t-mobile[.]avnod[.]cc

The domain t-mobile.avnod.cc was registered on February 21, 2026 through Gname.com Pte. Ltd. and is hosted on Cloudflare infrastructure (AS13335, United States). DNS resolution points to IP address 104.21.56.221, which is served by Cloudflare’s edge network and returns a default nginx page with the title "Welcome to nginx!". No SSL certificate is presented for the host, indicating an unsecured HTTP service. The domain is listed on one public security blocklist and has been explicitly blocked by PhishDestroy, confirming its classification as a brand‑impersonation campaign targeting the brand x.com.

Threat intelligence from VirusTotal shows that 13 of 93 scanning vendors have flagged the domain, reinforcing the malicious assessment. The Gridinsoft trust score is recorded as 0 out of 100, the lowest possible rating, and the site’s current operational status is offline, suggesting the hosting has been taken down or the operator has ceased activity. Evidence from the known intelligence does not reveal the content of the landing page beyond the generic nginx title, nor does it disclose any credential‑harvesting forms or additional payloads.

Consequently, the precise tactics employed by the actors remain uncertain. Defenders should continue to block the domain at perimeter filters, monitor DNS queries for the associated IP and nameservers (logan.ns.cloudflare.com and naya.ns.cloudflare.com), and update threat‑intel feeds with the observed indicators. Additional analysis of any archived HTTP responses or captures could clarify the phishing kit used, but until such data emerge, the domain should be treated as a confirmed brand‑impersonation threat with elevated risk.