t-mobile[.]vidnufw[.]cc

Analysis of the domain t-mobile.vidnufw.cc indicates that it was created on 31 January 2026 and is currently taken offline. The domain resolves to the IP address 188.114.96.3, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. DNS resolution is provided by the authoritative name servers A.SHARE-DNS.COM and B.SHARE-DNS.NET, a configuration commonly observed in fast‑flux or disposable hosting services. No TLS certificate is presented; HTTP requests return the default “Welcome to nginx!” page title, suggesting a bare‑bones web server without branding or login functionality.

The site is registered through Gname.com Pte. Ltd., and the registrar information matches the public WHOIS record. VirusTotal has recorded detections from 15 of 95 scanning engines, and the domain is listed on a single external blocklist, where it has also been flagged by the PhishDestroy filtering service. Gridinsoft assigns a trust score of 0 out of 100, reinforcing the malicious assessment.

The campaign’s stated objective is brand impersonation of x.com, aligning with the declared scam type of brand impersonation. While the offline status precludes active probing, defenders should continue to block the domain at network perimeters, update URL filtering policies, and monitor the hosting IP for any resurgence of malicious activity. Additional observation of the hosting provider’s IP range and the registrar’s recent registrations may reveal related infrastructure, and threat‑intel sharing platforms should be notified of this indicator to aid correlation with other campaigns.