t-mobile[.]tsmvf[.]cc

Analysis of the domain t-mobile.tsmvf.cc indicates it was actively involved in brand impersonation targeting x.com, with infrastructure taken offline as of the report date of July 23, 2026. The domain was registered on February 21, 2026, through Gname.com Pte. Ltd., a registrar frequently associated with phishing and fraudulent domains. At the time of assessment, it resolved to the IP address 172.67.171.247, hosted on Cloudflare's network (AS13335) in the United States. The use of Cloudflare nameservers (anna.ns.cloudflare.com and ignacio.ns.cloudflare.com) and an SSL certificate issued by Google Trust Services (WE1) suggests an attempt to lend legitimacy to the site, though such measures are commonly exploited in phishing operations.

The domain's page title, 'Welcome to nginx!', indicates the presence of a default or misconfigured web server, which may reflect either an incomplete setup or an attempt to evade detection by avoiding explicit phishing content. No specific phishing kit or malicious payload was identified in the available data, though the domain's classification as a brand impersonation site is supported by its inclusion on one security blocklist and a Gridinsoft trust score of 0/100. Twelve of 93 security vendors on VirusTotal flagged the domain as malicious, reinforcing its association with phishing activity. Defenders should treat this domain as compromised infrastructure.

Although it is currently offline, historical resolution data and registration details should be used to update blocklists and monitoring systems. The use of Cloudflare hosting does not inherently indicate malicious intent but is consistent with patterns observed in phishing campaigns seeking to obscure origin servers. No evidence of additional domains or linked infrastructure was provided, so further investigation into the registrar and hosting provider may be warranted to identify related threats. Given the domain's association with x.