t-mobile[.]wgvzi[.]cc

Analysis of t-mobile.wgvzi.cc indicates that the domain was registered on February 21, 2026 and is currently taken offline. The site resolved to the IP address 104.21.38.76, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. The HTTP response returned the generic page title "Welcome to nginx!", providing no direct indication of malicious content beyond the presence of a default web server banner. The SSL certificate presented for the host is identified only as "WE1", offering no further validation of ownership or legitimacy.

Threat intelligence sources classify the activity as brand impersonation targeting x.com, and the domain appears on one security blocklist. It was also blocked by the PhishDestroy service. VirusTotal scans recorded 12 detections out of 93 security vendors, confirming that a subset of automated tools flagged the domain as malicious.

No additional public reporting platforms, such as OTX or Safe Browsing, were cited in the available data. Defenders should continue to block traffic to the IP and domain, ensure that security solutions that reference VirusTotal or similar reputation feeds are updated to reflect the 12 vendor detections, and monitor for any re‑hosting attempts that might reuse the same domain name or associated sub‑domains. Given the offline status, the immediate risk is low, but the presence of a Cloudflare‑hosted IP and certificate anomalies suggest that the infrastructure could be repurposed for future impersonation campaigns targeting the same brand.