t-mobile[.]com-asa[.]com

Analysis indicates that the domain t-mobile.com-asa.com was registered on 11 December 2025 through Dominet (HK) Limited and is currently resolved to the IP address 188.114.97.3, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. The domain uses the Cloudflare nameservers devin.ns.cloudflare.com and thea.ns.cloudflare.com and does not present a TLS certificate, returning the generic page title “Welcome to nginx!”. VirusTotal reports that 13 out of 95 scanning engines have flagged the domain, and it is listed on a single security blocklist and has been actively blocked by PhishDestroy. The Gridinsoft trust score is 0 out of 100, reflecting a high level of suspicion.

The infrastructure analysis shows no HTTPS support, which simplifies interception and monitoring. The domain is classified as a brand‑impersonation campaign targeting the brand x.com, although the specific malicious payload or credential‑collection mechanism has not been observed. The current status is offline, indicating that the site is no longer reachable, but the underlying IP and hosting configuration remain active and could be reused for future campaigns. Defenders should add the domain and its IP address to existing blocklists, enforce DNS sinkholing for any future resolution attempts, and monitor Cloudflare name server queries for related subdomains.

Because the domain lacks a valid SSL certificate, network‑level filtering can be applied without TLS decryption complications. Continuous monitoring of VirusTotal and other threat‑intel feeds for new detections on the same IP or registrar is recommended. Organizations that use the x.com brand should alert users about the potential for impersonation attempts and consider implementing domain‑based email authentication (DMARC, SPF, DKIM) to reduce the success rate of related social‑engineering messages.