t-mobile[.]pauib[.]cc

The domain t-mobile.pauib.cc was registered on February 21, 2026 and is currently taken offline. Infrastructure analysis shows that it resolves to the IP address 172.67.142.52, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. Both authoritative name servers, dante.ns.cloudflare.com and jamie.ns.cloudflare.com, are operated by Cloudflare, indicating the use of a commercial CDN for anonymity and traffic buffering. The registrar listed for the registration is Gname.com Pte. Ltd., a known domain registration service.

No TLS certificate was observed for the domain, and the HTTP response returned the generic page title "Welcome to nginx!", suggesting a default web server configuration rather than a targeted credential‑collection page. The domain is classified as a brand impersonation campaign targeting x.com, and it has been flagged by PhishDestroy and appears on one public security blocklist. VirusTotal reports that 12 of 93 scanning engines have flagged the domain, reflecting a moderate level of detection across the security community.

Gridinsoft assigned a trust score of 0 out of 100, reinforcing the assessment of malicious intent. Although the site is offline, defenders should continue to block the domain at perimeter and DNS filtering layers, monitor for any re‑registration attempts, and consider adding the observed IP address to threat‑intel feeds. Ongoing vigilance is advised because the use of Cloudflare’s shared infrastructure may permit rapid re‑deployment of similar domains in the future.