t-mobile[.]sghbf[.]cc

Analysis of t-mobile.sghbf.cc indicates a brand impersonation campaign targeting x.com, active since February 21, 2026. The domain is currently offline but was previously hosted on Cloudflare IP 172.67.164.127 (AS13335, US) with nameservers amalia.ns.cloudflare.com and ken.ns.cloudflare.com. No SSL certificate was observed, and the only HTTP response recorded was a default 'Welcome to nginx!' page title, suggesting either placeholder content or a misconfigured server at the time of detection. Registration details point to Gname.com Pte. Ltd. as the registrar.

Detection coverage is limited but consistent: one security blocklist (PhishDestroy) and 9 of 95 security vendors on VirusTotal flagged the domain as malicious. Gridinsoft assigns a trust score of 0/100, reinforcing the elevated risk classification. The absence of an SSL certificate and the use of a default nginx page may indicate either an early-stage phishing setup or an abandoned attempt, though the registration date and blocklist presence suggest deliberate malicious intent. Defenders should treat this domain as a confirmed phishing indicator.

While the site is offline, the infrastructure (Cloudflare hosting, recent registration) and detection history warrant continued monitoring. Recommended actions include blocking the domain and IP at perimeter defenses, checking logs for prior connections, and alerting users to potential brand impersonation attempts referencing x.com. The lack of detailed page analysis means the exact phishing mechanism remains unconfirmed, but the combination of brand targeting, detection flags, and hosting patterns aligns with known impersonation tactics.