t-mobile[.]vidnufl[.]cc

Analysis of the domain t-mobile.vidnufl.cc indicates it was actively used for brand impersonation targeting X.com (formerly Twitter) before being taken offline. The domain was registered on February 21, 2026, through Gname.com Pte. Ltd., a registrar frequently associated with abusive registrations. Infrastructure analysis reveals the domain resolved to IP address 172.67.145.191, hosted on Cloudflare's network (AS13335) in the United States, a common tactic to obscure the true origin of phishing infrastructure. No SSL certificate was present, increasing the risk of credential interception during transmission.

The domain's HTTP response displayed the default 'Welcome to nginx!' page title, suggesting either misconfigured or placeholder infrastructure rather than a fully deployed phishing kit. However, the brand target was explicitly identified as X.com in threat intelligence feeds, and the domain was classified as a brand impersonation scam. Detection data shows the domain was flagged by 13 of 93 security vendors on VirusTotal and appears on at least one security blocklist, including PhishDestroy. Gridinsoft assigned a trust score of 0/100, further corroborating its malicious classification.

Nameservers were set to Cloudflare (aspen.ns.cloudflare.com and trevor.ns.cloudflare.com), a pattern observed in both legitimate and malicious domains leveraging Cloudflare's proxy services. The domain's current offline status suggests takedown action, though defenders should monitor for re-emergence under the same or similar infrastructure. Organizations are advised to block the domain and its resolved IP at the network level, and to review logs for prior connections from internal systems. No evidence of a specific phishing kit or additional scam categorization (e.g., crypto, investment) was present in available data, and the exact content of the phishing page remains unanalyzed.