t-mobile[.]fwdwdi[.]bond

This domain, t-mobile.fwdwdi.bond, was investigated on July 23, 2026, as a confirmed brand impersonation threat targeting x.com. The domain was created on December 8, 2025, through registrar Gname.com Pte. Ltd. It is hosted on Cloudflare infrastructure, resolving to IP address 172.67.195.158 in the United States (AS13335 Cloudflare, Inc.), and uses Cloudflare nameservers sid.ns.cloudflare.com and wanda.ns.cloudflare.com. No SSL certificate was detected for this domain. The page title observed was 'Welcome to nginx!', indicating a default web server configuration, and the actual phishing content was not captured or analyzed at the time of reporting. The domain is currently offline, having been taken down by the blocklist PhishDestroy.

Threat intelligence checks show that 16 out of 95 security vendors on VirusTotal flagged this domain as malicious, and it appears on one security blocklist. The Gridinsoft trust score is 0 out of 100, reflecting high suspicion. No Safe Browsing or AlienVault OTX data is recorded in the known intelligence for this domain. The specific scam type is brand impersonation, with the targeted brand being x.com, though the domain name includes 't-mobile', suggesting a possible layered impersonation or a redirection chain. Defenders should note that while the domain is now offline, the infrastructure provider (Cloudflare) and registrar (Gname) may be used in future similar campaigns.

Monitoring for related subdomains or new domains using the same nameservers or IP range is recommended. The exact phishing kit or method remains unknown because the page content was not retrieved before takedown. The absence of an SSL certificate and the use of a default nginx page suggest the site may have been in early setup or used a temporary landing page. Analysts should treat this as a resolved but instructive case for tracking fast-moving brand impersonation campaigns.