t-mobile[.]fenrd[.]cc

Analysis of the domain t-mobile.fenrd.cc indicates it was actively involved in brand impersonation targeting X.com, as documented in threat intelligence records from July 2026. The domain, registered on February 21, 2026, through Gname.com Pte. Ltd., resolved to the IP address 104.21.31.62, which is hosted on Cloudflare's infrastructure (AS13335) in the United States. At the time of assessment, the domain was offline, with no SSL certificate detected and an HTTP response displaying the default 'Welcome to nginx!' page title, suggesting either misconfiguration or an incomplete deployment of phishing infrastructure. Detection metrics reveal limited but clear indicators of malicious activity. The domain appeared on one security blocklist and was flagged by PhishDestroy.

VirusTotal records show that 17 out of 95 security vendors classified the domain as malicious, though the specific nature of the detections—whether related to phishing, malware, or other abuse—remains unconfirmed. The Gridinsoft trust score of 0/100 further corroborates its high-risk classification. Nameservers carlane.ns.cloudflare.com and trey.ns.cloudflare.com, also operated by Cloudflare, were associated with the domain, a common pattern in phishing campaigns leveraging Cloudflare's proxy services to obscure origin servers. The scam type is explicitly categorized as brand impersonation, with X.com identified as the targeted brand. While the domain is no longer active, its infrastructure and detection history align with known phishing tactics.

Defenders are advised to monitor for residual DNS records, subdomains, or related infrastructure that may resurface under different names. Organizations should update blocklists to include this domain and investigate any prior connections from internal networks. Given the use of Cloudflare, additional scrutiny of domains sharing the same nameservers or IP ranges may uncover related malicious activity.