t-mobile[.]xadhl[.]cc

Analysis of the domain t-mobile.xadhl.cc indicates it was a brand-impersonation phishing site targeting X.com, now offline as of July 24, 2026. The domain was registered on February 21, 2026, through Gname.com Pte. Ltd. and resolved to IP address 172.67.199.49, hosted on Cloudflare's network (AS13335) in the United States. Nameservers brodie.ns.cloudflare.com and mira.ns.cloudflare.com were in use, and no SSL certificate was detected. The page title 'Welcome to nginx!' suggests a default or misconfigured server response, which may indicate either an incomplete phishing setup or a placeholder prior to full deployment.

Security vendors flagged the domain on one blocklist, and PhishDestroy had already blocked it. VirusTotal records show 11 of 93 security vendors marked it as malicious. Gridinsoft assigned a trust score of 0 out of 100, reinforcing its high-risk classification. While the domain is currently offline, its infrastructure—particularly the use of Cloudflare—aligns with common phishing tactics to obscure hosting origins and evade takedowns.

Defenders should treat this domain as confirmed malicious infrastructure. Monitoring for re-registration or reuse of the same IP, nameservers, or registrar is recommended. If the domain reappears, immediate re-evaluation of its content and intent is necessary, as the prior nginx response provides no definitive evidence of the final phishing kit or payload. No further details about the intended scam type or user interaction flow are available from the data.