t-mobile[.]snhip[.]cc

Analysis indicates that the domain t-mobile.snhip.cc was registered on February 21 2026 through Gname.com Pte. Ltd. and is hosted on Cloudflare’s network (ASN 13335) with the address 188.114.96.3 located in the United States. The domain resolves to two Cloudflare name servers, nelci.ns.cloudflare.com and tadeo.ns.cloudflare.com, and currently returns a generic nginx welcome page with no SSL certificate, suggesting a minimal web front‑end. Gridinsoft assigns a trust score of zero out of one hundred, reflecting extreme suspicion. VirusTotal reports that sixteen of ninety‑three scanning engines have flagged the domain, and it appears on one external blocklist.

Defensive services such as PhishDestroy have already taken the site offline, and the status field confirms that the domain is no longer reachable. The primary threat vector is brand impersonation of x.com, as explicitly indicated in the intelligence. While the HTTP response does not reveal credential‑stealing forms or additional content, the combination of a newly created domain, zero trust score, multiple detections, and blocklist presence aligns with typical infrastructure used for credential‑harvesting campaigns. Uncertainty remains regarding the specific malicious payload or the exact phishing kit employed, because no further page content or certificate details have been observed.

Defenders should continue to block the domain at network perimeters and update URL filtering lists to include t‑mobile.snhip.cc. Monitoring of DNS queries for the associated Cloudflare name servers may help identify any resurgence. Given the Cloudflare hosting, rapid redeployment is possible; therefore, threat‑intel feeds should be queried for any re‑registration attempts or similar sub‑domains targeting the x.com brand. Maintaining vigilance against brand‑impersonation campaigns remains advisable.