t-mobile[.]zmhoe[.]cc

This domain, t-mobile.zmhoe.cc, was registered on 21 February 2026 through Gname.com Pte. Ltd. and is currently listed as offline. The authoritative nameservers are rosa.ns.cloudflare.com and seamus.ns.cloudflare.com, indicating that the domain is served via Cloudflare’s network. DNS resolution points to IP address 188.114.96.3, which belongs to AS13335 Cloudflare, Inc., a location in the United States. The web server responds with the default nginx welcome page, reflected in the observed page title “Welcome to nginx!”. No TLS certificate is presented, meaning the site operates over plain HTTP only.

The domain is categorized as a brand‑impersonation campaign targeting the brand x.com, as indicated by the “Impersonates: x.com” entry. It has been flagged by the PhishDestroy blocklist and appears on one additional security blocklist. VirusTotal analysis shows that 14 of 93 scanning engines have flagged the domain, suggesting a non‑trivial level of malicious intent. The Gridinsoft trust score is 0 out of 100, reinforcing the low credibility assessment. Given the available evidence, the primary indicators of abuse are the lack of encryption, the use of a generic nginx landing page, the association with a known brand‑impersonation target, and the multi‑vendor detection count.

No further content, login pages, or payloads have been captured, so the exact phishing or credential‑harvesting mechanisms remain unknown. The offline status may reflect a takedown by hosting providers or a temporary suspension by the attacker. Defenders should add t-mobile.zmhoe.cc to DNS‑based blocklists and network firewalls, monitor for any resurgence of the domain or similar sub‑domains, and apply URL filtering rules that block access to the IP address 188.114.96.3 when it resolves to unknown hostnames. Continuous re‑evaluation of the domain’s status is recommended, as threat actors frequently reactivate infrastructure after takedowns.