t-mobile[.]yebvp[.]cc

The domain t-mobile.yebvp.cc was registered on February 21, 2026 through Gname.com Pte. Ltd. and is hosted on Cloudflare infrastructure, resolving to IP address 104.21.63.208, which belongs to AS13335 (Cloudflare, Inc.) and is geolocated in the United States. No SSL certificate is presented, and the HTTP response returns a generic "Welcome to nginx!" page title, indicating a default web server configuration rather than a crafted malicious landing page. The site was identified as a brand‑impersonation campaign targeting x.com, and it has been classified under the scam type "Brand Impersonation". VirusTotal analysis recorded 14 detections out of 93 security vendors, and the domain appears on a single security blocklist.

PhishDestroy has already taken the domain offline, and the current status is recorded as offline. Additional reputation data shows a Gridinsoft trust score of 0 out of 100, reinforcing the malicious assessment. Nameservers listed are maria.ns.cloudflare.com and paul.ns.cloudflare.com, both belonging to Cloudflare's DNS service.

While the observed evidence confirms malicious intent, the exact content served prior to takedown is not available beyond the default nginx title, leaving the specifics of the phishing payload uncertain. Defenders should immediately block t-mobile.yebvp.cc at DNS and proxy layers, add the associated IP address 104.21.63.208 to network‑level deny lists, and monitor for future subdomains registered under the same second‑level domain (yebvp.cc) or similar patterns using the same registrar. Ongoing threat hunting should include correlation with other Cloudflare‑hosted domains flagged for brand impersonation, especially those targeting x.com, to pre‑empt potential re‑use of the infrastructure.