t-mobile[.]pmfuk[.]cc

On 23 July 2026 analysts observed the domain t-mobile.pmfuk.cc being used in a brand‑impersonation campaign targeting the X.com brand. The domain was registered on 21 February 2026 through Gname.com Pte. Ltd. and resolves to the Cloudflare‑hosted address 188.114.96.3, which is associated with ASN 13335 (Cloudflare, Inc.) and located in the United States. DNS resolution points to the authoritative nameservers bristol.ns.cloudflare.com and quentin.ns.cloudflare.com. No TLS certificate is presented; HTTP connections return the default “Welcome to nginx!” page title, indicating that the site is serving only plain HTTP and does not host any visible phishing login page at the time of analysis.

Reputation metrics are uniformly negative: Gridinsoft assigns a trust score of 0 / 100, and VirusTotal reports that 13 of 93 scanned security vendors flag the domain as malicious. The domain appears on a single security blocklist and has been actively blocked by the PhishDestroy mitigation service. Its current operational status is offline, confirming that the hosting has been taken down or the site is otherwise unavailable. The evidence therefore supports a high confidence assessment that t-mobile.pmfuk.cc was deliberately crafted to impersonate X.com for malicious purposes, likely to lure credential or payment information.

Uncertainty remains regarding the exact payload or lure employed because the HTTP response contains only the generic nginx banner and no further page content was captured. Defenders should continue to enforce DNS‑level blocks for the domain and its associated IP range, monitor for any re‑registration or new host resolution, and incorporate the observed indicators—creation date, registrar, nameservers, IP address, lack of TLS, low trust score, and vendor detections—into threat‑intel feeds. Ongoing surveillance of Cloudflare‑hosted infrastructure linked to this ASN may reveal additional related campaigns.