t-mobile[.]abvny[.]cc

t-mobile.abvny.cc was registered through Gname.com Pte. Ltd. on February 21, 2026. The domain resolves to the Cloudflare address 104.21.22.159, which is associated with AS13335 Cloudflare, Inc. and located in the United States. DNS resolution uses the Cloudflare nameservers hayes.ns.cloudflare.com and sarah.ns.cloudflare.com. An HTTP request to the host returns the generic page title “Welcome to nginx!” and presents no SSL certificate, indicating the service is delivered over plain HTTP. The site is classified as a brand‑impersonation campaign targeting x.com, as indicated by the intelligence record.

No malicious payload or login form has been captured, so the exact phishing kit or page content remains unverified. Detection telemetry shows that 13 of 93 security vendors on VirusTotal flagged the domain as malicious, and it appears on a single blocklist where it was blocked by PhishDestroy. Gridinsoft’s trust score is 0 out of 100, reinforcing the low credibility of the host. The domain’s current status is offline, which may be the result of takedown actions or temporary hosting suspension.

Uncertainties include the precise malicious functionality, the presence of any credential‑stealing forms, and whether the domain was ever serving phishing content before the takedown. Defensive teams should continue to monitor the IP address 104.21.22.159 for any re‑hosting of the same domain or related subdomains, add the domain to local blocklists, and enforce DNS filtering that includes the known blocklist entry. Because the domain uses Cloudflare’s infrastructure, any future re‑deployment may appear under the same ASN, so anomalies in traffic to that address should be investigated. Continuous VT scanning and correlation with endpoint alerts will help confirm if remnants of the campaign persist.