL WE1, trust scores, and VirusTotal detection count) into threat-intelligence platforms. Ongoing vigilance is advised to capture any resurgence of the impersonation campaign targeting Amazon customers.