t-mobile[.]buia[.]cc

Analysis of t-mobile.buia.cc indicates a newly registered domain that is being used to impersonate the x.com brand. The domain was created on January 31, 2026 and is registered through Gname.com Pte. Ltd. It resolves to the IP address 188.114.97.3, which belongs to the Cloudflare network (AS13335) and is located in the United States. The authoritative nameservers are A.SHARE-DNS.COM and B.SHARE-DNS.NET, suggesting the use of a shared DNS service. No SSL certificate is presented; HTTP requests return the default "Welcome to nginx!" page, confirming that the web server is running nginx without TLS protection. The site has been classified as a brand impersonation scam and appears on a single security blocklist, where it is flagged by PhishDestroy.

VirusTotal scans show that 16 of 93 security vendors have flagged the domain, providing modest detection confidence. A Gridinsoft trust score of 0 out of 100 further reflects a lack of legitimate reputation. The current operational status is offline, indicating that the malicious content has been taken down or the hosting has been disrupted. Defenders should continue to block the domain at perimeter firewalls and DNS filtering solutions, monitor the IP address for any reactivation, and add the domain to internal threat intelligence feeds.

Because the site lacks TLS, any attempted connections would be unencrypted, simplifying network detection. However, the use of Cloudflare’s infrastructure may obscure the true origin of future payloads if the domain is reactivated. Continuous observation of the registrar Gname.com for related registrations and periodic re‑scanning with VirusTotal or similar services are recommended to capture any changes in detection posture. Until further evidence emerges, the domain should be treated as a high‑confidence impersonation threat targeting users of x.com.