t-mobile[.]geavm[.]cc

The domain t-mobile.geavm.cc has been identified as a brand impersonation threat specifically targeting X.com, a high-profile social media platform. Analysis confirms this domain was actively engaged in fraudulent activity designed to deceive users into believing they were interacting with the legitimate X.com service. As of the latest assessment, the domain has been taken offline, though prior infrastructure analysis indicates it was operational during the threat window. Infrastructure analysis reveals critical technical indicators associated with this domain. It was flagged by 17 of 95 security vendors on VirusTotal, a significant detection rate that underscores its malicious nature. The domain resolved to the IP address 188.114.96.3, hosted on Cloudflare's network (AS13335) in the United States. Registration details show it was created on February 21, 2026, through Gname.com Pte. Ltd., a registrar frequently associated with high-risk domains. Additionally, the domain appeared on one security blocklist and lacked an SSL certificate, further reducing its legitimacy. The page title, 'Welcome to nginx!', suggests a default server configuration, often indicative of hastily deployed malicious infrastructure. The current status of t-mobile.geavm.cc is offline, likely due to takedown actions or infrastructure adjustments by the threat actor. However, the elevated risk level and prior activity warrant continued vigilance. Organizations and users are advised to block the domain and its associated IP address (188.114.96.3) at the network level to prevent potential re-emergence. Security teams should monitor for similar domains registered through Gname.com or resolving to Cloudflare IPs, particularly those impersonating X.com or other high-value brands. End users should be educated on recognizing brand impersonation tactics, such as verifying domain names and SSL certificates before entering credentials or sensitive information. Proactive threat hunting for related indicators of compromise is recommended to mitigate residual risk.