t-mobile[.]koyme[.]cc

The domain t-mobile.koyme.cc was registered on February 21, 2026 through Gname.com Pte. Ltd. and resolves to the Cloudflare address 172.67.220.10 (AS13335, United States). DNS is served by cass.ns.cloudflare.com and gordon.ns.cloudflare.com. No TLS certificate is presented, and an HTTP request returns the generic page title "Welcome to nginx!", indicating a default web server response rather than a brand‑specific landing page. Infrastructure analysis shows the site is hosted on Cloudflare’s network, a common choice for malicious actors seeking anonymity and DDoS protection.

Gridinsoft assigns a trust score of 0 / 100, and nine of ninety‑three VirusTotal scanners flagged the domain as malicious, confirming that multiple security vendors have observed suspicious behavior. The domain appears on one external blocklist and is actively blocked by PhishDestroy, reinforcing the consensus that it is being used for brand‑impersonation targeting x.com. Current status is offline, suggesting the operator may be re‑tooling or the takedown has been effective, but the recent creation date and infrastructure choices imply a short‑lived campaign that could resurface under a new name.

Defenders should continue to block the resolved IP address and associated Cloudflare ASN, add the domain to internal URL filtering lists, and monitor for future look‑alike registrations that reuse the "t-mobile.koyme.cc" pattern. Because the HTTP payload has not been publicly dissected, analysts should treat any future re‑activation as potentially malicious until a detailed page inspection can be performed. Continuous monitoring of Cloudflare‑hosted subdomains tied to the same registrar and ASN is recommended to pre‑empt similar brand‑impersonation attempts.