t-mobile[.]drols[.]cc

Analysis on 24 July 2026 records that the domain t-mobile.drols.cc was registered on 21 February 2026 through Gname.com Pte. Ltd. The domain resolves to 172.67.138.68, an IP owned by AS13335 Cloudflare, Inc., located in the United States. Nameservers armfazh.ns.cloudflare.com and laylah.ns.cloudflare.com confirm the use of Cloudflare’s DNS infrastructure. No TLS certificate is presented; HTTP requests return the default nginx page with the title "Welcome to nginx!". The site is listed on a single security blocklist and has been actively blocked by PhishDestroy.

Gridinsoft assigns a trust score of 0 out of 100, indicating maximal suspicion. VirusTotal reports that 11 of 93 antivirus or URL scanning engines flagged the domain as malicious, reinforcing the suspicion. The domain is classified as a brand‑impersonation campaign targeting x.com, and the scam type is recorded as "Brand Impersonation". Current status is offline, suggesting that the payload or phishing page has been taken down, but the infrastructure remains observable.

Defenders should continue to block the domain at DNS and proxy layers, monitor for any resurgence of the same host or similar sub‑domains, and consider adding the IP address and Cloudflare nameservers to deny lists. Because the site presently returns only a generic nginx page and lacks SSL, further content analysis is not possible, and the exact phishing workflow remains unknown. Ongoing vigilance is recommended, especially for traffic directed to x.com login portals, to detect any re‑hosted clones that may leverage the same brand‑spoofing tactics.