verizon[.]com-bau[.]com

Analysis of verizon.com-bau.com shows a newly registered domain created on February 21, 2026 and hosted behind Cloudflare’s network (AS13335, IP 188.114.97.3 located in the United States). The domain is delegated to the Cloudflare nameservers lila.ns.cloudflare.com and zahir.ns.cloudflare.com, and the web server returns the generic title “Welcome to nginx!”. SSL is issued by Google Trust Services under the WE1 intermediate, indicating a valid HTTPS certificate but offering no indication of malicious intent. Threat intelligence flags the site as a brand‑impersonation campaign targeting x.com.

Gridinsoft assigns a trust score of 0 / 100, and VirusTotal reports that 16 of 93 scanners mark the domain as malicious, confirming a consensus of suspicious activity. The domain appears on a single public blocklist and is actively blocked by PhishDestroy. The observed technology stack includes Cloudflare and HTTP/3, consistent with a typical hosting choice for fast‑flux or disposable phishing infrastructure. Current status is offline, suggesting the operators have taken the site down or are rotating assets.

Uncertainty remains regarding the exact payload or credential‑harvesting mechanisms, as no page content beyond the default nginx banner has been disclosed. Defenders should continue to monitor the associated IP and Cloudflare name server pair for re‑use, block the domain at perimeter defenses, and update brand‑specific threat feeds to include this indicator. Incident response teams encountering traffic to this host should treat it as a confirmed impersonation attempt and enforce blocking or sandbox analysis of any related artifacts.