t-mobile[.]tiuofsz[.]cc

Analysis of the domain t-mobile.tiuofsz.cc indicates it was actively involved in a brand impersonation campaign targeting X.com, as documented on July 23, 2026. The domain was registered on February 21, 2026, through Gname.com Pte. Ltd., a registrar frequently associated with high-risk domains. Infrastructure analysis reveals the domain resolved to IP address 172.67.156.118, hosted on Cloudflare's network (AS13335), a common obfuscation tactic used to conceal malicious infrastructure. The domain lacked an SSL certificate, increasing the likelihood of interception or detection by security tools. At the time of assessment, the domain was offline, and its HTTP response returned the default page title 'Welcome to nginx!', suggesting either incomplete deployment of the phishing kit or a placeholder configuration.

No specific phishing kit or payload was identified in the available data, though the scam type is classified as brand impersonation. Detection metrics indicate partial awareness among security vendors: 14 of 95 vendors on VirusTotal flagged the domain as malicious, while it appeared on one security blocklist (PhishDestroy). Gridinsoft assigned a trust score of 0/100, further corroborating its high-risk classification. Nameservers kiki.ns.cloudflare.com and mario.ns.cloudflare.com were in use, consistent with Cloudflare's infrastructure.

The absence of additional context—such as email headers, redirect chains, or payload samples—limits definitive attribution to a specific threat actor or campaign. However, the combination of a recently registered domain, Cloudflare hosting, and brand impersonation targeting a high-profile social media platform aligns with patterns observed in credential harvesting operations. Defenders are advised to block the domain and its resolving IP (172.67.156.118) at the network level, monitor for related domains registered through Gname.com, and alert users to the risk of X.com impersonation.