t-mobile[.]gnzcf[.]icu

Analysis indicates that the domain t-mobile.gnzcf.icu was registered on 5 December 2025 through Gname.com Pte. Ltd. The authoritative nameservers are byron.ns.cloudflare.com and maria.ns.cloudflare.com, placing the domain within Cloudflare's infrastructure (ASN 13335, United States). DNS resolution points to IP address 172.67.178.134, which is a Cloudflare edge node. No TLS certificate is associated with the host, and an HTTP request returns the default nginx page titled "Welcome to nginx!". This generic title provides no indication of legitimate content and is consistent with a placeholder site often used by malicious actors before deploying a lure.

The Gridinsoft trust engine assigns a score of 0 out of 100, reflecting extreme lack of reputation. VirusTotal records show that 14 of 95 scanning engines have flagged the domain, reinforcing the suspicion of abuse. The domain appears on a single external blocklist and has been explicitly blocked by PhishDestroy, confirming that at least one security community has recognized it as malicious. The listed scam type is "Brand Impersonation" targeting the brand x.com, indicating that attackers likely intend to mislead users into believing the site is associated with that brand.

Current status is offline, which may be a temporary takedown or a precautionary measure. Defenders should continue to block the domain at the network perimeter, enforce DNS sinkholing, and monitor for any resurgence of the host. Additional scrutiny of any future TLS deployment or content changes is advisable, as the absence of a certificate and the default page suggest the site can be rapidly reconfigured. Given the combination of recent registration, low trust score, multiple vendor detections, and explicit blocklist inclusion, the domain presents an elevated risk of brand impersonation and should be treated as malicious until proven otherwise.