t-mobile[.]buid[.]cc

t-mobile.buid.cc was created on 21 February 2026 and, as of the report date 24 July 2026, is taken offline. The domain resolves to 172.67.147.253, an address owned by Cloudflare, Inc. (AS13335) and located in the United States. Its authoritative name servers are gordon.ns.cloudflare.com and linda.ns.cloudflare.com, indicating that the hosting infrastructure is supplied through Cloudflare’s DNS service. Registration was performed through Gname.com Pte. Ltd., a registrar that frequently appears in abuse reports. VirusTotal scanned the domain and recorded 11 detections out of 93 security vendors, confirming that multiple independent scanners label the site as malicious.

The domain is listed on a single security blocklist and is specifically flagged by PhishDestroy. Gridinsoft assigned a trust score of 0 out of 100, the lowest possible rating. No TLS certificate is presented; an HTTP request returns the default "Welcome to nginx!" page title, suggesting that the site is either a placeholder or an unconfigured web server. The campaign is classified as brand impersonation targeting the brand x.com. Apart from the brand reference, no additional details about the phishing kit, login page, or payload have been observed.

The offline status prevents current content analysis, leaving the exact lure and user‑interaction vector unknown. Defenders should treat the domain as malicious. Recommended actions include adding the IP address 172.67.147.253 to deny lists, blocking the domain at DNS or proxy layers, and monitoring for future registrations that reuse the buid.cc second‑level domain or similar sub‑domains. Continuous observation of Cloudflare‑hosted IP ranges for rapid deployment of new impersonation sites is advisable, as the infrastructure can be re‑used with minimal overhead. Reporting any reappearance to shared intelligence feeds will aid collective mitigation.