t-mobile[.]tedhioe[.]cc

The domain t-mobile.tedhioe.cc is identified as a brand impersonation threat, specifically targeting the brand x.com. The domain is currently offline and has been taken down. This indicates that the threat has been mitigated, but users should still exercise caution due to the nature of the previous activities.

Analysis reveals that t-mobile.tedhioe.cc was flagged by 19 out of 95 VirusTotal vendors, suggesting a significant level of suspicion. The domain was registered through Gname.com Pte. Ltd. and resolves to the IP address 172.67.160.94, which is located in the United States and is part of the AS13335 Cloudflare, Inc. network. The domain was created on February 21, 2026, and appears on one security blocklist. The SSL certificate for the domain is issued by Google Trust Services / WE1, which could have been used to create a false sense of security. The page title displayed when the domain was active was 'Welcome to nginx!', a common default page for newly set up web servers, which may have been used as a cover while the phishing infrastructure was being configured.

Given the current offline status of t-mobile.tedhioe.cc, the immediate risk is reduced. However, the domain's history of impersonating x.com and its presence on security blocklists indicate a past threat. Users are advised not to attempt to access this domain and to be wary of any similar domains that may appear. Security teams should monitor for any attempts to revive this domain or the creation of new, similar domains. Regular updates to security policies and user education on the risks of brand impersonation are recommended to prevent future incidents.