t-mobile[.]sdupq[.]cc

Analysis of the domain t-mobile.sdupq.cc indicates it was actively used for brand impersonation targeting x.com, with elevated risk classification. The domain was registered on February 21, 2026, through Gname.com Pte. Ltd., and resolved to the IP address 104.21.51.229, hosted on Cloudflare's network (AS13335) in the United States. Infrastructure analysis reveals the use of Cloudflare nameservers (ricardo.ns.cloudflare.com and susan.ns.cloudflare.com), a common tactic to obscure hosting origins and evade takedowns. No SSL certificate was detected, increasing the likelihood of interception or distrust by potential victims.

As of July 23, 2026, the domain is offline, though it remains flagged by one security blocklist (PhishDestroy) and was previously detected by 15 of 93 security vendors on VirusTotal. The page title, 'Welcome to nginx!', suggests a default server response rather than a fully operational phishing page, though this does not rule out prior malicious activity. The exact content and functionality of the site are not yet analysed, and no definitive phishing kit or payload has been identified in available intelligence. Defenders should treat this domain as part of a broader impersonation campaign targeting x.com users.

While the domain is currently inactive, its infrastructure (Cloudflare hosting, recent registration) aligns with known phishing tactics. Network defenders are advised to block the domain and associated IP (104.21.51.229) at the perimeter, while monitoring for re-activation or related domains registered through the same registrar. Given the lack of SSL and the use of Cloudflare, additional scrutiny of traffic to or from this IP may be warranted. No further details about the attack vector or victim targeting are available at this time.