t-mobile[.]jtdvy[.]cc

On July 23, 2026, the domain t-mobile.jtdvy.cc was identified as part of a brand impersonation scam targeting x.com. The domain, registered through Gname.com Pte. Ltd., was created on February 21, 2026, and has since been taken offline. Infrastructure analysis reveals that the domain resolved to the IP address 172.67.221.14, which is located in the United States and is associated with AS13335 Cloudflare, Inc. The domain lacks an SSL certificate, further indicating its questionable nature.

PhishDestroy has listed this domain as blocked, and it has a Gridinsoft trust score of 0/100. Despite the domain being offline, 13 out of 93 security vendors on VirusTotal flagged it as suspicious, suggesting that it posed a significant risk when active. The domain appears on one security blocklist, indicating a high level of threat recognition.

When last checked, the page title was 'Welcome to nginx!', which is a default page often seen on newly set up or compromised servers. Given the elevated risk level and brand impersonation scam type, network defenders should remain vigilant and monitor for any signs of the domain reactivating. Any residual DNS records or cached pages related to this domain should be reviewed and removed if found to be malicious.