t-mobile[.]irmbx[.]cc

Analysis of the domain t-mobile.irmbx.cc indicates it was actively used for brand impersonation targeting x.com, a high-value social media platform. The domain was registered on February 21, 2026, through Gname.com Pte. Ltd., a registrar frequently associated with fraudulent infrastructure. As of July 23, 2026, the domain resolves to IP address 172.67.196.136, hosted on Cloudflare's network (AS13335) in the United States. No SSL certificate was detected, increasing the likelihood of interception or tampering during transmission. The page title 'Welcome to nginx!' suggests a default server configuration, which is atypical for legitimate brand-hosted pages.

This may indicate either an incomplete setup or an attempt to evade detection by presenting minimal content. The domain appears on at least one security blocklist and is flagged by 14 of 93 security vendors on VirusTotal, reinforcing its classification as malicious. PhishDestroy has blocked access to the domain, and it is currently offline, though prior activity cannot be ruled out. Defenders should treat this domain as part of a broader phishing campaign impersonating x.com.

The use of Cloudflare nameservers (dakota.ns.cloudflare.com and gigi.ns.cloudflare.com) is consistent with threat actors leveraging content delivery networks to obscure hosting origins. While the exact scam mechanics remain unconfirmed due to the domain's inactive status, the combination of brand impersonation, default server responses, and detection by multiple security vendors warrants elevated caution. Network-level blocking and monitoring for related subdomains or IP reuse are recommended. No evidence of a phishing kit or additional infrastructure was provided, so further investigation into associated artifacts is advised.