t-mobile[.]virnohe[.]cc

Analysis indicates that the domain t-mobile.virnohe.cc was provisioned on 21 February 2026 and is presently taken offline. The registration was performed through Gname.com Pte. Ltd., and the authoritative nameservers are priscilla.ns.cloudflare.com and yisroel.ns.cloudflare.com, both belonging to Cloudflare’s DNS service. DNS resolution points to the IP address 188.114.96.3, which is announced by AS13335 (Cloudflare, Inc.) and geolocated to the United States. No TLS certificate is presented; HTTP requests return the default “Welcome to nginx!” page, confirming that the web server is a standard Nginx instance without custom content.

The domain is listed on a single security blocklist and has been actively blocked by the PhishDestroy service. VirusTotal reports that 11 of 93 scanning engines flag the domain as malicious, reinforcing the suspicion of abuse. Gridinsoft assigns a trust score of 0 out of 100, indicating a highly untrusted reputation. The threat classification supplied identifies the site as a brand‑impersonation campaign targeting x.com.

No additional intelligence such as OTX indicators, URL snapshots, or malware payloads is currently available, leaving the exact phishing workflow undefined. Defenders should continue to block the domain at perimeter filters, enforce DNS‑level denial of resolution, and monitor for any resurgence of the host under alternate subdomains. Ongoing vigilance is advised, especially given the recent creation date and the use of Cloudflare’s infrastructure, which can be leveraged to rapidly spin up new malicious domains. Organizations that rely on the x.com brand should educate users about the lack of a valid TLS certificate and the generic Nginx landing page, and encourage reporting of any related suspicious URLs.