t-mobile[.]msdvo[.]cc

Analysis of the domain t-mobile.msdvo.cc indicates it was actively impersonating the X.com brand as part of a phishing operation. The domain was registered on February 21, 2026, through Gname.com Pte. Ltd. and resolved to the IP address 104.21.72.64, hosted on Cloudflare's infrastructure (AS13335) in the United States. No SSL certificate was present at the time of assessment, which is atypical for legitimate brand domains. The page title, 'Welcome to nginx!', suggests either a misconfigured or placeholder deployment, though this does not rule out malicious intent.

The domain was flagged by 13 of 95 security vendors on VirusTotal and appears on at least one blocklist (PhishDestroy), corroborating its classification as a brand impersonation threat. Gridinsoft assigned a trust score of 0/100, further indicating high risk. Nameservers (michael.ns.cloudflare.com and nelci.ns.cloudflare.com) point to Cloudflare, a common hosting choice for both legitimate and malicious domains.

As of July 23, 2026, the domain is offline, though this status may change. Defenders should treat any prior resolution to 104.21.72.64 as indicative of malicious activity and monitor for re-emergence under the same or similar infrastructure. The absence of additional technical indicators (e.g., phishing kit fingerprints, redirect chains) limits further attribution, but the combination of brand impersonation, blocklist presence, and low trust scores justifies elevated monitoring and blocking where appropriate.