t-mobile[.]tiuofsv[.]cc

Analysis of t-mobile.tiuofsv.cc indicates a recent brand‑impersonation campaign targeting the x.com brand. The domain was registered on 1 February 2026 through Gname.com Pte. Ltd. and resolves to the IP address 188.114.97.3, which belongs to Cloudflare, Inc. (AS13335) and is geolocated in the United States. The authoritative name servers are A.SHARE-DNS.COM and B.SHARE-DNS.NET. No TLS certificate is presented; HTTP requests return the default "Welcome to nginx!" page title, suggesting the server is delivering a generic web server banner rather than a brand‑specific landing page. The domain is listed on a single security blocklist and has been actively blocked by PhishDestroy.

VirusTotal reports that 16 of 93 scanned security vendors flag the domain as malicious, reinforcing the suspicion of malicious intent. Gridinsoft assigns a trust score of 0 out of 100, indicating a lack of reputable reputation. The current operational status is offline, which may be the result of takedown actions or temporary hosting changes. Uncertainty remains regarding the exact payload or phishing page content because the site has not been captured in a screenshot and no SSL certificate or detailed HTTP response body is available.

The absence of additional blocklist listings or public Safe Browsing entries limits the visibility of broader distribution. Defenders should continue to monitor DNS queries for the domain and its associated IP address, enforce outbound filtering for traffic to 188.114.97.3, and add the domain to internal blocklists. Given the confirmed brand‑impersonation indicator and the multi‑vendor detection, any inbound attempts that reference the domain should be blocked, and users should be warned that communications appearing to originate from the x.com brand may be fraudulent. Ongoing threat‑intel feeds should be queried for any new indicators of compromise related to this infrastructure.