t-mobile[.]pbiro[.]cc

Analysis of the domain t-mobile.pbiro.cc indicates confirmed phishing activity targeting the X.com brand. Registered on February 21, 2026, through Gname.com Pte. Ltd., the domain currently resolves to IP address 172.67.157.186, hosted on Cloudflare's network (AS13335) in the United States. No SSL certificate is present, and the domain's HTTP response displays the default 'Welcome to nginx!' page title, suggesting either misconfiguration or an attempt to conceal malicious content prior to activation. The domain appears on at least one security blocklist and is flagged by 13 of 93 security vendors in VirusTotal as malicious.

Detection engines, including PhishDestroy, classify this as a brand impersonation scam. Cloudflare nameservers (nelci.ns.cloudflare.com and tadeo.ns.cloudflare.com) are in use, which is consistent with both legitimate and malicious infrastructure leveraging Cloudflare's proxy services. Gridinsoft assigns a trust score of 0/100, reinforcing the domain's high-risk classification. As of July 23, 2026, the domain has been taken offline, though historical DNS records and detection data remain relevant for threat hunting.

Defenders should treat this domain as a confirmed phishing indicator and block it at the network level. Further investigation into associated IP addresses, registrar activity, and potential redirect chains is recommended to identify related infrastructure. The absence of SSL and the use of a default server banner suggest either early-stage deployment or an abandoned campaign, but the brand impersonation targeting X.com warrants continued monitoring.