t-mobile[.]virnofu[.]cc

The domain t-mobile.virnofu.cc was registered on February 21, 2026 through Gname.com Pte. Ltd. and is currently taken offline. Infrastructure analysis shows the domain resolves to IP address 188.114.96.3, which belongs to the Cloudflare network (AS13335) located in the United States. Authoritative nameservers are priscilla.ns.cloudflare.com and yisroel.ns.cloudflare.com, confirming the use of Cloudflare’s DNS services. No TLS certificate is presented; the site responded with a default HTTP server banner displaying the page title "Welcome to nginx!", indicating a bare nginx instance without custom branding.

The domain is flagged for brand impersonation of x.com, matching the recorded scam type. Trust scoring from Gridinsoft assigns a zero out of one hundred, reflecting extreme suspicion. VirusTotal scans returned 13 positive detections out of 95 submitted security vendors, providing independent confirmation of malicious activity. The domain appears on a single security blocklist and has been explicitly blocked by the PhishDestroy mitigation service.

Although the site is offline, the underlying hosting and DNS configuration remain active and could be re‑used for future campaigns. Defenders should continue to block the domain at perimeter defenses, monitor the associated IP address for any resurgence of malicious content, and add the nameservers to watchlists for other newly registered domains that might follow a similar pattern. Ongoing vigilance is advised, especially for any traffic targeting the impersonated brand x.com, to prevent potential credential harvesting or other brand‑related fraud.