verizon[.]com-bai[.]com

The domain verizon.com-bai.com was registered on 2026-02-21 through Dominet (HK) Limited and is currently taken offline. DNS resolution points to 172.67.167.118, an address owned by AS13335 Cloudflare, Inc. in the United States. Authoritative name servers are arvind.ns.cloudflare.com and rosemary.ns.cloudflare.com, both belonging to Cloudflare, and the hosting stack reports Cloudflare Browser Insights, Cloudflare services, and HTTP/3 support. The TLS certificate presented is issued by Google Trust Services under the WE1 label, indicating a valid HTTPS endpoint despite the offline status.

A VirusTotal scan returned 14 positive detections out of 95 security vendors, and the domain appears on a single external blocklist. The HTTP response includes the default Nginx page title "Welcome to nginx!", suggesting the site has not been populated with malicious content or that content was removed prior to takedown. The domain is classified as a brand impersonation targeting x.com and has been flagged by the PhishDestroy blocklist.

Because the site returns only the generic Nginx welcome page, the precise phishing landing page or credential‑harvesting mechanisms remain unknown. Defenders should continue to block the domain at DNS and proxy layers, monitor for any re‑activation, and correlate any inbound traffic with the observed IP address and certificate fingerprint. Organizations should also update URL filtering policies to include this indicator and review any logs for prior connections to the IP or certificate.