t-mobile[.]brmcq[.]cc

Analysis of t-mobile.brmcq.cc indicates a confirmed brand impersonation campaign targeting the x.com brand. The domain was registered on February 21, 2026 and currently resolves to the Cloudflare IP address 172.67.216.48, which is associated with ASN 13335 in the United States. The HTTP response returns the default nginx page title "Welcome to nginx!", suggesting no custom landing page is presently serving content. The site is marked as offline, but historical activity shows that it was actively used before takedown.

Security telemetry shows that 15 of 93 VirusTotal scanners flagged the domain as malicious, and it appears on at least one external blocklist. PhishDestroy has recorded the domain as blocked, reinforcing the classification of a brand impersonation scheme. The SSL certificate labeled WE1 was observed, but no further certificate details are available. The combination of Cloudflare hosting, a recent registration date, and the presence on multiple detection sources aligns with typical fast‑flux phishing infrastructure.

Uncertainties remain regarding the exact phishing kit employed, the specific URLs or payloads delivered, and whether the domain may be re‑activated under a different subdomain. Defenders should continue to block the IP address 172.67.216.48 and the fully qualified domain name, add the domain to internal threat intelligence feeds, and monitor Cloudflare‑hosted ranges for new subdomains that mimic the same naming pattern. Ongoing vigilance is recommended to detect any resurgence of the campaign, especially given the brand target and the observed willingness of the operators to employ disposable infrastructure.