t-mobile[.]xmvig[.]cc

t-mobile.xmvig.cc is a newly registered domain created on 21 February 2026 through Gname.com Pte. Ltd. The domain resolves to the IP address 172.67.196.84, which is announced by AS13335 Cloudflare, Inc. and geolocated to the United States. Authoritative name servers listed for the zone are ns1.fbi.seized.gov and ns2.fbi.seized.gov, both of which are unusual and may indicate an attempt to obscure the true hosting environment.

A TLS certificate labeled WE1 is presented for the site, and the HTTP response returns status code 200 with the default title "Welcome to nginx!". The presence of a generic Nginx landing page, combined with the lack of brand-specific content, is consistent with a credential-harvesting front-end that redirects victims to a later stage of the campaign. The infrastructure choice of Cloudflare suggests the operators are leveraging a widely trusted CDN to evade simple IP-based blocking.

The domain is currently classified as a high-risk brand-impersonation campaign targeting the brand x.com. VirusTotal analysis shows that 11 out of 95 scanned security vendors flag the domain as malicious, and the overall Gridinsoft trust score is 0 out of 100. The domain appears on one security blocklist and has been actively blocked by the PhishDestroy feed. Despite these indicators, the site remains reachable and continues to serve content, confirming its active status.

Defenders should prioritize the inclusion of t-mobile.xmvig.cc in URL filtering rules and ensure that any traffic to the associated IP address 172.67.196.84 is inspected or blocked. Because the domain uses Cloudflare’s network, endpoint solutions that rely solely on IP reputation may miss subsequent infrastructure changes; therefore, monitoring of the domain’s DNS records and certificate details is advised. Organizations that employ brand-monitoring controls for x.com should treat any login prompts originating from this domain as fraudulent and educate users to report such attempts.