t-mobile[.]rxzno[.]cc

Analysis of t-mobile.rxzno.cc, created on February 21, 2026, indicates that the domain was used for a brand impersonation campaign targeting x.com. The domain resolves to IP address 104.21.91.222, which belongs to Cloudflare, Inc. (AS13335) and is located in the United States. DNS records show the domain is delegated to Cloudflare name servers alla.ns.cloudflare.com and jermaine.ns.cloudflare.com, a configuration commonly employed by threat actors to leverage the provider's global edge network for anonymity and resilience. No SSL certificate is present; HTTP requests return a generic "Welcome to nginx!" page title, suggesting the site was served without TLS encryption.

The registrar listed for the domain is Gname.com Pte. Ltd., a registrar frequently observed in malicious registrations. Security telemetry reports that nine of ninety-three VirusTotal scanners flagged the domain, and it appears on a single public blocklist. PhishDestroy has actively blocked the domain, and Gridinsoft assigns it a trust score of zero out of one hundred, reinforcing the assessment of high malicious intent.

The current operational status is offline, but historical activity confirms the site was deployed as a phishing vector. Defenders should continue to block both the domain and its associated IP address at perimeter and DNS filtering layers, monitor for any re‑use of the Cloudflare IP range for similar campaigns, and consider adding the domain to internal threat intelligence feeds. Ongoing watch for new registrations that reuse the same registrar or name‑server pattern is advised, as adversaries often recycle infrastructure to evade detection.