t-mobile[.]rjoaz[.]cc

The domain t-mobile.rjoaz.cc has been identified as a brand_impersonation threat, specifically targeting x.com. Analysis confirms the domain is currently offline, though prior activity suggests malicious intent to deceive users by mimicking the legitimate brand's identity and infrastructure. Infrastructure analysis reveals the domain was registered on February 21, 2026, through Gname.com Pte. Ltd. and resolved to the IP address 172.67.137.70, hosted on Cloudflare's network (AS13335). At the time of assessment, 18 of 95 security vendors on VirusTotal flagged the domain as malicious. The domain appears on one security blocklist and was previously blocked by internal detection systems. Notably, the domain lacked an SSL certificate and displayed a default "Welcome to nginx!" page title, indicating minimal effort to conceal its illegitimate nature. Current status indicates the domain has been taken offline, reducing immediate risk to end users. However, the infrastructure remains a potential vector for future malicious activity. Organizations are advised to proactively block the domain and its associated IP (172.67.137.70) at the network perimeter. Security teams should monitor for similar impersonation attempts targeting x.com or other high-profile brands, particularly those leveraging newly registered domains or Cloudflare-hosted infrastructure. Logs should be reviewed for prior connections to this domain to assess potential exposure or compromise.