t-mobile[.]sgydt[.]cc

This domain, t-mobile.sgydt.cc, was registered on February 21, 2026 through Gname.com Pte. Ltd. and is currently resolved to the Cloudflare edge address 104.21.53.251, which maps to ASN 13335 (Cloudflare, Inc.) in the United States. The domain is served by Cloudflare’s infrastructure, as indicated by the presence of the nameservers anna.ns.cloudflare.com and ignacio.ns.cloudflare.com and the detection of HTTP/3 support. An HTTPS connection is presented using a Google Trust Services / WE1 certificate, confirming a valid TLS handshake. The web server returns HTTP 200 and the only observed page title is “Welcome to nginx!”, suggesting that the underlying application has not been customized for the impersonation campaign.

The domain is classified as a brand‑impersonation site targeting the brand x.com, and the scam type is listed explicitly as “Brand Impersonation”. Reputation analysis shows a Gridinsoft trust score of 0 out of 100, indicating a highly malicious profile. VirusTotal reports that 15 of 93 scanning engines flag the domain as malicious, and it appears on one external security blocklist, where it has already been added to the PhishDestroy blocklist. No additional public threat‑intel sources (OTX, Safe Browsing, etc.) are referenced in the available data.

The currently available evidence points to a high‑risk, active threat that may be used to lure victims into credential‑stealing or other fraudulent activities under the guise of x.com. Defenders should immediately add t-mobile.sgydt.cc to URL filtering and DNS block lists, monitor for any outbound connections to the associated IP range, and consider employing threat‑intelligence feeds that include the observed VirusTotal detections. Continuous monitoring of the domain’s DNS records and any changes to its hosting configuration is advised, as the attacker could switch to a different infrastructure or serve malicious payloads at a later stage.