verizon[.]com-bae[.]com

Analysis of the domain verizon.com-bae.com indicates confirmed phishing infrastructure targeting X.com (formerly Twitter) users. The domain was registered on February 21, 2026, through Dominet (HK) Limited and currently resolves to the IP address 188.114.97.3, hosted on Cloudflare's network (AS13335). No SSL certificate is present, increasing the risk of unencrypted credential harvesting. The page title 'Welcome to nginx!' suggests a default server configuration, often observed in hastily deployed phishing kits or misconfigured servers repurposed for malicious activity.

Infrastructure analysis reveals the domain uses Cloudflare nameservers (dakota.ns.cloudflare.com and natasha.ns.cloudflare.com), a common tactic to obscure hosting origins and evade takedowns. As of July 23, 2026, the domain appears on one security blocklist (PhishDestroy) and is flagged by 15 of 93 security vendors on VirusTotal, confirming detection by multiple threat intelligence sources. Gridinsoft assigns a trust score of 0/100, further corroborating its malicious classification. The domain is currently offline, likely following enforcement action, but defenders should treat any future resolution as high-risk.

The scam type is explicitly categorized as brand impersonation targeting X.com. While the exact phishing kit or payload is not analyzed, the combination of default server responses, missing SSL, and brand impersonation aligns with credential theft or account takeover campaigns. Defenders are advised to block the domain at the DNS and proxy levels, monitor for related infrastructure (e.g., subdomains or newly registered lookalikes), and alert users to potential X.com-themed phishing attempts. Given the domain's registration age and detection history, it may reappear under altered infrastructure or sister domains.