t-mobile[.]ijygk[.]cc

Analysis of the domain t-mobile.ijygk.cc, created on February 21, 2026 and registered through Gname.com Pte. Ltd., shows a clear pattern of brand impersonation targeting x.com. The domain resolves to the Cloudflare‑owned address 188.114.96.3, located in the United States under ASN 13335 (Cloudflare, Inc.). No SSL certificate was presented during the probe, and the HTTP response returned the generic page title "Welcome to nginx!", indicating a default web server page rather than a crafted phishing landing page.

Nameserver configuration points to cartman.ns.cloudflare.com and dawn.ns.cloudflare.com, both Cloudflare nameservers, confirming the use of Cloudflare’s DNS and edge services for hosting. Reputation signals are uniformly negative: Gridinsoft assigned a trust score of 0 out of 100, the domain appears on one security blocklist, and PhishDestroy has already blocked it. VirusTotal scans recorded 16 detections out of 93 security vendors, reinforcing the malicious assessment.

The risk level is marked as elevated, and the current operational status is offline, preventing live content verification. Defenders should immediately add t-mobile.ijygk.cc to DNS and URL filtering policies, monitor for any re‑activation of the domain, and consider extending blocklists to cover the associated Cloudflare IP range if similar abuse is observed. Continuous observation of the registrar Gname.com for bulk registrations and of the Cloudflare nameservers for related domains is advised to pre‑empt further impersonation campaigns.