verizon[.]com-bag[.]com

The domain verizon.com-bag.com was registered on February 21, 2026 through Dominet (HK) Limited and is currently listed as offline. DNS resolution points to IP address 188.114.97.3, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. The authoritative nameservers are dakota.ns.cloudflare.com and natasha.ns.cloudflare.com, confirming that the domain is hosted behind Cloudflare’s edge network and is serving content over HTTP/3. The presented SSL certificate is issued by Google Trust Services under the label WE1, indicating a valid TLS handshake despite the site’s offline status. The only visible page title returned by the server is "Welcome to nginx!", suggesting a default web server response rather than a custom landing page.

Detection signals show that the domain appears on one public security blocklist and has been actively blocked by the PhishDestroy service. VirusTotal reports that 16 of 95 scanning engines flagged the domain, reinforcing the suspicion of malicious use. A Gridinsoft trust score of 0 out of 100 further underscores the lack of credibility. The infrastructure analysis reveals that the domain is being used to impersonate the brand x.com, as indicated by the declared brand target and scam type of "Brand Impersonation".

While the site is presently taken offline, the combination of recent registration, Cloudflare front‑end, low trust score, and multiple vendor detections provides enough evidence for security teams to treat the domain as hostile. Defenders should add verizon.com-bag.com to local deny lists, enforce DNS blocking, and monitor for any re‑activation attempts. Continuous watch on the associated IP range (188.114.97.0/24) and the Cloudflare nameservers is advised, as threat actors often reuse the same hosting assets for future campaigns.