verizon[.]com-afd[.]com

This domain, verizon.com-afd.com, is flagged as a brand impersonation phishing site designed to deceive users of the targeted platform x.com. Analysis indicates the domain mimics legitimate branding to facilitate credential harvesting or account compromise, though no specific drainer kit signatures were identified in available telemetry. The threat type aligns with known patterns of brand abuse, where attackers leverage lookalike domains to exploit user trust in established services. Infrastructure analysis reveals the domain was registered on December 16, 2025, through Dominet (HK) Limited, a registrar historically associated with abusive registrations. It resolves to the IP address 104.21.46.170, hosted on AS13335 (Cloudflare, Inc.), a network frequently utilized for both legitimate and malicious purposes. VirusTotal detections show 14 out of 95 security vendors flagging the domain as malicious, while it appears on a single security blocklist. The page title, 'Welcome to nginx!', suggests a default or misconfigured server setup, which may indicate rushed deployment or obfuscation tactics. No SSL certificate was observed, further reducing the domain's legitimacy. The domain is currently offline, likely following takedown actions or voluntary suspension. However, residual risk persists due to the potential for re-registration or migration to alternative infrastructure. Organizations should monitor for related domains using similar naming conventions (e.g., brand+random suffix) and enforce DNS-level blocking for the IP 104.21.46.170. Users should be advised to verify domain authenticity before entering credentials, particularly for services matching the targeted brand. Continuous threat intelligence monitoring is recommended to detect resurgence or evolution of this campaign.