t-mobile[.]tedhioi[.]cc

This domain t-mobile.tedhioi.cc was observed resolving to the Cloudflare‑owned address 104.21.91.95 (AS13335, United States). The hosting provider is Cloudflare, as indicated by the nameservers owen.ns.cloudflare.com and rose.ns.cloudflare.com. No TLS certificate is presented; HTTP connections return the default nginx page with the title “Welcome to nginx!”, which suggests the site is either a placeholder or a minimal landing page without legitimate content. The registrar listed for the domain is Gname.com Pte. Ltd., and the registration timestamp is 21 February 2026. The domain is currently marked offline, and the threat has been classified as brand impersonation targeting the brand x.com.

Threat intelligence shows the domain is blocked by PhishDestroy and appears on a single security blocklist. Gridinsoft assigns a trust score of 0 / 100, indicating no perceived legitimacy. On VirusTotal the domain was flagged by 14 of 93 scanning engines, providing independent confirmation of malicious intent. The absence of an SSL certificate further reduces trustworthiness and may facilitate downgrade‑attack vectors.

Analysts should treat t-mobile.tedhioi.cc as a confirmed malicious infrastructure element. Immediate defensive actions include adding the domain and its resolved IP address to network‑level deny lists, updating DNS filtering policies, and ensuring endpoint protection solutions ingest the VirusTotal detection count. Continued monitoring of the associated Cloudflare IP range is advised, as the provider may be reused for other abusive domains. Because the site currently returns only a generic nginx banner, any future content changes cannot be assessed without direct inspection; therefore, periodic re‑resolution and content retrieval are recommended to capture possible escalation.