t-mobile[.]bdjix[.]cc

Analysis of the domain t-mobile.bdjix.cc shows it was registered on 21 February 2026 through Gname.com Pte. Ltd. and immediately pointed to Cloudflare nameservers armfazh.ns.cloudflare.com and laylah.ns.cloudflare.com, resolving to IP 104.21.35.63 owned by AS13335 Cloudflare, Inc. in the United States. The site returned the default nginx page with the title “Welcome to nginx!” and presented no SSL certificate, indicating an unencrypted HTTP service. VirusTotal records indicate that 16 of 93 scanning engines flagged the domain, and the domain appears on a single external blocklist. Independent threat‑intel feeds such as PhishDestroy have already blocked the host, and Gridinsoft assigned a trust score of 0 out of 100, reflecting a high likelihood of malicious use.

The listed scam type is “Brand Impersonation” and the domain is attributed to impersonating the brand x.com. The current operational status is offline, suggesting the hosting has been taken down or the content removed, but the infrastructure footprint remains observable. Given the registration timing, the use of Cloudflare’s edge network, and the lack of TLS, the domain fits a typical short‑lived phishing deployment that leverages reputable hosting to gain credibility while delivering minimal content.

Defenders should continue to deny any network connections to 104.21.35.63, add t-mobile.bdjix.cc to URL filtering policies, and monitor for future domains registered with the same registrar or nameserver pattern. Correlation with other domains that resolve to the same IP or share the same Cloudflare nameservers may reveal additional campaign artifacts. Because the site is already offline, immediate remediation focuses on preventing re‑use of the same hosting assets and ensuring that endpoint protection solutions recognize the 16 VirusTotal detections as an indicator of compromise.