t-mobile[.]iaguy[.]cc

On July 23, 2026, analysis of the domain t-mobile.iaguy.cc was completed. The domain was registered on February 21, 2026 through Gname.com Pte. Ltd. and resolves to the IP address 188.114.96.3, which is listed under AS13335 Cloudflare, Inc. in the United States. Authoritative nameservers are logan.ns.cloudflare.com and naya.ns.cloudflare.com, confirming the use of Cloudflare’s DNS service. The HTTP response returns a generic “Welcome to nginx!” page title and no TLS certificate is presented, indicating the site operates only over plain HTTP. Gridinsoft assigns a trust score of 0 out of 100, and the domain appears on a single security blocklist where it has been flagged by PhishDestroy, which has already taken the site offline.

VirusTotal scans show that 13 of 93 security vendors have flagged the domain as malicious, providing independent corroboration of its abusive nature. The observed behavior matches the declared scam type of brand impersonation targeting the brand x.com. No additional payloads, login forms, or credential‑capture infrastructure have been observed in the limited data set; the lack of an SSL certificate and the generic nginx title suggest a placeholder page rather than a fully‑featured phishing portal. However, the multiple vendor detections and the zero trust score indicate a high likelihood that the domain was used for malicious impersonation.

Uncertainties remain regarding the exact malicious content that may have been served before takedown, as the site is currently offline and no archived snapshots were available. Defenders should continue to block the IP 188.114.96.3 and the domain t-mobile.iaguy.cc at perimeter and DNS layers, monitor for any resurgence of the same infrastructure under alternate subdomains, and update detection rules to include the observed nameserver pattern and the absence of TLS. Network operators are advised to enforce HTTPS‑only policies to reduce accidental connections to non‑TLS sites.