t-mobile[.]xopej[.]cc

This domain, t-mobile.xopej.cc, was registered on 21 February 2026 through Gname.com Pte. Ltd. The authoritative name servers are clara.ns.cloudflare.com and jerry.ns.cloudflare.com, indicating that the zone is hosted on Cloudflare’s network. DNS resolution points to 172.67.201.86, an IP owned by AS13335 Cloudflare, Inc., geolocated in the United States. No TLS certificate is presented, and an HTTP request returns the default "Welcome to nginx!" page title, suggesting the site is either a placeholder or a minimal web server without content. The domain is flagged by PhishDestroy and has been taken offline, but it remains listed on at least one public blocklist.

VirusTotal analysis shows that 11 of 93 antivirus and URL‑reputation engines have marked the domain as malicious, and Gridinsoft assigns a trust score of 0 / 100, reinforcing the malicious assessment. The listed scam type is "Brand Impersonation" targeting the brand x.com, confirming that the operator intended to misuse the x.com brand. Evidence for active phishing infrastructure, such as a login portal or credential‑harvesting page, is not available in the current data set; the HTTP response only reveals the generic nginx title.

Consequently, defenders cannot determine whether the site ever hosted a functional phishing page, but the combination of registrar, hosting, blocklist presence, low trust score, and multiple vendor detections provides sufficient confidence to treat the domain as malicious. Recommended actions include adding the domain to internal deny lists, confirming that any related URL redirects are blocked in perimeter firewalls and secure web gateways, and monitoring for future re‑registration or similar sub‑domains that could be leveraged for brand‑impersonation campaigns. Continuous vigilance is advised, especially for traffic aimed at the x.com brand, to mitigate potential credential‑theft attempts.