t-mobile[.]ysatu[.]cc

Analysis of the domain t-mobile.ysatu.cc indicates a brand‑impersonation campaign targeting the x.com brand. The domain was registered on 21 February 2026 through Gname.com Pte. Ltd. and resolves to the Cloudflare address 172.67.149.114, which is associated with AS13335 Cloudflare, Inc. in the United States. Authoritative nameservers are maria.ns.cloudflare.com and paul.ns.cloudflare.com, confirming the use of Cloudflare’s DNS service. No TLS certificate is presented, so the site is reachable only over HTTP, and the HTTP response returns the generic page title “Welcome to nginx!”. The lack of a custom title or content suggests that the landing page has not been examined beyond the default server banner.

Detection telemetry shows that 13 of 93 security vendors on VirusTotal flagged the domain, and it appears on a single external blocklist. PhishDestroy has also taken the domain offline, and the current status is reported as offline. The Gridinsoft trust score of 0 / 100 further reinforces the malicious classification. The campaign is identified as brand impersonation, with the target brand explicitly listed as x.com.

Uncertainty remains around the specific payload or credential‑harvesting mechanisms because no detailed page content has been captured. Likewise, the absence of an SSL certificate limits the ability to observe HTTPS‑based indicators. Defenders should add t-mobile.ysatu.cc to network‑level blocklists, enforce DNS filtering for the domain, and monitor for any connections to the associated Cloudflare IP address. Continuous re‑scanning of the domain, should it become active again, is recommended to capture any evolving malicious infrastructure.