t-mobile[.]nucgd[.]cc

Analysis of t-mobile.nucgd.cc indicates that the domain was registered on 21 February 2026 through Gname.com Pte. Ltd. and is hosted on Cloudflare’s network (AS13335) with the address 188.114.96.3 located in the United States. The domain resolves to a single IP that serves an Nginx default page titled “Welcome to nginx!” and does not present a valid SSL certificate, which is consistent with the observed lack of HTTPS encryption. The infrastructure is configured with Cloudflare’s authoritative nameservers dakota.ns.cloudflare.com and gigi.ns.cloudflare.com, a common pattern for fast‑flux or proxy‑based abuse. The domain has been identified as a brand‑impersonation campaign targeting x.com; the threat type is recorded as “Brand Impersonation”. Threat intelligence feeds have placed the domain on at least one security blocklist, and it is also listed by PhishDestroy as blocked.

VirusTotal scans show that 18 out of 93 antivirus and URL‑reputation engines flagged the domain as malicious, reflecting a moderate level of consensus among detection vendors. Gridinsoft assigns a trust score of 0 out of 100, indicating an extremely low reputation. The domain’s current status is offline, suggesting that the malicious site has been taken down or is no longer serving content. However, the underlying infrastructure—particularly the Cloudflare IP and the lack of TLS—remains usable for future campaigns if the attacker re‑activates the domain or registers a similar one.

Defenders should continue to monitor the IP address 188.114.96.3 and the associated Cloudflare nameservers for any re‑use, add the domain to internal blocklists, and enforce URL filtering that blocks connections to the host regardless of protocol. Because the domain does not host a certificate, TLS inspection will not be applicable, but network‑level controls that inspect DNS queries for the domain can prevent resolution. Analysts should also track the registrar Gname.com Pte. Ltd.