t-mobile[.]codngitf[.]cc

Analysis of t-mobile.codngitf.cc, observed on July 23, 2026, indicates a confirmed brand-impersonation campaign targeting the x.com brand. The domain was registered through Gname.com Pte. Ltd. on February 21, 2026 and is currently taken offline. Infrastructure details show the domain resolved to IP address 104.21.50.127, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. Nameserver configuration points to celeste.ns.cloudflare.com and mike.ns.cloudflare.com, both Cloudflare‑owned, suggesting the use of a reputable CDN for temporary hosting.

The site presented a generic "Welcome to nginx!" title and did not serve an SSL certificate, leaving the HTTP connection unencrypted. A Gridinsoft trust score of 0 out of 100 reflects an extremely low reputation. The domain appears on one public security blocklist and has been blocked by PhishDestroy. VirusTotal scans reported 14 detections out of 93 security vendors, confirming malicious classification by multiple anti‑malware engines.

While the page content beyond the title has not been captured, the combination of brand impersonation labeling, low trust score, blocklist presence, and multi‑vendor detections provides strong evidence of malicious intent. Defenders should update proxy and DNS filtering rules to block both the domain and its resolving IP, monitor for any traffic to Cloudflare edge nodes associated with this address, and enforce TLS inspection to detect unencrypted connections attempting to reach the host. Continuous threat‑intel feeds should be consulted for any re‑registration attempts, and incident response teams should consider the domain as a high‑confidence indicator of compromise when observed in network logs.