t-mobile[.]virnoto[.]cc

This domain, t-mobile.virnoto.cc, was observed being used in a brand‑impersonation campaign that targets the x.com brand. The domain was registered on 21 February 2026 through Gname.com Pte. Ltd. and is hosted on Cloudflare infrastructure (AS13335) with the IP address 104.21.9.254 located in the United States. DNS resolution points to Cloudflare name servers priscilla.ns.cloudflare.com and yisroel.ns.cloudflare.com, a configuration commonly used by malicious actors to leverage the provider’s global network and hide the true origin of the payload. The web server responds with the generic title “Welcome to nginx!” and does not present an SSL certificate, indicating that the site is served over plain HTTP. At the time of analysis the host was taken offline, but historical data show that the domain appeared on a single security blocklist and was actively blocked by the PhishDestroy feed.

VirusTotal records indicate that 13 of 93 scanning engines flagged the domain, reinforcing the suspicion of malicious use. The Gridinsoft trust score of 0 / 100 further corroborates the lack of legitimacy. Evidence confirms the domain’s primary intent is to impersonate x.com, although the exact page content and phishing kit have not been disclosed. No additional public threat‑intel sources such as OTX entries or Google Safe Browsing reports are linked to this indicator. The absence of an SSL certificate and the use of a default nginx page suggest a minimalistic deployment, likely intended solely to host a redirect or credential‑harvesting endpoint.

Defenders should add t-mobile.virnoto.cc to internal blocklists and monitor DNS queries for the associated Cloudflare name servers. Because the domain resolves to a shared Cloudflare IP, network‑level filtering based on the IP alone may generate false positives; therefore, rule sets should target the fully qualified domain name.