verizon[.]com-bam[.]com

Analysis indicates that the domain verizon.com-bam.com was registered on 21 February 2026 through Dominet (HK) Limited and is presently taken offline. DNS resolution points to 188.114.97.3, an address owned by AS13335 Cloudflare, Inc. in the United States. The authoritative nameservers are lila.ns.cloudflare.com and zahir.ns.cloudflare.com, confirming Cloudflare as the hosting provider. The site presented the generic HTTP response “Welcome to nginx!” and supports HTTP/3, suggesting a default Nginx front‑end rather than a custom phishing page. The TLS certificate is issued by Google Trust Services under the WE1 identifier, a legitimate certificate authority, which does not by itself imply malicious intent but is consistent with the use of reputable infrastructure to mask abuse.

The domain is classified as a brand‑impersonation campaign targeting x.com. It appears on a single security blocklist and has been actively blocked by the PhishDestroy service. Independent scanning on VirusTotal recorded 17 detections out of 95 vendors, reinforcing the malicious assessment. Gridinsoft assigned a trust score of 0/100, indicating a high confidence of abuse.

No additional evidence such as Safe Browsing or OTX identifiers were supplied. Defenders should continue to enforce blocklist rules for verizon.com-bam.com, monitor any future DNS changes, and consider adding the IP 188.114.97.3 to network‑level deny lists, especially for traffic originating from Cloudflare edge nodes. Because the TLS certificate is legitimate, reliance on certificate pinning alone will not prevent connections; instead, content‑based filtering and reputation services should be employed. Ongoing observation of the registrar Dominet (HK) Limited may reveal further domains employing the same infrastructure.