t-mobile[.]rgivw[.]cc

This domain, t-mobile.rgivw.cc, is flagged for brand impersonation targeting X.com, a high-profile social media platform. Analysis indicates the site operates as a credential phishing portal, designed to deceive users into submitting login credentials through a fraudulent interface. The page title, 'Welcome to nginx!', suggests the use of a misconfigured or intentionally exposed nginx server, a common tactic in phishing infrastructure to host malicious content while evading initial scrutiny. Infrastructure analysis reveals the following technical indicators: the domain was registered on January 22, 2026, through Gname.com Pte. Ltd., and resolves to the IP address 104.21.16.161, hosted on AS13335 (Cloudflare, Inc.). VirusTotal detection metrics show 17 out of 95 security vendors flagging the domain as malicious. The domain appears on one security blocklist and is associated with an SSL certificate issued by Google Trust Services (WE1). The registrar and hosting provider combination, along with the use of Cloudflare, aligns with patterns observed in phishing campaigns seeking to obfuscate origin and prolong operational uptime. As of the latest assessment, t-mobile.rgivw.cc has been taken offline, likely in response to detection and reporting by security entities such as PhishDestroy. However, residual risk remains due to the potential for domain reactivation or migration to alternative infrastructure. Organizations and users are advised to block the domain and its associated IP address at the network level. Additionally, monitoring for newly registered domains with similar naming conventions (e.g., 't-mobile' paired with random subdomains) is recommended to preemptively mitigate related threats. Credential rotation for accounts potentially exposed to this campaign is strongly advised.