t-mobile[.]nfoer[.]cc

Analysis of t-mobile.nfoer.cc shows a newly registered domain (created February 21, 2026) that is being used for brand impersonation of x.com. The domain resolves to 104.21.93.219, an address owned by AS13335 Cloudflare, Inc., and is hosted on a Cloudflare network with the generic nginx default page title "Welcome to nginx!". No TLS certificate is present, indicating the site is served over plain HTTP. The registration was performed through Gname.com Pte. Ltd., and the authoritative name servers are natasha.ns.cloudflare.com and ram.ns.cloudflare.com.

Independent security feeds have placed the domain on a single blocklist and it is explicitly blocked by PhishDestroy. VirusTotal scans have flagged the domain in 11 of 95 vendor engines, reinforcing the malicious assessment. Gridinsoft assigns a trust score of 0 out of 100, reflecting a high likelihood of abuse. The current operational status is offline, but the infrastructure artifacts remain observable and could be re‑activated.

Defenders should add t-mobile.nfoer.cc to internal URL filtering and DNS sinkhole policies, monitor traffic to its IP address for any residual connections, and consider extending blocklist coverage to the associated Cloudflare IP range if similar patterns emerge. Continuous re‑scanning of the domain on VirusTotal and other multi‑engine platforms is advised to capture any future changes. Evidence from the registrar, hosting provider, and detection vendors collectively supports the classification as a brand‑impersonation threat targeting users of x.com.