t-mobile[.]dgoire[.]cc

This domain, t-mobile.dgoire.cc, is identified as a brand impersonation threat specifically targeting x.com (formerly Twitter) users. Analysis indicates the domain was configured to mimic legitimate login portals, likely to harvest user credentials through deceptive authentication prompts. No associated drainer kit signatures were observed in initial scans, but the infrastructure aligns with credential theft campaigns commonly deployed against social media platforms. Infrastructure analysis reveals the domain was registered through Gname.com Pte. Ltd. on February 21, 2026, and resolves to IP address 104.21.91.54, hosted on Cloudflare's network (AS13335). At the time of assessment, 18 out of 95 security vendors on VirusTotal flagged the domain as malicious. The domain appears on one security blocklist and was actively blocked by PhishDestroy. No SSL certificate was present, and the default nginx welcome page suggests either incomplete deployment or rapid takedown following detection. Current status indicates the domain has been taken offline, likely due to enforcement actions or hosting provider intervention. While no longer resolving, residual risk remains for users who may have interacted with the domain during its active window. Organizations are advised to monitor for credential reuse attempts and implement additional authentication factors for accounts potentially exposed. Network defenders should update blocklists with the domain and associated IP to prevent future resolution attempts.