t-mobile[.]virnobf[.]cc

Analysis indicates that the domain t-mobile.virnobf.cc was registered on 21 February 2026 through Gname.com Pte. Ltd. and is hosted on Cloudflare’s network (ASN 13335) with the IP address 104.21.12.247 located in the United States. The authoritative nameservers priscilla.ns.cloudflare.com and yisroel.ns.cloudflare.com confirm the use of Cloudflare’s DNS service, a common choice for malicious operators seeking rapid deployment and concealment. The site currently returns the default nginx page title “Welcome to nginx!” and presents no SSL certificate, suggesting that the server is either misconfigured or deliberately left without HTTPS to simplify hosting. Gridinsoft assigned a trust score of 0 out of 100, indicating extreme suspicion.

VirusTotal scans show that twelve of ninety‑five security vendors flagged the domain, and the domain appears on at least one public blocklist. PhishDestroy has also listed the domain as blocked. The threat classification is brand impersonation targeting the brand x.com, as indicated by the supplied intelligence. The domain’s status is recorded as offline, but the infrastructure footprint remains observable.

Defenders should continue to block the domain at network perimeter devices, update URL filtering rules, and monitor for any re‑appearance of the domain or related sub‑domains. Additional investigation should focus on any traffic logs that reference the IP address 104.21.12.247 or the Cloudflare nameservers, as well as correlation with the twelve vendor detections to identify the specific malicious payloads or techniques associated with this campaign. Because the site lacks an SSL certificate and serves only a generic nginx page, the likelihood of credential harvesting is low, but the presence of brand impersonation suggests potential use in social engineering campaigns. Continuous observation of the registrar Gname.com Pte. Ltd. for new registrations with similar patterns is recommended.