t-mobile[.]vihqj[.]cc

The domain t-mobile.vihqj.cc was registered on February 21, 2026 and is currently taken offline. DNS resolution points to the IP address 172.67.143.246, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. The site presents the default HTTP title "Welcome to nginx!" and serves a TLS certificate identified as WE1, indicating that SSL is configured but offering no brand‑specific validation.

Intelligence flags the domain as a brand impersonation campaign targeting x.com. The domain appears on a single security blocklist and has been explicitly blocked by the PhishDestroy feed. VirusTotal analysis shows that 15 out of 93 security vendors have flagged the domain as malicious, reinforcing the suspicion of malicious intent.

No additional public threat‑intel sources such as Safe Browsing or OTX entries are referenced, and the content of the site beyond the generic title has not been publicly reviewed. Given the combination of a recent registration, Cloudflare hosting, SSL presence, brand‑targeted impersonation labeling, and multiple vendor detections, the domain should be considered high‑risk. Defensive teams are advised to enforce network‑level blocks for t-mobile.vihqj.cc, monitor for any resurgence of the domain, and update intrusion‑prevention signatures to include the observed IP and certificate fingerprint.