t-mobile[.]tbmaf[.]cc

The domain t-mobile.tbmaf.cc was created on February 21, 2026 and is currently taken offline. Infrastructure analysis shows the domain is hosted behind Cloudflare (AS13335) with the resolved address 172.67.207.134, located in the United States. Registration was performed through Gname.com Pte. Ltd., and the authoritative nameservers are marissa.ns.cloudflare.com and olof.ns.cloudflare.com, indicating the use of Cloudflare’s DNS service. The site presented the generic page title "Welcome to nginx!" and was detected to be running Cloudflare and HTTP/3, but no further content analysis is available.

Security controls have already acted on the domain: PhishDestroy blocked it, and it appears on one external security blocklist. The SSL certificate is issued by Google Trust Services under the WE1 label, providing a valid TLS handshake but offering no indication of malicious intent beyond the domain’s association with brand impersonation. Gridinsoft assigned a trust score of 0 out of 100, reflecting the highest level of suspicion. VirusTotal scans flagged the domain in 11 of 93 security vendor engines, reinforcing the elevated risk assessment.

Defenders should continue to monitor for any re‑registration attempts of the t-mobile.tbmaf.cc host name, especially given its recent creation date and the use of reputable hosting services that can be abused for short‑lived phishing campaigns. Existing blocklists and the PhishDestroy block should be kept updated, and any outbound traffic to the resolved IP (172.67.207.134) should be inspected for anomalous patterns. Although the site is currently offline, the combination of a low trust score, multiple vendor detections, and confirmed brand impersonation of x.com warrants heightened vigilance and proactive blocking of the domain and associated IP range in enterprise security controls.