t-mobile[.]fhgtr[.]cc

The domain t-mobile.fhgtr.cc was first observed on February 21, 2026 and is currently listed as offline. Infrastructure analysis shows the hostname resolves to 188.114.96.3, an address owned by Cloudflare (AS13335) located in the United States. The domain is registered through Gname.com Pte. Ltd. and uses Cloudflare’s authoritative name servers ajay.ns.cloudflare.com and dolly.ns.cloudflare.com. No TLS certificate is presented, and the HTTP response returns the generic title “Welcome to nginx!”, indicating a default web server without application‑level content.

Threat intelligence flags the site as a brand‑impersonation campaign targeting x.com. The URL appears on one external security blocklist and has been explicitly blocked by the PhishDestroy service. Gridinsoft assigns a trust score of 0 out of 100, reflecting a high confidence of malicious intent. VirusTotal analysis shows that 12 of 93 security vendors label the domain as malicious, reinforcing the classification.

While the site’s offline status precludes active exploitation at this moment, the combination of a low trust score, multiple vendor detections, and confirmed blocklist presence suggests that the domain was used for credential‑stealing or fraudulent activity against the x.com brand. Defenders should add t-mobile.fhgtr.cc to network deny lists, monitor traffic to the associated IP address for any residual connections, and enforce strict outbound filtering for Cloudflare‑hosted domains that lack TLS. Continuous re‑evaluation is recommended in case the host is re‑activated, and any related indicators of compromise should be correlated with internal logs to detect potential follow‑up campaigns.