t-mobile[.]buix[.]cc

The domain t-mobile.buix.cc was registered on February 21, 2026 through Gname.com Pte. Ltd. and is currently listed as offline. Technical investigation shows it is hosted on Cloudflare infrastructure, using the nameservers gordon.ns.cloudflare.com and linda.ns.cloudflare.com, and resolves to the IP address 172.67.222.209, which belongs to AS13335 Cloudflare, Inc. in the United States. No TLS certificate was detected for the site, and the HTTP response presents a default page titled "Welcome to nginx!" indicating that the web server is operating without a customized front‑end. The domain is classified as a brand impersonation campaign targeting x.com, according to the supplied intelligence.

It appears on a single security blocklist, identified by PhishDestroy, and has been flagged by five of ninety‑three security vendors on VirusTotal. Independent analysis by Gridinsoft assigned a trust score of 0 out of 100, reflecting a high likelihood of malicious intent. While the listed evidence confirms the infrastructure and the blocklist presence, the exact content served by the site remains unknown because the page has been taken offline and no further payload or credential‑harvesting mechanisms have been observed.

Defenders should proactively block DNS resolution to t-mobile.buix.cc and deny traffic to its associated IP address, especially since the hosting provider is a shared service that could be reused for future campaigns. Adding the domain to internal and external blocklists, monitoring for re‑registration of the same name or similar subdomains, and sharing the observed indicators with threat‑intelligence communities will help mitigate potential repeat attacks. Continuous observation of the Cloudflare IP reputation is advised, as the infrastructure could be leveraged again for brand‑impersonation activities.