t-mobile[.]towru[.]cc

Analysis of t-mobile.towru.cc indicates that the domain was registered on 21 February 2026 through Gname.com Pte. Ltd. and is hosted on Cloudflare’s network (ASN 13335) at IP 188.114.96.3, a US‑based address. The domain resolves to the same IP used by many legitimate Cloudflare customers, and the presence of the default nginx page title “Welcome to nginx!” suggests no custom web content was served at the time of capture. No TLS certificate was observed, meaning the site was reachable only over plain HTTP. The nameservers michael.ns.cloudflare.com and nelci.ns.cloudflare.com confirm the use of Cloudflare’s DNS service. Threat intelligence flags the domain as a brand‑impersonation campaign targeting the brand x.com.

The site was identified by PhishDestroy and subsequently taken offline. VirusTotal scans show that 13 of 95 security vendors returned a positive detection, reinforcing the malicious classification. The domain appears on one external blocklist, and Gridinsoft assigned a trust score of 0 / 100, indicating a high likelihood of abuse. Uncertainty remains regarding the specific payload or credential‑collection mechanisms because the site returned only the default nginx page and no further content was captured. No evidence of a phishing landing page, credential‑stealing form, or redirect was observed, limiting the ability to characterize the exact user‑facing attack vector.

Additionally, no SSL/TLS configuration was present, which may have been intentional to reduce infrastructure costs or to avoid certificate‑related detection. Defenders should continue to block the domain at DNS and network layers, add the IP address 188.114.96.3 to outbound deny lists, and incorporate the associated Cloudflare nameservers into threat‑intel feeds. Monitoring for newly registered domains using the same registrar (Gname.com) or sharing the same nameserver pattern can help intercept future campaigns.